ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 1661:

  Individual access to a network is BEST determined based on:

  A. risk matrix
  B. value of the data
  C. business need
  D. data classification
  C. business need

• Question 1662:

  Which of the following is a process in the access provisioning lifecycle that will MOST likely identify access aggregation issues?

  A. Test
  B. Assessment
  C. Review
  D. Peer review
  C. Review

• Question 1663:

  Which security evaluation model assesses a product's Security Assurance Level (SAL) in comparison to similar solutions?

  A. Payment Card Industry Data Security Standard (PCI-DSS)
  B. International Organization for Standardization (ISO) 27001
  C. Common criteria (CC)
  D. Control Objectives for Information and Related Technology (COBIT)
  C. Common criteria (CC)

• Question 1664:

  What part of an organization's strategic risk assessment MOST likely includes information on items affecting the success of the organization?

  A. Key Risk Indicator (KRI)
  B. Threat analysis
  C. Vulnerability analysis
  D. Key Performance Indicator (KPI)
  A. Key Risk Indicator (KRI)

• Question 1665:

  A risk assessment report recommends upgrading all perimeter firewalls to mitigate a particular finding. Which of the following BEST supports this recommendation?

  A. The inherent risk is greater than the residual risk.
  B. The Annualized Loss Expectancy (ALE) approaches zero.
  C. The expected loss from the risk exceeds mitigation costs.
  D. The infrastructure budget can easily cover the upgrade costs.
  C. The expected loss from the risk exceeds mitigation costs.

• Question 1666:

  Which of the following assessment metrics is BEST used to understand a system's vulnerability to potential exploits?

  A. Determining the probability that the system functions safely during any time period
  B. Quantifying the system's available services
  C. Identifying the number of security flaws within the system
  D. Measuring the system's integrity in the presence of failure
  C. Identifying the number of security flaws within the system

• Question 1667:

  An organization is selecting a service provider to assist in the consolidation of multiple computing sites including development, implementation and ongoing support of various computer systems. Which of the following MUST be verified by the Information Security Department?

  A. The service provider's policies are consistent with ISO/IEC27001 and there is evidence that the service provider is following those policies.
  B. The service provider will segregate the data within its systems and ensure that each region's policies are met.
  C. The service provider will impose controls and protections that meet or exceed the current systems controls and produce audit logs as verification.
  D. The service provider's policies can meet the requirements imposed by the new environment even if they differ from the organization's current policies.
  D. The service provider's policies can meet the requirements imposed by the new environment even if they differ from the organization's current policies.

• Question 1668:

  Which of the following presents the PRIMARY concern to an organization when setting up a federated single sign-on (SSO) solution with another organization?

  A. Sending assertions to an identity provider
  B. Requesting Identity assertions from the partners domain
  C. defining the identity mapping scheme
  D. Having the resource provider query the Identity provider
  C. defining the identity mapping scheme

• Question 1669:

  Who would be the BEST person to approve an organizations information security policy?

  A. Chief Information Officer (CIO)
  B. Chief Information Security Officer (CISO)
  C. Chief internal auditor
  D. Chief Executive Officer (CEO)
  B. Chief Information Security Officer (CISO)

• Question 1670:

  What is the PRIMARY objective for conducting an internal security audit?

  A. Verify that all systems and Standard Operating Procedures (SOP) are properly documented
  B. Verify that all personnel supporting a system are knowledgeable of their responsibilities
  C. Verify that security controls are established following best practices
  D. Verify that applicable security controls are implemented and effective
  D. Verify that applicable security controls are implemented and effective