ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 11:

  In a basic SYN flood attack, what is the attacker attempting to achieve?

  A. Exceed the threshold limit of the connection queue for a given service
  B. Set the threshold to zero for a given service
  C. Cause the buffer to overflow, allowing root access
  D. Flush the register stack, allowing hijacking of the root account
  A. Exceed the threshold limit of the connection queue for a given service

• Question 12:

  Refer to the information below to answer the question.

  An organization has hired an information security officer to lead their security department. The officer has adequate people resources but is lacking the other necessary components to have an effective security program. There are numerous initiatives requiring security involvement. The effectiveness of the security program can PRIMARILY be measured through

  A. audit findings.
  B. risk elimination.
  C. audit requirements.
  D. customer satisfaction.
  A. audit findings.

• Question 13:

  Which of the following provides the GREATEST level of data security for a Virtual Private Network (VPN) connection?

  A. Internet Protocol Payload Compression (IPComp)
  B. Internet Protocol Security (IPSec)
  C. Extensible Authentication Protocol (EAP)
  D. Remote Authentication Dial-In User Service (RADIUS)
  B. Internet Protocol Security (IPSec)

• Question 14:

  What industry-recognized document could be used as a baseline reference that is related to data security and business operations for conducting a security assessment?

  A. Service Organization Control (SOC) 1 Type 2
  B. Service Organization Control (SOC) 2 Type 1
  C. Service Organization Control (SOC) 1 Type 1
  D. Service Organization Control (SOC) 2 Type 2
  B. Service Organization Control (SOC) 2 Type 1

• Question 15:

  To ensure proper governance of information throughout the lifecycle, which of the following should be assigned FIRST?

  A. Owner
  B. Classification
  C. Custodian
  D. Retention
  A. Owner

• Question 16:

  A software developer wishes to write code that will execute safely and only as intended. Which of the following programming language types is MOST likely to achieve this goal?

  A. Statically typed
  B. Weakly typed
  C. Strongly typed
  D. Dynamically typed
  D. Dynamically typed

• Question 17:

  Which of the following is an advantage of Secure Shell (SSH)?

  A. It operates at the network layer
  B. It encrypts transmitted User ID and passwords
  C. It uses challenge-response to authenticate each party
  D. It uses the International Data Encryption Algorithm (IDEA) for data privacy
  C. It uses challenge-response to authenticate each party

• Question 18:

  How can a forensic specialist exclude from examination a large percentage of operating system files residing on a copy of the target system?

  A. Take another backup of the media in question then delete all irrelevant operating system files.
  B. Create a comparison database of cryptographic hashes of the files from a system with the same operating system and patch level.
  C. Generate a message digest (MD) or secure hash on the drive image to detect tampering of the media being examined.
  D. Discard harmless files for the operating system, and known installed programs.
  B. Create a comparison database of cryptographic hashes of the files from a system with the same operating system and patch level.

• Question 19:

  Which of the following phases in the software acquisition process does developing evaluation criteria take place?

  A. Follow-On
  B. Planning
  C. Contracting
  D. Monitoring and Acceptance
  D. Monitoring and Acceptance

• Question 20:

  To comply with industry requirements, a security assessment on the cloud server should identify which protocols and weaknesses are being exposed to attackers on the Internet. Which of the following tools is the MOST appropriate to complete the assessment?

  A. Use tcpdump and parse the output file in a protocol analyzer.
  B. Use an IP scanner and target the cloud WAN network addressing
  C. Run netstat in each cloud server and retrieve the running processes.
  D. Use nmap and set the servers' public IPs as the targets.
  D. Use nmap and set the servers' public IPs as the targets.