ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 201:

  An organization wants a service provider to authenticate users via the users' organization domain credentials. Which markup language should the organization's security personnel use to support the integration?

  A. Security Assertion Markup Language (SAML)
  B. YAML Ain't Markup Language (YAML)
  C. Hypertext Markup Language (HTML)
  D. Extensible Markup Language (XML)
  A. Security Assertion Markup Language (SAML)

• Question 202:

  A cloud service accepts Security Assertion Markup Language (SAML) assertions from users to on and security However, an attacker was able to spoof a registered account on the network and query the SAML provider. What is the MOST common attack leverage against this flaw?

  A. Attacker forges requests to authenticate as a different user.
  B. Attacker leverages SAML assertion to register an account on the security domain.
  C. Attacker conducts denial-of-service (DoS) against the security domain by authenticating as the same user repeatedly.
  D. Attacker exchanges authentication and authorization data between security domains.
  A. Attacker forges requests to authenticate as a different user.

• Question 203:

  An organization has experienced multiple distributed denial-of-service (DDoS) attacks in recent months that have impact of their public-facing web and e-commerce sites that were previously all on-premises. After an analysis of the problems, the network engineers have recommended that the organization implement additional name service providers and redundant network paths. What is another recommendation that helps ensure the future availability of their web and e-commerce sites?

  A. Move all cloud-based operations back to on-premises to mitigate attacks.
  B. Move all websites to a new location.
  C. Review current detection strategies and employ signature-based techniques.
  D. Review the service-level agreements (SLA) with their cloud service providers.
  D. Review the service-level agreements (SLA) with their cloud service providers.

• Question 204:

  Which of the following is the BEST way to determine if a particular system is able to identify malicious software without executing it?

  A. Testing with a Botnet
  B. Testing with an EICAR file
  C. Executing a binary shellcode
  D. Run multiple antivirus programs
  B. Testing with an EICAR file

• Question 205:

  The acquisition of personal data being obtained by a lawful and fair means is an example of what principle?

  A. Data Quality Principle
  B. Openness Principle
  C. Purpose Specification Principle
  D. Collection Limitation Principle
  D. Collection Limitation Principle

• Question 206:

  Which of the following defines the key exchange for Internet Protocol Security (IPSec)?

  A. Secure Sockets Layer (SSL) key exchange
  B. Internet Key Exchange (IKE)
  C. Security Key Exchange (SKE)
  D. Internet Control Message Protocol (ICMP)
  B. Internet Key Exchange (IKE)

• Question 207:

  What is the PRIMARY objective of an application security assessment?

  A. Obtain information security management approval
  B. Maintain the integrity of the application
  C. Obtain feedback before implementation
  D. Identify vulnerabilities
  D. Identify vulnerabilities

• Question 208:

  Which of the following is a term used to describe maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions?

  A. Information Security Management System (ISMS)
  B. Information Sharing and Analysis Centers (ISAC)
  C. Risk Management Framework (RMF)
  D. Information Security Continuous Monitoring (ISCM)
  D. Information Security Continuous Monitoring (ISCM)

• Question 209:

  A data owner determines the appropriate job-based access for an employee to perform their duties. Which type of access control is this?

  A. Discretionary Access Control (DAC)
  B. Non-discretionary access control
  C. Mandatory Access Control (MAC)
  D. Role-based access control (RBAC)
  D. Role-based access control (RBAC)

• Question 210:

  Refer to the information below to answer the question.

  In a Multilevel Security (MLS) system, the following sensitivity labels are used in increasing levels of sensitivity: restricted, confidential, secret, top secret. Table A lists the clearance levels for four users, while Table B lists the security classes of four different files.

  

  Which of the following is true according to the star property (*property)?

  A. User D can write to File 1
  B. User B can write to File 1
  C. User A can write to File 1
  D. User C can write to File 1
  C. User A can write to File 1