ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 211:

  While performing a security review for a new product, an information security professional discovers that the organization's product development team is proposing to collect government-issued identification (ID) numbers from customers to use as unique customer identifiers. Which of the following recommendations should be made to the product development team?

  A. Customer identifiers should be a variant of the user's government-issued ID number.
  B. Customer identifiers that do not resemble the user's government-issued ID number should be used.
  C. Customer identifiers should be a cryptographic hash of the user's government-issued ID number.
  D. Customer identifiers should be a variant of the user's name, for example, "jdoe" or "john.doe."
  C. Customer identifiers should be a cryptographic hash of the user's government-issued ID number.

• Question 212:

  A Certified Information Systems Security Professional (CISSP) with identity and access management (IAM) responsibilities is asked by the Chief Information Security Officer (CISO) to4 perform a vulnerability assessment on a web application to pass a Payment Card Industry (PCI) audit. The CISSP has never performed this before. According to the (ISC)? Code of Professional Ethics, which of the following should the CISSP do?

  A. Review the CISSP guidelines for performing a vulnerability assessment before proceeding to complete it
  B. Review the PCI requirements before performing the vulnerability assessment
  C. Inform the CISO that they are unable to perform the task because they should render only those services for which they are fully competent and qualified
  D. Since they are CISSP certified, they have enough knowledge to assist with the request, but will need assistance in order to complete it in a timely manner
  C. Inform the CISO that they are unable to perform the task because they should render only those services for which they are fully competent and qualified

• Question 213:

  International bodies established a regulatory scheme that defines how weapons are exchanged between the signatories. It also addresses cyber weapons, including malicious software, Command and Control (C2) software, and internet surveillance software. This is a description of which of the following?

  A. General Data Protection Regulation (GDPR)
  B. Palermo convention
  C. Wassenaar arrangement
  D. International Traffic in Arms Regulations (ITAR)
  C. Wassenaar arrangement

• Question 214:

  Which of the following is the MOST difficult to enforce when using cloud computing?

  A. Data access
  B. Data backup
  C. Data recovery
  D. Data disposal
  D. Data disposal

• Question 215:

  The application owner of a system that handles confidential data leaves an organization. It is anticipated that a replacement will be hired in approximately six months. During that time, which of the following should the organization do?

  A. Grant temporary access to the former application owner's account
  B. Assign a temporary application owner to the system
  C. Restrict access to the system until a replacement application owner is hired
  D. Prevent changes to the confidential data until a replacement application owner is hired
  B. Assign a temporary application owner to the system

• Question 216:

  When a system changes significantly, who is PRIMARILY responsible for assessing the security impact?

  A. Chief Information Security Officer (CISO)
  B. Information System Owner
  C. Information System Security Officer (ISSO)
  D. Authorizing Official
  B. Information System Owner

• Question 217:

  How is remote authentication Dial-In user service (RADIUS) authentication accomplished?

  A. It uses clear text and shared secret keys.
  B. It uses clear text and firewall rules.
  C. It relies on Virtual Private Networks (VPN).
  D. It relies on asymmetric encryption keys.
  A. It uses clear text and shared secret keys.

• Question 218:

  Which of the following attack types can be used to compromise the integrity of data during transmission?

  A. Keylogging
  B. Packet sniffing
  C. Synchronization flooding
  D. Session hijacking
  B. Packet sniffing

• Question 219:

  An engineer notices some late collisions on a half-duplex link. The engineer verifies that the devices on both ends of the connection are configured for half duplex. Which of the following is the MOST likely cause of this issue?

  A. The link is improperly terminated
  B. One of the devices is misconfigured
  C. The cable length is excessive.
  D. One of the devices has a hardware issue.
  C. The cable length is excessive.

• Question 220:

  What is the MOST important purpose of testing the Disaster Recovery Plan (DRP)?

  A. Evaluating the efficiency of the plan
  B. Identifying the benchmark required for restoration
  C. Validating the effectiveness of the plan
  D. Determining the Recovery Time Objective (RTO)
  C. Validating the effectiveness of the plan