ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 221:

  Which of the following is used to support the of defense in depth during development phase of a software product?

  A. Security auditing
  B. Polyinstantiation
  C. Maintenance
  D. Known vulnerability list
  B. Polyinstantiation

• Question 222:

  A corporate security policy specifies that all devices on the network must have updated operating system patches and anti-malware software. Which technology should be used to enforce this policy?

  A. Network Address Translation (NAT)
  B. Stateful Inspection
  C. Packet filtering
  D. Network Access Control (NAC)
  D. Network Access Control (NAC)

• Question 223:

  Refer to the information below to answer the question.

  An organization has hired an information security officer to lead their security department. The officer has adequate people resources but is lacking the other necessary components to have an effective security program. There are numerous initiatives requiring security involvement. The security program can be considered effective when

  A. vulnerabilities are proactively identified.
  B. audits are regularly performed and reviewed.
  C. backups are regularly performed and validated.
  D. risk is lowered to an acceptable level.
  D. risk is lowered to an acceptable level.

• Question 224:

  An organization is the victim of a major data breach just one month after passing an external cyber security audit. Which of the following is the likely reason for this situation?

  A. Both the auditor and the organization validated the controls to be accurate.
  B. The organization had the minimum level of controls in place to pass the audit.
  C. The auditor performed an in-depth analysis of the required controls.
  D. The audit was initiated by appropriate levels of management in the organization.
  B. The organization had the minimum level of controls in place to pass the audit.

• Question 225:

  What is the PRIMARY reason that a bit-level copy is more desirable than a file-level copy when replicating a hard drive's contents for an e-discovery investigation?

  A. Files that have been deleted will be transferred.
  B. The file and directory structure is retained.
  C. File-level security settings will be preserved.
  D. The corruption of files is less likely.
  A. Files that have been deleted will be transferred.

• Question 226:

  Functional security testing is MOST critical during which phese of the system development Life Cycle (SDLC)?

  A. Acquisition / Development
  B. Operations / Maintenance
  C. Implementation
  D. Initiation
  C. Implementation

• Question 227:

  Why MUST a Kerberos server be well protected from unauthorized access?

  A. It contains the keys of all clients.
  B. It always operates at root privilege.
  C. It contains all the tickets for services.
  D. It contains the Internet Protocol (IP) address of all network entities.
  A. It contains the keys of all clients.

• Question 228:

  Which of the following is the BEST way to verify the integrity of a software patch?

  A. Cryptographic checksums
  B. Version numbering
  C. Automatic updates
  D. Vendor assurance
  A. Cryptographic checksums

• Question 229:

  Which of the following protocols will allow the encrypted transfer of content on the Internet?

  A. Server Message Block (SMB)
  B. Secure copy
  C. Hypertext Transfer Protocol (HTTP)
  D. Remote copy
  B. Secure copy

• Question 230:

  A project manager for a large software firm has acquired a government contract that generates large amounts of Controlled Unclassified Information (CUI). The organization's information security manager has received a request to transfer project-related CUI between systems of differing security classifications. What role provides the authoritative guidance for this transfer?

  A. Information owner
  B. PM
  C. Data Custodian
  D. Mission/Business Owner
  C. Data Custodian