ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 241:

  Which one of the following is an advantage of an effective release control strategy from a configuration control standpoint?

  A. Ensures that there is no loss of functionality between releases
  B. Allows for future enhancements to existing features
  C. Enforces backward compatibility between releases
  D. Ensures that a trace for all deliverables is maintained and auditable
  D. Ensures that a trace for all deliverables is maintained and auditable

• Question 242:

  A client server infrastructure that provides user-to-server authentication describes which one of the following?

  A. Secure Sockets Layer (SSL)
  B. Kerberos
  C. 509
  D. User-based authorization
  B. Kerberos

• Question 243:

  Which of the following is the weakest form of protection for an application that handles Personally Identifiable Information (PII)?

  A. Transport Layer Security (TLS)
  B. Ron Rivest Cipher 4 (RC4) encryption
  C. Security Assertion Markup Language (SAML)
  D. Multifactor authentication
  B. Ron Rivest Cipher 4 (RC4) encryption

• Question 244:

  Change management policies and procedures belong to which of the following types of controls?

  A. Directive
  B. Detective
  C. Corrective
  D. Preventative
  A. Directive

• Question 245:

  In addition to life, protection of which of the following elements is MOST important when planning a data center site?

  A. Data and hardware
  B. Property and operations
  C. Profits and assets
  D. Resources and reputation
  D. Resources and reputation

• Question 246:

  Management has decided that a core application will be used on personal cellular phones. As an implementation requirement, regularly scheduled analysis of the security posture needs to be conducted. Management has also directed that continuous monitoring be implemented. Which of the following is required to accomplish management's directive?

  A. Strict integration of application management, configuration management (CM), and phone management
  B. Management application installed on user phones that tracks all application events and cellular traffic
  C. Enterprise-level security information and event management (SIEM) dashboard that provides full visibility of cellular phone activity
  D. Routine reports generated by the user's cellular phone provider that detail security events
  B. Management application installed on user phones that tracks all application events and cellular traffic

• Question 247:

  Which of the following is the MOST important consideration when storing and processing Personally Identifiable Information (PII)?

  A. Encrypt and hash all PII to avoid disclosure and tampering.
  B. Store PII for no more than one year.
  C. Avoid storing PII in a Cloud Service Provider.
  D. Adherence to collection limitation laws and regulations.
  D. Adherence to collection limitation laws and regulations.

• Question 248:

  A malicious user gains access to unprotected directories on a web server. Which of the following is MOST likely the cause for this information disclosure?

  A. Security misconfiguration
  B. Cross-site request forgery (CSRF)
  C. Structured Query Language injection (SQLi)
  D. Broken authentication management
  A. Security misconfiguration

• Question 249:

  The principle that personally identifiable information (PII) should be kept up-to-date and relevant to the purposes for which they are to be used is attributed to which fair information practice per the United States (US) Organization for Economic Cooperation and Development (OECD)?

  A. Purpose Specification
  B. Security Safeguards
  C. Collection Limitation
  D. Data Quality
  D. Data Quality

• Question 250:

  Which of the following BEST represents the principle of open design?

  A. Disassembly, analysis, or reverse engineering will reveal the security functionality of the computer system.
  B. Algorithms must be protected to ensure the security and interoperability of the designed system.
  C. A knowledgeable user should have limited privileges on the system to prevent their ability to compromise security capabilities.
  D. The security of a mechanism should not depend on the secrecy of its design or implementation.
  D. The security of a mechanism should not depend on the secrecy of its design or implementation.