ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 251:

  Which is the FIRST action the Incident Response team should take when an incident is suspected?

  A. Choose a containment strategy.
  B. Record all facts regarding the incident.
  C. Attempt to identify the attacker.
  D. Notify management of the incident.
  B. Record all facts regarding the incident.

• Question 252:

  Which of the following is true of Service Organization Control (SOC) reports?

  A. SOC 1 Type 2 reports assess the security, confidentiality, integrity, and availability of an organization's controls
  B. SOC 2 Type 2 reports include information of interest to the service organization's management
  C. SOC 2 Type 2 reports assess internal controls for financial reporting
  D. SOC 3 Type 2 reports assess internal controls for financial reporting
  B. SOC 2 Type 2 reports include information of interest to the service organization's management

• Question 253:

  When conduting a security assessment of access controls , Which activity is port of the data analysis phase?

  A. Collect logs and reports.
  B. Present solutions to address audit exceptions.
  C. Categorize and Identify evidence gathered during the audit
  D. Conduct statiscal sampling of data transactions.
  C. Categorize and Identify evidence gathered during the audit

• Question 254:

  A company was ranked as high in the following National Institute of Standards and Technology (NIST) functions: Protect, Detect, Respond and Recover. However, a low maturity grade was attributed to the Identify function. In which of the following the controls categories does this company need to improve when analyzing its processes individually?

  A. Asset Management, Business Environment, Governance and Risk Assessment
  B. Access Control, Awareness and Training, Data Security and Maintenance
  C. Anomalies and Events, Security Continuous Monitoring and Detection Processes
  D. Recovery Planning, Improvements and Communications
  A. Asset Management, Business Environment, Governance and Risk Assessment

• Question 255:

  An application is used for funds transfer between an organization and a third-party. During a security audit, an issue with the business continuity/disaster recovery policy and procedures for this application. Which of the following reports should the audit file with the organization?

  A. Service Organization Control (SOC) 1
  B. Statement on Auditing Standards (SAS) 70
  C. Service Organization Control (SOC) 2
  D. Statement on Auditing Standards (SAS) 70-1
  C. Service Organization Control (SOC) 2

• Question 256:

  When are security requirements the LEAST expensive to implement?

  A. When identified by external consultants
  B. During the application rollout phase
  C. During each phase of the project cycle
  D. When built into application design
  D. When built into application design

• Question 257:

  Which of the following departments initiates the request, approval, and provisioning business process?

  A. Operations
  B. Human resources (HR)
  C. Information technology (IT)
  D. Security
  A. Operations

• Question 258:

  Retaining system logs for six months or longer can be valuable for what activities?

  A. Disaster recovery and business continuity
  B. Forensics and incident response
  C. Identity and authorization management
  D. Physical and logical access control
  B. Forensics and incident response

• Question 259:

  Which security action should be taken FIRST when computer personnel are terminated from their jobs?

  A. Remove their computer access
  B. Require them to turn in their badge
  C. Conduct an exit interview
  D. Reduce their physical access level to the facility
  A. Remove their computer access

• Question 260:

  A project requires the use of en authentication mechanism where playback must be protected and plaintext secret must be used. Which of the following should be used?

  A. Password Authentication Protocol (PAP)
  B. Extensible Authentication Protocol (EAP)
  C. Secure Hash Algorithm (SHA)
  D. Challenge Handshake Authentication Protocol (CHAP)
  A. Password Authentication Protocol (PAP)