ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 281:

  To control the scope of a Business Continuity Management (BCM) system, a security practitioner should identify which of the following?

  A. Size, nature, and complexity of the organization
  B. Business needs of the security organization
  C. All possible risks
  D. Adaptation model for future recovery planning
  A. Size, nature, and complexity of the organization

• Question 282:

  Which of the following is an appropriate source for test data?

  A. Production data that is secured and maintained only in the production environment.
  B. Test data that has no similarities to production datA.
  C. Test data that is mirrored and kept up-to-date with production datA.
  D. Production data that has been sanitized before loading into a test environment.
  D. Production data that has been sanitized before loading into a test environment.

• Question 283:

  In configuration management, what baseline configuration information MUST be maintained for each computer system?

  A. Operating system and version, patch level, applications running, and versions.
  B. List of system changes, test reports, and change approvals
  C. Last vulnerability assessment report and initial risk assessment report
  D. Date of last update, test report, and accreditation certificate
  A. Operating system and version, patch level, applications running, and versions.

• Question 284:

  What is the MOST effective method of testing custom application code?

  A. Negative testing
  B. White box testing
  C. Penetration testing
  D. Black box testing
  B. White box testing

• Question 285:

  With regards to physical security, what is the MOST critical element of an organization’s recovery plan?

  A. Restore monitoring.
  B. Restore communications.
  C. Restore the network.
  D. Restore power.
  D. Restore power.

• Question 286:

  What principle requires that changes to the plaintext affect many parts of the ciphertext?

  A. Encapsulation
  B. Permutation
  C. Diffusion
  D. Obfuscation
  C. Diffusion

• Question 287:

  What component of a web application that stores the session state in a cookie can be bypassed by an attacker?

  A. An initialization check
  B. An identification check
  C. An authentication check
  D. An authorization check
  C. An authentication check

• Question 288:

  Refer to the information below to answer the question.

  A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant

  messaging. The organization's Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.

  Which of the following solutions would have MOST likely detected the use of peer-to-peer programs when the computer was connected to the office network?

  A. Anti-virus software
  B. Intrusion Prevention System (IPS)
  C. Anti-spyware software
  D. Integrity checking software
  B. Intrusion Prevention System (IPS)

• Question 289:

  During a Disaster Recovery (DR) assessment, additional coverage for assurance is required. What should en assessor do?

  A. Increase the number and type of relevant staff to interview.
  B. Conduct a comprehensive examination of the Disaster Recovery Plan (DRP).
  C. Increase the level of detail of the interview questions.
  D. Conduct a detailed review of the organization's DR policy.
  C. Increase the level of detail of the interview questions.

• Question 290:

  What balance MUST be considered when web application developers determine how information application error message should be constructed?

  A. Risk versus benefit
  B. Availability versus auditability
  C. Performance versus user satisfaction
  D. Confidentially versus integrity
  A. Risk versus benefit