ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 291:

  An employee receives a promotion that entities them to access higher-level functions on the company's accounting system, as well as keeping their access to the previous system that is no longer needed or applicable. What is the name of the process that tries to remove this excess privilege?

  A. Access provisioning
  B. Segregation of Duties (SoD)
  C. Access certification
  D. Access aggregation
  B. Segregation of Duties (SoD)

• Question 292:

  A Business Continuity Plan (BCP) is based on

  A. the policy and procedures manual.
  B. an existing BCP from a similar organization.
  C. a review of the business processes and procedures.
  D. a standard checklist of required items and objectives.
  C. a review of the business processes and procedures.

• Question 293:

  Which of the following explains why classifying data is an important step in performing a risk assessment?

  A. To provide a framework for developing good security metrics
  B. To justify the selection of costly security controls
  C. To classify the security controls sensitivity that helps scope the risk assessment
  D. To help determine the appropriate level of data security controls
  D. To help determine the appropriate level of data security controls

• Question 294:

  Which of the following is the MOST important security goal when performing application interface testing?

  A. Confirm that all platforms are supported and function properly
  B. Evaluate whether systems or components pass data and control correctly to one another
  C. Verify compatibility of software, hardware, and network connections
  D. Examine error conditions related to external interfaces to prevent application details leakage
  B. Evaluate whether systems or components pass data and control correctly to one another

• Question 295:

  Which of the following is established to collect information in accordance with pre-established metrics, utilizing information readily available in part through implemented security controls?

  A. Security Assessment Report (SAR)
  B. Organizational risk tolerance
  C. Information Security Continuous Monitoring (ISCM)
  D. Risk assessment report
  C. Information Security Continuous Monitoring (ISCM)

• Question 296:

  To minimize the vulnerabilities of a web-based application, which of the following FIRST actions will lock down the system and minimize the risk of an attack?

  A. Install an antivirus on the server
  B. Run a vulnerability scanner
  C. Review access controls
  D. Apply the latest vendor patches and updates
  D. Apply the latest vendor patches and updates

• Question 297:

  Which of the following BEST describes an access control method utilizing cryptographic keys derived from a smart card private key that is embedded within mobile devices?

  A. Derived credential
  B. Temporary security credential
  C. Mobile device credentialing service
  D. Digest authentication
  A. Derived credential

• Question 298:

  What is the BEST way to correlate large volumes of disparate data sources in a Security Operations Center (SOC) environment?

  A. Implement Intrusion Detection System (IDS)
  B. Implement a Security Information and Event Management (SIEM) system
  C. Hire a team of analysts to consolidate data and generate reports
  D. Outsource the management of the SOC
  B. Implement a Security Information and Event Management (SIEM) system

• Question 299:

  Which of the following is the BEST approach to take in order to effectively incorporate the concepts of business continuity into the organization?

  A. Ensure end users are aware of the planning activities
  B. Validate all regulatory requirements are known and fully documented
  C. Develop training and awareness programs that involve all stakeholders
  D. Ensure plans do not violate the organization's cultural objectives and goals
  C. Develop training and awareness programs that involve all stakeholders

• Question 300:

  Which of the following should be included in a hardware retention policy?

  A. The use of encryption technology to encrypt sensitive data prior to retention
  B. Retention of data for only one week and outsourcing the retention to a third-party vendor
  C. Retention of all sensitive data on media and hardware
  D. A plan to retain data required only for business purposes and a retention schedule
  A. The use of encryption technology to encrypt sensitive data prior to retention