ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 301:

  Which of the following types of web-based attack is happening when an attacker is able to send a well-crafted, malicious request to an authenticated user without the user realizing it?

  A. ross-Site Scripting (XSS)
  B. Cross-Site request forgery (CSRF)
  C. Cross injection
  D. Broken Authentication And Session Management
  B. Cross-Site request forgery (CSRF)

• Question 302:

  In Business Continuity Planning (BCP), what is the importance of documenting business processes?

  A. Provides senior management with decision-making tools
  B. Establishes and adopts ongoing testing and maintenance strategies
  C. Defines who will perform which functions during a disaster or emergency
  D. Provides an understanding of the organization's interdependencies
  D. Provides an understanding of the organization's interdependencies

• Question 303:

  A database server for a financial application is scheduled for production deployment. Which of the following controls will BEST prevent tampering?

  A. Service accounts removal
  B. Data validation
  C. Logging and monitoring
  D. Data sanitization
  B. Data validation

• Question 304:

  With what frequency should monitoring of a control occur when implementing information security continuous monitoring (ISCM) solutions?

  A. At a rate concurrent with the volatility of the security control
  B. Only during system implementation and decommissioning
  C. Continuously without exception for all security controls
  D. Before and after each change of the control
  C. Continuously without exception for all security controls

• Question 305:

  Which of the following is the BEST way to protect against Structured Query language (SQL) injection?

  A. Enforce boundary checking.
  B. Ratfrict um of SELECT command.
  C. Restrict HyperText Markup Language (HTML) source code
  D. Use stored procedures.
  D. Use stored procedures.

• Question 306:

  Building blocks for software-defined networks (SDN) require which of the following?

  A. The SDN is mostly composed of virtual machines (VM).
  B. The SDN is composed entirely of client-server pairs.
  C. Virtual memory is used in preference to random-access memory (RAM).
  D. Random-access memory (RAM) is used in preference to virtual memory.
  A. The SDN is mostly composed of virtual machines (VM).

• Question 307:

  When auditing the Software Development Life Cycle (SDLC) which of the following is one of the high-level audit phases?

  A. Requirements
  B. Risk assessment
  C. Due diligence
  D. Planning
  A. Requirements

• Question 308:

  Directive controls are a form of change management policy and procedures. Which of the following subsections are recommended as part of the change management process?

  A. Build and test
  B. Implement security controls
  C. Categorize Information System (IS)
  D. Select security controls
  A. Build and test

• Question 309:

  A database administrator is asked by a high-ranking member of management to perform specific changes to the accounting system database. The administrator is specifically instructed to not track or evidence the change in a ticket. Which of the following is the BEST course of action?

  A. Ignore the request and do not perform the change.
  B. Perform the change as requested, and rely on the next audit to detect and report the situation.
  C. Perform the change, but create a change ticket regardless to ensure there is complete traceability.
  D. Inform the audit committee or internal audit directly using the corporate whistleblower process.
  D. Inform the audit committee or internal audit directly using the corporate whistleblower process.

• Question 310:

  Which of the following BEST obtains an objective audit of security controls?

  A. The security audit is measured against a known standard.
  B. The security audit is performed by a certified internal auditor.
  C. The security audit is performed by an independent third-party.
  D. The security audit produces reporting metrics for senior leadership.
  C. The security audit is performed by an independent third-party.