ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 311:

  DRAG DROP

  Drag the following Security Engineering terms on the left to the BEST definition on the right.

  Select and Place:

  

  

• Question 312:

  Which of the following is a covert channel type?

  A. Pipe
  B. Memory
  C. Storage
  D. Monitoring
  C. Storage

• Question 313:

  A breach investigation found a website was exploited through an open source component. What is the FIRST step in the process that could have prevented this breach?

  A. Application whitelisting
  B. Vulnerability remediation
  C. Web application firewall (WAF)
  D. Software inventory
  D. Software inventory

• Question 314:

  Which of the following criteria ensures information is protected relative to its importance to the organization?

  A. The value of the data to the organization's senior management
  B. Legal requirements, value, criticality, and sensitivity to unauthorized disclosure or modification
  C. Legal requirements determined by the organization headquarters' location
  D. Organizational stakeholders, with classification approved by the management board
  D. Organizational stakeholders, with classification approved by the management board

• Question 315:

  A Chief Information Security Officer (CISO) of a firm which decided to migrate to cloud has been tasked with ensuring an optimal level of security. Which of the following would be the FIRST consideration?

  A. Define the cloud migration roadmap and set out which applications and data repositories should be moved into the cloud.
  B. Ensure that the contract between the cloud vendor and the firm clearly defines responsibilities for operating security controls.
  C. Analyze the firm's applications and data repositories to determine the relevant control requirements.
  D. Request a security risk assessment of the cloud vendor be completed by an independent third-party.
  A. Define the cloud migration roadmap and set out which applications and data repositories should be moved into the cloud.

• Question 316:

  A system is developed so that its business users can perform business functions but not user administration functions. Application administrators can perform administration functions but not user business functions. These capabilities are BEST described as

  A. least privilege.
  B. rule based access controls.
  C. Mandatory Access Control (MAC).
  D. separation of duties.
  D. separation of duties.

• Question 317:

  From a security perspective, which of the following assumptions MUST be made about input to an application?

  A. It is tested
  B. It is logged
  C. It is verified
  D. It is untrusted
  D. It is untrusted

• Question 318:

  A vendor released a security patch for a dangerous vulnerability affecting thousands of computers in an organization. Which of the following actions will the security practitioner do FIRST to mitigate the security risk?

  A. Deploy the patch.
  B. Accept the risk.
  C. Transfer the risk.
  D. Evaluate the patch.
  D. Evaluate the patch.

• Question 319:

  What is the MAIN reason to ensure the appropriate retention periods are enforced for data stored on electronic media?

  A. To reduce the carbon footprint by eliminating paper
  B. To create an inventory of data assets stored on disk for backup recovery
  C. To declassify information that has been improperly classified
  D. To reduce the risk of loss, unauthorized access, use, modification, and disclosure
  D. To reduce the risk of loss, unauthorized access, use, modification, and disclosure

• Question 320:

  Which of the following is required to verify the authenticity of a digitally signed document?

  A. Digital hash of the signed document
  B. Sender's private key
  C. Recipient's public key
  D. Agreed upon shared secret
  A. Digital hash of the signed document