ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 321:

  What type of investigation applies when malicious behavior is suspected between two organizations?

  A. Regulatory
  B. Criminal
  C. Civil
  D. Operational
  A. Regulatory

• Question 322:

  A system developer has a requirement for an application to check for a secure digital signature before the application is accessed on a user's laptop. Which security mechanism addresses this requirement?

  A. Hardware encryption
  B. Certificate revocation list (CRL) policy
  C. Trusted Platform Module (TPM)
  D. Key exchange
  B. Certificate revocation list (CRL) policy

• Question 323:

  What is the FINAL step in the waterfall method for contingency planning?

  A. Maintenance
  B. Testing
  C. Implementation
  D. Training
  A. Maintenance

• Question 324:

  In the Software Development Life Cycle (SDLC), maintaining accurate hardware and software inventories is a critical part of

  A. systems integration.
  B. risk management.
  C. quality assurance.
  D. change management.
  D. change management.

• Question 325:

  How should an organization determine the priority of its remediation efforts after a vulnerability assessment has been conducted?

  A. Use an impact-based approach.
  B. Use a risk-based approach.
  C. Use a criticality-based approach.
  D. Use a threat-based approach.
  B. Use a risk-based approach.

• Question 326:

  Which of the following is the MOST likely cause of a non-malicious data breach when the source of the data breach was an un-marked file cabinet containing sensitive documents?

  A. Ineffective data classification
  B. Lack of data access controls
  C. Ineffective identity management controls
  D. Lack of Data Loss Prevention (DLP) tools
  A. Ineffective data classification

• Question 327:

  Which of the following is performed to determine a measure of success of a security awareness training program designed to prevent social engineering attacks?

  A. Employee evaluation of the training program
  B. Internal assessment of the training program's effectiveness
  C. Multiple choice tests to participants
  D. Management control of reviews
  B. Internal assessment of the training program's effectiveness

• Question 328:

  A large international organization that collects information from its consumers has contracted with a Software as a Service (SaaS) cloud provider to process this data. The SaaS cloud provider uses additional data processing to demonstrate other capabilities it wishes to offer to the data owner. This vendor believes additional data processing activity is allowed since they are not disclosing to other organizations. Which of the following BEST supports this rationale?

  A. The data was encrypted at all times and only a few cloud provider employees had access.
  B. As the data owner, the cloud provider has the authority to direct how the data will be processed.
  C. As the data processor, the cloud provider has the authority to direct how the data will be processed.
  D. The agreement between the two parties is vague and does not detail how the data can be used.
  C. As the data processor, the cloud provider has the authority to direct how the data will be processed.

• Question 329:

  Which of the following is needed to securely distribute symmetric cryptographic keys?

  A. Officially approved Public-Key Infrastructure (PKI) Class 3 or Class 4 certificates
  B. Officially approved and compliant key management technology and processes
  C. An organizationally approved communication protection policy and key management plan
  D. Hardware tokens that protect the user's private key.
  C. An organizationally approved communication protection policy and key management plan

• Question 330:

  An organization has requested storage area network (SAN) disks for a new project. What Redundant Array of Independent Disks (RAID) level provides the BEST redundancy and fault tolerance?

  A. RAID level 1
  B. RAID level 3
  C. RAID level 4
  D. RAID level 5
  D. RAID level 5