ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 431:

  What is the most effective form of media sanitization to ensure residual data cannot be retrieved?

  A. Clearing
  B. Destroying
  C. Purging
  D. Disposal
  B. Destroying

• Question 432:

  What is the MAIN purpose of a change management policy?

  A. To assure management that changes to the Information Technology (IT) infrastructure are necessary
  B. To identify the changes that may be made to the Information Technology (IT) infrastructure
  C. To verify that changes to the Information Technology (IT) infrastructure are approved
  D. To determine the necessary for implementing modifications to the Information Technology (IT) infrastructure
  C. To verify that changes to the Information Technology (IT) infrastructure are approved

• Question 433:

  What is the MOST important goal of conducting security assessments?

  A. To prepare the organization for an external audit, particularly by a regulatory entity
  B. To discover unmitigated security vulnerabilities, and propose paths for mitigating them
  C. To align the security program with organizational risk appetite
  D. To demonstrate proper function of security controls and processes to senior management
  B. To discover unmitigated security vulnerabilities, and propose paths for mitigating them

• Question 434:

  Which of the following is a method of attacking internet protocol (IP) v6 Layer 3 and Layer 4?

  A. Internet Control Message Protocol (ICMP) flooding
  B. Media Access Control (MAC) flooding
  C. Domain Name Server (DNS) cache poisoning
  D. Synchronize sequence numbers (SYN) flooding
  D. Synchronize sequence numbers (SYN) flooding

• Question 435:

  When can a security program be considered effective?

  A. Audits are rec/Jarty performed and reviewed.
  B. Vulnerabilities are proactively identified.
  C. Risk is lowered to an acceptable level.
  D. Badges are regiiartv performed and validated
  C. Risk is lowered to an acceptable level.

• Question 436:

  Which of the following provides the MOST comprehensive filtering of Peer-to-Peer (P2P) traffic?

  A. Application proxy
  B. Port filter
  C. Network boundary router
  D. Access layer switch
  A. Application proxy

• Question 437:

  Which of the following is the PRIMARY reason to perform regular vulnerability scanning of an organization network?

  A. Provide vulnerability reports to management.
  B. Validate vulnerability remediation activities.
  C. Prevent attackers from discovering vulnerabilities.
  D. Remediate known vulnerabilities.
  B. Validate vulnerability remediation activities.

• Question 438:

  Which of the following is the FIRST step an organization's security professional performs when defining a cyber-security program based upon industry standards?

  A. Map the organization's current security practices to industry standards and frameworks.
  B. Define the organization's objectives regarding security and risk mitigation.
  C. Select from a choice of security best practices.
  D. Review the past security assessments.
  B. Define the organization's objectives regarding security and risk mitigation.

• Question 439:

  The birthday attack is MOST effective against which one of the following cipher technologies?

  A. Chaining block encryption
  B. Asymmetric cryptography
  C. Cryptographic hash
  D. Streaming cryptography
  C. Cryptographic hash

• Question 440:

  A company hired an external vendor to perform a penetration test ofa new payroll system. The company's internal test team had already performed an in-depth application and security test of the system and determined that it met security requirements. However, the external vendor uncovered significant security weaknesses where sensitive personal data was being sent unencrypted to the tax processing systems. What is the MOST likely cause of the security issues?

  A. Failure to perform interface testing
  B. Failure to perform negative testing
  C. Inadequate performance testing
  D. Inadequate application level testing
  A. Failure to perform interface testing