ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 441:

  Which of the following will an organization's network vulnerability testing process BEST enhance?

  A. Firewall log review processes
  B. Asset management procedures
  C. Server hardening processes
  D. Code review procedures
  A. Firewall log review processes

• Question 442:

  What is the HIGHEST priority in agile development?

  A. Selecting appropriate coding language
  B. Managing costs of product delivery
  C. Early and continuous delivery of software
  D. Maximizing the amount of code delivered
  C. Early and continuous delivery of software

• Question 443:

  With data labeling, which of the following MUST be the key decision maker?

  A. Information security
  B. Departmental management
  C. Data custodian
  D. Data owner
  D. Data owner

• Question 444:

  What is the PRIMARY objective of the post-incident phase of the incident response process in the security operations center (SOC)?

  A. improve the IR process.
  B. Communicate the IR details to the stakeholders.
  C. Validate the integrity of the IR.
  D. Finalize the IR.
  A. improve the IR process.

• Question 445:

  Which one of the following is a threat related to the use of web-based client side input validation?

  A. Users would be able to alter the input after validation has occurred
  B. The web server would not be able to validate the input after transmission
  C. The client system could receive invalid input from the web server
  D. The web server would not be able to receive invalid input from the client
  A. Users would be able to alter the input after validation has occurred

• Question 446:

  A criminal organization is planning an attack on a government network. Which of the following is the MOST severe attack to the network availability?

  A. Network management communications is disrupted by attacker
  B. Operator loses control of network devices to attacker
  C. Sensitive information is gathered on the network topology by attacker
  D. Network is flooded with communication traffic by attacker
  B. Operator loses control of network devices to attacker

• Question 447:

  An organization wants to ensure that employees that move to a different department within the organization do not retain access privileges from their former department. To this end, the organization has implemented role-based access control (RBAC). Which additional measure is MOST important to successfully limit excess access privileges?

  A. Business role review
  B. Line manager review of assigned roles
  C. Segregation of duties (SoD) review
  D. Access control matrix
  C. Segregation of duties (SoD) review

• Question 448:

  Which of the following is an important requirement when designing a secure remote access system?

  A. Configure a Demilitarized Zone (DMZ) to ensure that user and service traffic is separated
  B. Provide privileged access rights to computer files and systems
  C. Ensure that logging and audit controls are included
  D. Reduce administrative overhead through password self service
  C. Ensure that logging and audit controls are included

• Question 449:

  Which of the following are common components of a Security Assertion Markup Language (SAML) based federation system?

  A. Client, Service Provider, identity provider (IdP), Token
  B. Client, Service Provider, Resource Server, Grant
  C. Client, Authorization Server, identity provider (IdP), Claim
  D. Client, Authorization Server, Resource Server, Assertion
  A. Client, Service Provider, identity provider (IdP), Token

• Question 450:

  Which of the following is TRUE for an organization that is using a third-party federated identity service?

  A. The organization enforces the rules to other organization's user provisioning
  B. The organization establishes a trust relationship with the other organizations
  C. The organization defines internal standard for overall user identification
  D. The organization specifies alone how to authenticate other organization's users
  C. The organization defines internal standard for overall user identification