ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 451:

  Information security practitioners are in the midst of implementing a new firewall. Which of the following failure methods would BEST prioritize security in the event of failure?

  A. Fail-Closed
  B. Fail-Open
  C. Fail-Safe
  D. Failover
  A. Fail-Closed

• Question 452:

  A Denial of Service (DoS) attack on a syslog server exploits weakness in which of the following protocols?

  A. Point-to-Point Protocol (PPP) and Internet Control Message Protocol (ICMP)
  B. Transmission Control Protocol (TCP) and User Datagram Protocol (UDP)
  C. Address Resolution Protocol (ARP) and Reverse Address Resolution Protocol (RARP)
  D. Transport Layer Security (TLS) and Secure Sockets Layer (SSL)
  B. Transmission Control Protocol (TCP) and User Datagram Protocol (UDP)

• Question 453:

  Which of the following is security control volatility?

  A. A reference to the stability of the security control.
  B. A reference to how unpredictable the security control is.
  C. A reference to the impact of the security control.
  D. A reference to the likelihood of change in the security control.
  D. A reference to the likelihood of change in the security control.

• Question 454:

  Which organizational department is ultimately responsible for information governance related to e-mail and other e-records?

  A. Audit
  B. Compliance
  C. Legal
  D. Security
  C. Legal

• Question 455:

  Which of the following actions should be performed when implementing a change to a database schema in a production system?

  A. Test in development, determine dates, notify users, and implement in production
  B. Apply change to production, run in parallel, finalize change in production, and develop a back-out strategy
  C. Perform user acceptance testing in production, have users sign off, and finalize change
  D. Change in development, perform user acceptance testing, develop a back-out strategy, and implement change
  D. Change in development, perform user acceptance testing, develop a back-out strategy, and implement change

• Question 456:

  Copyright provides protection for which of the following?

  A. Ideas expressed in literary works
  B. A particular expression of an idea
  C. New and non-obvious inventions
  D. Discoveries of natural phenomena
  B. A particular expression of an idea

• Question 457:

  Refer to the information below to answer the question.

  A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes. Which of the following BEST describes the access control methodology used?

  A. Least privilege
  B. Lattice Based Access Control (LBAC)
  C. Role Based Access Control (RBAC)
  D. Lightweight Directory Access Control (LDAP)
  C. Role Based Access Control (RBAC)

• Question 458:

  Which of the following technologies would provide the BEST alternative to anti-malware software?

  A. Host-based Intrusion Detection Systems (HIDS)
  B. Application whitelisting
  C. Host-based firewalls
  D. Application sandboxing
  B. Application whitelisting

• Question 459:

  Which of the following is the BEST method a security practitioner can use to ensure that systems and sub-systems gracefully handle invalid input?

  A. Unit testing
  B. Integration testing
  C. Negative testing
  D. Acceptance testing
  C. Negative testing

• Question 460:

  A user's credential for an application is stored in a relational database. Which control protects the confidentiality of the credential while it is stored?

  A. Validate passwords using a stored procedure.
  B. Allow only the application to have access to the password field in order to verify user authentication.
  C. Use a salted cryptographic hash of the password.
  D. Encrypt the entire database and embed an encryption key in the application.
  C. Use a salted cryptographic hash of the password.