ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 41:

  Which of the following Secure Shell (SSH) remote access practices is MOST suited for scripted functions?

  A. Restricting authentication by Internet Protocol (IP) address
  B. Requiring multi-factor authentication (MFA)
  C. Implementing access credentials management tools
  D. Using public key-based authentication method
  D. Using public key-based authentication method

• Question 42:

  An organization is looking to include mobile devices in its asset management system for better tracking. In which system tier of the reference architecture would mobile devices be tracked?

  B. 1
  C. 2
  D. 3
  A

• Question 43:

  Which of the following ensures old log data is not overwritten?

  A. Increase log file size
  B. Implement Syslog
  C. Log preservation
  D. Log retention
  D. Log retention

• Question 44:

  According to the Capability Maturity Model Integration (CMMI), which of the following levels is identified by a managed process that is tailored from the organization's set of standard processes according to the organization's tailoring guidelines?

  A. Level 0: Incomplete
  B. Level 1: Performed
  C. Level 2: Managed
  D. Level 3: Defined
  D. Level 3: Defined

• Question 45:

  Which of the following is a potential risk when a program runs in privileged mode?

  A. It may serve to create unnecessary code complexity
  B. It may not enforce job separation duties
  C. It may create unnecessary application hardening
  D. It may allow malicious code to be inserted
  D. It may allow malicious code to be inserted

• Question 46:

  Which of the following BEST avoids data remanence disclosure for cloud hosted resources?

  A. Strong encryption and deletion of the keys after data is deleted.
  B. Strong encryption and deletion of the virtual host after data is deleted.
  C. Software based encryption with two factor authentication.
  D. Hardware based encryption on dedicated physical servers.
  A. Strong encryption and deletion of the keys after data is deleted.

• Question 47:

  Changes to a Trusted Computing Base (TCB) system that could impact the security posture of that system and trigger a recertification activity are documented in the

  A. security impact analysis.
  B. structured code review.
  C. routine self assessment.
  D. cost benefit analysis.
  A. security impact analysis.

• Question 48:

  Computer forensics requires which of the following MAIN steps?

  A. Announce the incident to responsible sections, analyze the data, assimilate the data for correlation
  B. Take action to contain the damage, announce the incident to responsible sections, analyze the data
  C. Acquire the data without altering, authenticate the recovered data, analyze the data
  D. Access the data before destruction, assimilate the data for correlation, take action to contain the damage
  B. Take action to contain the damage, announce the incident to responsible sections, analyze the data

• Question 49:

  When writing security assessment procedures, what is the MAIN purpose of the test outputs and reports?

  A. To force the software to fail and document the process
  B. To find areas of compromise in confidentiality and integrity
  C. To allow for objective pass or fail decisions
  D. To identify malware or hidden code within the test results
  C. To allow for objective pass or fail decisions

• Question 50:

  Which of the following is fundamentally required to address potential security issues when initiating software development?

  A. Implement ongoing security audits in all environments.
  B. Ensure isolation of development from production.
  C. Add information security objectives into development.
  D. Conduct independent source code review.
  C. Add information security objectives into development.