ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 501:

  In which of the following system life cycle processes should security requirements be developed?

  A. Risk management
  B. Business analysis
  C. Information management
  D. System analysis
  B. Business analysis

• Question 502:

  A continuous information security monitoring program can BEST reduce risk through which of the following?

  A. Collecting security events and correlating them to identify anomalies
  B. Facilitating system-wide visibility into the activities of critical user accounts
  C. Encompassing people, process, and technology
  D. Logging both scheduled and unscheduled system changes
  B. Facilitating system-wide visibility into the activities of critical user accounts

• Question 503:

  What is a consideration when determining the potential impact an organization faces in the event of the loss of confidentiality of Personally Identifiable Information (PII)?

  A. Quantity
  B. Availability
  C. Quality
  D. Criticality
  A. Quantity

• Question 504:

  An enterprise is developing a baseline cybersecurity standard its suppliers must meet before being awarded a contract. Which of the following statements is TRUE about the baseline cybersecurity standard?

  A. It should be expressed as general requirements.
  B. It should be expressed in legal terminology.
  C. It should be expressed in business terminology.
  D. It should be expressed as technical requirements.
  D. It should be expressed as technical requirements.

• Question 505:

  An engineer in a software company has created a virus creation tool. The tool can generate thousands of polymorphic viruses. The engineer is planning to use the tool in a controlled environment to test the company's next generation virus scanning software.

  Which would BEST describe the behavior of the engineer and why?

  A. The behavior is ethical because the tool will be used to create a better virus scanner.
  B. The behavior is ethical because any experienced programmer could create such a tool.
  C. The behavior is not ethical because creating any kind of virus is bad.
  D. The behavior is not ethical because such a tool could be leaked on the Internet.
  A. The behavior is ethical because the tool will be used to create a better virus scanner.

• Question 506:

  What security principle addresses the issue of "Security by Obscurity"?

  A. Open design
  B. Segregation of duties (SoD)
  C. Role Based Access Control (RBAC)
  D. Least privilege
  A. Open design

• Question 507:

  What is the MOST effective response to a hacker who has already gained access to a network and will attempt to pivot to other resources?

  A. Reset all passwords.
  B. Shut down the network.
  C. Warn users of a breach.
  D. Segment the network.
  D. Segment the network.

• Question 508:

  The security organization is looking for a solution that could help them determine with a strong level of confidence that attackers have breached their network. Which solution is MOST effective at discovering a successful network breach?

  A. Deploying a honeypot
  B. Developing a sandbox
  C. Installing an intrusion prevention system (IPS)
  D. Installing an intrusion detection system (IDS)
  A. Deploying a honeypot

• Question 509:

  Which of the following is a PRIMARY challenge when running a penetration test?

  A. Determining the cost
  B. Establishing a business case
  C. Remediating found vulnerabilities
  D. Determining the depth of coverage
  D. Determining the depth of coverage

• Question 510:

  The personal laptop of an organization executive is stolen from the office, complete with personnel and project records. Which of the following should be done FIRST to mitigate future occurrences?

  A. Encrypt disks on personal laptops
  B. Issue cable locks for use on personal laptops
  C. Create policies addressing critical information on personal laptops
  D. Monitor personal laptops for critical information
  A. Encrypt disks on personal laptops