ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 511:

  When recovering from an outage, what is the Recovery Point Objective (RPO), in terms of data recovery?

  A. The RPO is the maximum amount of time for which loss of data is acceptable.
  B. The RPO is the minimum amount of data that needs to be recovered.
  C. The RPO is a goal to recover a targeted percentage of data lost.
  D. The RPO is the amount of time it takes to recover an acceptable percentage of data lost.
  B. The RPO is the minimum amount of data that needs to be recovered.

• Question 512:

  Which of the following technologies can be used to monitor and dynamically respond to potential threats on web applications?

  A. Security Assertion Markup Language (SAML)
  B. Web application vulnerability scanners
  C. Runtime application self-protection (RASP)
  D. Field-level tokenization
  C. Runtime application self-protection (RASP)

• Question 513:

  Which type of control recognizes that a transaction amount is excessive in accordance with corporate policy?

  A. Detection
  B. Prevention
  C. Investigation
  D. Correction
  A. Detection

• Question 514:

  Which of the following assures that rules are followed in an identity management architecture?

  A. Policy database
  B. Digital signature
  C. Policy decision point
  D. Policy enforcement point
  D. Policy enforcement point

• Question 515:

  Which security audit standard provides the BEST way for an organization to understand a vendor's Information Systems (IS) in relation to confidentiality, integrity, and availability?

  A. Statement on Auditing Standards (SAS) 70
  B. Service Organization Control (SOC) 2
  C. Service Organization Control (SOC) 1
  D. Statement on Standards for Attestation Engagements (SSAE) 18
  B. Service Organization Control (SOC) 2

• Question 516:

  Which of the following is the MOST important consideration in selecting a security testing method based on different Radio-Frequency Identification (RFID) vulnerability types?

  A. The performance and resource utilization of tools
  B. The quality of results and usability of tools
  C. An understanding of the attack surface
  D. Adaptability of testing tools to multiple technologies
  C. An understanding of the attack surface

• Question 517:

  Which of the following is the BEST definition of Cross-Site Request Forgery (CSRF)?

  A. An attack which forces an end user to execute unwanted actions on a web application in which they are currently authenticated
  B. An attack that injects a script into a web page to execute a privileged command
  C. An attack that makes an illegal request across security zones and thereby forges itself into the security database of the system
  D. An attack that forges a false Structure Query Language (SQL) command across systems
  A. An attack which forces an end user to execute unwanted actions on a web application in which they are currently authenticated

• Question 518:

  Are companies legally required to report all data breaches?

  A. No, different jurisdictions have different rules.
  B. No, not if the data is encrypted.
  C. No, companies' codes of ethics don't require it.
  D. No, only if the breach had a material impact.
  A. No, different jurisdictions have different rules.

• Question 519:

  Which of the following BEST describes centralized identity management?

  A. Service providers rely on a trusted third party (TTP) to provide requestors with both credentials and identifiers.
  B. Service providers agree to integrate identity system recognition across organizational boundaries.
  C. Service providers identify an entity by behavior analysis versus an identification factor.
  D. Service providers perform as both the credential and identity provider (IdP).
  B. Service providers agree to integrate identity system recognition across organizational boundaries.

• Question 520:

  An organization is considering outsourcing applications and data to a Cloud Service Provider (CSP). Which of the following is the MOST important concern regarding privacy?

  A. The CSP determines data criticality
  B. The CSP provides end-to-end encryption services
  C. The CSP's privacy policy may be developed by the organization
  D. The CSP may not be subject to the organization's country legislation
  D. The CSP may not be subject to the organization's country legislation