ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 521:

  A user sends an e-mail request asking for read-only access to files that are not considered sensitive. A Discretionary Access Control (DAC) methodology is in place. Which is the MOST suitable approach that the administrator should take?

  A. Administrator should request data owner approval to the user access
  B. Administrator should request manager approval for the user access
  C. Administrator should directly grant the access to the non-sensitive files
  D. Administrator should assess the user access need and either grant or deny the access
  A. Administrator should request data owner approval to the user access

• Question 522:

  At which layer of the Open Systems Interconnection (OSI) model does a circuit-level firewall operate?

  A. Session layer
  B. Network layer
  C. Application layer
  D. Transport layer
  A. Session layer

• Question 523:

  What is the MOST important step during forensic analysis when trying to learn the purpose of an unknown application?

  A. Disable all unnecessary services
  B. Ensure chain of custody
  C. Prepare another backup of the system
  D. Isolate the system from the network
  D. Isolate the system from the network

• Question 524:

  Which of the following MOST accurately describes the Security Target (ST) in the Common Criteria framework?

  A. The set of rules that define how resources or assets are managed and protected
  B. A product independent set of security criteria for a class of products
  C. The product and documentation to be evaluated
  D. A document that includes a product specific set of security criteria
  D. A document that includes a product specific set of security criteria

• Question 525:

  The PRIMARY outcome of a certification process is that it provides documented

  A. interconnected systems and their implemented security controls.
  B. standards for security assessment, testing, and process evaluation.
  C. system weakness for remediation.
  D. security analyses needed to make a risk-based decision.
  D. security analyses needed to make a risk-based decision.

• Question 526:

  Which of the following is applicable to a publicly held company concerned about information handling and storage requirement specific to the financial reporting?

  A. Privacy Act of 1974
  B. Clinger-Cohan Act of 1996
  C. Sarbanes-Oxley (SOX) Act of 2002
  D. International Organization for Standardization (ISO) 27001
  C. Sarbanes-Oxley (SOX) Act of 2002

• Question 527:

  An organization decides to implement a partial Public Key Infrastructure (PKI) with only the servers having digital certificates. What is the security benefit of this implementation?

  A. Clients can authenticate themselves to the servers.
  B. Mutual authentication is available between the clients and servers.
  C. Servers are able to issue digital certificates to the client.
  D. Servers can authenticate themselves to the client.
  D. Servers can authenticate themselves to the client.

• Question 528:

  An organization is trying to secure instant messaging (IM) communications through its network perimeter. Which of the following is the MOST significant challenge?

  A. IM clients can interoperate between multiple vendors.
  B. IM clients can run without administrator privileges.
  C. IM clients can utilize random port numbers.
  D. IM clients can run as executable that do not require installation.
  B. IM clients can run without administrator privileges.

• Question 529:

  The adoption of an enterprise-wide business continuilty program requires Which of the folllowing?

  A. Good communication throughout the organization
  B. Formation of Disaster Recovery (DP) project team
  C. A completed Business Impact Analysis (BIA)
  D. Well-documented information asset classification
  D. Well-documented information asset classification

• Question 530:

  Which of the following is the MOST relevant risk indicator after a penetration test?

  A. Lists of hosts vulnerable to remote exploitation attacks
  B. Details of vulnerabilities and recommended remediation
  C. Lists of target systems on the network identified and scanned for vulnerabilities
  D. Details of successful vulnerability exploitations
  C. Lists of target systems on the network identified and scanned for vulnerabilities