ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 541:

  What MUST each information owner do when a system contains data from multiple information owners?

  A. Provide input to the Information System (IS) owner regarding the security requirements of the data
  B. Review the Security Assessment report (SAR) for the Information System (IS) and authorize the IS to operate.
  C. Develop and maintain the System Security Plan (SSP) for the Information System (IS) containing the data
  D. Move the data to an Information System (IS) that does not contain data owned by other information owners
  C. Develop and maintain the System Security Plan (SSP) for the Information System (IS) containing the data

• Question 542:

  Refer to the information below to answer the question.

  A large, multinational organization has decided to outsource a portion of their Information Technology (IT) organization to a third-party provider's facility. This provider will be responsible for the design, development, testing, and support of several critical, customer-based applications used by the organization. The organization should ensure that the third party's physical security controls are in place so that they

  A. are more rigorous than the original controls.
  B. are able to limit access to sensitive information.
  C. allow access by the organization staff at any time.
  D. cannot be accessed by subcontractors of the third party.
  B. are able to limit access to sensitive information.

• Question 543:

  Who must approve modifications to an organization's production infrastructure configuration?

  A. Technical management
  B. Change control board
  C. System operations
  D. System users
  B. Change control board

• Question 544:

  Which of the following is the MOST effective countermeasure against Man-in-the-Middle (MITM) attacks while using online banking?

  A. Transport Layer Security (TLS)
  B. Secure Sockets Layer (SSL)
  C. Pretty Good Privacy (PGP)
  D. Secure Shell (SSH)
  A. Transport Layer Security (TLS)

• Question 545:

  The European Union (EU) General Data Protection Regulation (GDPR) requires organizations to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The Data Owner should therefore consider which of the following requirements?

  A. Data masking and encryption of personal data
  B. Only to use encryption protocols approved by EU
  C. Anonymization of personal data when transmitted to sources outside the EU
  D. Never to store personal data of EU citizens outside the EU
  A. Data masking and encryption of personal data

• Question 546:

  What security risk does the role-based access approach mitigate MOST effectively?

  A. Excessive access rights to systems and data
  B. Segregation of duties conflicts within business applications
  C. Lack of system administrator activity monitoring
  D. Inappropriate access requests
  A. Excessive access rights to systems and data

• Question 547:

  In a dispersed network that lacks central control, which of the following is die PRIMARY course of action to mitigate exposure?

  A. Implement management policies, audit control, and data backups
  B. Implement security policies and standards, access controls, and access limitations
  C. Implement security policies and standards, data backups, and audit controls
  D. Implement remote access policies, shared workstations, and log management
  C. Implement security policies and standards, data backups, and audit controls

• Question 548:

  Which of the following is a characteristic of convert security testing?

  A. Induces less risk than over testing
  B. Tests staff knowledge and Implementation of the organization's security policy
  C. Focuses an Identifying vulnerabilities
  D. Tests and validates all security controls in the organization
  B. Tests staff knowledge and Implementation of the organization's security policy

• Question 549:

  An organization is implementing data encryption using symmetric ciphers and the Chief Information Officer (CIO) is concerned about the risk of using one key to protect all sensitive data, The security practitioner has been tasked with recommending a solution to address the CIO's concerns, Which of the following is the BEST approach to achieving the objective by encrypting all sensitive data?

  A. Use a Secure Hash Algorithm 256 (SHA-256).
  B. Use a hierarchy of encryption keys.
  C. Use Hash Message Authentication Code (HMAC) keys.
  D. Use Rivest-Shamir-Adleman (RSA) keys.
  D. Use Rivest-Shamir-Adleman (RSA) keys.

• Question 550:

  What is the PRIMARY difference between security policies and security procedures?

  A. Policies are used to enforce violations, and procedures create penalties
  B. Policies point to guidelines, and procedures are more contractual in nature
  C. Policies are included in awareness training, and procedures give guidance
  D. Policies are generic in nature, and procedures contain operational details
  D. Policies are generic in nature, and procedures contain operational details