ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 571:

  Which of the following is the MOST important element of change management documentation?

  A. List of components involved
  B. Number of changes being made
  C. Business case justification
  D. A stakeholder communication
  C. Business case justification

• Question 572:

  The Chief Information Security Officer (CISO) is to establish a single, centralized, and relational repository to hold all information regarding the software and hardware assets. Which of the following s ions would be the BEST option?

  A. Information Security Management System (ISMS)
  B. Configuration Management Database (CMDB)
  C. Security Information and Event Management (SIEM)
  D. Information Technology Asset Management (ITAM)
  B. Configuration Management Database (CMDB)

• Question 573:

  What is the PRIMARY advantage of using automated application security testing tools?

  A. The application can be protected in the production environment.
  B. Large amounts of code can be tested using fewer resources.
  C. The application will fail less when tested using these tools.
  D. Detailed testing of code functions can be performed.
  B. Large amounts of code can be tested using fewer resources.

• Question 574:

  What is an important characteristic of Role Based Access Control (RBAC)?

  A. Supports Mandatory Access Control (MAC)
  B. Simplifies the management of access rights
  C. Relies on rotation of duties
  D. Requires two factor authentication
  B. Simplifies the management of access rights

• Question 575:

  Which of the following findings would MOST likely indicate a high risk in a vulnerability assessment report?

  A. Transmission control protocol (TCP) port 443 open
  B. Non-standard system naming convention used
  C. Unlicensed software installed
  D. End of life system detected
  A. Transmission control protocol (TCP) port 443 open

• Question 576:

  A developer begins employment with an information technology (IT) organization. On the first day, the developer works through the list of assigned projects and finds that some files within those projects aren't accessible, Other developers working on the same project have no trouble locating and working on the. What is the MOST likely explanation for the discrepancy in access?

  A. The IT administrator had failed to grant the developer privileged access to the servers.
  B. The project files were inadvertently deleted.
  C. The new developer's computer had not been added to an access control list (ACL).
  D. The new developer's user account was not associated with the right roles needed for the projects.
  A. The IT administrator had failed to grant the developer privileged access to the servers.

• Question 577:

  Which of the following steps should be conducted during the FIRST phase of software assurance in a generic acquisition process?

  A. Establishing and consenting to the contract work schedule
  B. Issuing a Request for Proposal (RFP) with a work statement
  C. Developing software requirements to be included in work statement
  D. Reviewing and accepting software deliverables
  C. Developing software requirements to be included in work statement

• Question 578:

  The process of "salting" a password is designed to increase the difficulty of cracking which of the following?

  A. Specific password
  B. Password hash function
  C. Password algorithm
  D. Maximum password length
  B. Password hash function

• Question 579:

  Which of the following is a direct monetary cost of a security incident?

  A. Morale
  B. Reputation
  C. Equipment
  D. Information
  C. Equipment

• Question 580:

  Which of the following has the GREATEST impact on an organization's security posture?

  A. International and country-specific compliance requirements
  B. Security violations by employees and contractors
  C. Resource constraints due to increasing costs of supporting security
  D. Audit findings related to employee access and permissions process
  A. International and country-specific compliance requirements