ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 591:

  What is the term commonly used to refer to a technique of authenticating one machine to another by forging packets from a trusted source?

  A. Man-in-the-Middle (MITM) attack
  B. Smurfing
  C. Session redirect
  D. Spoofing
  D. Spoofing

• Question 592:

  The security team is notified that a device on the network is infected with malware. Which of the following is MOST effective in enabling the device to be quickly located and remediated?

  A. Data loss protection (DLP)
  B. Intrusion detection
  C. Vulnerability scanner
  D. Information Technology Asset Management (ITAM)
  D. Information Technology Asset Management (ITAM)

• Question 593:

  Why is authentication by ownership stronger than authentication by knowledge?

  A. It is easier to change.
  B. It can be kept on the user's person.
  C. It is more difficult to duplicate.
  D. It is simpler to control.
  B. It can be kept on the user's person.

• Question 594:

  Which of the following BEST ensures the integrity of transactions to intended recipients?

  A. Public key infrastructure (PKI)
  B. Blockchain technology
  C. Pre-shared key (PSK)
  D. Web of trust
  A. Public key infrastructure (PKI)

• Question 595:

  Which of the following could cause a Denial of Service (DoS) against an authentication system?

  A. Encryption of audit logs
  B. No archiving of audit logs
  C. Hashing of audit logs
  D. Remote access audit logs
  B. No archiving of audit logs

• Question 596:

  Which of the following is required to determine classification and ownership?

  A. System and data resources are properly identified
  B. Access violations are logged and audited
  C. Data file references are identified and linked
  D. System security controls are fully integrated
  A. System and data resources are properly identified

• Question 597:

  When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?

  A. After the system preliminary design has been developed and the data security categorization has been performed
  B. After the business functional analysis and the data security categorization have been performed
  C. After the vulnerability analysis has been performed and before the system detailed design begins
  D. After the system preliminary design has been developed and before the data security categorization begins
  B. After the business functional analysis and the data security categorization have been performed

• Question 598:

  Which of the following is the FIRST requirement a data owner should consider before implementing a data retention policy?

  A. Training
  B. Legal
  C. Business
  D. Storage
  B. Legal

• Question 599:

  What steps can be taken to prepare personally identifiable information (PII) for processing by a third party?

  A. It is not necessary to protect PII as long as it is in the hands of the provider.
  B. A security agreement with a Cloud Service Provider (CSP) was required so there is no concern.
  C. The personal information should be maintained separately connected with a one-way reference.
  D. The personal information can be hashed and then the data can be sent to an outside processor.
  C. The personal information should be maintained separately connected with a one-way reference.

• Question 600:

  Logical access control programs are MOST effective when they are

  A. approved by external auditors.
  B. combined with security token technology.
  C. maintained by computer security officers.
  D. made part of the operating system.
  D. made part of the operating system.