ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 641:

  An organization's retail website provides its only source of revenue, so the disaster recovery plan (DRP) must document an estimated time for each step in the plan. Which of the following steps in the DRP will list the GREATEST duration of time for the service to be fully operational?

  A. Update the Network Address Translation (NAT) table.
  B. Update Domain Name System (DNS) server addresses with domain registrar.
  C. Update the Border Gateway Protocol (BGP) autonomous system number.
  D. Update the web server network adapter configuration.
  B. Update Domain Name System (DNS) server addresses with domain registrar.

• Question 642:

  What are the essential elements of a Risk Assessment Report (RAR)?

  A. Table of contents, testing criteria, and index
  B. Table of contents, chapters, and executive summary
  C. Executive summary, graph of risks, and process
  D. Executive summary, body of the report, and appendices
  D. Executive summary, body of the report, and appendices

• Question 643:

  Which of the following roles has the obligation to ensure that a third party provider is capable of processing and handling data in a secure manner and meeting the standards set by the organization?

  A. Data Custodian
  B. Data Owner
  C. Data Creator
  D. Data User
  B. Data Owner

• Question 644:

  What is the GREATEST challenge to identifying data leaks?

  A. Available technical tools that enable user activity monitoring.
  B. Documented asset classification policy and clear labeling of assets.
  C. Senior management cooperation in investigating suspicious behavior.
  D. Law enforcement participation to apprehend and interrogate suspects.
  B. Documented asset classification policy and clear labeling of assets.

• Question 645:

  Which of the following entails identification of data end links to business processes, applications, and data stores as well as assignment of ownership responsibilities?

  A. Risk management
  B. Security portfolio management
  C. Security governance
  D. Risk assessment
  A. Risk management

• Question 646:

  An organization is considering partnering with a third-party supplier of cloud services. The organization will only be providing the data and the third-party supplier will be providing the security controls. Which of the following BEST describes this service offering?

  A. Platform as a Service (PaaS)
  B. Infrastructure as a Service (IaaS)
  C. Software as a Service (SaaS)
  D. Anything as a Service (XaaS)
  C. Software as a Service (SaaS)

• Question 647:

  Which of the following actions should be taken by a security professional when a mission critical computer network attack is suspected?

  A. Isolate the network, log an independent report, fix the problem, and redeploy the computer
  B. Isolate the network, install patches, and report the occurrence
  C. Prioritize, report and investigate the occurrence
  D. Turn the router off, perform forensic analysis, apply the appropriate fix, and log incidents
  A. Isolate the network, log an independent report, fix the problem, and redeploy the computer

• Question 648:

  What is the MINIMUM standard for testing a disaster recovery plan (DRP)?

  A. Semi-annually and in alignment with a fiscal half-year business cycle
  B. Annually or less frequently depending upon audit department requirements
  C. Quarterly or more frequently depending upon the advice of the information security manager
  D. As often as necessary depending upon the stability of the environment and business requirements
  D. As often as necessary depending upon the stability of the environment and business requirements

• Question 649:

  Which reporting type requires a service organization to describe its system and define its control objectives and controls that are relevant to users internal control over financial reporting?

  A. Statement on Auditing Standards (SAS)70
  B. Service Organization Control 1 (SOC1)
  C. Service Organization Control 2 (SOC2)
  D. Service Organization Control 3 (SOC3)
  B. Service Organization Control 1 (SOC1)

• Question 650:

  For network based evidence, which of the following contains traffic details of all network sessions in order to detect anomalies?

  A. Alert data
  B. User data
  C. Content data
  D. Statistical data
  D. Statistical data