ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 671:

  Which methodology is recommended for penetration testing to be effective in the development phase of the life-cycle process?

  A. White-box testing
  B. Software fuzz testing
  C. Black-box testing
  D. Visual testing
  A. White-box testing

• Question 672:

  Which of the following types of security testing is the MOST effective in providing a better indication of the everyday security challenges of an organization when performing a security risk assessment?

  A. External
  B. Overt
  C. Internal
  D. Covert
  D. Covert

• Question 673:

  If an employee transfers from one role to another, which of the following actions should this trigger within the identity and access management (IAM) lifecycle?

  A. New account creation
  B. User access review and adjustment
  C. Deprovisioning
  D. System account access review and adjustment
  B. User access review and adjustment

• Question 674:

  An organization discovers that its secure file transfer protocol (SFTP) server has been accessed by an unauthorized person to download an unreleased game. A recent security audit found weaknesses in some of the organization's general information technology (IT) controls, specifically pertaining to software change control and security patch management, but not in other control areas.

  Which of the following is the MOST probable attack vector used in the security breach?

  A. Buffer overflow
  B. Weak password able to lack of complexity rules
  C. Distributed Denial of Service (DDoS)
  D. Cross-Site Scripting (XSS)
  A. Buffer overflow

• Question 675:

  Which of the following is a web application control that should be put into place to prevent exploitation of Operating System (OS) bugs?

  A. Check arguments in function calls
  B. Test for the security patch level of the environment
  C. Include logging functions
  D. Digitally sign each application module
  B. Test for the security patch level of the environment

• Question 676:

  Which type of security testing is being performed when an ethical hacker has no knowledge about the target system but the testing target is notified before the test?

  A. Reversal
  B. Gray box
  C. Blind
  D. White box
  B. Gray box

• Question 677:

  What protocol is often used between gateway hosts on the Internet?

  A. Exterior Gateway Protocol (EGP)
  B. Border Gateway Protocol (BGP)
  C. Open Shortest Path First (OSPF)
  D. Internet Control Message Protocol (ICMP)
  B. Border Gateway Protocol (BGP)

• Question 678:

  What is the best way for mutual authentication of devices belonging to the same organization?

  A. Token
  B. Certificates
  C. User ID and passwords
  D. Biometric
  A. Token

• Question 679:

  Which of the following authorization standards is built to handle Application Programming Interface (API) access for Federated Identity Management (FIM)?

  A. Security Assertion Markup Language (SAML)
  B. Open Authentication (OAUTH)
  C. Remote Authentication Dial-in User service (RADIUS)
  D. Terminal Access Control Access Control System Plus (TACACS+)
  B. Open Authentication (OAUTH)

• Question 680:

  Spyware is BEST described as

  A. data mining for advertising.
  B. a form of cyber-terrorism,
  C. an information gathering technique,
  D. a web-based attack.
  B. a form of cyber-terrorism,