ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 61:

  A security professional should consider the protection of which of the following elements FIRST when developing a defense-in-depth strategy for a mobile workforce?

  A. Network perimeters
  B. Demilitarized Zones (DMZ)
  C. Databases and back-end servers
  D. End-user devices
  A. Network perimeters

• Question 62:

  What does an organization FIRST review to assure compliance with privacy requirements?

  A. Best practices
  B. Business objectives
  C. Legal and regulatory mandates
  D. Employee's compliance to policies and standards
  C. Legal and regulatory mandates

• Question 63:

  Which of the following methods provides the MOST protection for user credentials?

  A. Forms-based authentication
  B. Digest authentication
  C. Basic authentication
  D. Self-registration
  B. Digest authentication

• Question 64:

  HOTSPOT

  Which Web Services Security (WS-Security) specification handles the management of security tokens and the underlying policies for granting access? Click on the correct specification in the image below.

  

  

• Question 65:

  Which of the following is a characteristic of a challenge/response authentication process?

  A. Using a password history blacklist
  B. Transmitting a hash based on the user's password
  C. Presenting distorted gravies of text for authentication
  D. Requiring the use of non-consecutive numeric characters
  C. Presenting distorted gravies of text for authentication

• Question 66:

  Which of the following is the MOST important action regarding authentication?

  A. Granting access rights
  B. Enrolling in the system
  C. Establishing audit controls
  D. Obtaining executive authorization
  B. Enrolling in the system

• Question 67:

  Which of the following is MOST important to follow when developing information security controls for an organization?

  A. Exercise due diligence with regard to all risk management information to tailor appropriate controls.
  B. Perform a risk assessment and choose a standard that addresses existing gaps.
  C. Use industry standard best practices for security controls in the organization.
  D. Review all local and international standards and choose the most stringent based on location.
  C. Use industry standard best practices for security controls in the organization.

• Question 68:

  Which of the following is the BEST method to perform an end-to-end testing on production for both operational and security requirements?

  A. Synthetic transaction analysis.
  B. Dynamic code analysis
  C. Static code analysis
  D. Vulnerability analysis
  B. Dynamic code analysis

• Question 69:

  Which one of the following effectively obscures network addresses from external exposure when implemented on a firewall or router?

  A. Network Address Translation (NAT)
  B. Application Proxy
  C. Routing Information Protocol (RIP) Version 2
  D. Address Masking
  A. Network Address Translation (NAT)

• Question 70:

  What are the PRIMARY responsibilities of security operations for handling and reporting violations and incidents?

  A. Monitoring and identifying system failures, documenting incidents for future analysis, and scheduling patches for systems
  B. Scheduling patches for systems, notifying the help desk, and alerting key personnel
  C. Monitoring and identifying system failures, alerting key personnel, and containing events
  D. Documenting incidents for future analysis, notifying end users, and containing events
  D. Documenting incidents for future analysis, notifying end users, and containing events