ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 711:

  An organization has implemented a protection strategy to secure the network from unauthorized external access. The new Chief Information Security Officer (CISO) wants to increase security by better protecting the network from unauthorized internal access. Which Network Access Control (NAC) capability BEST meets this objective?

  A. Application firewall
  B. Port security
  C. Strong passwords
  D. Two-factor authentication (2FA)
  D. Two-factor authentication (2FA)

• Question 712:

  Which one of the following is an advantage of an effective release control strategy form a configuration control standpoint?

  A. Ensures that a trace for all deliverables is maintained and auditable
  B. Enforces backward compatibility between releases
  C. Ensures that there is no loss of functionality between releases
  D. Allows for future enhancements to existing features
  A. Ensures that a trace for all deliverables is maintained and auditable

• Question 713:

  A company wants to implement two-factor authentication (2FA) to protect their computers from unauthorized users. Which solution provides the MOST secure means of authentication and meets the criteria they have set?

  A. Username and personal identification number (PIN)
  B. Fingerprint and retinal scanners
  C. Short Message Services (SMS) and smartphone authenticator
  D. Hardware token and password
  D. Hardware token and password

• Question 714:

  Which dynamic routing protocol is BEST suited for a dispersed campus network utilizing Internet Protocol version 6 (IPv6) addresses?

  A. Open Shortest Path First (OPSF) version 3
  B. Enhanced Interior Gateway Routing Protocol (EIGRP)
  C. Border Gateway Protocol (BGP) version 4
  D. Routing Information Protocol (RIP) version 2
  A. Open Shortest Path First (OPSF) version 3

• Question 715:

  The defense strategy “never trust any input” is MOST effective against which of the following web-based system vulnerabilities?

  A. Injection vulnerabilities
  B. Sensitive data exposure
  C. Man-in-the-browser attack
  D. Broken authentication
  A. Injection vulnerabilities

• Question 716:

  What should an auditor do when conducting a periodic audit on media retention?

  A. Check electronic storage media to ensure records are not retained past their destruction date
  B. Ensure authorized personnel are in possession of paper copies containing Personally Identifiable Information (PII)
  C. Check that hard disks containing backup data that are still within a retention cycle are being destroyed correctly
  D. Ensure that data shared with outside organizations is no longer on a retention schedule
  A. Check electronic storage media to ensure records are not retained past their destruction date

• Question 717:

  What is the process of removing sensitive data from a system or storage device with the intent that the data cannot be reconstructed by any known technique?

  A. Purging
  B. Encryption
  C. Destruction
  D. Clearing
  A. Purging

• Question 718:

  The Chief Information Security Officer (CISO) of an organization has requested that a Service Organization Control (SOC) report be created to outline the security and availability of a particular system over a 12-month period. Which type of SOC report should be utilized?

  A. SOC 1 Type 1
  B. SOC 2 Type 2
  C. SOC 2 Type 2
  D. SOC 3 Type 1
  C. SOC 2 Type 2

• Question 719:

  When should the software Quality Assurance (QA) team feel confident that testing is complete?

  A. When release criteria are met
  B. When the time allocated for testing the software is met
  C. When senior management approves the test results
  D. When the software has zero security vulnerabilities
  C. When senior management approves the test results

• Question 720:

  Which layer of the Open System Interconnection (OSI) model is reliant on other layers and is concerned with the structure, interpretation and handling of information?

  A. Presentation Layer
  B. Session Layer
  C. Application Layer
  D. Transport Layer
  C. Application Layer