ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 721:

  In the common criteria, which of the following is a formal document that expresses an implementation-independent set of security requirements?

  A. Organizational Security Policy
  B. Security Target (ST)
  C. Protection Profile (PP)
  D. Target of Evaluation (TOE)
  C. Protection Profile (PP)

• Question 722:

  A company developed a web application which is sold as a Software as a Service (SaaS) solution to the customer. The application is hosted by a web server running on a `specific operating system (OS) on a virtual machine (VM). During the transition phase of the service, it is determined that the support team will need access to the application logs. Which of the following privileges would be the MOST suitable?

  A. Administrative privileges on the OS
  B. Administrative privileges on the web server
  C. Administrative privileges on the hypervisor
  D. Administrative privileges on the application folders
  D. Administrative privileges on the application folders

• Question 723:

  Within the company, desktop clients receive Internet Protocol (IP) address over Dynamic Host Configuration Protocol (DHCP). Which of the following represents a valid measure to help protect the network against unauthorized access?

  A. Implement path management
  B. Implement port based security through 802.1x
  C. Implement DHCP to assign IP address to server systems
  D. Implement change management
  B. Implement port based security through 802.1x

• Question 724:

  Which of the following is the MOST crucial for a successful audit plan?

  A. Defining the scope of the audit to be performed
  B. Identifying the security controls to be implemented
  C. Working with the system owner on new controls
  D. Acquiring evidence of systems that are not compliant
  A. Defining the scope of the audit to be performed

• Question 725:

  An organization implements a Remote Access Server (RAS). Once users correct to the server, digital certificates are used to authenticate their identity. What type of Extensible Authentication Protocol (EAP) would the organization use dring this authentication?

  A. Transport layer security (TLS)
  B. Message Digest 5 (MD5)
  C. Lightweight Extensible Authentication Protocol (EAP)
  D. Subscriber Identity Module (SIM)
  A. Transport layer security (TLS)

• Question 726:

  Which of the following statements is TRUE for point-to-point microwave transmissions?

  A. They are not subject to interception due to encryption.
  B. Interception only depends on signal strength.
  C. They are too highly multiplexed for meaningful interception.
  D. They are subject to interception by an antenna within proximity.
  D. They are subject to interception by an antenna within proximity.

• Question 727:

  How can lessons learned from business continuity training and actual recovery incidents BEST be used?

  A. As a means for improvement
  B. As alternative options for awareness and training
  C. As indicators of a need for policy
  D. As business function gap indicators
  A. As a means for improvement

• Question 728:

  Functional security testing is MOST critical during which phase of the system development life cycle (SDLC)?

  A. Operations / Maintenance
  B. Implementation
  C. Acquisition / Development
  D. Initiation
  B. Implementation

• Question 729:

  Additional padding may be added to the Encapsulating security protocol (ESP) trailer to provide which of the following?

  A. Data origin authentication
  B. Partial traffic flow confidentiality
  C. protection ao>ainst replay attack
  D. Access control
  C. protection ao>ainst replay attack

• Question 730:

  The configuration management and control task of the certification and accreditation process is incorporated in which phase of the System Development Life Cycle (SDLC)?

  A. System acquisition and development
  B. System operations and maintenance
  C. System initiation
  D. System implementation
  A. System acquisition and development