ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 71:

  A software engineer uses automated tools to review application code and search for application flaws, back doors, or other malicious code. Which of the following is the FIRST Software Development Life Cycle (SDLC) phase where this takes place?

  A. Design
  B. Test
  C. Development
  D. Deployment
  C. Development

• Question 72:

  A breach investigation ...... a website was exploited through an open soured .....Is The FIRB Stan In the Process that could have prevented this breach?

  A. Application whitelisting
  B. Web application firewall (WAF)
  C. Vulnerability remediation
  D. Software inventory
  B. Web application firewall (WAF)

• Question 73:

  Compared with hardware cryptography, software cryptography is generally

  A. less expensive and slower.
  B. more expensive and faster.
  C. more expensive and slower.
  D. less expensive and faster.
  A. less expensive and slower.

• Question 74:

  In order to meet the project delivery deadline, a web application developer used readily available software components. Which is the BEST method for reducing the risk associated with this practice?

  A. Ensure developers are using approved software development frameworks.
  B. Obtain components from official sources over secured link.
  C. Ensure encryption of all sensitive data in a manner that protects and defends against threats.
  D. Implement a process to verify the effectiveness of the software components and settings.
  D. Implement a process to verify the effectiveness of the software components and settings.

• Question 75:

  An input validation and exception handling vulnerability has been discovered on a critical web-based system. Which of the following is MOST suited to quickly implement a control?

  A. Add a new rule to the application layer firewall
  B. Block access to the service
  C. Install an Intrusion Detection System (IDS)
  D. Patch the application source code
  A. Add a new rule to the application layer firewall

• Question 76:

  DRAG DROP

  Given a file containing ordered number, i.e. "123456789," match each of the following redundant Array of independent Disks (RAID) levels to the corresponding visual representation visual representation. Note: P() = parity.

  Drag each level to the appropriate place on the diagram.

  Select and Place:

  

  

• Question 77:

  Which of the following MUST be done when promoting a security awareness program to senior management?

  A. Show the need for security; identify the message and the audience
  B. Ensure that the security presentation is designed to be all-inclusive
  C. Notify them that their compliance is mandatory
  D. Explain how hackers have enhanced information security
  A. Show the need for security; identify the message and the audience

• Question 78:

  Which of the following would present the highert annualized loss expectancy (ALE)?

  

  A. Fire
  B. Earthquake
  C. Windstorm
  D. Flood
  A. Fire

• Question 79:

  A Chief Information Officer (CIO) has delegated responsibility of their system security to the head of the information technology (IT) department. While corporate policy dictates that only the CIO can make decisions on the level of data protection required, technical implementation decisions are done by the head of the IT department. Which of the following BEST describes the security role filled by the head of the IT department?

  A. System analyst
  B. System security officer
  C. System processor
  D. System custodian
  D. System custodian

• Question 80:

  An organization has approved deployment of a virtual environment for the development servers and has established controls for restricting access to resources. In order to implement best security practices for the virtual environment, the security team MUST also implement which of the following steps?

  A. Implement a dedicated management network for the hypervisor.
  B. Deploy Terminal Access Controller Access Control System Plus (TACACS+) for authentication.
  C. Implement complex passwords using Privileged Access Management (PAM).
  D. Capture network traffic for the network interface.
  A. Implement a dedicated management network for the hypervisor.