ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 791:

  A security engineer is designing a Customer Relationship Management (CRM) application for a third-party vendor. In which phase of the System Development Life Cycle (SDLC) will it be MOST beneficial to conduct a data sensitivity assessment?

  A. Development / Acquisition
  B. Initiation
  C. Enumeration
  D. Operation / Maintenance
  B. Initiation

• Question 792:

  An organization needs to evaluate the effectiveness of security controls implemented on a new system. Which of the following roles should the organization entrust to conduct the evaluation?

  A. Authorizing Official (AO)
  B. System owner
  C. Control assessor
  D. Information System Security Officer (ISSO)
  C. Control assessor

• Question 793:

  Which of the following will help prevent improper session handling?

  A. Ensure that all UlWebView calls do not execute without proper input validation.
  B. Ensure that tokens are sufficiently long, complex, and pseudo-random.
  C. Ensure JavaScript and plugin support is disabled.
  D. Ensure that certificates are valid and fail closed.
  B. Ensure that tokens are sufficiently long, complex, and pseudo-random.

• Question 794:

  What is the BEST method to use for assessing the security impact of acquired software?

  A. Common vulnerability review
  B. Software security compliance validation
  C. Threat modeling
  D. Vendor assessment
  C. Threat modeling

• Question 795:

  Which of the following is the FIRST action that a system administrator should take when it is revealed during a penetration test that everyone in an organization has unauthorized access to a server holding sensitive data?

  A. Immediately document the finding and report to senior management.
  B. Use system privileges to alter the permissions to secure the server
  C. Continue the testing to its completion and then inform IT management
  D. Terminate the penetration test and pass the finding to the server management team
  A. Immediately document the finding and report to senior management.

• Question 796:

  Which of the following should be included a hardware retention policy?

  A. A plan to retain date required only for business purposes and a retention schedule
  B. Retention of all sensitive data on media and hardware
  C. The use of encryption technology to encrypt sensitive data prior to retention
  D. Retention of data for only one week and outsourcing the retention to a third-party vendor
  C. The use of encryption technology to encrypt sensitive data prior to retention

• Question 797:

  Which attack defines a piece of code that is inserted into software to trigger a malicious function?

  A. Phishing
  B. Salami
  C. Back door
  D. Logic bomb
  D. Logic bomb

• Question 798:

  The three PRIMARY requirements for a penetration test are A. A defined goal, limited time period, and approval of management

  B. A general objective, unlimited time, and approval of the network administrator

  C. An objective statement, disclosed methodology, and fixed cost

  D. A stated objective, liability waiver, and disclosed methodology

  Correct Answer. A
  A

• Question 799:

  Which of the following techniques is MOST useful when dealing with Advanced persistent Threat (APT) intrusions on live virtualized environments?

  A. Antivirus operations
  B. Reverse engineering
  C. Memory forensics
  D. Logfile analysis
  B. Reverse engineering

• Question 800:

  As users switch roles within an organization, their accounts are given additional permissions to perform the duties of their new position. After a recent audit, it was discovered that many of these accounts maintained their old permissions as well. The obsolete permissions identified by the audit have been remediated and accounts have only the appropriate permissions to complete their jobs.

  Which of the following is the BEST way to prevent access privilege creep?

  A. Implementing Identity and Access Management (IAM) solution
  B. Time-based review and certification
  C. Internet audit
  D. Trigger-based review and certification
  A. Implementing Identity and Access Management (IAM) solution