ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 831:

  The process of mutual authentication involves a computer system authenticating a user and authenticating the

  A. user to the audit process.
  B. computer system to the user.
  C. user's access to all authorized objects.
  D. computer system to the audit process.
  B. computer system to the user.

• Question 832:

  Which of the following PRIMARILY contributes to security incidents in web-based applications?

  A. Systems administration and operating systems
  B. System incompatibility and patch management
  C. Third-party applications and change controls
  D. Improper stress testing and application interfaces
  C. Third-party applications and change controls

• Question 833:

  Which of the following should be done at a disaster site before any item is removed, repaired, or replaced?

  A. Take photos of the damage
  B. Notify all of the Board of Directors
  C. Communicate with the press following the communications plan
  D. Dispatch personnel to the disaster recovery (DR) site
  A. Take photos of the damage

• Question 834:

  A security manager has noticed an inconsistent application of server security controls resulting in vulnerabilities on critical systems. What is the MOST likely cause of this issue?

  A. A lack of baseline standards
  B. Improper documentation of security guidelines
  C. A poorly designed security policy communication program
  D. Host-based Intrusion Prevention System (HIPS) policies are ineffective
  A. A lack of baseline standards

• Question 835:

  A chemical plan wants to upgrade the Industrial Control System (ICS) to transmit data using Ethernet instead of RS422. The project manager wants to simplify administration and maintenance by utilizing the office network infrastructure and staff to implement this upgrade.

  Which of the following is the GREATEST impact on security for the network?

  A. The network administrators have no knowledge of ICS
  B. The ICS is now accessible from the office network
  C. The ICS does not support the office password policy
  D. RS422 is more reliable than Ethernet
  B. The ICS is now accessible from the office network

• Question 836:

  An online retail company has formulated a record retention schedule for customer transactions. Which of the following is a valid reason a customer transaction is kept beyond the retention schedule?

  A. Pending legal hold
  B. Long term data mining needs
  C. Customer makes request to retain
  D. Useful for future business initiatives
  A. Pending legal hold

• Question 837:

  Regarding asset security and appropriate retention, which of the following INITIAL top three areas are important to focus on?

  A. Security control baselines, access controls, employee awareness and training
  B. Human resources, asset management, production management
  C. Supply chain lead time, inventory control, encryption
  D. Polygraphs, crime statistics, forensics
  A. Security control baselines, access controls, employee awareness and training

• Question 838:

  A security consultant has been hired by a company to establish its vulnerability management program. The consultant is now in the deployment phase. Which of the following tasks is part of this process?

  A. Educate and train key stakeholders.
  B. Measure effectiveness of the program’s stated goals.
  C. Determine a budget and cost analysis for the program.
  D. Select and procure supporting technologies.
  D. Select and procure supporting technologies.

• Question 839:

  Which of the following processes is BEST used to determine the extent to which modifications to an information system affect the security posture of the system?

  A. Patch management
  B. Continuous monitoring
  C. Configuration change control
  D. Security impact analysis
  D. Security impact analysis

• Question 840:

  An organization discovers that its Secure File Transfer Protocol (SFTP) server has been accessed by an unauthorized person to download an unreleased game. A recent security audit found weaknesses in some of the organization's general Information Technology (IT) controls, specifically pertaining to software change control and security patch management, but not in other control areas.

  Which of the following is the MOST probable attack vector used in the security breach?

  A. Buffer overflow
  B. Distributed Denial of Service (DDoS)
  C. Cross-Site Scripting (XSS)
  D. Weak password due to lack of complexity rules
  A. Buffer overflow