ISC CISSP Online Practice Questions and Exam Preparation

ISC CISSP Online Questions & Answers

• Question 921:

  What is static analysis intended to do when analyzing an executable file?

  A. Collect evidence of the executable file's usage, including dates of creation and last use.
  B. Search the documents and files associated with the executable file.
  C. Analyze the position of the file in the file system and the executable file's libraries.
  D. Disassemble the file to gather information about the executable file's function.
  D. Disassemble the file to gather information about the executable file's function.

• Question 922:

  An organization's information security strategic plan MUST be reviewed

  A. whenever there are significant changes to a major application.
  B. quarterly, when the organization's strategic plan is updated.
  C. whenever there are major changes to the business.
  D. every three years, when the organization's strategic plan is updated.
  C. whenever there are major changes to the business.

• Question 923:

  Which of the following is the MOST effective way to ensure the endpoint devices used by remote users are compliant with an organization's approved policies before being allowed on the network?

  A. Group Policy Object (GPO)
  B. Network Access Control (NAC)
  C. Mobile Device Management (MDM)
  D. Privileged Access Management (PAM)
  B. Network Access Control (NAC)

• Question 924:

  Which of the following is a limitation of the Bell-LaPadula model?

  A. Segregation of duties (SoD) is difficult to implement as the "no read-up" rule limits the ability of an object to access information with a higher classification.
  B. Mandatory access control (MAC) is enforced at all levels making discretionary access control (DAC) impossible to implement.
  C. It contains no provision or policy for changing data access control and works well only with access systems that are static in nature.
  D. It prioritizes integrity over confidentiality which can lead to inadvertent information disclosure.
  C. It contains no provision or policy for changing data access control and works well only with access systems that are static in nature.

• Question 925:

  What is the overall goal of software security testing?

  A. Identifying the key security features of the software
  B. Ensuring all software functions perform as specified
  C. Reducing vulnerabilities within a software system
  D. Making software development more agile
  C. Reducing vulnerabilities within a software system

• Question 926:

  A development operations team would like to start building new applications delegating the cybersecurity responsibility as much as possible to the service provider. Which of the following environments BEST fits their need?

  A. Cloud Virtual Machines (VM)
  B. Cloud application container within a Virtual Machine (VM)
  C. On premises Virtual Machine (VM)
  D. Self-hosted Virtual Machine (VM)
  A. Cloud Virtual Machines (VM)

• Question 927:

  Which of the following is a strategy of grouping requirements in developing a Security Test and Evaluation (STandE)?

  A. Standards, policies, and procedures
  B. Tactical, strategic, and financial
  C. Management, operational, and technical
  D. Documentation, observation, and manual
  C. Management, operational, and technical

• Question 928:

  Which software defined networking (SDN) architectural component is responsible for translating network requirements?

  A. SDN Application
  B. SDN Data path
  C. SDN Controller
  D. SDN Northbound Interfaces
  C. SDN Controller

• Question 929:

  What is the BEST way to restrict access to a file system on computing systems?

  A. Allow a user group to restrict access.
  B. Use a third-party tool to restrict access.
  C. Use least privilege at each level to restrict access.
  D. Restrict access to all users.
  C. Use least privilege at each level to restrict access.

• Question 930:

  Which action is MOST effective for controlling risk and minimizing maintenance costs in the software supply chain?

  A. Selecting redundant suppliers
  B. Selecting suppliers based on business requirements
  C. Selecting fewer, more reliable suppliers
  D. Selecting software suppliers with the fewest known vulnerabilities
  D. Selecting software suppliers with the fewest known vulnerabilities