Certified Information Systems Security Professional (CISSP)
Last Update 5 days ago
Total Questions : 1486
Certified Information Systems Security Professional (CISSP) is stable now with all latest exam questions are added 5 days ago. Incorporating CISSP practice exam questions into your study plan is more than just a preparation strategy.
By familiarizing yourself with the Certified Information Systems Security Professional (CISSP) exam format, identifying knowledge gaps, applying theoretical knowledge in ISC practical scenarios, you are setting yourself up for success. CISSP exam dumps provide a realistic preview, helping you to adapt your preparation strategy accordingly.
CISSP exam questions often include scenarios and problem-solving exercises that mirror real-world challenges. Working through CISSP dumps allows you to practice pacing yourself, ensuring that you can complete all Certified Information Systems Security Professional (CISSP) exam questions within the allotted time frame without sacrificing accuracy.
Refer to the information below to answer the question.
A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes.
Which of the following BEST describes the access control methodology used?
Which of the following provides effective management assurance for a Wireless Local Area Network (WLAN)?
Refer to the information below to answer the question.
A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.
Which of the following solutions would have MOST likely detected the use of peer-to-peer programs when the computer was connected to the office network?
Which of the following provides the MOST protection against data theft of sensitive information when a laptop is stolen?
Which of the following is a limitation of the Common Vulnerability Scoring System (CVSS) as it relates to conducting code review?
Which of the following is a security feature of Global Systems for Mobile Communications (GSM)?
When building a data center, site location and construction factors that increase the level of vulnerability to physical threats include
An internal Service Level Agreement (SLA) covering security is signed by senior managers and is in place. When should compliance to the SLA be reviewed to ensure that a good security posture is being delivered?
The Structured Query Language (SQL) implements Discretionary Access Controls (DAC) using
What is the MOST critical factor to achieve the goals of a security program?
Which of the following is a BEST practice when traveling internationally with laptops containing Personally Identifiable Information (PII)?
During an investigation of database theft from an organization's web site, it was determined that the Structured Query Language (SQL) injection technique was used despite input validation with client-side scripting. Which of the following provides the GREATEST protection against the same attack occurring again?
Which of the following is the MOST beneficial to review when performing an IT audit?
Refer to the information below to answer the question.
A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes.
In addition to authentication at the start of the user session, best practice would require re-authentication
Refer to the information below to answer the question.
An organization experiencing a negative financial impact is forced to reduce budgets and the number of Information Technology (IT) operations staff performing basic logical access security administration functions. Security processes have been tightly integrated into normal IT operations and are not separate and distinct roles.
When determining appropriate resource allocation, which of the following is MOST important to monitor?
When dealing with compliance with the Payment Card Industry-Data Security Standard (PCI-DSS), an organization that shares card holder information with a service provider MUST do which of the following?
What physical characteristic does a retinal scan biometric device measure?
Which of the following BEST mitigates a replay attack against a system using identity federation and Security Assertion Markup Language (SAML) implementation?
While impersonating an Information Security Officer (ISO), an attacker obtains information from company employees about their User IDs and passwords. Which method of information gathering has the attacker used?
An organization is designing a large enterprise-wide document repository system. They plan to have several different classification level areas with increasing levels of controls. The BEST way to ensure document confidentiality in the repository is to
Which of the following methods protects Personally Identifiable Information (PII) by use of a full replacement of the data element?
The BEST method of demonstrating a company's security level to potential customers is
What is an effective practice when returning electronic storage media to third parties for repair?
Which one of the following is the MOST important in designing a biometric access system if it is essential that no one other than authorized individuals are admitted?
Which of the following MOST influences the design of the organization's electronic monitoring policies?
A business has implemented Payment Card Industry Data Security Standard (PCI-DSS) compliant handheld credit card processing on their Wireless Local Area Network (WLAN) topology. The network team partitioned the WLAN to create a private segment for credit card processing using a firewall to control device access and route traffic to the card processor on the Internet. What components are in the scope of PCI-DSS?
What is the MOST effective method for gaining unauthorized access to a file protected with a long complex password?
What type of encryption is used to protect sensitive data in transit over a network?
Which of the following countermeasures is the MOST effective in defending against a social engineering attack?
Which of the following could elicit a Denial of Service (DoS) attack against a credential management system?
Network-based logging has which advantage over host-based logging when reviewing malicious activity about a victim machine?
Which one of the following is a common risk with network configuration management?
Which of the following PRIMARILY contributes to security incidents in web-based applications?
A practice that permits the owner of a data object to grant other users access to that object would usually provide
Which of the following is an effective method for avoiding magnetic media data remanence?
Refer to the information below to answer the question.
An organization has hired an information security officer to lead their security department. The officer has adequate people resources but is lacking the other necessary components to have an effective security program. There are numerous initiatives requiring security involvement.
Which of the following is considered the MOST important priority for the information security officer?
Refer to the information below to answer the question.
A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access.
Which of the following could have MOST likely prevented the Peer-to-Peer (P2P) program from being installed on the computer?
Refer to the information below to answer the question.
A security practitioner detects client-based attacks on the organization’s network. A plan will be necessary to address these concerns.
In the plan, what is the BEST approach to mitigate future internal client-based attacks?
What do Capability Maturity Models (CMM) serve as a benchmark for in an organization?
What is the PRIMARY advantage of using automated application security testing tools?
Host-Based Intrusion Protection (HIPS) systems are often deployed in monitoring or learning mode during their initial implementation. What is the objective of starting in this mode?
Refer to the information below to answer the question.
A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes.
What MUST the access control logs contain in addition to the identifier?
An organization's data policy MUST include a data retention period which is based on
According to best practice, which of the following is required when implementing third party software in a production environment?
Identify the component that MOST likely lacks digital accountability related to information access.
Click on the correct device in the image below.
The use of proximity card to gain access to a building is an example of what type of security control?
Which of the following describes the concept of a Single Sign -On (SSO) system?
When implementing a secure wireless network, which of the following supports authentication and authorization for individual client endpoints.
Refer to the information below to answer the question.
In a Multilevel Security (MLS) system, the following sensitivity labels are used in increasing levels of sensitivity: restricted, confidential, secret, top secret. Table A lists the clearance levels for four users, while Table B lists the security classes of four different files.
In a Bell-LaPadula system, which user cannot write to File 3?
Which of the following is the MOST difficult to enforce when using cloud computing?
Which security action should be taken FIRST when computer personnel are terminated from their jobs?
What maintenance activity is responsible for defining, implementing, and testing updates to application systems?
The stringency of an Information Technology (IT) security assessment will be determined by the
Which one of these risk factors would be the LEAST important consideration in choosing a building site for a new computer facility?
Which of the following is an essential element of a privileged identity lifecycle management?
Which of the following does the Encapsulating Security Payload (ESP) provide?
A software scanner identifies a region within a binary image having high entropy. What does this MOST likely indicate?
What principle requires that changes to the plaintext affect many parts of the ciphertext?
In a financial institution, who has the responsibility for assigning the classification to a piece of information?
When constructing an Information Protection Policy (IPP), it is important that the stated rules are necessary, adequate, and
What would be the PRIMARY concern when designing and coordinating a security assessment for an Automatic Teller Machine (ATM) system?
Which of the following Disaster Recovery (DR) sites is the MOST difficult to test?
Which of the following is an attacker MOST likely to target to gain privileged access to a system?
When network management is outsourced to third parties, which of the following is the MOST effective method of protecting critical data assets?
Extensible Authentication Protocol-Message Digest 5 (EAP-MD5) only provides which of the following?
“Stateful” differs from “Static” packet filtering firewalls by being aware of which of the following?
An organization adopts a new firewall hardening standard. How can the security professional verify that the technical staff correct implemented the new standard?
As part of an application penetration testing process, session hijacking can BEST be achieved by which of the following?
A security professional determines that a number of outsourcing contracts inherited from a previous merger do not adhere to the current security requirements. Which of the following BEST minimizes the risk of this
happening again?
Which of the following is the BEST metric to obtain when gaining support for an Identify and Access
Management (IAM) solution?
Who is responsible for the protection of information when it is shared with or provided to other organizations?
Which type of test would an organization perform in order to locate and target exploitable defects?
A vulnerability assessment report has been submitted to a client. The client indicates that one third of the hosts
that were in scope are missing from the report.
In which phase of the assessment was this error MOST likely made?
What is the BEST location in a network to place Virtual Private Network (VPN) devices when an internal review reveals network design flaws in remote access?
As part of the security assessment plan, the security professional has been asked to use a negative testing strategy on a new website. Which of the following actions would be performed?
Which security access policy contains fixed security attributes that are used by the system to determine a
user’s access to a file or object?
Which of the following mechanisms will BEST prevent a Cross-Site Request Forgery (CSRF) attack?
A minimal implementation of endpoint security includes which of the following?
Which of the following access management procedures would minimize the possibility of an organization's employees retaining access to secure werk areas after they change roles?
Match the functional roles in an external audit to their responsibilities.
Drag each role on the left to its corresponding responsibility on the right.
Select and Place:
Who would be the BEST person to approve an organizations information security policy?
Which of the BEST internationally recognized standard for evaluating security products and systems?
Which of the following is a direct monetary cost of a security incident?
Which of the following is the MOST important security goal when performing application interface testing?
An organization recently conducted a review of the security of its network applications. One of the
vulnerabilities found was that the session key used in encrypting sensitive information to a third party server had been hard-coded in the client and server applications. Which of the following would be MOST effective in mitigating this vulnerability?
What is the MOST significant benefit of an application upgrade that replaces randomly generated session keys with certificate based encryption for communications with backend servers?
Which of the following MUST be scalable to address security concerns raised by the integration of third-party
identity services?
Digital certificates used in Transport Layer Security (TLS) support which of the following?
The security accreditation task of the System Development Life Cycle (SDLC) process is completed at the end of which phase?
Which of the following provides the MOST comprehensive filtering of Peer-to-Peer (P2P) traffic?
The organization would like to deploy an authorization mechanism for an Information Technology (IT)
infrastructure project with high employee turnover.
Which access control mechanism would be preferred?
From a security perspective, which of the following assumptions MUST be made about input to an
application?
Which of the following techniques is known to be effective in spotting resource exhaustion problems, especially with resources such as processes, memory, and connections?
When evaluating third-party applications, which of the following is the GREATEST responsibility of Information Security?
A security architect plans to reference a Mandatory Access Control (MAC) model for implementation. This indicates that which of the following properties are being prioritized?
Software Code signing is used as a method of verifying what security concept?
Which of the following is the MOST important element of change management documentation?
Which of the following BEST describes the purpose of performing security certification?
Which of the following is most helpful in applying the principle of LEAST privilege?
Place in order, from BEST (1) to WORST (4), the following methods to reduce the risk of data remanence on magnetic media.
What security risk does the role-based access approach mitigate MOST effectively?
Which of the following is BEST suited for exchanging authentication and authorization messages in a multi-party decentralized environment?
Application of which of the following Institute of Electrical and Electronics Engineers (IEEE) standards will prevent an unauthorized wireless device from being attached to a network?
In the Open System Interconnection (OSI) model, which layer is responsible for the transmission of binary data over a communications network?
Which of the following is the MOST likely cause of a non-malicious data breach when the source of the data breach was an un-marked file cabinet containing sensitive documents?
The restoration priorities of a Disaster Recovery Plan (DRP) are based on which of the following documents?
Which of the following are Systems Engineering Life Cycle (SELC) Technical Processes?
In general, servers that are facing the Internet should be placed in a demilitarized zone (DMZ). What is MAIN purpose of the DMZ?
If compromised, which of the following would lead to the exploitation of multiple virtual machines?
A proxy firewall operates at what layer of the Open System Interconnection (OSI) model?
Which of the following is the BEST method to assess the effectiveness of an organization's vulnerability management program?
What type of wireless network attack BEST describes an Electromagnetic Pulse (EMP) attack?
Which of the following prevents improper aggregation of privileges in Role Based Access Control (RBAC)?
The goal of a Business Continuity Plan (BCP) training and awareness program is to
Determining outage costs caused by a disaster can BEST be measured by the
How does a Host Based Intrusion Detection System (HIDS) identify a potential attack?
A network scan found 50% of the systems with one or more critical vulnerabilities. Which of the following represents the BEST action?
Which Web Services Security (WS-Security) specification handles the management of security tokens and the underlying policies for granting access? Click on the correct specification in the image below.
Which of the following is the MOST effective method of mitigating data theft from an active user workstation?
Which of the following BEST describes an access control method utilizing cryptographic keys derived from a smart card private key that is embedded within mobile devices?
Users require access rights that allow them to view the average salary of groups of employees. Which control would prevent the users from obtaining an individual employee’s salary?
A manufacturing organization wants to establish a Federated Identity Management (FIM) system with its 20 different supplier companies. Which of the following is the BEST solution for the manufacturing organization?
What is the BEST approach for controlling access to highly sensitive information when employees have the same level of security clearance?
When assessing an organization’s security policy according to standards established by the International Organization for Standardization (ISO) 27001 and 27002, when can management responsibilities be defined?
Which of the following types of technologies would be the MOST cost-effective method to provide a reactive control for protecting personnel in public areas?
A company whose Information Technology (IT) services are being delivered from a Tier 4 data center, is preparing a companywide Business Continuity Planning (BCP). Which of the following failures should the IT manager be concerned with?
An important principle of defense in depth is that achieving information security requires a balanced focus on which PRIMARY elements?
All of the following items should be included in a Business Impact Analysis (BIA) questionnaire EXCEPT questions that
Intellectual property rights are PRIMARY concerned with which of the following?
Which of the following represents the GREATEST risk to data confidentiality?
What is the MOST important consideration from a data security perspective when an organization plans to relocate?
Which of the following actions will reduce risk to a laptop before traveling to a high risk area?
Which of the following terms BEST describes a system which allows a user to log in and access multiple related servers and applications?
Which of the below strategies would MOST comprehensively address the risk of malicious insiders leaking sensitive information?
Which of the following is true of Service Organization Control (SOC) reports?
A security engineer is designing a Customer Relationship Management (CRM) application for a third-party vendor. In which phase of the System Development Life Cycle (SDLC) will it be MOST beneficial to conduct a data sensitivity assessment?
Information security practitioners are in the midst of implementing a new firewall. Which of the following failure methods would BEST prioritize security in the event of failure?
Which of the following is a characteristic of a challenge/response authentication process?
What Hypertext Transfer Protocol (HTTP) response header can be used to disable the execution of inline JavaScript and the execution of eval()-type functions?
A software engineer uses automated tools to review application code and search for application flaws, back doors, or other malicious code. Which of the following is the
FIRST Software Development Life Cycle (SDLC) phase where this takes place?
Which of the following authorization standards is built to handle Application programming Interface (API) access for federated Identity management (FIM)?
In what phase of the System Development Life Cycle (SDLC) should security training for the development team begin?
A hospital’s building controls system monitors and operates the environmental equipment to maintain a safe and comfortable environment. Which of the following could be used to minimize the risk of utility supply interruption?
The MAIN purpose of placing a tamper seal on a computer system's case is to:
Which of the following BEST describes the responsibilities of data owner?
When reviewing vendor certifications for handling and processing of company data, which of the following is the BEST Service Organization Controls (SOC) certification for the vendor to possess?
Which of the following is an important design feature for the outer door o f a mantrap?
A software developer wishes to write code that will execute safely and only as intended. Which of the following programming language types is MOST likely to achieve this goal?
An organization has been collecting a large amount of redundant and unusable data and filling up the storage area network (SAN). Management has requested the identification of a solution that will address ongoing storage problems. Which is the BEST technical solution?
The Chief Information Security Officer (CISO) of an organization has requested that a Service Organization Control (SOC) report be created to outline the security and availability of a
particular system over a 12-month period. Which type of SOC report should be utilized?
When selecting a disk encryption technology, which of the following MUST also be assured to be encrypted?
Which of the following in the BEST way to reduce the impact of an externally sourced flood attack?
What is the FIRST step that should be considered in a Data Loss Prevention (DLP) program?
The use of private and public encryption keys is fundamental in the implementation of which of the following?
Which of the following mobile code security models relies only on trust?
Who in the organization is accountable for classification of data information assets?
Which technique can be used to make an encryption scheme more resistant to a known plaintext attack?
What is the second phase of Public Key Infrastructure (PKI) key/certificate life-cycle management?
Which component of the Security Content Automation Protocol (SCAP) specification contains the data required to estimate the severity of vulnerabilities identified automated vulnerability assessments?
Which security service is served by the process of encryption plaintext with the sender’s private key and decrypting cipher text with the sender’s public key?
When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?
Which of the following is the PRIMARY risk with using open source software in a commercial software construction?
The configuration management and control task of the certification and accreditation process is incorporated in which phase of the System Development Life Cycle (SDLC)?
What is the BEST approach to addressing security issues in legacy web applications?
A Java program is being developed to read a file from computer A and write it to computer B, using a third computer
C.
The program is not working as expected. What is the MOST probable security feature of Java preventing the program from operating as intended?Which of the following is a web application control that should be put into place to prevent exploitation of Operating System (OS) bugs?
Which of the following is the BEST method to prevent malware from being introduced into a production environment?
What should be the FIRST action to protect the chain of evidence when a desktop computer is involved?
With what frequency should monitoring of a control occur when implementing Information Security Continuous Monitoring (ISCM) solutions?
Recovery strategies of a Disaster Recovery planning (DRIP) MUST be aligned with which of the following?
Which of the following is the FIRST step in the incident response process?
What would be the MOST cost effective solution for a Disaster Recovery (DR) site given that the organization’s systems cannot be unavailable for more than 24 hours?
A Business Continuity Plan/Disaster Recovery Plan (BCP/DRP) will provide which of the following?
Which of the following types of business continuity tests includes assessment of resilience to internal and external risks without endangering live operations?
A continuous information security-monitoring program can BEST reduce risk through which of the following?
Which of the following is a PRIMARY advantage of using a third-party identity service?
An organization is found lacking the ability to properly establish performance indicators for its Web hosting solution during an audit. What would be the MOST probable cause?
What is the MOST important step during forensic analysis when trying to learn the purpose of an unknown application?
Which of the following BEST describes the responsibilities of a data owner?
An organization has doubled in size due to a rapid market share increase. The size of the Information Technology (IT) staff has maintained pace with this growth. The organization hires several contractors whose onsite time is limited. The IT department has pushed its limits building servers and rolling out workstations and has a backlog of account management requests.
Which contract is BEST in offloading the task from the IT staff?
Which of the following is an initial consideration when developing an information security management system?
Which of the following is an effective control in preventing electronic cloning of Radio Frequency Identification (RFID) based access cards?
Which of the following is MOST important when assigning ownership of an asset to a department?
When implementing a data classification program, why is it important to avoid too much granularity?
In a Transmission Control Protocol/Internet Protocol (TCP/IP) stack, which layer is responsible for negotiating and establishing a connection with another node?
Which of the following operates at the Network Layer of the Open System Interconnection (OSI) model?
Which of the following is the BEST network defense against unknown types of attacks or stealth attacks in progress?
An external attacker has compromised an organization’s network security perimeter and installed a sniffer onto an inside computer. Which of the following is the MOST effective layer of security the organization could have implemented to mitigate the attacker’s ability to gain further information?
Which of the following factors contributes to the weakness of Wired Equivalent Privacy (WEP) protocol?
At what level of the Open System Interconnection (OSI) model is data at rest on a Storage Area Network (SAN) located?
An input validation and exception handling vulnerability has been discovered on a critical web-based system. Which of the following is MOST suited to quickly implement a control?
Which of the following is used by the Point-to-Point Protocol (PPP) to determine packet formats?
Which of the following is of GREATEST assistance to auditors when reviewing system configurations?
In which of the following programs is it MOST important to include the collection of security process data?
Which of the following could cause a Denial of Service (DoS) against an authentication system?
Which of the following is a PRIMARY benefit of using a formalized security testing report format and structure?
A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation. What MUST an administrator review to audit a user’s access to data files?
TESTED 19 May 2024
Hi this is Romona Kearns from Holland and I would like to tell you that I passed my exam with the use of exams4sure dumps. I got same questions in my exam that I prepared from your test engine software. I will recommend your site to all my friends for sure.
Our all material is important and it will be handy for you. If you have short time for exam so, we are sure with the use of it you will pass it easily with good marks. If you will not pass so, you could feel free to claim your refund. We will give 100% money back guarantee if our customers will not satisfy with our products.
