Free CISSP Dump

Question #200

What BEST describes the confidentiality, integrity, availability triad?

• A. A vulnerability assessment to see how well the organization’s data is protected
• B. The three-step approach to determine the risk level of an organization
• C. The implementation of security systems to protect the organization’s data
• D. A tool used to assist in understanding how to protect the organization’s data

Correct Answer: C

Community vote distribution

C (57%)

D (41%)

Question #201

Why is it important that senior management clearly communicates the formal Maximum Tolerable Downtime (MTD) decision?

• A. To provide each manager with precise direction on selecting an appropriate recovery alternative
• B. To demonstrate to the board of directors that senior management is committed to continuity recovery efforts
• C. To provide a formal declaration from senior management as required by internal audit to demonstrate sound business practices
• D. To demonstrate to the regulatory bodies that the company takes business continuity seriously

Correct Answer: D

Community vote distribution

A (100%)

Question #202

A Simple Power Analysis (SPA) attack against a device directly observes which of the following?

• A. Magnetism
• B. Generation
• C. Consumption
• D. Static discharge

Correct Answer: B

Community vote distribution

C (100%)

Question #203

Which of the following MUST the administrator of a security information and event management (SIEM) system ensure?

• A. All sources are synchronized with a common time reference.
• B. All sources are reporting in the exact same Extensible Markup Language (XML) format.
• C. Data sources do not contain information infringing upon privacy regulations.
• D. Each source uses the same Internet Protocol (IP) address for reporting.

Correct Answer: A

Community vote distribution

A (75%)

C (25%)

Question #204

An organization wants to share data securely with their partners via the Internet. Which standard port is typically used to meet this requirement?

• A. Setup a server on User Datagram Protocol (UDP) port 69
• B. Setup a server on Transmission Control Protocol (TCP) port 21
• C. Setup a server on Transmission Control Protocol (TCP) port 22
• D. Setup a server on Transmission Control Protocol (TCP) port 80

Correct Answer: C

Community vote distribution

C (100%)

Question #205

When designing a business continuity plan (BCP), what is the formula to determine the Maximum Tolerable Downtime (MTD)?

• A. Estimated Maximum Loss (EML) + Recovery Time Objective (RTO)
• B. Business impact analysis (BIA) + Recovery Point Objective (RPO)
• C. Annual Loss Expectancy (ALE) + Work Recovery Time (WRT)
• D. Recovery Time Objective (RTO) + Work Recovery Time (WRT)

Correct Answer: D

Community vote distribution

D (100%)

Question #206

In systems security engineering, what does the security principle of modularity provide?

• A. Minimal access to perform a function
• B. Documentation of functions
• C. Isolated functions and data
• D. Secure distribution of programs and data

Correct Answer: C

Community vote distribution

C (100%)

Question #207

Which of the following is the strongest physical access control?

• A. Biometrics, a password, and personal identification number (PIN)
• B. Individual password for each user
• C. Biometrics and badge reader
• D. Biometrics, a password, and badge reader

Correct Answer: D

Community vote distribution

D (71%)

C (29%)

Question #208

An access control list (ACL) on a router is a feature MOST similar to which type of firewall?

• A. Stateful firewall
• B. Packet filtering firewall
• C. Application gateway firewall
• D. Heuristic firewall

Correct Answer: B

Community vote distribution

B (89%)

Question #209

While dealing with the consequences of a security incident, which of the following security controls are MOST appropriate?

• A. Detective and recovery controls
• B. Corrective and recovery controls
• C. Preventative and corrective controls
• D. Recovery and proactive controls

Correct Answer: B

Community vote distribution

B (92%)

Question #210

A cloud hosting provider would like to provide a Service Organization Control (SOC) report relevant to its security program. This report should an abbreviated report that can be freely distributed. Which type of report BEST meets this requirement?

• A. SOC 1
• B. SOC 2 Type 1
• C. SOC 2 Type 2
• D. SOC 3

Correct Answer: B

Community vote distribution

D (100%)

Question #211

Which of the following is TRUE for an organization that is using a third-party federated identity service?

• A. The organization specifies alone how to authenticate other organization’s users
• B. The organization defines internal standard for overall user identification
• C. The organization establishes a trust relationship with the other organizations
• D. The organization enforces the rules to other organization’s user provisioning

Correct Answer: C

Community vote distribution

C (100%)

Question #212

Which of the following describes the BEST method of maintaining the inventory of software and hardware within the organization?

• A. Maintaining the inventory through a combination of asset owner interviews, open-source system management, and open-source management tools
• B. Maintaining the inventory through a combination of desktop configuration, administration management, and procurement management tools
• C. Maintaining the inventory through a combination of on premise storage configuration, cloud management, and partner management tools
• D. Maintaining the inventory through a combination of system configuration, network management, and license management tools

Correct Answer: C

Community vote distribution

D (100%)

Question #213

Which of the following outsourcing agreement provisions has the HIGHEST priority from a security operations perspective?

• A. Conditions to prevent the use of subcontractors
• B. Terms for contract renegotiation in case of disaster
• C. Root cause analysis for application performance issue
• D. Escalation process for problem resolution during incidents

Correct Answer: D

Community vote distribution

D (80%)

A (20%)

Question #214

Which of the following is the MOST comprehensive Business Continuity (BC) test?

• A. Full interruption
• B. Full simulation
• C. Full table top
• D. Full functional drill

Correct Answer: A

Community vote distribution

A (82%)

B (18%)

Question #215

A security practitioner needs to implement a solution to verify endpoint security protections and operating system (OS) versions. Which of the following is the

BEST solution to implement?

• A. An intrusion prevention system (IPS)
• B. Network Access Control (NAC)
• C. Active Directory (AD) authentication
• D. A firewall

Correct Answer: B

Community vote distribution

B (100%)

Question #216

During an internal audit of an organizational Information Security Management System (ISMS), nonconformities are identified. In which of the following management stages are nonconformities reviewed, assessed and/or corrected by the organization?

• A. Assessment
• B. Planning
• C. Improvement
• D. Operation

Correct Answer: D

Community vote distribution

C (73%)

D (27%)

Question #217

When developing an external facing web-based system, which of the following would be the MAIN focus of the security assessment prior to implementation and production?

• A. Ensuring Secure Sockets Layer (SSL) certificates are signed by a certificate authority
• B. Ensuring Secure Sockets Layer (SSL) certificates are internally signed
• C. Assessing the Uniform Resource Locator (URL)
• D. Ensuring that input validation is enforced

Correct Answer: A

Community vote distribution

D (70%)

A (30%)

Question #218

A financial services organization has employed a security consultant to review processes used by employees across various teams. The consultant interviewed a member of the application development practice and found gaps in their threat model. Which of the following correctly represents a trigger for when a threat model should be revised?

• A. After operating system (OS) patches are applied
• B. A new developer is hired into the team.
• C. After a modification to the firewall rule policy
• D. A new data repository is added.

Correct Answer: D

Community vote distribution

D (100%)

Question #219

The Chief Information Security Officer (CISO) of an organization has requested that a Service Organization Control (SOC) report be created to outline the security and availability of a particular system over a 12-month period. Which type of SOC report should be utilized?

• A. SOC 1 Type 1
• B. SOC 1 Type 2
• C. SOC 2 Type 2
• D. SOC 3 Type 1

Correct Answer: C

Community vote distribution

C (100%)

Question #220

An organization recently upgraded to a Voice over Internet Protocol (VoIP) phone system. Management is concerned with unauthorized phone usage. The security consultant is responsible for putting together a plan to secure these phones. Administrators have assigned unique personal identification number (PIN) codes for each person in the organization. What is the BEST solution?

• A. Have the administrator enforce a policy to change the PIN regularly. Implement call detail records (CDR) reports to track usage.
• B. Have the administrator change the PIN regularly. Implement call detail records (CDR) reports to track usage.
• C. Use phone locking software to enforce usage and PIN policies. Inform the user to change the PIN regularly.
• D. Implement call detail records (CDR) reports to track usage.

Correct Answer: A

Community vote distribution

A (86%)

14%

Question #221

Which of the following protection is provided when using a Virtual Private Network (VPN) with Authentication Header (AH)?

• A. Sender non-repudiation
• B. Multi-factor authentication (MFA)
• C. Payload encryption
• D. Sender confidentiality

Correct Answer: A

Community vote distribution

A (100%)

Question #222

An organization contracts with a consultant to perform a System Organization Control (SOC) 2 audit on their internal security controls. An auditor documents a finding a related to an Application Programming Interface (API) performing an action that is not aligned with the scope or objective of the system. Which trust service principle would be MOST applicable in th is situation?

• A. Confidentiality
• B. Processing Integrity
• C. Security
• D. Availability

Correct Answer: B

Community vote distribution

B (70%)

A (20%)

10%

Question #223

In which process MUST security be considered during the acquisition of new software?

• A. Request for proposal (RFP)
• B. Implementation
• C. Vendor selection
• D. Contract negotiation

Correct Answer: A

Community vote distribution

A (56%)

C (44%)

Question #224

Which of the following is the MAIN difference between a network-based firewall and a host-based firewall?

• A. A network-based firewall is stateful, while a host-based firewall is stateless.
• B. A network-based firewall blocks network intrusions, while a host-based firewall blocks malware.
• C. A network-based firewall controls traffic passing through the device, while a host-based firewall controls traffic destined for the device.
• D. A network-based firewall verifies network traffic, while a host-based firewall verifies processes and applications.

Correct Answer: C

Community vote distribution

C (77%)

D (23%)

Question #225

Which of the following measures serves as the BEST means for protecting data on computers, smartphones, and external storage devices when traveling to high- risk countries?

• A. Review applicable destination country laws, forensically clean devices prior to travel, and only download sensitive data over a virtual private network (VPN) upon arriving at the destination.
• B. Leverage a Secure Socket Layer (SSL) connection over a virtual private network (VPN) to download sensitive data upon arriving at the destination.
• C. Keep laptops, external storage devices, and smartphones in the hotel room when not in use.
• D. Use multi-factor authentication (MFA) to gain access to data stored on laptops or external storage devices and biometric fingerprint access control mechanisms to unlock smartphones.

Correct Answer: D

Community vote distribution

D (59%)

A (41%)

Question #226

When network management is outsourced to third parties, which of the following is the MOST effective method of protecting critical data assets?

• A. Confirm that confidentiality agreements are signed
• B. Employ strong access controls
• C. Log all activities associated with sensitive systems
• D. Provide links to security policies

Correct Answer: B

Community vote distribution

B (70%)

A (30%)

Question #227

Which of the following regulations dictates how data breaches are handled?

• A. Payment Card Industry Data Security Standard (PCI-DSS)
• B. National Institute of Standards and Technology (NIST)
• C. Sarbanes-Oxley (SOX)
• D. General Data Protection Regulation (GDPR)

Correct Answer: D

Community vote distribution

D (100%)

Question #228

In software development, developers should use which type of queries to prevent a Structured Query Language (SQL) injection?

• A. Parameterised
• B. Controlled
• C. Dynamic
• D. Static

Correct Answer: A

Community vote distribution

A (100%)

Question #229

Which type of access control includes a system that allows only users that are type=managers and department=sales to access employee records?

• A. Role-based access control (RBAC)
• B. Attribute-based access control (ABAC)
• C. Discretionary access control (DAC)
• D. Mandatory access control (MAC)

Correct Answer: A

Community vote distribution

B (77%)

A (23%)

Question #230

Which of the following examples is BEST to minimize the attack surface for a customer’s private information?

• A. Data masking
• B. Authentication
• C. Obfuscation
• D. Collection limitation

Correct Answer: D

Community vote distribution

D (78%)

B (22%)

Question #231

Which evidence collecting technique would be utilized when it is believed an attacker is employing a rootkit and a quick analysis is needed?

• A. Forensic disk imaging
• B. Live response
• C. Memory collection
• D. Malware analysis

Correct Answer: C

Community vote distribution

C (67%)

B (33%)

Question #232

An application is used for funds transfers between an organization and a third-party. During a security audit, an auditor has found an issue with the business continuity disaster recovery policy and procedures for this application. Which of the following reports should the auditor file with the organization?

• A. Statement on Auditing Standards (SAS) 70-1
• B. Statement on Auditing Standards (SAS) 70
• C. Service Organization Control (SOC) 1
• D. Service Organization Control (SOC) 2

Correct Answer: C

Community vote distribution

D (92%)

8%

Question #233

When determining data and information asset handling, regardless of the specific toolset being used, which of the following is one of the common components of big data?

• A. Distributed storage locations
• B. Centralized processing location
• C. Distributed data collection
• D. Consolidated data collection

Correct Answer: C

Community vote distribution

A (73%)

C (27%)

Question #234

A Chief Information Security Officer (CISO) of a firm which decided to migrate to cloud has been tasked with ensuring an optimal level of security. Which of the following would be the FIRST consideration?

• A. Analyze the firm’s applications and data repositories to determine the relevant control requirements.
• B. Request a security risk assessment of the cloud vendor be completed by an independent third-party.
• C. Define the cloud migration roadmap and set out which applications and data repositories should be moved into the cloud.
• D. Ensure that the contract between the cloud vendor and the firm clearly defines responsibilities for operating security controls.

Correct Answer: C

Community vote distribution

A (55%)

D (20%)

C (20%)

5%

Question #235

Which of the following BEST describes the purpose of Border Gateway Protocol (BGP)?

• A. Provide Routing Information Protocol (RIP) version 2 advertisements to neighboring layer 3 devices.
• B. Maintain a list of network paths between internet routers.
• C. Provide firewall services to cloud-enabled applications.
• D. Maintain a list of efficient network paths between autonomous systems.

Correct Answer: D

Community vote distribution

D (100%)

Question #236

What is the BEST design for securing physical perimeter protection?

• A. Closed-circuit television (CCTV)
• B. Business continuity planning (BCP)
• C. Barriers, fences, gates, and walls
• D. Crime Prevention through Environmental Design (CPTED)

Correct Answer: D

Community vote distribution

C (82%)

D (18%)

Question #237

The security organization is looking for a solution that could help them determine with a strong level of confidence that attackers have breached their network.

Which solution is MOST effective at discovering a successful network breach?

• A. Developing a sandbox
• B. Installing an intrusion detection system (IDS)
• C. Deploying a honeypot
• D. Installing an intrusion prevention system (IPS)

Correct Answer: C

Community vote distribution

C (61%)

B (39%)

Question #238

Which of the following is a benefit of implementing data-in-use controls?

• A. If the data is lost, it must be decrypted to be opened.
• B. When the data is being viewed, it can only be printed by authorized users.
• C. When the data is being viewed, it can be accessed using secure protocols.
• D. If the data is lost, it may not be accessible to unauthorized users.

Correct Answer: B

Community vote distribution

B (65%)

C (27%)

8%

Question #239

When configuring Extensible Authentication Protocol (EAP) in a Voice over Internet Protocol (VoIP) network, which of the following authentication types is the

MOST secure?

• A. EAP-Protected Extensible Authentication Protocol (PEAP)
• B. EAP-Transport Layer Security (TLS)
• C. EAP-Tunneled Transport Layer Security (TLS)
• D. EAP-Flexible Authentication via Secure Tunneling

Correct Answer: B

Community vote distribution

B (100%)

Question #240

Which of the following would be the BEST guideline to follow when attempting to avoid the exposure of sensitive data?

• A. Monitor mail servers for sensitive data being exfiltrated.
• B. Educate end-users on methods of attacks on sensitive data.
• C. Establish report parameters for sensitive data.
• D. Store sensitive data only when necessary.

Correct Answer: D

Community vote distribution

D (69%)

B (31%)

Question #241

An organization with divisions in the United States (US) and the United Kingdom (UK) processes data comprised of personal information belonging to subjects living in the European Union (EU) and in the US. Which data MUST be handled according to the privacy protections of General Data Protection Regulation

(GDPR)?

• A. Only the UK citizens’ data
• B. Only the EU residents’ data
• C. Only data processed in the UK
• D. Only the EU citizens’ data

Correct Answer: D

Community vote distribution

B (65%)

D (35%)

Question #242

What are the first two components of logical access control?

• A. Authentication and availability
• B. Authentication and identification
• C. Identification and confidentiality
• D. Confidentiality and authentication

Correct Answer: D

Community vote distribution

B (100%)

Question #243

Which of the following is the MOST effective measure for dealing with rootkit attacks?

• A. Restoring the system from the last backup
• B. Finding and replacing the altered binaries with legitimate ones
• C. Turning off unauthorized services and rebooting the system
• D. Reinstalling the system from trusted sources

Correct Answer: D

Community vote distribution

D (100%)

Question #244

Which of the following is the FIRST requirement a data owner should consider before implementing a data retention policy?

• A. Storage
• B. Training
• C. Legal
• D. Business

Correct Answer: C

Community vote distribution

C (100%)

Question #245

A new employee formally reported suspicious behavior to the organization security team. The report claims that someone not affiliated with the organization was inquiring about the member’s work location, length of employment, and building access controls. The employee’s reporting is MOST likely the result of which of the following?

• A. Security engineering
• B. Security awareness
• C. Phishing
• D. Risk avoidance

Correct Answer: C

Community vote distribution

B (100%)

Question #246

The disaster recovery (DR) process should always include:

• A. periodic inventory review
• B. financial data analysis
• C. plan maintenance
• D. periodic vendor review

Correct Answer: A

Community vote distribution

C (100%)

Question #247

An organization has determined that its previous waterfall approach to software development is not keeping pace with business demands. To adapt to the rapid changes required for product delivery, the organization has decided to move towards an Agile software development and release cycle. In order to ensure the success of the Agile methodology, who is the MOST critical in creating acceptance criteria for each release?

• A. Business customers
• B. Software developers
• C. Independent testers
• D. Project managers

Correct Answer: C

Community vote distribution

A (57%)

D (21%)

14%

7%

Question #248

What is the FIRST step for an organization to take before allowing personnel to access social media from a corporate device or user account?

• A. Publish an acceptable usage policy.
• B. Publish a social media guidelines document.
• C. Deliver security awareness training.
• D. Document a procedure for accessing social media sites.

Correct Answer: A

Community vote distribution

A (80%)

C (20%)

Question #249

A hospital has allowed virtual private networking (VPN) access to remote database developers. Upon auditing the internal configuration, the network administrator discovered that split-tunneling was enabled. What is the concern with this configuration?

• A. The network intrusion detection system (NIDS) will fail to inspect Secure Sockets Layer (SSL) traffic.
• B. Remote sessions will not require multi-layer authentication.
• C. Remote clients are permitted to exchange traffic with the public and private network.
• D. Multiple Internet Protocol Security (IPSec) tunnels may be exploitable in specific circumstances.

Correct Answer: C

Community vote distribution

C (56%)

A (33%)