ISC2 CISSP Free Practice QuestionsQ1. What is the term commonly used to refer to a technique of authenticating one machine to another by forging packets from a trusted source? A. Man-in-the-Middle (MITM) attack B. Smurfing C. Session redirect D. Spoofing Q2. Two companies wish to share electronic inventory and purchase orders in a supplier and client relationship. What is the BEST security solution for them? A. Write a Service Level Agreement (SLA) for the two companies. B. Set up a Virtual Private Network (VPN) between the two companies. C. Configure a firewall at the perimeter of each of the two companies. D. Establish a File Transfer Protocol (FTP) connection between the two companies. Q3. A security manager has noticed an inconsistent application of server security controls resulting in vulnerabilities on critical systems. What is the MOST likely cause of this issue? A. A lack of baseline standards B. Improper documentation of security guidelines C. A poorly designed security policy communication program D. Host-based Intrusion Prevention System (HIPS).policies are ineffective Q4. Which of the following is the BEST solution to provide redundancy for telecommunications links? A. Provide multiple links from the same telecommunications vendor. B. Ensure that the telecommunications links connect to the network in one location. C. Ensure.that the telecommunications links connect to the network in multiple locations. D. Provide multiple links from multiple telecommunications vendors. Q5. DRAG DROP A software security engineer is developing a black box-based test plan that will measure the system's reaction to incorrect or illegal inputs or unexpected operational errors and situations. Match the functional testing techniques on the left with the correct input parameters on.the right. Q6. What is the GREATEST challenge to identifying data leaks? A. Available technical tools that enable user activity monitoring. B. Documented asset classification policy and clear labeling of assets. C. Senior management cooperation in investigating suspicious behavior. D. Law enforcement participation to apprehend and interrogate suspects. Q7. What technique BEST describes antivirus software that detects viruses by watching anomalous behavior? A. Signature B. Inference C. Induction D. Heuristic Q8. Disaster Recovery Plan (DRP) training material should be A. consistent so that all audiences receive the same training. B. stored in a fire proof safe to ensure availability when needed. C. only delivered in paper format. D. presented in a professional looking manner. Q9. Which of the following are Systems Engineering Life Cycle (SELC) Technical Processes? A. Concept, Development, Production, Utilization, Support, Retirement B. Stakeholder Requirements Definition, Architectural Design, Implementation, Verification, Operation C. Acquisition, Measurement, Configuration Management, Production, Operation, Support D. Concept, Requirements, Design, Implementation, Production, Maintenance, Support, Disposal Q10. Which of the following is the MAIN goal of a data retention policy? A. Ensure.that data is destroyed properly. B. Ensure that data recovery can be done on the data. C. Ensure the integrity and availability of data for a predetermined amount of time. D. Ensure.the integrity and confidentiality of data for a predetermined amount of time. Q11. For privacy protected data, which of the following roles has the highest authority for establishing dissemination rules for the data? A. Information Systems Security Officer B. Data Owner C. System Security Architect D. Security Requirements Analyst Q12. Which of the following assessment metrics is BEST used to understand a system's vulnerability to potential exploits? A. Determining the probability that the system functions safely during any time period B. Quantifying the system's available services C. Identifying the number of security flaws within the system D. Measuring the system's integrity in the presence of failure Q13. Which of the following is TRUE about Disaster Recovery Plan (DRP) testing? A. Operational networks are usually shut down during testing. B. Testing should continue even if components of the test fail. C. The company is fully prepared for a disaster if all tests pass. D. Testing should not be done until the entire disaster plan can be tested. Q14. The PRIMARY security concern for handheld devices is the A. strength of the encryption algorithm. B. spread of malware during synchronization. C. ability to bypass the authentication mechanism. D. strength of the Personal Identification Number (PIN). Q15. What is the GREATEST.challenge of.an agent-based patch management solution? A. Time to gather vulnerability information about the computers in the program B. Requires that software be installed, running, and managed on all participating computers C. The significant amount of network bandwidth while scanning computers D. The consistency of distributing patches to each participating computer |
