ISC Certified Information Systems Security Professional (CISSP) - CISSP Exam Practice Test

Question 1

Which of the following should exist in order to perform a security audit?

A. External (third-party) auditor B. Internal certified auditor C. Industry framework to audit against D. Neutrality of the auditor

Correct Answer: C

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 2

When developing a business case for updating a security program, the security program owner MUST do which of the following?

A. Identify relevant metrics B. Interview executive management C. Prepare performance test reports D. Obtain resources for the security program

Correct Answer: A

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 3

Which of the following determines how traffic should flow based on the status of the infrastructure layer?

A. Traffic plane B. Control plane C. Application plane D. Data plane

Correct Answer: B

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 4

The overall goal of a penetration test is to determine a system's

A. ability to withstand an attack. B. error recovery capabilities. C. reliability under stress. D. capacity management.

Correct Answer: A

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 5

In the "Do" phase of the Plan-Do-Check-Act model, which of the following is performed?

A. Maintain and improve the Business Continuity Management (BCM) system by taking corrective action, based on the results of management review. B. Monitor and review performance against business continuity policy and objectives, report the results to management for review, and determine and authorize actions for remediation and improvement. C. Ensure the business continuity policy, controls, processes, and procedures have been implemented. D. Ensure that business continuity policy, objectives, targets, controls, processes and procedures relevant to improving business continuity have been established.

Correct Answer: C

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 6

What should an auditor do when conducting a periodic audit on media retention?

A. Check electronic storage media to ensure records are not retained past their destruction date. B. Ensure that data shared with outside organizations is no longer on a retention schedule. C. Check that hard disks containing backup data that are still within a retention cycle are being destroyed correctly D. Ensure authorized personnel are in possession of paper copies containing Personally Identifiable Information (PII)

Correct Answer: A

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 7

Transport Layer Security (TLS) provides which of the following capabilities for a remote access server?

A. Peer identity authentication B. Digital certificate revocation C. Application layer negotiation D. Transport layer handshake compression

Correct Answer: A

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 8

What is one way to mitigate the risk of security flaws in custom software?

A. Include security assurance clauses in the Service Level Agreement (SLA) B. Include security language in the Earned Value Management (EVM) contract C. Purchase only Commercial Off-The-Shelf (COTS) products D. Purchase only software with no open source Application Programming Interfaces (APIs)

Correct Answer: A

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 9

Which of the following BEST describes "input validation" as a secure coding practice?

A. Logging all user input for auditing purposes B. Compressing input data to improve performance C. Encrypting all input data before processing D. Verifying that data received by an application conforms to expected format, type, length, and range before processing it

Correct Answer: D

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 10

From a cryptographic perspective, the service of non-repudiation includes which of the following features?

A. Validity of digital certificates B. Validity of the authorization rules C. Proof of authenticity of the message D. Proof of integrity of the message

Correct Answer: D

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 11

A vehicle of a private courier company that transports backup data for offsite storage was robbed while in transport backup data for offsite was robbed while in transit. The incident management team is now responsible to estimate the robbery, which of the following would help the incident management team to MOST effectively analyze the business impact of the robbery?

A. Log of backup administrative actions B. Log of the transported media and its classification marking C. Log of the transported media and Its detailed contents D. Log of backed up data and their respective data custodians

Correct Answer: B

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 12

Why do certificate Authorities (CA) add value to the security of electronic commerce transactions?

A. They maintain the certificate revocation list. B. They maintain the private keys of transition parties. C. They provide a secure communication enamel to the transaction parties. D. They verify the transaction parties' private keys.

Correct Answer: A

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 13

What type of risk is related to the sequences of value-adding and managerial activities undertaken in an organization?

A. Process risk B. Control risk C. Demand risk D. Supply risk

Correct Answer: A

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 14

An establish information technology (IT) consulting firm is considering acquiring a successful local startup. To gain a comprehensive understanding of the startup's security posture' which type of assessment provides the BEST information?

A. A security audit B. A tabletop exercise C. A security threat model D. A penetration test

Correct Answer: D

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 15

Where can the Open Web Application Security Project (OWASP) list of associated vulnerabilities be found?

A. OWASP Top 10 Project B. OWASP Guide Project C. OWASP Mobile Project D. OWASP Software Assurance Maturity Model (SAMM) Project

Correct Answer: A

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).