ISC2 CISSP Past Paper PDF

Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) ISC2 Exam Questions CISSP...

Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) ISC2 Exam Questions CISSP Certified Information Systems Security Professional (CISSP) Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) NEW QUESTION 1 - (Exam Topic 1) Which of the following types of technologies would be the MOST cost-effective method to provide a reactive control for protecting personnel in public areas? A. Install mantraps at the building entrances B. Enclose the personnel entry area with polycarbonate plastic C. Supply a duress alarm for personnel exposed to the public D. Hire a guard to protect the public area Answer: D NEW QUESTION 2 - (Exam Topic 2) Which of the following is an effective control in preventing electronic cloning of Radio Frequency Identification (RFID) based access cards? A. Personal Identity Verification (PIV) B. Cardholder Unique Identifier (CHUID) authentication C. Physical Access Control System (PACS) repeated attempt detection D. Asymmetric Card Authentication Key (CAK) challenge-response Answer: C NEW QUESTION 3 - (Exam Topic 2) Which of the following is MOST important when assigning ownership of an asset to a department? A. The department should report to the business owner B. Ownership of the asset should be periodically reviewed C. Individual accountability should be ensured D. All members should be trained on their responsibilities Answer: B NEW QUESTION 4 - (Exam Topic 3) Which of the following mobile code security models relies only on trust? A. Code signing B. Class authentication C. Sandboxing D. Type safety Answer: A NEW QUESTION 5 - (Exam Topic 4) Which of the following operates at the Network Layer of the Open System Interconnection (OSI) model? A. Packet filtering B. Port services filtering C. Content filtering D. Application access control Answer: A NEW QUESTION 6 - (Exam Topic 4) An input validation and exception handling vulnerability has been discovered on a critical web-based system. Which of the following is MOST suited to quickly implement a control? A. Add a new rule to the application layer firewall B. Block access to the service C. Install an Intrusion Detection System (IDS) D. Patch the application source code Answer: A NEW QUESTION 7 - (Exam Topic 4) Which of the following factors contributes to the weakness of Wired Equivalent Privacy (WEP) protocol? A. WEP uses a small range Initialization Vector (IV) B. WEP uses Message Digest 5 (MD5) C. WEP uses Diffie-Hellman D. WEP does not use any Initialization Vector (IV) Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) Answer: A NEW QUESTION 8 - (Exam Topic 6) Which of the following is of GREATEST assistance to auditors when reviewing system configurations? A. Change management processes B. User administration procedures C. Operating System (OS) baselines D. System backup documentation Answer: A NEW QUESTION 9 - (Exam Topic 7) Recovery strategies of a Disaster Recovery planning (DRIP) MUST be aligned with which of the following? A. Hardware and software compatibility issues B. Applications’ critically and downtime tolerance C. Budget constraints and requirements D. Cost/benefit analysis and business objectives Answer: D NEW QUESTION 10 - (Exam Topic 7) A continuous information security monitoring program can BEST reduce risk through which of the following? A. Collecting security events and correlating them to identify anomalies B. Facilitating system-wide visibility into the activities of critical user accounts C. Encompassing people, process, and technology D. Logging both scheduled and unscheduled system changes Answer: B NEW QUESTION 10 - (Exam Topic 7) What should be the FIRST action to protect the chain of evidence when a desktop computer is involved? A. Take the computer to a forensic lab B. Make a copy of the hard drive C. Start documenting D. Turn off the computer Answer: C NEW QUESTION 13 - (Exam Topic 8) Which of the following is a web application control that should be put into place to prevent exploitation of Operating System (OS) bugs? A. Check arguments in function calls B. Test for the security patch level of the environment C. Include logging functions D. Digitally sign each application module Answer: B NEW QUESTION 14 - (Exam Topic 8) When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined? A. After the system preliminary design has been developed and the data security categorization has been performed B. After the vulnerability analysis has been performed and before the system detailed design begins C. After the system preliminary design has been developed and before the data security categorization begins D. After the business functional analysis and the data security categorization have been performed Answer: C NEW QUESTION 17 - (Exam Topic 8) What is the BEST approach to addressing security issues in legacy web applications? A. Debug the security issues B. Migrate to newer, supported applications where possible C. Conduct a security assessment Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) D. Protect the legacy application with a web application firewall Answer: D NEW QUESTION 21 - (Exam Topic 9) Which of the following is a method used to prevent Structured Query Language (SQL) injection attacks? A. Data compression B. Data classification C. Data warehousing D. Data validation Answer: D NEW QUESTION 24 - (Exam Topic 9) Internet Protocol (IP) source address spoofing is used to defeat A. address-based authentication. B. Address Resolution Protocol (ARP). C. Reverse Address Resolution Protocol (RARP). D. Transmission Control Protocol (TCP) hijacking. Answer: A NEW QUESTION 27 - (Exam Topic 9) What technique BEST describes antivirus software that detects viruses by watching anomalous behavior? A. Signature B. Inference C. Induction D. Heuristic Answer: D NEW QUESTION 29 - (Exam Topic 9) Checking routing information on e-mail to determine it is in a valid format and contains valid information is an example of which of the following anti-spam approaches? A. Simple Mail Transfer Protocol (SMTP) blacklist B. Reverse Domain Name System (DNS) lookup C. Hashing algorithm D. Header analysis Answer: D NEW QUESTION 30 - (Exam Topic 9) The Structured Query Language (SQL) implements Discretionary Access Controls (DAC) using A. INSERT and DELETE. B. GRANT and REVOKE. C. PUBLIC and PRIVATE. D. ROLLBACK and TERMINATE. Answer: B NEW QUESTION 31 - (Exam Topic 9) A security professional has just completed their organization's Business Impact Analysis (BIA). Following Business Continuity Plan/Disaster Recovery Plan (BCP/DRP) best practices, what would be the professional's NEXT step? A. Identify and select recovery strategies. B. Present the findings to management for funding. C. Select members for the organization's recovery teams. D. Prepare a plan to test the organization's ability to recover its operations. Answer: A NEW QUESTION 35 - (Exam Topic 9) As one component of a physical security system, an Electronic Access Control (EAC) token is BEST known for its ability to Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) A. overcome the problems of key assignments. B. monitor the opening of windows and doors. C. trigger alarms when intruders are detected. D. lock down a facility during an emergency. Answer: A NEW QUESTION 40 - (Exam Topic 9) What security management control is MOST often broken by collusion? A. Job rotation B. Separation of duties C. Least privilege model D. Increased monitoring Answer: B NEW QUESTION 44 - (Exam Topic 9) The BEST method of demonstrating a company's security level to potential customers is A. a report from an external auditor. B. responding to a customer's security questionnaire. C. a formal report from an internal auditor. D. a site visit by a customer's security team. Answer: A NEW QUESTION 48 - (Exam Topic 9) Which one of the following security mechanisms provides the BEST way to restrict the execution of privileged procedures? A. Role Based Access Control (RBAC) B. Biometric access control C. Federated Identity Management (IdM) D. Application hardening Answer: A NEW QUESTION 50 - (Exam Topic 9) Which of the following statements is TRUE for point-to-point microwave transmissions? A. They are not subject to interception due to encryption. B. Interception only depends on signal strength. C. They are too highly multiplexed for meaningful interception. D. They are subject to interception by an antenna within proximity. Answer: D NEW QUESTION 53 - (Exam Topic 9) The use of strong authentication, the encryption of Personally Identifiable Information (PII) on database servers, application security reviews, and the encryption of data transmitted across networks provide A. data integrity. B. defense in depth. C. data availability. D. non-repudiation. Answer: B NEW QUESTION 55 - (Exam Topic 9) Which of the following is the BEST way to verify the integrity of a software patch? A. Cryptographic checksums B. Version numbering C. Automatic updates D. Vendor assurance Answer: A NEW QUESTION 58 Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) - (Exam Topic 9) Which of the following is TRUE about Disaster Recovery Plan (DRP) testing? A. Operational networks are usually shut down during testing. B. Testing should continue even if components of the test fail. C. The company is fully prepared for a disaster if all tests pass. D. Testing should not be done until the entire disaster plan can be tested. Answer: B NEW QUESTION 63 - (Exam Topic 9) Which one of the following describes granularity? A. Maximum number of entries available in an Access Control List (ACL) B. Fineness to which a trusted system can authenticate users C. Number of violations divided by the number of total accesses D. Fineness to which an access control system can be adjusted Answer: D NEW QUESTION 66 - (Exam Topic 9) Which of the following can BEST prevent security flaws occurring in outsourced software development? A. Contractual requirements for code quality B. Licensing, code ownership and intellectual property rights C. Certification of the quality and accuracy of the work done D. Delivery dates, change management control and budgetary control Answer: C NEW QUESTION 67 - (Exam Topic 9) Which one of the following is a fundamental objective in handling an incident? A. To restore control of the affected systems B. To confiscate the suspect's computers C. To prosecute the attacker D. To perform full backups of the system Answer: A NEW QUESTION 70 - (Exam Topic 9) When transmitting information over public networks, the decision to encrypt it should be based on A. the estimated monetary value of the information. B. whether there are transient nodes relaying the transmission. C. the level of confidentiality of the information. D. the volume of the information. Answer: C NEW QUESTION 73 - (Exam Topic 9) Which of the following is an appropriate source for test data? A. Production data that is secured and maintained only in the production environment. B. Test data that has no similarities to production datA. C. Test data that is mirrored and kept up-to-date with production datA. D. Production data that has been sanitized before loading into a test environment. Answer: D NEW QUESTION 77 - (Exam Topic 9) What maintenance activity is responsible for defining, implementing, and testing updates to application systems? A. Program change control B. Regression testing C. Export exception control D. User acceptance testing Answer: A Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) NEW QUESTION 82 - (Exam Topic 9) Which of the following is an effective method for avoiding magnetic media data remanence? A. Degaussing B. Encryption C. Data Loss Prevention (DLP) D. Authentication Answer: A NEW QUESTION 87 - (Exam Topic 9) Which of the following MUST be done when promoting a security awareness program to senior management? A. Show the need for security; identify the message and the audience B. Ensure that the security presentation is designed to be all-inclusive C. Notify them that their compliance is mandatory D. Explain how hackers have enhanced information security Answer: A NEW QUESTION 89 - (Exam Topic 9) Which of the following is the BEST mitigation from phishing attacks? A. Network activity monitoring B. Security awareness training C. Corporate policy and procedures D. Strong file and directory permissions Answer: B NEW QUESTION 92 - (Exam Topic 9) Which one of the following affects the classification of data? A. Passage of time B. Assigned security label C. Multilevel Security (MLS) architecture D. Minimum query size Answer: A NEW QUESTION 96 - (Exam Topic 9) By allowing storage communications to run on top of Transmission Control Protocol/Internet Protocol (TCP/IP) with a Storage Area Network (SAN), the A. confidentiality of the traffic is protected. B. opportunity to sniff network traffic exists. C. opportunity for device identity spoofing is eliminated. D. storage devices are protected against availability attacks. Answer: B NEW QUESTION 98 - (Exam Topic 9) Why must all users be positively identified prior to using multi-user computers? A. To provide access to system privileges B. To provide access to the operating system C. To ensure that unauthorized persons cannot access the computers D. To ensure that management knows what users are currently logged on Answer: C NEW QUESTION 100 - (Exam Topic 9) Which of the following wraps the decryption key of a full disk encryption implementation and ties the hard disk drive to a particular device? A. Trusted Platform Module (TPM) B. Preboot eXecution Environment (PXE) C. Key Distribution Center (KDC) D. Simple Key-Management for Internet Protocol (SKIP) Answer: A Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) NEW QUESTION 105 - (Exam Topic 9) Two companies wish to share electronic inventory and purchase orders in a supplier and client relationship. What is the BEST security solution for them? A. Write a Service Level Agreement (SLA) for the two companies. B. Set up a Virtual Private Network (VPN) between the two companies. C. Configure a firewall at the perimeter of each of the two companies. D. Establish a File Transfer Protocol (FTP) connection between the two companies. Answer: B NEW QUESTION 110 - (Exam Topic 9) What should be the INITIAL response to Intrusion Detection System/Intrusion Prevention System (IDS/IPS) alerts? A. Ensure that the Incident Response Plan is available and current. B. Determine the traffic's initial source and block the appropriate port. C. Disable or disconnect suspected target and source systems. D. Verify the threat and determine the scope of the attack. Answer: D NEW QUESTION 115 - (Exam Topic 10) Refer to the information below to answer the question. A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access. Which of the following solutions would have MOST likely detected the use of peer-to-peer programs when the computer was connected to the office network? A. Anti-virus software B. Intrusion Prevention System (IPS) C. Anti-spyware software D. Integrity checking software Answer: B NEW QUESTION 120 - (Exam Topic 10) Refer to the information below to answer the question. A large, multinational organization has decided to outsource a portion of their Information Technology (IT) organization to a third-party provider’s facility. This provider will be responsible for the design, development, testing, and support of several critical, customer-based applications used by the organization. The organization should ensure that the third party's physical security controls are in place so that they A. are more rigorous than the original controls. B. are able to limit access to sensitive information. C. allow access by the organization staff at any time. D. cannot be accessed by subcontractors of the third party. Answer: B NEW QUESTION 122 - (Exam Topic 10) Which of the following is the BEST reason to review audit logs periodically? A. Verify they are operating properly B. Monitor employee productivity C. Identify anomalies in use patterns D. Meet compliance regulations Answer: C NEW QUESTION 123 - (Exam Topic 10) Refer to the information below to answer the question. During the investigation of a security incident, it is determined that an unauthorized individual accessed a system which hosts a database containing financial information. If it is discovered that large quantities of information have been copied by the unauthorized individual, what attribute of the data has been compromised? A. Availability B. Integrity C. Accountability D. Confidentiality Answer: D Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) NEW QUESTION 124 - (Exam Topic 10) Which item below is a federated identity standard? A. 802.11i B. Kerberos C. Lightweight Directory Access Protocol (LDAP) D. Security Assertion Markup Language (SAML) Answer: D NEW QUESTION 125 - (Exam Topic 10) Multi-Factor Authentication (MFA) is necessary in many systems given common types of password attacks. Which of the following is a correct list of password attacks? A. Masquerading, salami, malware, polymorphism B. Brute force, dictionary, phishing, keylogger C. Zeus, netbus, rabbit, turtle D. Token, biometrics, IDS, DLP Answer: B NEW QUESTION 127 - (Exam Topic 10) Which of the following are required components for implementing software configuration management systems? A. Audit control and signoff B. User training and acceptance C. Rollback and recovery processes D. Regression testing and evaluation Answer: C NEW QUESTION 129 - (Exam Topic 10) Which of the following BEST mitigates a replay attack against a system using identity federation and Security Assertion Markup Language (SAML) implementation? A. Two-factor authentication B. Digital certificates and hardware tokens C. Timed sessions and Secure Socket Layer (SSL) D. Passwords with alpha-numeric and special characters Answer: C NEW QUESTION 132 - (Exam Topic 10) Given the various means to protect physical and logical assets, match the access management area to the technology. Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) A. Mastered B. Not Mastered Answer: A Explanation: NEW QUESTION 137 - (Exam Topic 10) Refer to the information below to answer the question. A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes. What MUST the access control logs contain in addition to the identifier? A. Time of the access B. Security classification C. Denied access attempts D. Associated clearance Answer: A NEW QUESTION 138 - (Exam Topic 10) What is the BEST first step for determining if the appropriate security controls are in place for protecting data at rest? A. Identify regulatory requirements B. Conduct a risk assessment C. Determine business drivers D. Review the security baseline configuration Answer: B NEW QUESTION 139 - (Exam Topic 10) Which of the following is a critical factor for implementing a successful data classification program? A. Executive sponsorship B. Information security sponsorship C. End-user acceptance D. Internal audit acceptance Answer: A NEW QUESTION 140 - (Exam Topic 10) Which of the following actions MUST be taken if a vulnerability is discovered during the maintenance stage in a System Development Life Cycle (SDLC)? A. Make changes following principle and design guidelines. B. Stop the application until the vulnerability is fixed. C. Report the vulnerability to product owner. D. Monitor the application and review code. Answer: C NEW QUESTION 145 - (Exam Topic 10) Which of the following is a detective access control mechanism? A. Log review B. Least privilege C. Password complexity D. Non-disclosure agreement Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) Answer: A NEW QUESTION 146 - (Exam Topic 10) Which of the following problems is not addressed by using OAuth (Open Standard to Authorization) 2.0 to integrate a third-party identity provider for a service? A. Resource Servers are required to use passwords to authenticate end users. B. Revocation of access of some users of the third party instead of all the users from the third party. C. Compromise of the third party means compromise of all the users in the service. D. Guest users need to authenticate with the third party identity provider. Answer: C NEW QUESTION 149 - (Exam Topic 10) Refer to the information below to answer the question. A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes. Following best practice, where should the permitted access for each department and job classification combination be specified? A. Security procedures B. Security standards C. Human resource policy D. Human resource standards Answer: B NEW QUESTION 153 - (Exam Topic 10) Refer to the information below to answer the question. A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classification. The organization is subject to periodic independent reviews of access controls and violations. The organization uses wired and wireless networks and remote access. The organization also uses secure connections to branch offices and secure backup and recovery strategies for selected information and processes. Which of the following BEST describes the access control methodology used? A. Least privilege B. Lattice Based Access Control (LBAC) C. Role Based Access Control (RBAC) D. Lightweight Directory Access Control (LDAP) Answer: C NEW QUESTION 156 - (Exam Topic 10) The use of proximity card to gain access to a building is an example of what type of security control? A. Legal B. Logical C. Physical D. Procedural Answer: C NEW QUESTION 159 - (Exam Topic 10) For a service provider, which of the following MOST effectively addresses confidentiality concerns for customers using cloud computing? A. Hash functions B. Data segregation C. File system permissions D. Non-repudiation controls Answer: B NEW QUESTION 164 - (Exam Topic 10) From a security perspective, which of the following is a best practice to configure a Domain Name Service (DNS) system? A. Configure secondary servers to use the primary server as a zone forwarder. B. Block all Transmission Control Protocol (TCP) connections. C. Disable all recursive queries on the name servers. D. Limit zone transfers to authorized devices. Answer: D Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) NEW QUESTION 168 - (Exam Topic 10) Which of the following is the BEST way to determine if a particular system is able to identify malicious software without executing it? A. Testing with a Botnet B. Testing with an EICAR file C. Executing a binary shellcode D. Run multiple antivirus programs Answer: B NEW QUESTION 170 - (Exam Topic 10) Which of the following is the PRIMARY benefit of a formalized information classification program? A. It drives audit processes. B. It supports risk assessment. C. It reduces asset vulnerabilities. D. It minimizes system logging requirements. Answer: B NEW QUESTION 172 - (Exam Topic 10) What is the MOST important reason to configure unique user IDs? A. Supporting accountability B. Reducing authentication errors C. Preventing password compromise D. Supporting Single Sign On (SSO) Answer: A NEW QUESTION 173 - (Exam Topic 10) Refer to the information below to answer the question. Desktop computers in an organization were sanitized for re-use in an equivalent security environment. The data was destroyed in accordance with organizational policy and all marking and other external indications of the sensitivity of the data that was formerly stored on the magnetic drives were removed. Organizational policy requires the deletion of user data from Personal Digital Assistant (PDA) devices before disposal. It may not be possible to delete the user data if the device is malfunctioning. Which destruction method below provides the BEST assurance that the data has been removed? A. Knurling B. Grinding C. Shredding D. Degaussing Answer: C NEW QUESTION 177 - (Exam Topic 11) Which Web Services Security (WS-Security) specification handles the management of security tokens and the underlying policies for granting access? Click on the correct specification in the image below. Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) A. Mastered B. Not Mastered Answer: A Explanation: WS-Authorization Reference: Java Web Services: Up and Running” By Martin Kalin page 228 NEW QUESTION 178 - (Exam Topic 11) Which of the following prevents improper aggregation of privileges in Role Based Access Control (RBAC)? A. Hierarchical inheritance B. Dynamic separation of duties C. The Clark-Wilson security model D. The Bell-LaPadula security model Answer: B NEW QUESTION 180 - (Exam Topic 11) A security professional has been asked to evaluate the options for the location of a new data center within a multifloor building. Concerns for the data center include emanations and physical access controls. Which of the following is the BEST location? A. On the top floor B. In the basement C. In the core of the building D. In an exterior room with windows Answer: C NEW QUESTION 181 - (Exam Topic 11) Changes to a Trusted Computing Base (TCB) system that could impact the security posture of that system and trigger a recertification activity are documented in the A. security impact analysis. B. structured code review. C. routine self assessment. D. cost benefit analysis. Answer: A NEW QUESTION 186 - (Exam Topic 11) Data remanence refers to which of the following? A. The remaining photons left in a fiber optic cable after a secure transmission. B. The retention period required by law or regulation. C. The magnetic flux created when removing the network connection from a server or personal computer. D. The residual information left on magnetic storage media after a deletion or erasure. Answer: D NEW QUESTION 190 - (Exam Topic 11) Order the below steps to create an effective vulnerability management process. Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) A. Mastered B. Not Mastered Answer: A Explanation: NEW QUESTION 194 - (Exam Topic 11) What should happen when an emergency change to a system must be performed? A. The change must be given priority at the next meeting of the change control board. B. Testing and approvals must be performed quickly. C. The change must be performed immediately and then submitted to the change board. D. The change is performed and a notation is made in the system log. Answer: B NEW QUESTION 195 - (Exam Topic 11) Which of the following has the GREATEST impact on an organization's security posture? A. International and country-specific compliance requirements B. Security violations by employees and contractors C. Resource constraints due to increasing costs of supporting security D. Audit findings related to employee access and permissions process Answer: A NEW QUESTION 199 - (Exam Topic 11) How does an organization verify that an information system's current hardware and software match the standard system configuration? A. By reviewing the configuration after the system goes into production B. By running vulnerability scanning tools on all devices in the environment C. By comparing the actual configuration of the system against the baseline D. By verifying all the approved security patches are implemented Answer: C NEW QUESTION 204 - (Exam Topic 11) Which of the following PRIMARILY contributes to security incidents in web-based applications? A. Systems administration and operating systems B. System incompatibility and patch management C. Third-party applications and change controls D. Improper stress testing and application interfaces Answer: C NEW QUESTION 205 - (Exam Topic 11) Which of the following types of security testing is the MOST effective in providing a better indication of the everyday security challenges of an organization when performing a security risk assessment? A. External B. Overt C. Internal D. Covert Answer: D Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) NEW QUESTION 206 - (Exam Topic 11) Which of the following is the BEST method to assess the effectiveness of an organization's vulnerability management program? A. Review automated patch deployment reports B. Periodic third party vulnerability assessment C. Automated vulnerability scanning D. Perform vulnerability scan by security team Answer: B NEW QUESTION 211 - (Exam Topic 11) Which of the following roles has the obligation to ensure that a third party provider is capable of processing and handling data in a secure manner and meeting the standards set by the organization? A. Data Custodian B. Data Owner C. Data Creator D. Data User Answer: B NEW QUESTION 214 - (Exam Topic 11) Which security approach will BEST minimize Personally Identifiable Information (PII) loss from a data breach? A. A strong breach notification process B. Limited collection of individuals' confidential data C. End-to-end data encryption for data in transit D. Continuous monitoring of potential vulnerabilities Answer: B NEW QUESTION 218 - (Exam Topic 11) What type of encryption is used to protect sensitive data in transit over a network? A. Payload encryption and transport encryption B. Authentication Headers (AH) C. Keyed-Hashing for Message Authentication D. Point-to-Point Encryption (P2PE) Answer: A NEW QUESTION 222 - (Exam Topic 11) Which of the following is an advantage of on-premise Credential Management Systems? A. Improved credential interoperability B. Control over system configuration C. Lower infrastructure capital costs D. Reduced administrative overhead Answer: B NEW QUESTION 223 - (Exam Topic 11) Software Code signing is used as a method of verifying what security concept? A. Integrity B. Confidentiality C. Availability D. Access Control Answer: A NEW QUESTION 228 - (Exam Topic 11) What is one way to mitigate the risk of security flaws in custom software? A. Include security language in the Earned Value Management (EVM) contract B. Include security assurance clauses in the Service Level Agreement (SLA) C. Purchase only Commercial Off-The-Shelf (COTS) products D. Purchase only software with no open source Application Programming Interfaces (APIs) Answer: Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) B NEW QUESTION 233 - (Exam Topic 11) The goal of a Business Continuity Plan (BCP) training and awareness program is to A. enhance the skills required to create, maintain, and execute the plan. B. provide for a high level of recovery in case of disaster. C. describe the recovery organization to new employees. D. provide each recovery team with checklists and procedures. Answer: A NEW QUESTION 234 - (Exam Topic 11) The PRIMARY outcome of a certification process is that it provides documented A. system weaknesses for remediation. B. standards for security assessment, testing, and process evaluation. C. interconnected systems and their implemented security controls. D. security analyses needed to make a risk-based decision. Answer: D NEW QUESTION 239 - (Exam Topic 11) For an organization considering two-factor authentication for secure network access, which of the following is MOST secure? A. Challenge response and private key B. Digital certificates and Single Sign-On (SSO) C. Tokens and passphrase D. Smart card and biometrics Answer: D NEW QUESTION 242 - (Exam Topic 11) When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined? A. After the system preliminary design has been developed and the data security categorization has been performed B. After the business functional analysis and the data security categorization have been performed C. After the vulnerability analysis has been performed and before the system detailed design begins D. After the system preliminary design has been developed and before the data security categorization begins Answer: B NEW QUESTION 245 - (Exam Topic 11) Which of the following BEST describes the purpose of the security functional requirements of Common Criteria? A. Level of assurance of the Target of Evaluation (TOE) in intended operational environment B. Selection to meet the security objectives stated in test documents C. Security behavior expected of a TOE D. Definition of the roles and responsibilities Answer: C NEW QUESTION 246 - (Exam Topic 11) Which of the following secures web transactions at the Transport Layer? A. Secure HyperText Transfer Protocol (S-HTTP) B. Secure Sockets Layer (SSL) C. Socket Security (SOCKS) D. Secure Shell (SSH) Answer: B NEW QUESTION 247 - (Exam Topic 11) While investigating a malicious event, only six days of audit logs from the last month were available. What policy should be updated to address this problem? A. Retention B. Reporting C. Recovery D. Remediation Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) Answer: A NEW QUESTION 248 - (Exam Topic 11) An organization is found lacking the ability to properly establish performance indicators for its Web hosting solution during an audit. What would be the MOST probable cause? A. Improper deployment of the Service-Oriented Architecture (SOA) B. Absence of a Business Intelligence (BI) solution C. Inadequate cost modeling D. Insufficient Service Level Agreement (SLA) Answer: D NEW QUESTION 253 - (Exam Topic 11) Which of the following is the PRIMARY benefit of implementing data-in-use controls? A. If the data is lost, it must be decrypted to be opened. B. If the data is lost, it will not be accessible to unauthorized users. C. When the data is being viewed, it can only be printed by authorized users. D. When the data is being viewed, it must be accessed using secure protocols. Answer: C NEW QUESTION 254 - (Exam Topic 11) During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant. What is the best approach for the CISO? During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant. What is the best approach for the CISO? A. Document the system as high risk B. Perform a vulnerability assessment C. Perform a quantitative threat assessment D. Notate the information and move on Answer: B NEW QUESTION 259 - (Exam Topic 11) In order for a security policy to be effective within an organization, it MUST include A. strong statements that clearly define the problem. B. a list of all standards that apply to the policy. C. owner information and date of last revision. D. disciplinary measures for non compliance. Answer: D NEW QUESTION 262 - (Exam Topic 11) Which of the following provides the minimum set of privileges required to perform a job function and restricts the user to a domain with the required privileges? A. Access based on rules B. Access based on user's role C. Access determined by the system D. Access based on data sensitivity Answer: B NEW QUESTION 265 - (Exam Topic 12) Match the name of access control model with its associated restriction. Drag each access control model to its appropriate restriction access on the right. Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) A. Mastered B. Not Mastered Answer: A Explanation: Mandatory Access Control – End user cannot set controls Discretionary Access Control (DAC) – Subject has total control over objects Role Based Access Control (RBAC) – Dynamically assigns roles permissions to particular duties based on job function Rule Based access control – Dynamically assigns roles to subjects based on criteria assigned by a custodian. NEW QUESTION 268 - (Exam Topic 12) The PRIMARY outcome of a certification process is that it provides documented A. interconnected systems and their implemented security controls. B. standards for security assessment, testing, and process evaluation. C. system weakness for remediation. D. security analyses needed to make a risk-based decision. Answer: D NEW QUESTION 273 - (Exam Topic 12) Which of the following sets of controls should allow an investigation if an attack is not blocked by preventive controls or detected by monitoring? A. Logging and audit trail controls to enable forensic analysis B. Security incident response lessons learned procedures C. Security event alert triage done by analysts using a Security Information and Event Management (SIEM) system D. Transactional controls focused on fraud prevention Answer: C NEW QUESTION 277 - (Exam Topic 12) Match the types of e-authentication tokens to their description. Drag each e-authentication token on the left to its corresponding description on the right. A. Mastered B. Not Mastered Answer: A Explanation: Look-up secret token - A physical or electronic token that stores a set of secrets between the claimant and the credential service provider Out-of-Band Token - A physical token that is uniquely addressable and can receive a verifier-selected secret for one-time use Pre-registered Knowledge Token - A series of responses to a set of prompts or challenges established by the subscriber and credential service provider during the registration process Memorized Secret Token - A secret shared between the subscriber and credential service provider that is typically character strings NEW QUESTION 280 - (Exam Topic 12) Which type of security testing is being performed when an ethical hacker has no knowledge about the target system but the testing target is notified before the test? A. Reversal Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) B. Gray box C. Blind D. White box Answer: B NEW QUESTION 282 - (Exam Topic 12) What does the Maximum Tolerable Downtime (MTD) determine? A. The estimated period of time a business critical database can remain down before customers are affected. B. The fixed length of time a company can endure a disaster without any Disaster Recovery (DR) planning C. The estimated period of time a business can remain interrupted beyond which it risks never recovering D. The fixed length of time in a DR process before redundant systems are engaged Answer: C NEW QUESTION 286 - (Exam Topic 12) The PRIMARY purpose of accreditation is to: A. comply with applicable laws and regulations. B. allow senior management to make an informed decision regarding whether to accept the risk of operating the system. C. protect an organization’s sensitive datA. D. verify that all security controls have been implemented properly and are operating in the correct manner. Answer: B NEW QUESTION 289 - (Exam Topic 12) Which of the following media sanitization techniques is MOST likely to be effective for an organization using public cloud services? A. Low-level formatting B. Secure-grade overwrite erasure C. Cryptographic erasure D. Drive degaussing Answer: B NEW QUESTION 291 - (Exam Topic 12) Match the access control type to the example of the control type. Drag each access control type net to its corresponding example. A. Mastered B. Not Mastered Answer: A Explanation: Administrative – labeling of sensitive data Technical – Constrained user interface Logical – Biometrics for authentication Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) Physical – Radio Frequency Identification 9RFID) badge NEW QUESTION 293 - (Exam Topic 12) Which of the following BEST describes a chosen plaintext attack? A. The cryptanalyst can generate ciphertext from arbitrary text. B. The cryptanalyst examines the communication being sent back and forth. C. The cryptanalyst can choose the key and algorithm to mount the attack. D. The cryptanalyst is presented with the ciphertext from which the original message is determined. Answer: A NEW QUESTION 294 - (Exam Topic 12) Determining outage costs caused by a disaster can BEST be measured by the A. cost of redundant systems and backups. B. cost to recover from an outage. C. overall long-term impact of the outage. D. revenue lost during the outage. Answer: C NEW QUESTION 299 - (Exam Topic 12) A database administrator is asked by a high-ranking member of management to perform specific changes to the accounting system database. The administrator is specifically instructed to not track or evidence the change in a ticket. Which of the following is the BEST course of action? A. Ignore the request and do not perform the change. B. Perform the change as requested, and rely on the next audit to detect and report the situation. C. Perform the change, but create a change ticket regardless to ensure there is complete traceability. D. Inform the audit committee or internal audit directly using the corporate whistleblower process. Answer: D NEW QUESTION 304 - (Exam Topic 12) How does a Host Based Intrusion Detection System (HIDS) identify a potential attack? A. Examines log messages or other indications on the system. B. Monitors alarms sent to the system administrator C. Matches traffic patterns to virus signature files D. Examines the Access Control List (ACL) Answer: C NEW QUESTION 306 - (Exam Topic 12) When writing security assessment procedures, what is the MAIN purpose of the test outputs and reports? A. To force the software to fail and document the process B. To find areas of compromise in confidentiality and integrity C. To allow for objective pass or fail decisions D. To identify malware or hidden code within the test results Answer: C NEW QUESTION 308 - (Exam Topic 12) An employee of a retail company has been granted an extended leave of absence by Human Resources (HR). This information has been formally communicated to the access provisioning team. Which of the following is the BEST action to take? A. Revoke access temporarily. B. Block user access and delete user account after six months. C. Block access to the offices immediately. D. Monitor account usage temporarily. Answer: D NEW QUESTION 313 - (Exam Topic 12) Which of the following approaches is the MOST effective way to dispose of data on multiple hard drives? A. Delete every file on each drive. B. Destroy the partition table for each drive using the command line. Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) C. Degauss each drive individually. D. Perform multiple passes on each drive using approved formatting methods. Answer: D NEW QUESTION 316 - (Exam Topic 12) A security architect plans to reference a Mandatory Access Control (MAC) model for implementation. This indicates that which of the following properties are being prioritized? A. Confidentiality B. Integrity C. Availability D. Accessibility Answer: C NEW QUESTION 318 - (Exam Topic 12) The goal of a Business Impact Analysis (BIA) is to determine which of the following? A. Cost effectiveness of business recovery B. Cost effectiveness of installing software security patches C. Resource priorities for recovery and Maximum Tolerable Downtime (MTD) D. Which security measures should be implemented Answer: C NEW QUESTION 321 - (Exam Topic 12) When designing a vulnerability test, which one of the following is likely to give the BEST indication of what components currently operate on the network? A. Topology diagrams B. Mapping tools C. Asset register D. Ping testing Answer: D NEW QUESTION 324 - (Exam Topic 12) Knowing the language in which an encrypted message was originally produced might help a cryptanalyst to perform a A. clear-text attack. B. known cipher attack. C. frequency analysis. D. stochastic assessment. Answer: C NEW QUESTION 325 - (Exam Topic 12) In which identity management process is the subject’s identity established? A. Trust B. Provisioning C. Authorization D. Enrollment Answer: D NEW QUESTION 327 - (Exam Topic 12) During the Security Assessment and Authorization process, what is the PRIMARY purpose for conducting a hardware and software inventory? A. Calculate the value of assets being accredited. B. Create a list to include in the Security Assessment and Authorization package. C. Identify obsolete hardware and software. D. Define the boundaries of the information system. Answer: A NEW QUESTION 331 - (Exam Topic 12) Which of the following is the PRIMARY reason to perform regular vulnerability scanning of an organization network? Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) A. Provide vulnerability reports to management. B. Validate vulnerability remediation activities. C. Prevent attackers from discovering vulnerabilities. D. Remediate known vulnerabilities. Answer: B NEW QUESTION 334 - (Exam Topic 13) Which of the following is the MOST effective method to mitigate Cross-Site Scripting (XSS) attacks? A. Use Software as a Service (SaaS) B. Whitelist input validation C. Require client certificates D. Validate data output Answer: B NEW QUESTION 336 - (Exam Topic 13) A security analyst for a large financial institution is reviewing network traffic related to an incident. The analyst determines the traffic is irrelevant to the investigation but in the process of the review, the analyst also finds that an applications data, which included full credit card cardholder data, is transferred in clear text between the server and user’s desktop. The analyst knows this violates the Payment Card Industry Data Security Standard (PCI-DSS). Which of the following is the analyst’s next step? A. Send the log file co-workers for peer review B. Include the full network traffic logs in the incident report C. Follow organizational processes to alert the proper teams to address the issue. D. Ignore data as it is outside the scope of the investigation and the analyst’s role. Answer: C Explanation: Section: Security Operations NEW QUESTION 340 - (Exam Topic 13) A control to protect from a Denial-of-Service (DoS) attach has been determined to stop 50% of attacks, and additionally reduces the impact of an attack by 50%. What is the residual risk? A. 25% B. 50% C. 75% D. 100% Answer: A NEW QUESTION 344 - (Exam Topic 13) Who is responsible for the protection of information when it is shared with or provided to other organizations? A. Systems owner B. Authorizing Official (AO) C. Information owner D. Security officer Answer: C Explanation: Section: Security Operations NEW QUESTION 345 - (Exam Topic 13) As part of the security assessment plan, the security professional has been asked to use a negative testing strategy on a new website. Which of the following actions would be performed? A. Use a web scanner to scan for vulnerabilities within the website. B. Perform a code review to ensure that the database references are properly addressed. C. Establish a secure connection to the web server to validate that only the approved ports are open. D. Enter only numbers in the web form and verify that the website prompts the user to enter a valid input. Answer: D NEW QUESTION 349 - (Exam Topic 13) Which security access policy contains fixed security attributes that are used by the system to determine a user’s access to a file or object? Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) A. Mandatory Access Control (MAC) B. Access Control List (ACL) C. Discretionary Access Control (DAC) D. Authorized user control Answer: A NEW QUESTION 352 - (Exam Topic 13) Drag the following Security Engineering terms on the left to the BEST definition on the right. A. Mastered B. Not Mastered Answer: A Explanation: Risk - A measure of the extent to which an entity is threatened by a potential circumstance of event, the adverse impacts that would arise if the circumstance or event occurs, and the likelihood of occurrence. Protection Needs Assessment - The method used to identify the confidentiality, integrity, and availability requirements for organizational and system assets and to characterize the adverse impact or consequences should be asset be lost, modified, degraded, disrupted, compromised, or become unavailable. Threat assessment - The method used to identify and characterize the dangers anticipated throughout the life cycle of the system. Security Risk Treatment - The method used to identify feasible security risk mitigation options and plans. NEW QUESTION 353 - (Exam Topic 13) It is MOST important to perform which of the following to minimize potential impact when implementing a new vulnerability scanning tool in a production environment? A. Negotiate schedule with the Information Technology (IT) operation’s team B. Log vulnerability summary reports to a secured server C. Enable scanning during off-peak hours D. Establish access for Information Technology (IT) management Answer: A Explanation: Section: Security Operations NEW QUESTION 354 - (Exam Topic 13) Which of the following is the MOST efficient mechanism to account for all staff during a speedy nonemergency evacuation from a large security facility? A. Large mantrap where groups of individuals leaving are identified using facial recognition technology B. Radio Frequency Identification (RFID) sensors worn by each employee scanned by sensors at each exitdoor C. Emergency exits with push bars with coordinates at each exit checking off the individual against a predefined list D. Card-activated turnstile where individuals are validated upon exit Answer: B Explanation: Section: Security Operations NEW QUESTION 359 - (Exam Topic 13) Which of the following is a characteristic of an internal audit? A. An internal audit is typically shorter in duration than an external audit. B. The internal audit schedule is published to the organization well in advance. C. The internal auditor reports to the Information Technology (IT) department D. Management is responsible for reading and acting upon the internal audit results Answer: D NEW QUESTION 362 - (Exam Topic 13) What are the steps of a risk assessment? A. identification, analysis, evaluation Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) B. analysis, evaluation, mitigation C. classification, identification, risk management D. identification, evaluation, mitigation Answer: A Explanation: Section: Security Assessment and Testing NEW QUESTION 363 - (Exam Topic 13) What is the MOST significant benefit of an application upgrade that replaces randomly generated session keys with certificate based encryption for communications with backend servers? A. Non-repudiation B. Efficiency C. Confidentially D. Privacy Answer: A NEW QUESTION 368 - (Exam Topic 13) Proven application security principles include which of the following? A. Minimizing attack surface area B. Hardening the network perimeter C. Accepting infrastructure security controls D. Developing independent modules Answer: A NEW QUESTION 372 - (Exam Topic 13) Which of the following is considered a secure coding practice? A. Use concurrent access for shared variables and resources B. Use checksums to verify the integrity of libraries C. Use new code for common tasks D. Use dynamic execution functions to pass user supplied data Answer: B NEW QUESTION 377 - (Exam Topic 13) The core component of Role Based Access Control (RBAC) must be constructed of defined data elements. Which elements are required? A. Users, permissions, operations, and protected objects B. Roles, accounts, permissions, and protected objects C. Users, roles, operations, and protected objects D. Roles, operations, accounts, and protected objects Answer: C NEW QUESTION 379 - (Exam Topic 13) What is the PRIMARY goal of fault tolerance? A. Elimination of single point of failure B. Isolation using a sandbox C. Single point of repair D. Containment to prevent propagation Answer: A NEW QUESTION 381 - (Exam Topic 13) Assessing a third party’s risk by counting bugs in the code may not be the best measure of an attack surface within the supply chain. Which of the following is LEAST associated with the attack surface? A. Input protocols B. Target processes C. Error messages D. Access rights Answer: C Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) Explanation: Section: Security Assessment and Testing NEW QUESTION 383 - (Exam Topic 13) Within the company, desktop clients receive Internet Protocol (IP) address over Dynamic Host Configuration Protocol (DHCP). Which of the following represents a valid measure to help protect the network against unauthorized access? A. Implement path management B. Implement port based security through 802.1x C. Implement DHCP to assign IP address to server systems D. Implement change management Answer: B NEW QUESTION 385 - (Exam Topic 13) After following the processes defined within the change management plan, a super user has upgraded a device within an Information system. What step would be taken to ensure that the upgrade did NOT affect the network security posture? A. Conduct an Assessment and Authorization (A&A) B. Conduct a security impact analysis C. Review the results of the most recent vulnerability scan D. Conduct a gap analysis with the baseline configuration Answer: B Explanation: Section: Security Assessment and Testing NEW QUESTION 386 - (Exam Topic 13) At a MINIMUM, audits of permissions to individual or group accounts should be scheduled A. annually B. to correspond with staff promotions C. to correspond with terminations D. continually Answer: A NEW QUESTION 391 - (Exam Topic 13) A chemical plan wants to upgrade the Industrial Control System (ICS) to transmit data using Ethernet instead of RS422. The project manager wants to simplify administration and maintenance by utilizing the office network infrastructure and staff to implement this upgrade. Which of the following is the GREATEST impact on security for the network? A. The network administrators have no knowledge of ICS B. The ICS is now accessible from the office network C. The ICS does not support the office password policy D. RS422 is more reliable than Ethernet Answer: B NEW QUESTION 394 - (Exam Topic 13) A security professional determines that a number of outsourcing contracts inherited from a previous merger do not adhere to the current security requirements. Which of the following BEST minimizes the risk of this happening again? A. Define additional security controls directly after the merger B. Include a procurement officer in the merger team C. Verify all contracts before a merger occurs D. Assign a compliancy officer to review the merger conditions Answer: D NEW QUESTION 398 - (Exam Topic 13) Which of the following is a responsibility of a data steward? A. Ensure alignment of the data governance effort to the organization. B. Conduct data governance interviews with the organization. C. Document data governance requirements. D. Ensure that data decisions and impacts are communicated to the organization. Answer: Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) A NEW QUESTION 403 - (Exam Topic 13) Which of the BEST internationally recognized standard for evaluating security products and systems? A. Payment Card Industry Data Security Standards (PCI-DSS) B. Common Criteria (CC) C. Health Insurance Portability and Accountability Act (HIPAA) D. Sarbanes-Oxley (SOX) Answer: B NEW QUESTION 405 - (Exam Topic 13) Which of the following is the GREATEST benefit of implementing a Role Based Access Control (RBAC) system? A. Integration using Lightweight Directory Access Protocol (LDAP) B. Form-based user registration process C. Integration with the organizations Human Resources (HR) system D. A considerably simpler provisioning process Answer: D NEW QUESTION 408 - (Exam Topic 13) What is the correct order of steps in an information security assessment? Place the information security assessment steps on the left next to the numbered boxes on the right in the correct order. A. Mastered B. Not Mastered Answer: A Explanation: Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) NEW QUESTION 410 - (Exam Topic 13) Attack trees are MOST useful for which of the following? A. Determining system security scopes B. Generating attack libraries C. Enumerating threats D. Evaluating Denial of Service (DoS) attacks Answer: A NEW QUESTION 414 - (Exam Topic 13) Which of the following is the BEST metric to obtain when gaining support for an Identify and Access Management (IAM) solution? A. Application connection successes resulting in data leakage B. Administrative costs for restoring systems after connection failure C. Employee system timeouts from implementing wrong limits D. Help desk costs required to support password reset requests Answer: D NEW QUESTION 416 - (Exam Topic 13) The MAIN use of Layer 2 Tunneling Protocol (L2TP) is to tunnel data A. through a firewall at the Session layer B. through a firewall at the Transport layer C. in the Point-to-Point Protocol (PPP) D. in the Payload Compression Protocol (PCP) Answer: C NEW QUESTION 418...... Guaranteed success with Our exam guides visit - https://www.certshared.com  Certshared now are offering 100% pass ensure CISSP dumps! https://www.certshared.com/exam/CISSP/ (1487 Q&As) Thank You for Trying Our Product We offer two products: 1st - We have Practice Tests Software with Actual Exam Questions 2nd - Questons and Answers in PDF Format CISSP Practice Exam Features: * CISSP Questions and Answers Updated Frequently * CISSP Practice Questions Verified by Expert Senior Certified Staff * CISSP Most Realistic Questions that Guarantee you a Pass on Your FirstTry * CISSP Practice Test Questions in Multiple Choice Formats and Updatesfor 1 Year 100% Actual & Verified — Instant Download, Please Click Order The CISSP Practice Test Here Guaranteed success with Our exam guides visit - https://www.certshared.com Powered by TCPDF (www.tcpdf.org)