CISSP Exam Questions
1,535 real CISSP exam questions with expert-verified answers and explanations. Page 12 of 31.
- Question #551Security Operations
What is the MOST common component of a vulnerability management framework?
vulnerability managementpatch managementsecurity operationsrisk mitigation - Question #552Security and Risk Management
A new Chief Information Officer (CIO) created a group to write a data retention policy based on applicable laws. Which of the following is the PRIMARY motivation for the policy?
data retentionlegal compliancedata disposalorganizational liability - Question #553Security Architecture and Engineering
What determines the level of security of a combination lock?
physical securitybrute force attacksecurity strengthattack work factor - Question #554Security Architecture and Engineering
A user downloads a file from the Internet, then applies the Secure Hash Algorithm 3 (SHA-3)?
hashingSHA-3data integritycryptography - Question #555Security and Risk Management
Which of the following is held accountable for the risk to organizational systems and data that result from outsourcing Information Technology (IT) systems and services?
outsourcing riskthird-party risk managementaccountabilityrisk ownership - Question #556Software Development Security
Which of the following is the BEST definition of Cross-Site Request Forgery (CSRF)?
CSRFweb application securityvulnerabilitiesHTTP attacks - Question #557Identity and Access Management (IAM)
Which of the following is a process in the access provisioning lifecycle that will MOST likely identify access aggregation issues?
access provisioningaccess reviewprivilege aggregationIAM lifecycle - Question #558Communication and Network Security
Which of the following is the PRIMARY reason a sniffer operating on a network is collecting packets only from its own host?
network sniffingnetwork switchesnetwork segmentationEthernet - Question #559Identity and Access Management (IAM)
Which of the following is the final phase of the identity and access provisioning lifecycle?
IAM lifecycleaccess revocationdeprovisioningidentity management - Question #560Security Assessment and Testing
Which of the following is mobile device remote fingerprinting?
device fingerprintingmobile securityreconnaissancedevice identification - Question #561Security and Risk Management
Which of the following trust services principles refers to the accessibility of information used by the systems, products, or services offered to a third-party provider's customers...
Trust services principlesAvailabilityCIA triad - Question #562Software Development Security
Which of the following open source software issues pose the MOST risk to an application?
Open source securityVulnerability managementSoftware supply chain riskRisk assessment - Question #563Security Architecture and Engineering
Which of the following is the PRIMARY mechanism used to limit the range of objects available to a given subject within different execution domains?
Process isolationExecution domainsAccess control mechanismsOperating system security - Question #564Asset Security
Once the types of information have been identified, who should an information security practitioner work with to ensure that the information is properly categorized?
Information ownerData classificationRoles and responsibilities - Question #565Security Operations
What should be the FIRST action for a security administrator who detects an intrusion on the network based on precursors and other indicators?
Incident responseContainmentSecurity operations - Question #566Security Assessment and Testing
Which of the following needs to be taken into account when assessing vulnerability?
Vulnerability assessmentRisk identificationRisk management - Question #567Communication and Network Security
For the purpose of classification, which of the following is used to divide trust domain and trust boundaries?
Network architectureTrust domainsSecurity boundariesNetwork segmentation - Question #568Security Operations
Which of the following is the key requirement for test results when implementing forensic procedures?
Digital forensicsEvidence handlingReproducibility - Question #569Software Development Security
An application team is running tests to ensure that user entry fields will not accept invalid input of any length. What type of negative testing is this an example of?
Negative testingInput validationSoftware testingApplication security - Question #570Software Development Security
An Internet software application requires authentication before a user is permitted to utilize the resource. Which testing scenario BEST validates the functionality of the applicat...
Web application testingAuthentication testingSession managementApplication security - Question #571Software Development Security
Which of the following techniques BEST prevents buffer overflows?
Buffer overflow preventionCode auditingSoftware vulnerabilitiesSecure coding practices - Question #572Security Architecture and Engineering
A security architect is responsible for the protection of a new home banking system. Which of the following solutions can BEST improve the confidentiality and integrity of this ext...
Authentication solutionsOne-time password (OTP)ConfidentialityIntegritySecurity architecture - Question #573Software Development Security
A security professional recommends that a company integrate threat modeling into its Agile development processes. Which of the following BEST describes the benefits of this approac...
Threat modelingAgile securitySDLC securityDevSecOps - Question #574Security Assessment and Testing
A security consultant has been hired by a company to establish its vulnerability management program. The consultant is now in the deployment phase. Which of the following tasks is...
Vulnerability management programProgram deploymentSecurity controls procurement - Question #575Software Development Security
Directive controls are a form of change management policy and procedures. Which of the following subsections are recommended as part of the change management process?
Change managementDirective controlsBuild and testSoftware development - Question #576Identity and Access Management
Which of the following BEST describes how access to a system is granted to federated user accounts?
Federated identityRelying PartyIdentity ProviderAccess granting - Question #577Communication and Network Security
Which of the following is the primary advantage of segmenting Virtual Machines (VM) using physical networks?
Network segmentationVirtualization securityPhysical network separationNetwork monitoring - Question #578Security Assessment and Testing
Which of the following would an internal technical security audit BEST validate?
Technical security auditSystem changesConfiguration managementSecurity assessment - Question #579Security Assessment and Testing
Which of the following processes has the PRIMARY purpose of identifying outdated software versions, missing patches, and lapsed system updates?
Vulnerability managementPatch managementSystem updates - Question #580Security Architecture and Engineering
A development operations team would like to start building new applications delegating the cybersecurity responsibility as much as possible to the service provider. Which of the fo...
Cloud computingShared responsibility modelPaaSContainerization securityDevOps - Question #581Security and Risk Management
Change management policies and procedures belong to which of the following types of controls?
Change managementSecurity controlsAdministrative controls - Question #582Identity and Access Management (IAM)
What access control scheme uses fine-grained rules to specify the conditions under which access to each data item or applications is granted?
Access control modelsABACAuthorization - Question #583Identity and Access Management (IAM)
Why is planning the MOST critical phase of a Role Based Access Control (RBAC) implementation?
RBAC implementationAccess control planningRole mining - Question #584Security Assessment and Testing
Vulnerability scanners may allow for the administrator to assign which of the following in order to assist in prioritizing remediation activities?
Vulnerability managementVulnerability scanningRisk prioritizationAsset valuation - Question #585Software Development Security
In order for application developers to detect potential vulnerabilities earlier during the Software Development Life Cycle (SDLC), which of the following safeguards should be imple...
SDLC securityThreat modelingVulnerability detectionSecure design - Question #586Asset Security
Physical assets defined in an organization's Business Impact Analysis (BIA) could include which of the following?
Business Impact Analysis (BIA)Asset typesPhysical assets - Question #587Identity and Access Management (IAM)
What is the best way for mutual authentication of devices belonging to the same organization?
Mutual authenticationDevice authenticationCertificates - Question #588Security Architecture and Engineering
Which of the following encryption types is used in Hash Message Authentication Code (HMAC) for key distribution?
HMACSymmetric encryptionCryptographic primitives - Question #589Security Architecture and Engineering
Compared with hardware cryptography, software cryptography is generally
Hardware cryptographySoftware cryptographyPerformanceCost - Question #590Security and Risk Management
A financial company has decided to move its main business application to the Cloud. The legal department objects, arguing that the move of the platform should comply with several r...
Cloud securityGDPR complianceKey managementShared responsibility - Question #591Identity and Access Management (IAM)
An employee receives a promotion that entities them to access higher-level functions on the company's accounting system, as well as keeping their access to the previous system that...
Access reviewsPrivilege creepAccess certificationLeast privilege - Question #592Communication and Network Security
Which of the following is PRIMARILY adopted for ensuring the integrity of information is preserved?
Data integrityTLSCryptographic protocolsNetwork security - Question #593Communication and Network Security
Why might a network administrator choose distributed virtual switches instead of stand-alone switches for network segmentation?
Network segmentationVirtual networkingDistributed virtual switchesConfiguration management - Question #594Asset Security
An organization has implemented a new backup process which protects confidential data by encrypting the information stored on backup tapes. Which of the following is a MAJOR data c...
Data confidentialityBackup securityEncryptionData lifecycle - Question #595Asset Security
Organization A is adding a large collection of confidential data records that it received when it acquired Organization B to its data store. Many of the users and staff from Organi...
Data classificationData ownershipData governanceM&A security - Question #596Asset Security
An organization has a short-term agreement with a public Cloud Service Provider (CSP). Which of the following BEST protects sensitive data once the agreement expires and the assets...
Cloud securityData sanitizationData disposalContractual agreements - Question #597Communication and Network Security
Which of the following techniques is effective to detect taps in fiber optic cables?
Fiber optic securityCable tappingPhysical securityNetwork monitoring - Question #598Security and Risk Management
When would an organization review a Business Continuity Management (BCM) system?
BCM lifecycleBusiness continuityPolicy reviewGovernance - Question #599Software Development Security
Which of the following is a characteristic of the independent testing of a program?
Independent testingSoftware testingQuality assuranceVulnerability detection - Question #600Asset Security
Which of the following MUST be considered when developing business rules for a data loss prevention (DLP) solution?
DLPData sensitivityData classificationData protection