CISSP Exam Questions

A company receives an email threat informing of an Imminent Distributed Denial of Service (DDoS) attack targeting its web application, unless ransom is paid. Which of the following...

The MAIN use of Layer 2 Tunneling Protocol (L2TP) is to tunnel data

Which of the following methods is MOST effective in mitigating Cross-Site Scripting (XSS) vulnerabilities within HyperText Markup Language (HTML) websites?

Which of the following MOST accurately describes the Security Target (ST) in the Common Criteria framework?

An organization has approved deployment of a virtual environment for the development servers and has established controls for restricting access to resources. In order to implement...

Which of the following is a weakness of the Data Encryption Standard (DES)?

What are facets of trustworthy software in supply chain operations?

In order to meet the project delivery deadline, a web application developer used readily available software components. Which is the BEST method for reducing the risk associated wi...

To ensure proper governance of information throughout the lifecycle, which of the following should be assigned FIRST?

An effective information security strategy is PRIMARILY based upon which of the following?

One of Canada's leading pharmaceutical firms recently hired a Chief Data Officer (CDO) to oversee its data privacy program. The CDO has discovered the firm's marketing department h...

An organization is attempting to strengthen the configuration of its enterprise resource planning (ERP) software in order to enforce sufficient segregation of duties (SoD). Which o...

Which type of log collection is focused on detecting and responding to attacks, malware infection, and data theft?

A company is planning to implement a private cloud infrastructure. Which of the following recommendations will support the move to a cloud infrastructure?

While performing a security review for a new product, an information security professional discovers that the organization's product development team is proposing to collect govern...

Which of the following is performed to determine a measure of success of a security awareness training program designed to prevent social engineering attacks?

What level of Redundant Array of Independent Disks (RAID) is configured PRIMARILY for high- performance data reads and writes?

A retail company is looking to start a development project that will utilize open source components in its code for the first time. The development team has already acquired severa...

Upon commencement of an audit within an organization, which of the following actions is MOST important for the auditor(s) to take?

An organization is planning a penetration test that simulates the malicious actions of a former network administrator. What kind of penetration test is needed?

An organization has discovered that organizational data is posted by employees to data storage accessible to the general public. What is the PRIMARY step an organization must take...

What is the PRIMARY reason that a bit-level copy is more desirable than a file-level copy when replicating a hard drive's contents for an e-discovery investigation?

While reviewing the financial reporting risks of a third-party application, which of the following Service Organization Control (SOC) reports will be the MOST useful?

A large manufacturing organization arranges to buy an industrial machine system to produce a new line of products. The system includes software provided to the vendor by a thirdpar...

Which of the following types of hosts should be operating in the demilitarized zone (DMZ)?

In systems security engineering, what does the security principle of modularity provide?

Which of the following is MOST appropriate to collect evidence of a zero-day attack?

Which of the following is required to verify the authenticity of a digitally signed document?

Which of the following is the BEST method to gather evidence from a computer's hard drive?

Who should perform the design review to uncover security design flaws as part of the Software Development Life Cycle (SDLC)?

During a penetration test, what are the three PRIMARY objectives of the planning phase?

What term is commonly used to describe hardware and software assets that are stored in a configuration management database (CMDB)?

Which of the following Disaster recovery (DR) testing processes is LEAST likely to disrupt normal business operations?

The Open Web Application Security Project's (OWASP) Software Assurance Maturity Model (SAMM) allows organizations to implement a flexible software security strategy to measure orga...

The security architect is designing and implementing an internal certification authority to generate digital certificates for all employees. Which of the following is the BEST solu...

Which of the following is a common risk with fiber optical communications, and what is the associated mitigation measure?

During an internal audit of an organizational Information Security Management System (ISMS), nonconformities are identified. In which of the following management stages are nonconf...

What is the BEST reason to include supply chain risks in a corporate risk register?

An employee's home address should be categorized according to which of the following references?

Why is authentication by ownership stronger than authentication by knowledge?

A network security engineer needs to ensure that a security solution analyzes traffic for protocol manipulation and various sorts of common attacks. In addition, all Uniform Resour...

Which of the following is the BEST way to protect an organization's data assets?

Which of the following would qualify as an exception to the "right to be forgotten" of the General Data Protection Regulation's (GDPR)?

Which of the following is a benefit of implementing data-in-use controls?

Which of the following secure transport protocols is often used to secure Voice over Internet Protocol (VoIP) communications on a network from end to end?

Which of the following is a MUST for creating a new custom-built, cloud-native application designed to be horizontally scalable?

Which of the following access control mechanisms characterized subjects and objects using a set of encoded security-relevant properties?

Which kind of dependencies should be avoided when implementing secure design principles in software-defined networking (SDN)?

Which mechanism provides the BEST protection against buffer overflow attacks in memory?

An organization is setting a security assessment scope with the goal of developing a Security Management Program (SMP). The next step is to select an approach for conducting the ri...