CISSP Exam Questions

What is static analysis intended to do when analyzing an executable file?

In addition to life, protection of which of the following elements is MOST important when planning a data center site?

In an IDEAL encryption system, who has sole access to the decryption key?

Which of the following roles is responsible for ensuring that important datasets are developed, maintained, and are accessible within their defined specifications?

What is the MOST important criterion that needs to be adhered to during the data collection process of an active investigation?

What is the PRIMARY benefit of relying on Security Content Automation Protocol (SCAP)?

A user's credential for an application is stored in a relational database. Which control protects the confidentiality of the credential while it is stored?

What is the PRIMARY consideration when testing industrial control systems (ICS) for security weaknesses?

An organization implements Network Access Control (NAC) ay Institute of Electrical and Electronics Engineers (IEEE) 802.1x and discovers the printers do not support the IEEE 802.1x...

What process facilitates the balance of operational and economic costs of protective measures with gains in mission capability?

Which of the following BEST describes why software assurance is critical in helping prevent an increase in business and mission risk for an organization?

In software development, which of the following entities normally signs the code to protect the code integrity?

Which security evaluation model assesses a product's Security Assurance Level (SAL) in comparison to similar solutions?

Which of the following is a risk matrix?

Which evidence collecting technique would be utilized when it is believed an attacker is employing a rootkit and a quick analysis is needed?

A user is allowed to access the file labeled "Financial Forecast," but only between 9:00 a.m. and 5:00 p.m., Monday through Friday. Which type of access mechanism should be used to...

An organization wants to share data securely with their partners via the Internet. Which standard port is typically used to meet this requirement?

Which part of an operating system (OS) is responsible for providing security interfaces among the hardware, OS, and other parts of the computing system?

Recently, an unknown event has disrupted a single Layer-2 network that spans between two geographically diverse data centers. The network engineers have asked for assistance in ide...

What would be the BEST action to take in a situation where collected evidence was left unattended overnight in an unlocked vehicle?

Which of the following contributes MOST to the effectiveness of a security officer?

An organization wants a service provider to authenticate users via the users' organization domain credentials. Which markup language should the organization's security personnel us...

A recent security audit is reporting several unsuccessful login attempts being repeated at specific times during the day on an Internet facing authentication server. No alerts have...

What is a security concern when considering implementing software-defined networking (SDN)?

Which of the following is the MOST important rule for digital investigations?

A cybersecurity engineer has been tasked to research and implement an ultra-secure communications channel to protect the organization's most valuable intellectual property (IP). Th...

An organization is trying to secure instant messaging (IM) communications through its network perimeter. Which of the following is the MOST significant challenge?

A company wants to store data related to users on an offsite server. What method can be deployed to protect the privacy of the user's information while maintaining the field-level...

What is the FIRST step in developing a patch management plan?

When resolving ethical conflicts, the information security professional MUST consider many factors. In what order should these considerations be prioritized?

An organization is implementing security review as part of system development. Which of the following is the BEST technique to follow?

How does Radio-Frequency Identification (RFID) assist with asset management?

Which of the following services can be deployed via a cloud service or on-premises to integrate with Identity as a Service (IDaaS) as the authoritative source of user identities?

Which of the following security tools monitors devices and records the information in a central database for further analysis?

Secure coding can be developed by applying which one of the following?

A company is moving from the V model to Agile development. How can the information security department BEST ensure that secure design principles are implemented in the new methodol...

An organization wants to define its physical perimeter. What primary device should be used to accomplish this objective if the organization's perimeter MUST cost-efficiently deter...

The acquisition of personal data being obtained by a lawful and fair means is an example of what principle?

What is the BEST control to be implemented at a login page in a web application to mitigate the ability to enumerate users?

If the wide area network (WAN) is supporting converged applications like Voice over Internet Protocol (VoIP), which of the following becomes even MORE essential to the assurance of...

A cloud service accepts Security Assertion Markup Language (SAML) assertions from users to on and security However, an attacker was able to spoof a registered account on the networ...

A company is attempting to enhance the security of its user authentication processes. After evaluating several options, the company has decided to utilize Identity as a Service (ID...

In which of the following system life cycle processes should security requirements be developed?

Which of the following virtual network configuration options is BEST to protect virtual machines (VM)?

Which of the following is the BEST method to validate secure coding techniques against injection and overflow attacks?

A Distributed Denial of Service (DDoS) attack was carried out using malware called Mirai to create a large-scale command and control system to launch a botnet. Which of the followi...

An establish information technology (IT) consulting firm is considering acquiring a successful local startup. To gain a comprehensive understanding of the startup's security postur...

As a design principle, which one of the following actors is responsible for identifying and approving data security requirements in a cloud ecosystem?

A company is enrolled in a hard drive reuse program where decommissioned equipment is sold back to the vendor when it is no longer needed. The vendor pays more money for functionin...

In supervisory control and data acquisition (SCADA) systems, which of the following controls can be used to reduce device exposure to malware?