CISSP Exam Questions

A security architect is developing an information system for a client. One of the requirements is to deliver a platform that mitigates against common vulnerabilities and attacks, W...

A security engineer is assigned to work with the patch and vulnerability management group. The deployment of a new patch has been approved and needs to be applied. The research is...

When telephones in a city are connected by a single exchange, the caller can only connect with the switchboard operator. The operator then manually connects the call. This is an ex...

Which of the following departments initiates the request, approval, and provisioning business process?

Which of the following should be done at a disaster site before any item is removed, repaired, or replaced?

Which organizational department is ultimately responsible for information governance related to e- mail and other e-records?

What is the FIRST step in risk management?

Which element of software supply chain management has the GREATEST security risk to organizations?

A colleague who recently left the organization asked a security professional for a copy of the organization's confidential incident management policy. Which of the following is the...

Within a large organization, what business unit is BEST positioned to initiate provisioning and deprovisioning of user accounts?

An enterprise is developing a baseline cybersecurity standard its suppliers must meet before being awarded a contract. Which of the following statements is TRUE about the baseline...

Which of the following is the MOST effective strategy to prevent an attacker from disabling a network?

Which of the following features is MOST effective in mitigating against theft of data on a corporate mobile device which has been stolen?

An organization is implementing data encryption using symmetric ciphers and the Chief Information Officer (CIO) is concerned about the risk of using one key to protect all sensitiv...

International bodies established a regulatory scheme that defines how weapons are exchanged between the signatories. It also addresses cyber weapons, including malicious software,...

In software development, developers should use which type of queries to prevent a Structured Query Language (SQL) injection?

Which of the following is a major component of the federated identity management (FIM) implementation model and used to establish a network between dozens of organizations?

A Chief Information Security Officer (CISO) is considering various proposals for evaluating security weaknesses and vulnerabilities at the source code level. Which of the following...

If a medical analyst independently provides protected health information (PHI) to an external marketing organization, which ethical principal is this a violation of?

Which component of the Security Content Automation Protocol (SCAP) specification contains the data required to estimate the severity of vulnerabilities identified automated vulnera...

Who in the organization is accountable for classification of data information assets?

The use of private and public encryption keys is fundamental in the implementation of which of the following?

What is the purpose of an Internet Protocol (IP) spoofing attack?

At what level of the Open System Interconnection (OSI) model is data at rest on a Storage Area Network (SAN) located?

In a Transmission Control Protocol/Internet Protocol (TCP/IP) stack, which layer is responsible for negotiating and establishing a connection with another node?

Which of the following is used by the Point-to-Point Protocol (PPP) to determine packet formats?

Which of the following operates at the Network Layer of the Open System Interconnection (OSI) model?

An external attacker has compromised an organization's network security perimeter and installed a sniffer onto an inside computer. Which of the following is the MOST effective laye...

An input validation and exception handling vulnerability has been discovered on a critical web- based system. Which of the following is MOST suited to quickly implement a control?

Which of the following is the BEST network defense against unknown types of attacks or stealth attacks in progress?

Which of the following factors contributes to the weakness of Wired Equivalent Privacy (WEP) protocol?

A manufacturing organization wants to establish a Federated Identity Management (FIM) system with its 20 different supplier companies. Which of the following is the BEST solution f...

Which of the following BEST describes an access control method utilizing cryptographic keys derived from a smart card private key that is embedded within mobile devices?

Users require access rights that allow them to view the average salary of groups of employees. Which control would prevent the users from obtaining an individual employee's salary?

What is the BEST approach for controlling access to highly sensitive information when employees have the same level of security clearance?

Which of the following is of GREATEST assistance to auditors when reviewing system configurations?

In which of the following programs is it MOST important to include the collection of security process data?

A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation. What MUST an administrator review to audit a user's access to data files?

Which of the following is a PRIMARY benefit of using a formalized security testing report format and structure?

Which of the following could cause a Denial of Service (DoS) against an authentication system?

An organization is found lacking the ability to properly establish performance indicators for its Web hosting solution during an audit. What would be the MOST probable cause?

Which of the following types of business continuity tests includes assessment of resilience to internal and external risks without endangering live operations?

What is the PRIMARY reason for implementing change management?

Which of the following is a PRIMARY advantage of using a third-party identity service?

With what frequency should monitoring of a control occur when implementing Information Security Continuous Monitoring (ISCM) solutions?

What should be the FIRST action to protect the chain of evidence when a desktop computer is involved?

What is the MOST important step during forensic analysis when trying to learn the purpose of an unknown application?

Which of the following security tools will ensure authorized data is sent to the application when implementing a cloud based application?

Before implementing an internet-facing router, a network administrator ensures that the equipment is baselined/hardened according to approved configurations and settings. This acti...

A cloud service provider requires its customer organizations to enable maximum audit logging for its data storage service and to retain the logs for the period of three months. The...