CISSP Exam Questions

A security professional has been asked to evaluate the options for the location of a new data center within a multifloor building. Concerns for the data center include emanations a...

Which of the following is the PRIMARY concern when using an Internet browser to access a cloud-based service?

After a thorough analysis, it was discovered that a perpetrator compromised a network by gaining access to the network through a Secure Socket Layer (SSL) Virtual Private Network (...

For an organization considering two-factor authentication for secure network access, which of the following is MOST secure?

If an identification process using a biometric system detects a 100% match between a presented template and a stored template, what is the interpretation of this result?

Regarding asset security and appropriate retention, which of the following INITIAL top three areas are important to focus on?

Discretionary Access Control (DAC) is based on which of the following?

By carefully aligning the pins in the lock, which of the following defines the opening of a mechanical lock without the proper key?

An organization has decided to contract with a cloud-based service provider to leverage their identity as a service offering. They will use Open Authentication (OAuth) 2.0 to authe...

How does an organization verify that an information system's current hardware and software match the standard system configuration?

The goal of a Business Continuity Plan (BCP) training and awareness program is to

Which of the following disaster recovery test plans will be MOST effective while providing minimal risk?

An organization has developed a major application that has undergone accreditation testing. After receiving the results of the evaluation, what is the final step before the applica...

What is one way to mitigate the risk of security flaws in custom software?

Which of the following is the BEST example of weak management commitment to the protection of security assets and resources?

What does an organization FIRST review to assure compliance with privacy requirements?

Which security approach will BEST minimize Personally Identifiable Information (PII) loss from a data breach?

An organization lacks a data retention policy. Of the following, who is the BEST person to consult for such requirement?

Which of the following analyses is performed to protect information assets?

The PRIMARY characteristic of a Distributed Denial of Service (DDoS) attack is that it

Which of the following is generally indicative of a replay attack when dealing with biometric authentication?

During a fingerprint verification process, which of the following is used to verify identity and authentication?

The BEST example of the concept of "something that a user has" when providing an authorized user access to a computing system is

A security professional is asked to provide a solution that restricts a bank teller to only perform a savings deposit transaction but allows a supervisor to perform corrections aft...

Sensitive customer data is going to be added to a database. What is the MOST effective implementation for ensuring data privacy?

Which of the following types of security testing is the MOST effective in providing a better indication of the everyday security challenges of an organization when performing a sec...

What is the MOST effective method of testing custom application code?

Which one of the following is a common risk with network configuration management?

What type of test assesses a Disaster Recovery (DR) plan using realistic disaster scenarios while maintaining minimal impact to business operations?

How can lessons learned from business continuity training and actual recovery incidents BEST be used?

Which of the following problem is the most difficult to defend against?

In configuration management, what baseline configuration information MUST be maintained for each computer system?

Which Radio Frequency Interference (RFI) phenomenon associated with bundled cable runs can create information leakage?

An organization's information security strategic plan MUST be reviewed

When building a data classification scheme, which of the following is the PRIMARY concern?

Which technology is a prerequisite for populating the cloud-based directory in a federated identity solution?

What is an advantage of Elliptic Curve Cryptography (ECC)?

Backup information that is critical to the organization is identified through a

When using Generic Routing Encapsulation (GRE) tunneling over Internet Protocol version 4 (IPv4), where is the GRE header inserted?

An application developer is deciding on the amount of idle session time that the application allows before a timeout. The BEST reason for determining the session timeout requiremen...

Knowing the language in which an encrypted message was originally produced might help a cryptanalyst to perform a

During the Security Assessment and Authorization process, what is the PRIMARY purpose for conducting a hardware and software inventory?

When evaluating third-party applications, which of the following is the GREATEST responsibility of Information Security?

An employee of a retail company has been granted an extended leave of absence by Human Resources (HR). This information has been formally communicated to the access provisioning te...

The goal of a Business Impact Analysis (BIA) is to determine which of the following?

What does the Maximum Tolerable Downtime (MTD) determine?

What is a characteristic of Secure Socket Layer (SSL) and Transport Layer Security (TLS)?

How does a Host Based Intrusion Detection System (HIDS) identify a potential attack?

From a cryptographic perspective, the service of non-repudiation includes which of the following features?

Which of the following BEST represents the concept of least privilege?