ISC2 Certified Information Systems Security Professional practice questions

1. Question 1 of 25

   Physical assets defined in an organization's business impact analysis (BIA) could include which of the following?

   • APersonal belongings of organizational staff members
   • BDisaster recovery (DR) line-item revenues
   • CCloud-based applications
   • DSupplies kept off-site a remote facility

   Show answer

   Correct answer: D

   How others answered

   • D95%

   Explanation

   Supplies, especially those kept off-site for disaster recovery or business continuity purposes, are physical assets. If these supplies are essential for the organization to continue its operations after a disruption, they would be considered in a BIA.

   Adapted from community discussion by 01010100 · 2023-10-17 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

   1. 0

      01010100

      2023-10-17

      Selected D10 upvotes

      Supplies, especially those kept off-site for disaster recovery or business continuity purposes, are physical assets. If these supplies are essential for the organization to continue its operations after a disruption, they would be considered in a BIA.

   2. S

      ShaneOrton

      2025-01-09

      Selected D8 upvotes

      None of the answer other than Option (D) is referencing physical asset. Also try Certsleader their study resources are fine and upto Date.

   3. B

      Bietchasup

      2024-12-10

      Selected D6 upvotes

      now that your're here. Don't rely on these questions. 0 on test

   4. C

      Cyber_Judy

      2024-09-23

      3 upvotes

      The correct answer to question #1 is D. Supplies kept off-site at a remote facility. Physical assets in the context of a BIA are any tangible resources that are essential to the operation of a business. This can include things like: Buildings and infrastructure Equipment and machinery Inventories and supplies Data and records Supplies kept off-site at a remote facility would fall into this category, as they are essential to the business' ability to operate in the event of a disruption at its primary location. The other answer choices are incorrect: A. Personal belongings of organizational staff members are not considered business assets, as they are not essential to the operation of the business. B. Disaster recovery (DR) line-item revenues are not physical assets, but rather financial assets. C. Cloud-based applications are not considered physical assets, as they are not tangible resources.

2. Question 2 of 25

   An organization has been collecting a large amount of redundant and unusable data and filling up the storage area network (SAN). Management has requested the identification of a solution that will address ongoing storage problems. Which is the BEST technical solution?

   • ACompression
   • BCaching
   • CReplication
   • DDeduplication

   Show answer

   Correct answer: D

   How others answered

   • D75%
   • A25%

   Explanation

   "D" it is. Data deduplication is a process that eliminates excessive copies of data and significantly decreases storage capacity requirements. Deduplication can be run as an inline process as the data is being written into the storage system and/or as a background process to eliminate duplicates after the data is written to disk. https://www.netapp.com/data-management/what-is-data-deduplication/#:~:text=Data%20deduplication%20is%20a%20process,data%20is%20written%20to%20disk.

   Adapted from community discussion by franbarpro · 2022-09-06 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

   1. T

      Tanzy360

      2022-09-06

      Selected D9 upvotes

      D is the only answer choice that makes sense with the excess data

   2. F

      franbarpro

      2022-09-06

      Selected D7 upvotes

      "D" it is. Data deduplication is a process that eliminates excessive copies of data and significantly decreases storage capacity requirements. Deduplication can be run as an inline process as the data is being written into the storage system and/or as a background process to eliminate duplicates after the data is written to disk. https://www.netapp.com/data-management/what-is-data-deduplication/#:~:text=Data%20deduplication%20is%20a%20process,data%20is%20written%20to%20disk.

   3. C

      CPT_Pepper

      2023-06-03

      3 upvotes

      ANSWER: A. (Ref: CISSP All In One Exam Guide (9th ed) - Shon Harris) Key words are "ongoing" , "management" and "BEST". If you dedupe existing storage, you are effectively DESTROYING data which violates the regulated data retention policy. In addition, you'd lose valuable event logs that may later support a security investigation. To address the storage issue TODAY, compressing the redundant data is the MOST sensible. The business can later go back and strategize what key information should really be included in the logs to reduce space, add more storage allocations, or even go to a cloud storage solution. Dedupe is a very drastic tactical measure with far stronger risk implications that could damage the organization. I suggest reading "How to Think Like a Manager for the CISSP Exam" by Luke Ahmed.

   4. M

      Moose01

      2024-12-02

      Selected D4 upvotes

      I need to slow down and read it. it is De-duplication not Duplication, Jesus what a trap.

3. Question 3 of 25

   What is the PRIMARY purpose of creating and reporting metrics for a security awareness, training, and education program?

   • AMeasure the effect of the program on the organization's workforce.
   • BMake all stakeholders aware of the program's progress.
   • CFacilitate supervision of periodic training events.
   • DComply with legal regulations and document due diligence in security practices.

   Show answer

   Correct answer: A

   How others answered

   • A69%
   • D31%

   Only 69% agreed on this answer — treat it as contested rather than settled.

   Explanation

   A. Measure the effect of the program on the organization's workforce. Creating and reporting metrics for a security awareness, training, and education program allows organizations to assess the effectiveness and impact of the program on their workforce By measuring the effect of the program, organizations can determine if their workforce is gaining knowledge, adopting desired behaviors, and applying security practices effectively.

   Adapted from community discussion by Bach1968 · 2023-07-05 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

   1. B

      Bach1968

      2023-07-05

      Selected A4 upvotes

      A. Measure the effect of the program on the organization's workforce. Creating and reporting metrics for a security awareness, training, and education program allows organizations to assess the effectiveness and impact of the program on their workforce By measuring the effect of the program, organizations can determine if their workforce is gaining knowledge, adopting desired behaviors, and applying security practices effectively.

   2. D

      deeden

      2024-08-06

      Selected A1 upvote

      This is the primary purpose of creating and reporting metrics for a security awareness, training, and education program. By measuring the program's effectiveness, organizations can: Demonstrate ROI: Justify the program's existence and secure continued funding. Identify areas for improvement: Pinpoint weaknesses in training content or delivery. Enhance security culture: Foster a culture of security awareness among employees. While the other options are important, they are secondary to the overall goal of measuring the program's impact on the workforce.

   3. I

      invincible96

      2023-03-23

      Selected A1 upvote

      The main point here is "Primary" which makes option A the right answer. Option D is not the primary purpose of creating and reporting metrics. While compliance with legal regulations and documenting due diligence are important, the primary purpose of metrics is to measure the effectiveness of the program in changing the behavior of the workforce.

   4. B

      BigITGuy

      2025-04-02

      Selected A1 upvote

      Not D (Comply with legal regulations and document due diligence in security practices) - While compliance may be a benefit, the primary purpose of metrics is to ensure the program is working effectively, not just to check a compliance box.

4. Question 4 of 25

   In a DevOps environment, which of the following actions is MOST necessary to have confidence in the quality of the changes being made?

   • APrepare to take corrective actions quickly.
   • BAutomate functionality testing.
   • CReview logs for any anomalies.
   • DReceive approval from the change review board.

   Show answer

   Correct answer: B

   How others answered

   • B57%
   • D41%

   Only 57% agreed on this answer — treat it as contested rather than settled.

   Explanation

   CISSP Official Study Guide pg 966 "...organizations using the DevOps model often deploy code several times per day. Some organizations even strive to reach the goal of continuous integration/continuous delivery (CI/CD), where code may roll out dozens or even hundreds of times per day. This requires a high degree of automation, including integrating code repositories, the software configuration management process, and the movement of code between development, testing, and production environments."

   Adapted from community discussion by RVoigt · 2023-03-04 · 16 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

   1. R

      RVoigt

      2023-03-04

      Selected B16 upvotes

      CISSP Official Study Guide pg 966 "...organizations using the DevOps model often deploy code several times per day. Some organizations even strive to reach the goal of continuous integration/continuous delivery (CI/CD), where code may roll out dozens or even hundreds of times per day. This requires a high degree of automation, including integrating code repositories, the software configuration management process, and the movement of code between development, testing, and production environments."

   2. S

      somkiatr

      2022-12-28

      Selected B2 upvotes

      A successful DevOps testing strategy is one aimed at building, testing and releasing software faster and more frequently. If you're lucky enough to start out in a "greenfield" organization without an established coding culture, it's a good idea to try to create and automate your software delivery pipeline upfront. If you're successful out-of-the-gate in creating a Continuous Delivery DevOps pipeline, your business will be much more competitive since you'll be able to get higher-quality software into the hands of your users and customers faster than your competitors, and you'll be able to react to business demand and change much more rapidly. reference : https://smartbear.com/blog/devops-testing-strategy-best-practices-tools/#:~:text=A%20successful%20DevOps%20testing%20strategy%20is%20one%20aimed%20at%20building,your%20software%20delivery%20pipeline%20upfront.

   3. [

      [Removed]

      2024-07-23

      Selected B2 upvotes

      Option D , is indeed a critical step in change mgmt. However, in the context of having confidence in the "quality" of changes being made in a DevOps environment, automated functionality testing (Option B) is typically seen as more directly related. You can then submit your request for change to the CAB knowing that you`ve done the due diligence through testing prior to submittal . Also you may refer to the Official study guide page 966 as RVoigt suggested.

   4. A

      Andy880

      2023-05-14

      4 upvotes

      https://kb.mit.edu/confluence/pages/viewpage.action?pageId=155261648

5. Question 5 of 25

   What is the MAIN purpose of a security assessment plan?

   • AProvide education to employees on security and privacy, to ensure their awareness on policies and procedures.
   • BProvide the objectives for the security and privacy control assessments and a detailed roadmap of how to conduct such assessments.
   • CProvide guidance on security requirements, to ensure the identified security risks are properly addressed based on the recommendation.
   • DProvide technical information to executives to help them understand information security postures and secure funding.

   Show answer

   Correct answer: B

   How others answered

   • B91%

   Explanation

   The MAIN purpose of a security assessment plan is: B. Provide the objectives for the security and privacy control assessments and a detailed roadmap of how to conduct such assessments. A security assessment plan outlines the objectives, scope, methodology, and approach for conducting security and privacy control assessments within an organization. Its primary purpose is to provide a clear roadmap and guidance on how to assess and evaluate the effectiveness of security controls in place.

   Adapted from community discussion by Bach1968 · 2024-01-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • nist.gov documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

   1. B

      Bach1968

      2024-01-05

      Selected B2 upvotes

      The MAIN purpose of a security assessment plan is: B. Provide the objectives for the security and privacy control assessments and a detailed roadmap of how to conduct such assessments. A security assessment plan outlines the objectives, scope, methodology, and approach for conducting security and privacy control assessments within an organization. Its primary purpose is to provide a clear roadmap and guidance on how to assess and evaluate the effectiveness of security controls in place.

   2. Y

      YesPlease

      2024-06-10

      Selected B3 upvotes

      Answer B) Keyword in question is "plan" and the only sentence that refers to a plan is "The objectives for the control assessments and a detailed roadmap of how to conduct such assessments."

   3. D

      dev46

      2023-03-22

      3 upvotes

      B could be right, but D sounds right too I have been engaged with a few initiatives where executives want to conduct security assessments and see if it's financially viable to kick off the project or not.

   4. J

      Jamati

      2023-05-09

      Selected B2 upvotes

      Clearly the answer is B here. Before conducting a security assessment, you need to know the objectives of that assessment, and all objectives must be SMART (Specific, Measurable, Attainable/Achievable, Relevant, Time-bound).

6. Question 6 of 25

   What documentation is produced FIRST when performing an effective physical loss control process?

   • ADeterrent controls list
   • BSecurity standards list
   • CAsset valuation list
   • DInventory list

   Show answer

   Correct answer: D

   How others answered

   • D71%
   • C29%

   Only 71% agreed on this answer — treat it as contested rather than settled.

   Explanation

   I believe the key in the question here is word "effective": (effective physical loss control process). ! Asset valuation should be the answer. Because this list is not any list, but it is driven from risk analysis process.

   Adapted from community discussion by oudmaster · 2023-06-25 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • isaca.org documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

   1. C

      Cww1

      2023-03-06

      14 upvotes

      I would go D, you need to inventory assets before you can value them.

   2. O

      oudmaster

      2023-06-25

      5 upvotes

      I believe the key in the question here is word "effective": (effective physical loss control process). ! Asset valuation should be the answer. Because this list is not any list, but it is driven from risk analysis process.

   3. D

      Dee83

      2023-07-21

      2 upvotes

      D. Inventory list The first step in an effective physical loss control process is to conduct an inventory of the organization's assets. This includes identifying, cataloging, and valuing all physical assets that are important to the organization. The inventory list should include a description of each asset, its location, and its value. This information is used to identify the most critical assets that need to be protected and to prioritize security measures. The inventory list serves as the foundation for the rest of the physical loss control process, providing a clear understanding of the assets that need to be protected and the potential risks that they may face.

   4. S

      SongOTD

      2023-04-10

      Selected D3 upvotes

      You need to know what you have , then the value for each item.

7. Question 7 of 25

   Which organizational department is ultimately responsible for information governance related to e-mail and other e-records?

   • ALegal
   • BAudit
   • CCompliance
   • DSecurity

   Show answer

   Correct answer: A

   How others answered

   • A74%
   • C26%

   Only 74% agreed on this answer — treat it as contested rather than settled.

   Explanation

   A. Legal. The legal department is ultimately responsible for information governance related to e-mail and other electronic records within an organization. This responsibility includes establishing policies, procedures, and guidelines for the proper management, retention, and disposal of electronic records in compliance with applicable laws, regulations, and industry standards. The legal department ensures that the organization maintains legal and regulatory compliance regarding e-records, including e-mail communications. They also handle any legal matters related to e-records, such as e-discovery requests or litigation involving electronic evidence.

   Adapted from community discussion by Bach1968 · 2023-07-05 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

   1. B

      Bach1968

      2023-07-05

      Selected A3 upvotes

      A. Legal. The legal department is ultimately responsible for information governance related to e-mail and other electronic records within an organization. This responsibility includes establishing policies, procedures, and guidelines for the proper management, retention, and disposal of electronic records in compliance with applicable laws, regulations, and industry standards. The legal department ensures that the organization maintains legal and regulatory compliance regarding e-records, including e-mail communications. They also handle any legal matters related to e-records, such as e-discovery requests or litigation involving electronic evidence.

   2. F

      Firedragon

      2022-11-14

      Selected A4 upvotes

      A. https://www.ironmountain.com/resources/general-articles/w/who-really-owns-your-information-governance-program Every IG program needs a Jeter—a senior executive who typically works in the legal, IT, compliance or risk management department. Player #1: The Legal Eagle. Your legal team's IG role is to determine your firm's ongoing profile based on (among other factors):

   3. V

      Vasyamba1

      2024-03-21

      Selected A1 upvote

      OSG p912 - In legal proceedings, each side has a duty to preserve evidence related to the case and, through the discovery process, share information with their adversary in the proceedings. This discovery process applies to both paper records and electronic records, and the electronic discovery (or eDiscovery) process facilitates the processing of electronic information for disclosure. The Electronic Discovery Reference Model (EDRM) describes a standard process for conducting eDiscovery with nine aspects: 1. Information Governance - Ensures that information is well organized for future eDiscovery efforts.

   4. R

      Ramye

      2024-05-20

      2 upvotes

      In theory it my be Legal but in reality this department does not get involve For information governance for email or e-records unless or until there’s a litigation situation. In reality it is the compliance team that is responsible for to be compliant in these. For the sake of CISSP the answer could be Legal as many said but a confirmed answer needed to be sure.

8. Question 8 of 25

   A cloud service provider requires its customer organizations to enable maximum audit logging for its data storage service and to retain the logs for the period of three months. The audit logging gene has extremely high amount of logs. What is the MOST appropriate strategy for the log retention?

   • AKeep all logs in an online storage.
   • BKeep last week's logs in an online storage and the rest in an offline storage.
   • CKeep last week's logs in an online storage and the rest in a near-line storage.
   • DKeep all logs in an offline storage.

   Show answer

   Correct answer: C

   How others answered

   • C64%
   • B36%

   Only 64% agreed on this answer — treat it as contested rather than settled.

   Explanation

   B is right Near line is ideal if you want to access the data (at least once a month) but for pure retention purpose, off-line is cost-effective option

   Adapted from community discussion by dev46 · 2023-03-22 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

   1. D

      dev46

      2023-03-22

      9 upvotes

      B is right Near line is ideal if you want to access the data (at least once a month) but for pure retention purpose, off-line is cost-effective option

   2. B

      BenjamineSB

      2024-02-11

      Selected C4 upvotes

      This option is the most balanced. Logs from the last week (which are the most likely to be immediately accessed for recent incidents or issues) are kept readily available online. The older logs, which might be accessed less frequently but still within a reasonable time frame, are kept in near-line storage, which offers a compromise between accessibility and cost.

   3. 7

      73f8ac3

      2024-10-08

      Selected C1 upvote

      For cloud storage, there are two things to keep in mind : - Offline storage is cheap, but it can become costly if you need to access it, also for offline, 3 months is short, so there might be penalties there if you access or delete the data before one year - on the other hand, nearline allows you to retrieve the data with very little or no additional costs when it is in a short period like 3 months. 3 months is an appropriate period for a nearline storage, so C is my choice

   4. H

      HeadAttacks

      2023-07-11

      3 upvotes

      This is a strange question. Cost of storage types matters a lot, very hard to say what is most appropriate without more information. Must know the frequency of log reviews as well.

9. Question 9 of 25

   In Federated Identity Management (FIM), which of the following represents the concept of federation?

   • ACollection, maintenance, and deactivation of user objects and attributes in one or more systems, directories or applications
   • BCollection of information logically grouped into a single entity
   • CCollection of information for common identities in a system
   • DCollection of domains that have established trust among themselves

   Show answer

   Correct answer: D

   How others answered

   • D79%
   • A21%

   Explanation

   CISSP All-In-One Exam Guide 9th Edition: ! User provisioning refers to the creation, maintenance, and deactivation of user objects and attributes as they exist in one or more systems, directories, or applications, in response to business processes. User provisioning software may include one or more of the following components: change propagation, self-service workflow, consolidated user administration, delegated user administration, and federated change control. User objects may represent employees, contractors, vendors, partners, customers, or other recipients of a service. Services may include e-mail, access to a database, access to a file server or database, and so on. ! So option A is a definition of User provisioning.

   Adapted from community discussion by oudmaster · 2023-06-16 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

   1. O

      oudmaster

      2023-06-16

      Selected D3 upvotes

      CISSP All-In-One Exam Guide 9th Edition: ! User provisioning refers to the creation, maintenance, and deactivation of user objects and attributes as they exist in one or more systems, directories, or applications, in response to business processes. User provisioning software may include one or more of the following components: change propagation, self-service workflow, consolidated user administration, delegated user administration, and federated change control. User objects may represent employees, contractors, vendors, partners, customers, or other recipients of a service. Services may include e-mail, access to a database, access to a file server or database, and so on. ! So option A is a definition of User provisioning.

   2. J

      Jamati

      2023-05-09

      Selected D2 upvotes

      D is correct. FIM extends beyond a single organization. Multiple organizations can join a federation or group, where they agree to share identity information. Users in each organization can log on once in their own organization, and their credentials are matched with a federated Implementing Identity Management system. They can then use this federated identity to access resources in any other organization within the group. A federation can be composed of multiple organizations sharing resources, or any other group that can agree on a common federated identity management system. CISSP official study guide 9th edition - page 660

   3. M

      Mgz156

      2023-03-24

      4 upvotes

      Answer is A. Please do not confuse with AD Federation with Federated Identity. Federated identity management systems offer single access to a number of applications across various enterprises.

   4. D

      Dee83

      2023-07-26

      1 upvote

      D. Collection of domains that have established trust among themselves represents the concept of federation in Federated Identity Management (FIM). In FIM, federation is the process of connecting multiple domains or systems together, so that they can share and trust each other's identities. This enables users to access different systems and applications using a single set of credentials, without the need for multiple usernames and passwords. By establishing trust among domains, FIM enables a seamless and secure flow of identity information across multiple systems and organizations, allowing users to access resources they are authorized to access, with out the need to authenticate each time they access a new resource.

10. Question 10 of 25

    Which of the following is an indicator that a company's new user security awareness training module has been effective?

    • AThere are more secure connections to internal e-mail servers.
    • BMore incidents of phishing attempts are being reported.
    • CFewer incidents of phishing attempts are being reported.
    • DThere are more secure connections to the internal database servers.

    Show answer

    Correct answer: B

    How others answered

    • B74%
    • C26%

    Only 74% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Tricky options B & C - I ended up choosing C, but B is right The whole idea of awareness training is to change user behaviour. When more incidents are reported, it's a good indicator that users are security aware and taking the right action

    Adapted from community discussion by dev46 · 2022-09-21 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. D

       dev46

       2022-09-21

       9 upvotes

       Tricky options B & C - I ended up choosing C, but B is right The whole idea of awareness training is to change user behaviour. When more incidents are reported, it's a good indicator that users are security aware and taking the right action

    2. S

       Soleandheel

       2023-12-07

       4 upvotes

       C. Fewer incidents of phishing attempts are being reported. For those selecting B, you are mistaken. I understand your logic, you're thinking that employees will report more phishing attemps when they are more away but your approach of looking at it is flawed. When an awareness program is effective, employees will have fewer security incidents. There is a difference between a security event and a security incident. An incident usually means that the phishing event was successful and as such an incident that needs to be contained or mitigated. C. is the correct answer because fewer incidents will be reported because the phishing attempt events will not be successful to become incidents. I hope this makes sense to you. You have to be able to distinguish between a phishing event and a phishing incident. There is a difference between an event and an incident. Not all security events are incidents.

    3. M

       MG1707

       2022-10-15

       Selected B4 upvotes

       To report it one shall recognize it, so B, as a progress measure of awareness

    4. L

       LalithW

       2023-10-04

       2 upvotes

       Here most of the people have misunderstood the word Incident and have voted for C. According to NIST, an Incident is An occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies. Simply, a security incident is an event that may indicate that an organization's systems or data have been compromised. So fewer incidents of phishing attempts are being reported means that the awareness training are success.

11. Question 11 of 25

    An organization is trying to secure instant messaging (IM) communications through its network perimeter. Which of the following is the MOST significant challenge?

    • AIM clients can interoperate between multiple vendors.
    • BIM clients can run as executables that do not require installation.
    • CIM clients can utilize random port numbers.
    • DIM clients can run without administrator privileges.

    Show answer

    Correct answer: C

    How others answered

    • C81%
    • A19%

    Explanation

    C. IM clients can utilize random port numbers. Through the perimeter lends me to think they are asking for firewall ports to open

    Adapted from community discussion by stickerbush1970 · 2023-03-20 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. S

       stickerbush1970

       2023-03-20

       Selected C10 upvotes

       C. IM clients can utilize random port numbers. Through the perimeter lends me to think they are asking for firewall ports to open

    2. J

       JAckThePip

       2023-04-03

       5 upvotes

       Answer is C "IM clients find ways to tunnel through firewalls, creating risk. Most IM services come through well-publicized ports (5190 for AOL Instant Messenger, 1863 for MSN and 5050 for Yahoo), but IM clients also can exploit any open port on the firewall, including those used by other applications (such as Port 80 for Web and HTTP traffic). Some clients also can connect via peer-to-peer connections or establish connections on randomly negotiated ports." https://www.networkworld.com/article/2323048/top-5-im-security-risks.html

    3. D

       Dee83

       2023-07-21

       1 upvote

       C. IM clients can utilize random port numbers. The use of random port numbers by IM clients can make it difficult to secure the organization's network perimeter. Because IM clients can use any available port, it can be challenging for network administrators to identify and block IM traffic. This makes it difficult to ensure that all IM traffic is being properly monitored and controlled, increasing the risk that sensitive information could be leaked or that malware could spread through the network. In addition, the use of random port numbers can allow IM clients to bypass firewalls and intrusion detection systems, making it harder to detect and prevent unauthorized access to the network.

    4. M

       murphseal

       2024-10-03

       Selected C1 upvote

       C. IM clients can utilize random port numbers. Random port numbers can make it difficult for traditional security measures to effectively control and secure IM traffic, as they can bypass standard port-based security policies. This can pose a significant challenge in monitoring and securing IM communications within the network perimeter.

12. Question 12 of 25

    Using the cipher text and resultant cleartext message to derive the monoalphabetic cipher key is an example of which method of cryptanalytic attack?

    • AKnown-plaintext attack
    • BCiphertext-only attack
    • CFrequency analysis
    • DProbable-plaintext attack

    Show answer

    Correct answer: A

    How others answered

    • A64%
    • B21%

    Only 64% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A. Known-plaintext attack In a known-plaintext attack, the attacker has access to both the cipher text (encrypted message) and the corresponding cleartext (decrypted message). By analyzing the relationship between the two, the attacker attempts to derive the encryption key or discover vulnerabilities in the encryption algorithm. In this case, using the cipher text and the resultant cleartext message to derive the monoalphabetic cipher key falls under the category of a known-plaintext attack. The attacker can compare the pairs of known cipher text and cleartext to deduce the correspondence between specific characters or patterns, which can lead to the recovery of the encryption key.

    Adapted from community discussion by Bach1968 · 2024-01-05 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. B

       Bach1968

       2024-01-05

       Selected A3 upvotes

       A. Known-plaintext attack In a known-plaintext attack, the attacker has access to both the cipher text (encrypted message) and the corresponding cleartext (decrypted message). By analyzing the relationship between the two, the attacker attempts to derive the encryption key or discover vulnerabilities in the encryption algorithm. In this case, using the cipher text and the resultant cleartext message to derive the monoalphabetic cipher key falls under the category of a known-plaintext attack. The attacker can compare the pairs of known cipher text and cleartext to deduce the correspondence between specific characters or patterns, which can lead to the recovery of the encryption key.

    2. I

       imather

       2025-01-20

       Selected A1 upvote

       A. Known-plaintext attack - KPA requires having plaintext and cipher text pairs in order to map out the key. (https://www.geeksforgeeks.org/cryptanalysis-and-types-of-attacks/) B. Ciphertext-only attack - COA has the cipher text only. This cannot be the answer. (https://www.geeksforgeeks.org/cryptanalysis-and-types-of-attacks/) C. Frequency analysis - frequency analysis is tempting since it mentions a monoaplphabetic key which is what frequency analysis is strong at breaking. However, as you have both the cipher and plaintext in this scenario, you don't need frequency analysis. (https://www.101computing.net/frequency-analysis/) D. Probable-plaintext attack - "A probable plaintext attack works by looking at certain bit positions for which a likely value can be predicted." (https://www.cs.columbia.edu/~smb/papers/probtxt.pdf) This attack is not relevant as you have the full plaintext.

    3. J

       Jamati

       2023-05-09

       Selected A3 upvotes

       In the known plaintext attack, the attacker has both a copy of the encrypted message along with the plaintext message that was used to generate the ciphertext.

    4. G

       GuardianAngel

       2024-08-05

       2 upvotes

       known plain text attack is the answer: https://www.sciencedirect.com/topics/computer-science/plaintext-attack#:~:text=In%20the%20known%20plaintext%20attack,try%20to%20decrypt%20the%20ciphertext.

13. Question 13 of 25

    Which Wide Area Network (WAN) technology requires the first router in the path to determine the full path the packet will travel, removing the need for other routers in the path to make independent determinations?

    • ASynchronous Optical Networking (SONET)
    • BMultiprotocol Label Switching (MPLS)
    • CFiber Channel Over Ethernet (FCoE)
    • DSession Initiation Protocol (SIP)

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    "B" it is! Multiprotocol label switching (MPLS) is a technique for speeding up network connections that was first developed in the 1990s. The public Internet functions by forwarding packets from one router to the next until the packets reach their destination. MLPS, on the other hand, sends packets along predetermined network paths. Ideally, the result is that routers spend less time deciding where to forward each packet, and packets take the same path every time. Consider the process of planning a long drive. Instead of identifying which towns and cities one must drive through in order to reach the destination, it is usually more efficient to identify the roads that go in the correct direction. Similarly, MPLS identifies paths — network "roads" — rather than a series of intermediary destinations. https://www.cloudflare.com/learning/network-layer/what-is-mpls/

    Adapted from community discussion by franbarpro · 2022-09-06 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. F

       franbarpro

       2022-09-06

       Selected B12 upvotes

       "B" it is! Multiprotocol label switching (MPLS) is a technique for speeding up network connections that was first developed in the 1990s. The public Internet functions by forwarding packets from one router to the next until the packets reach their destination. MLPS, on the other hand, sends packets along predetermined network paths. Ideally, the result is that routers spend less time deciding where to forward each packet, and packets take the same path every time. Consider the process of planning a long drive. Instead of identifying which towns and cities one must drive through in order to reach the destination, it is usually more efficient to identify the roads that go in the correct direction. Similarly, MPLS identifies paths — network "roads" — rather than a series of intermediary destinations. https://www.cloudflare.com/learning/network-layer/what-is-mpls/

    2. J

       Jenkins3mol

       2024-09-23

       Selected B5 upvotes

       The answer is: B. Multiprotocol Label Switching (MPLS) Here's why the other options are incorrect: Synchronous Optical Networking (SONET): SONET is a physical layer technology that deals with the transmission of data over optical fiber. It doesn't handle path determination. Fiber Channel Over Ethernet (FCoE): FCoE is a protocol for encapsulating Fibre Channel frames over Ethernet networks. It doesn't involve path determination either. Session Initiation Protocol (SIP): SIP is a signaling protocol for establishing and terminating voice and video communication sessions. It doesn't handle path determination in WANs. MPLS, on the other hand, is a technology that uses labels to direct packets across a network. The first router in the path assigns a label to the packet, and subsequent routers simply switch the packet based on the label, eliminating the need for them to independently determine the entire path.

    3. C

       Cww1

       2022-09-06

       4 upvotes

       Multiprotocol Label Switching ( MPLS) is a routing technique in telecommunications networks that directs data from one node to the next based on short path labels rather than long network addresses, thus avoiding complex lookups in a routing table and speeding traffic flows.

    4. J

       Jamati

       2024-09-23

       Selected B2 upvotes

       MPLS is correct, however, technically speaking, with MPLS the first router does not really determine the full path that the packet will traverse, it only determines the next hop info using labels, not the full path. Only Segment Routing, not MPLS, would have this capability to have the 1st router determine the full path.

14. Question 14 of 25

    A subscription service which provides power, climate control, raised flooring, and telephone wiring but NOT the computer and peripheral equipment is BEST described as a:

    • Acold site.
    • Bwarm site.
    • Chot site.
    • Dreciprocal site.

    Show answer

    Correct answer: A

    How others answered

    • A89%

    Explanation

    Hot site A facility that is fully configured and ready to operate within a few hours. Warm site A facility that is usually partially configured with some equipment, such as HVAC, and foundational infrastructure components, but does not include all the hardware needed to restore mission-critical business functions. These sites typically do not have data replicated to them, so backups would have to be delivered and restored onto the warm site systems after a disaster. Cold site A facility that supplies the basic environment, electrical wiring, HVAC, plumbing, and flooring but none of the equipment or additional services. A cold site is essentially an empty data center.

    Adapted from community discussion by DracoL · 2023-04-22 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. [

       [Removed]

       2024-11-21

       12 upvotes

       A: Cold site is the correct answer Because computer and peripheral equipment's are not icluded.

    2. D

       DracoL

       2023-04-22

       Selected A6 upvotes

       Hot site A facility that is fully configured and ready to operate within a few hours. Warm site A facility that is usually partially configured with some equipment, such as HVAC, and foundational infrastructure components, but does not include all the hardware needed to restore mission-critical business functions. These sites typically do not have data replicated to them, so backups would have to be delivered and restored onto the warm site systems after a disaster. Cold site A facility that supplies the basic environment, electrical wiring, HVAC, plumbing, and flooring but none of the equipment or additional services. A cold site is essentially an empty data center.

    3. G

       GuardianAngel

       2024-08-10

       4 upvotes

       I initially choose cold site, but after reading different sources, the raised floors and telephone wiring would fall under "may have some pre-configured equipment" Personally I would interpret "equipment' as computers only but a cold site only has space and utilities. A raised floor is not a utility and not included in a bare-bones space, it's something that has to be installed and typically would have a cabling system installed with it which goes beyond "space and utilities' for a cold site. It's another one of those "throw in something seemingly minor to trick you" questions. https://www.snaketray.com/raised-floor-cable-management/

    4. A

       Alex71

       2023-08-27

       Selected A2 upvotes

       A cold site is a backup data center that is fully equipped with necessary infrastructure, such as power, cooling, and cabling, but it lacks the computing and networking hardware. In the event of a disaster or outage, the organization will need to procure, install, and configure the necessary hardware and software at the cold site, which can take time and lead to significant downtime. A warm site, on the other hand, is a backup data center that is partially equipped with computing and networking hardware. The hardware and software may not be the same as the primary site, but they will be pre-installed and configured to some extent, allowing for a quicker transition in case of a disaster. A warm site typically has power, cooling, and cabling infrastructure, as well as some level of network connectivity, and it may require additional hardware to be procured and installed before it can become fully operational.

15. Question 15 of 25

    The quality assurance (QA) department is short-staffed and is unable to test all modules before the anticipated release date of an application. What security control is MOST likely to be violated?

    • AChange management
    • BSeparation of environments
    • CProgram management
    • DMobile code controls

    Show answer

    Correct answer: A

    How others answered

    • A75%
    • C25%

    Explanation

    Violated the "Release Control" of Change Management. Release Control Once the changes are finalized, they must be approved for release through the release control procedure. An essential step of the release control process is to double-check and ensure that any code inserted as a programming aid during the change process (such as debugging code and/or backdoors) is removed before releasing the new software to production. This process also ensures that only approved changes are made to production systems. Release control should also include acceptance testing to ensure that any alterations to end-user work tasks are understood and functional.

    Adapted from community discussion by Roy_Xenon · 2022-10-05 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. R

       Roy_Xenon

       2022-10-05

       Selected A12 upvotes

       Violated the "Release Control" of Change Management. Release Control Once the changes are finalized, they must be approved for release through the release control procedure. An essential step of the release control process is to double-check and ensure that any code inserted as a programming aid during the change process (such as debugging code and/or backdoors) is removed before releasing the new software to production. This process also ensures that only approved changes are made to production systems. Release control should also include acceptance testing to ensure that any alterations to end-user work tasks are understood and functional.

    2. S

       stickerbush1970

       2022-09-20

       3 upvotes

       I am thinking this does align with C PM-11 MISSION/BUSINESS PROCESS DEFINITION Page last updated: Control Description The organization: Defines mission/business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and Determines information protection needs arising from the defined mission/business processes and revises the processes as necessary, until achievable protection needs are obtained. PM-11 MISSION/BUSINESS PROCESS DEFINITION Control Description The organization: Defines mission/business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and Determines information protection needs arising from the defined mission/business processes and revises the processes as necessary, until achievable protection needs are obtained.

    3. A

       Alex71

       2023-02-27

       Selected A2 upvotes

       The security control that is most likely to be violated in this scenario is "Change management." Change management is a process that is designed to ensure that changes to systems or applications are made in a controlled and authorized manner, minimizing the risk of disruption or compromise. Testing is an important part of the change management process, as it helps to identify and address any security issues that may be introduced as a result of a change. If the QA department is short-staffed and cannot test all modules before the anticipated release date of an application, it is likely that some changes will not be adequately tested, which could result in security issues being introduced into the application.

    4. S

       somkiatr

       2022-12-29

       Selected A1 upvote

       I agreed with A. Shouldn't be C. What Is Program Management? Program management refers to managing all processes associated collectively with individual projects, such as looking into the staff, and work-related actions, aligning multiple projects with the company's objectives and reporting on status updates and progress. It also oversees the resource management plan and plans for involved projects regarding strategies and change management. reference : https://www.simplilearn.com/what-is-program-management-article The Change Management control can be re-designed to match the release control strategy. reference : https://cloud.google.com/architecture/devops/devops-process-streamlining-change-approval

16. Question 16 of 25

    What is the FIRST step when developing an Information Security Continuous Monitoring (ISCM) program?

    • ACollect the security-related information required for metrics, assessments, and reporting.
    • BEstablish an ISCM program determining metrics, status monitoring frequencies, and control assessment frequencies.
    • CDefine an ISCM strategy based on risk tolerance.
    • DEstablish an ISCM technical architecture.

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    Information Security Continuous Monitoring Reference Continuous monitoring can be a ubiquitous term as it means different things to different professions. NIST SP 800-137 sets forth a standard to follow when applying the principle in the risk management framework utilizing the NIST control set. The primary process for implementing ISCM is to: 1 - Define the ISCM strategy 2 - Establish an ISCM program 3 - Implement an ISCM program 4 - Analyze data and report findings 5 - Respond to findings 6 - Review and update the monitoring program and strategy Factored into this is the use of manual and automated checks to provide continuous updates and feedback to the system as a whole.

    Adapted from community discussion by rajkamal0 · 2022-12-27 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. R

       rajkamal0

       2022-12-27

       Selected C4 upvotes

       Information Security Continuous Monitoring Reference Continuous monitoring can be a ubiquitous term as it means different things to different professions. NIST SP 800-137 sets forth a standard to follow when applying the principle in the risk management framework utilizing the NIST control set. The primary process for implementing ISCM is to: 1 - Define the ISCM strategy 2 - Establish an ISCM program 3 - Implement an ISCM program 4 - Analyze data and report findings 5 - Respond to findings 6 - Review and update the monitoring program and strategy Factored into this is the use of manual and automated checks to provide continuous updates and feedback to the system as a whole.

    2. P

       Peterzhang

       2022-10-21

       3 upvotes

       C is correct which from the CISSP Cert guide 2022: According to NIST SP 800-137, ISCM is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. Organizations should take the following steps to establish, implement, and maintain ISCM: 1. Define an ISCM strategy based on risk tolerance that maintains clear visibility into assets, awareness of vulnerabilities, up-to-date threat information, and mission/business impacts. 2. Establish an ISCM program that includes metrics, status monitoring frequencies, control assessment frequencies, and an ISCM technical architecture.

    3. B

       Bach1968

       2023-07-06

       Selected C2 upvotes

       C. Define an ISCM strategy based on risk tolerance. When developing an Information Security Continuous Monitoring (ISCM) program, the first step is to define an ISCM strategy based on the organization's risk tolerance. This involves assessing the organization's risk appetite, understanding its security objectives, and determining the level of risk it is willing to accept.

    4. I

       IT_Guy23

       2022-09-24

       3 upvotes

       C is correct, the first step would be to define an ISCM strategy based on risk tolerance. B would be the second step.

17. Question 17 of 25

    What are the essential elements of a Risk Assessment Report (RAR)?

    • AExecutive summary, body of the report, and appendices
    • BExecutive summary, graph of risks, and process
    • CTable of contents, testing criteria, and index
    • DTable of contents, chapters, and executive summary

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    The essential elements of information in a risk assessment can be described in three sections of the risk assessment report (or whatever vehicle is chosen by organizations to convey the results of the assessment): (i) an executive summary; (ii) the main body containing detailed risk assessment results; and (iii) supporting appendices https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf

    Adapted from community discussion by rdy4u · 2023-10-27 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion3

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. R

       rdy4u

       2023-10-27

       Selected A11 upvotes

       The essential elements of information in a risk assessment can be described in three sections of the risk assessment report (or whatever vehicle is chosen by organizations to convey the results of the assessment): (i) an executive summary; (ii) the main body containing detailed risk assessment results; and (iii) supporting appendices https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf

    2. B

       Bach1968

       2024-07-06

       Selected A4 upvotes

       he essential elements of a Risk Assessment Report (RAR) typically include: A. Executive summary: This section provides a high-level overview of the risk assessment, including key findings, identified risks, and recommended actions. It is designed to provide a concise summary for executive stakeholders. B. Body of the report: This section contains the detailed analysis and findings of the risk assessment. It includes information such as the scope of the assessment, methodology used, risk identification and analysis, control evaluation, and risk treatment recommendations. It provides a comprehensive view of the risks and their potential impact on the organization. C. Appendices: The appendices contain supporting documentation and additional details that are referenced in the body of the report. This may include technical assessments, data analysis, risk matrices, mitigation plans, or other relevant information. The appendices provide supplemental information to support the findings and recommendations presented in the report.

    3. J

       JAckThePip

       2023-10-04

       3 upvotes

       Answer is correct https://www.sciencedirect.com/topics/computer-science/risk-assessment-report

18. Question 18 of 25

    When designing a new Voice over Internet Protocol (VoIP) network, an organization's top concern is preventing unauthorized users accessing the VoIP network. Which of the following will BEST help secure the VoIP network?

    • A802.11g
    • BWeb application firewall (WAF)
    • CTransport Layer Security (TLS)
    • D802.1x

    Show answer

    Correct answer: D

    How others answered

    • D56%
    • C44%

    Only 56% agreed on this answer — treat it as contested rather than settled.

    Explanation

    https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/concept/802-1x-pnac-voip-understanding-mx-series.html When you use Voice over IP (VoIP), you can connect IP telephones to the router and configure IEEE 802.1X authentication for 802.1X-compatible IP telephones. Starting with Junos OS Release 14.2, 802.1X authentication provides network edge security, protecting Ethernet LANs from unauthorized user access. When VoIP is used with 802.1X, the RADIUS server authenticates the phone. You can configure 802.1X authentication to work with VoIP in multiple supplicant or single supplicant mode. In multiple-supplicant mode, the 802.1X process allows multiple supplicants to connect to the interface. The BEST option to secure the VoIP network is option D, 802.1x. This is a standard for port-based network access control that provides authentication and authorization to devices trying to connect to the network. By implementing 802.1x, only authorized devices can connect to the VoIP network, preventing unauthorized access.

    Adapted from community discussion by 74gjd_37 · 2023-09-23 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • juniper.net documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. 7

       74gjd_37

       2023-09-23

       Selected D2 upvotes

       https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/concept/802-1x-pnac-voip-understanding-mx-series.html When you use Voice over IP (VoIP), you can connect IP telephones to the router and configure IEEE 802.1X authentication for 802.1X-compatible IP telephones. Starting with Junos OS Release 14.2, 802.1X authentication provides network edge security, protecting Ethernet LANs from unauthorized user access. When VoIP is used with 802.1X, the RADIUS server authenticates the phone. You can configure 802.1X authentication to work with VoIP in multiple supplicant or single supplicant mode. In multiple-supplicant mode, the 802.1X process allows multiple supplicants to connect to the interface. The BEST option to secure the VoIP network is option D, 802.1x. This is a standard for port-based network access control that provides authentication and authorization to devices trying to connect to the network. By implementing 802.1x, only authorized devices can connect to the VoIP network, preventing unauthorized access.

    2. D

       dev46

       2022-09-23

       Selected D4 upvotes

       The ask is for a VoIP network, not wireless A. 802.11g - inappropriate, not for wireless B. Web application firewall (WAF) - good for application layer security, not VoIP C. Transport Layer Security (TLS) - more for data in transit security D. 802.1x - perfect for filtering unauthorized access

    3. J

       Jamati

       2022-11-09

       5 upvotes

       I never look at their answers, I just go straight to the discussion.

    4. A

       abb77

       2022-10-28

       4 upvotes

       This is to protect against access (e.g. eavesdropping). This could be achieved by encryption e.g by SRTP or TLS orTLS/SRTP https://www.bandwidth.com/glossary/tlssrtp/

19. Question 19 of 25

    Which of the following frameworks provides vulnerability metrics and characteristics to support the National Vulnerability Database (NVD)?

    • ACommon Vulnerabilities and Exposures (CVE)
    • BCenter for Internet Security (CIS)
    • CCommon Vulnerability Scoring System (CVSS)
    • DOpen Web Application Security Project (OWASP)

    Show answer

    Correct answer: C

    How others answered

    • C89%

    Explanation

    C is Correct The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities. CVSS consists of three metric groups: Base, Temporal, and Environmental https://nvd.nist.gov/vuln-metrics/cvss

    Adapted from community discussion by explorer3 · 2023-04-24 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation
    • nist.gov documentation
    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. V

       Vino22

       2023-04-02

       11 upvotes

       A is correct https://cve.mitre.org/about/cve_and_nvd_relationship.html

    2. B

       Bach1968

       2024-01-06

       Selected C2 upvotes

       The framework that provides vulnerability metrics and characteristics to support the National Vulnerability Database (NVD) is the Common Vulnerability Scoring System (CVSS). CVSS is a standardized framework for assessing and rating the severity of vulnerabilities. It provides a set of metrics and scores that help to quantify the impact and exploitability of vulnerabilities. These scores are used by the NVD to provide consistent and objective information about vulnerabilities in various software and systems. Therefore, option C, Common Vulnerability Scoring System (CVSS), is the correct answer.

    3. E

       explorer3

       2023-04-24

       Selected C3 upvotes

       C is Correct The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities. CVSS consists of three metric groups: Base, Temporal, and Environmental https://nvd.nist.gov/vuln-metrics/cvss

    4. J

       JAckThePip

       2023-04-04

       4 upvotes

       Answer is correct "A CVSS score is composed of three sets of metrics (Base, Temporal, Environmental), each of which have an underlying scoring component." https://www.balbix.com/insights/understanding-cvss-scores/

20. Question 20 of 25

    What is the PRIMARY benefit of relying on Security Content Automation Protocol (SCAP)?

    • AStandardize specifications between software security products.
    • BAchieve organizational compliance with international standards.
    • CImprove vulnerability assessment capabilities.
    • DSave security costs for the organization.

    Show answer

    Correct answer: C

    How others answered

    • C49%
    • A46%

    Only 49% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Answer is c "The Security Content Automation Protocol (SCAP) is a method for using specific standards to enable automated vulnerability management, measurement, and policy compliance evaluation of systems deployed in an organization," https://en.wikipedia.org/wiki/Security_Content_Automation_Protocol

    Adapted from community discussion by JAckThePip · 2022-10-04 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. J

       JAckThePip

       2022-10-04

       13 upvotes

       Answer is c "The Security Content Automation Protocol (SCAP) is a method for using specific standards to enable automated vulnerability management, measurement, and policy compliance evaluation of systems deployed in an organization," https://en.wikipedia.org/wiki/Security_Content_Automation_Protocol

    2. 7

       74gjd_37

       2023-09-23

       Selected C3 upvotes

       From the point of view of a Certified Information Systems Security Professional (CISSP) within an organization, the primary benefit of relying on Security Content Automation Protocol (SCAP) would be to improve vulnerability assessment capabilities. SCAP provides a standardized way to evaluate and assess the security posture of an organization's systems and applications, which can help identify vulnerabilities and potential security risks. By using SCAP, a CISSP can gain better visibility into the security status of the organization's assets, which can help inform decisions about risk management and prioritize security efforts. Additionally, using SCAP can help demonstrate compliance with security regulations and standards, which is an important responsibility of a CISSP.

    3. D

       Delab202

       2023-01-02

       1 upvote

       One standard protocol for the automation of security-related data is the Security Content Automation Protocol. SCAP is administered by NIST, but it's developed and broadly supported through the security community. SCAP-compliant data uses standardized terminology and formatting so that security-related information is easy to read. Just as importantly, as XML data, it can be loaded into compliant software to make it easier to update security baselines and scanning criteria, or orchestrate it into workflows across the enterprise. When new vulnerabilities or configuration checklists arrive from your third-party feeds, you can combine them with your own customizations and push them to vulnerability management and configuration tools. SCAP 1.0 was published in 2010. The current version is 1.3, published in 2018. The protocol includes a variety of specifications for different kinds of security-related data, focused primarily on vulnerability management and system configuration.

    4. S

       somkiatr

       2023-01-02

       Selected C3 upvotes

       It mentions "PRIMARY Benefit" then C shows the benefit of SCAP. A seem to be not benefit.

21. Question 21 of 25

    Which application type is considered high risk and provides a common way for malware and viruses to enter a network?

    • AInstant messaging or chat applications
    • BPeer-to-Peer (P2P) file sharing applications
    • CE-mail applications
    • DEnd-to-end applications

    Show answer

    Correct answer: B

    How others answered

    • B82%

    Explanation

    Agreed B is highly likely to be correct. I was tempted to select email. Another reason why I go with B is because option D is positioned to trick the candidate. "D. End-to-end applications" closest match to P2P, so answer is B

    Adapted from community discussion by cccispman · 2022-12-29 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. C

       cccispman

       2022-12-29

       3 upvotes

       Agreed B is highly likely to be correct. I was tempted to select email. Another reason why I go with B is because option D is positioned to trick the candidate. "D. End-to-end applications" closest match to P2P, so answer is B

    2. J

       JAckThePip

       2022-10-02

       3 upvotes

       Answer is B "Eliminating unsecured file shares, which are a common way for malware to spread" https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-83r1.pdf

    3. D

       dev46

       2022-09-16

       2 upvotes

       P2P sounds good The question ask about application type. The keyword is "type". So, D will be eliminated straight away. Among A, B and C - PGP can be used for email protection and I can't recall but there is protection for chat app too. P2P such as torrent is the risky one.

    4. F

       febd35a

       2024-03-11

       2 upvotes

       I believe eliminating unsecured file shares in that context would be like a shared drive on the network that isn't secure. If you have a SAN that doesn't require authentication (isn't secured) that would be a problem.

22. Question 22 of 25

    The Chief Information Officer (CIO) has decided that as part of business modernization efforts the organization will move towards a cloud architecture. All business-critical data will be migrated to either internal or external cloud services within the next two years. The CIO has a PRIMARY obligation to work with personnel in which role in order to ensure proper protection of data during and after the cloud migration?

    • AChief Security Officer (CSO)
    • BInformation owner
    • CChief Information Security Officer (CISO)
    • DGeneral Counsel

    Show answer

    Correct answer: B

    How others answered

    • B67%
    • C33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I'd say B. It says primary obligation, not about hierarchy or sth. You can do this move without the CISO. Can you do it without the information owner? You are moving the information to cloud. owners are responsible with these information. You are obliged to do with this personnel. Sorry, dear ciso.

    Adapted from community discussion by TheManiac · 2024-05-18 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. T

       TheManiac

       2024-05-18

       Selected B4 upvotes

       I'd say B. It says primary obligation, not about hierarchy or sth. You can do this move without the CISO. Can you do it without the information owner? You are moving the information to cloud. owners are responsible with these information. You are obliged to do with this personnel. Sorry, dear ciso.

    2. I

       izaman2022

       2022-10-13

       5 upvotes

       I think in the context of the CISSP, the CISO generally reports to the CIO. So in this case, the CIO primarily needs to work with the CISO. The next logical step is that the CISO would work with the information owners to properly protect the data

    3. V

       Vasyamba1

       2024-03-23

       4 upvotes

       Information owner is responsible to define controls and ensure data is protected properly.

    4. O

       oudmaster

       2022-12-15

       3 upvotes

       Information Owner (or Data Owner) they own the data and usually the CIO report to them. While CISO reports to CIO. ! In my opinion, for the CIO to ensure the proper protection for the data, he should understand what is the protection requirement from the data owner first.

23. Question 23 of 25

    An organization is looking to include mobile devices in its asset management system for better tracking. In which system tier of the reference architecture would mobile devices be tracked?

    • A0
    • B1
    • C2
    • D3

    Show answer

    Correct answer: B

    How others answered

    • B49%
    • D24%
    • C16%

    Only 49% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Although I went for B: I assume they're talking about the IT Asset Management(ITAM) Tiers of which there are three: So there is no Tier 0 Tier 1 - Asset Data Collection - method to inventory every software application and virtual OS that runs on the hardware you have in your inventory Tier 2 - Asset Data Intelligence - normalize the information, to map the assets to relevant information, and to link the assets to their contracts, projects, departments, and people. Tier 3 - Asset Lifecycle management - processes that control how you purchase, procure, and dispose of IT assets. This includes virtual devices and software, along with the associated software licenses. NIST has it as Tier 1 - Reporting, Analytics, Data storage Tier 2 - Data collection ie location/HW/SW Tier 3 - Enterprise assets - Servers, workstations, Laptops etc So for tracking mobile devices, according to these it could be Tier 3 as the diagrams seem to work backwards to what you would expect (devices at level 1 etc)

    Adapted from community discussion by mark9999 · 2022-10-03 · 17 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation
    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. M

       mark9999

       2022-10-03

       Selected B17 upvotes

       Although I went for B: I assume they're talking about the IT Asset Management(ITAM) Tiers of which there are three: So there is no Tier 0 Tier 1 - Asset Data Collection - method to inventory every software application and virtual OS that runs on the hardware you have in your inventory Tier 2 - Asset Data Intelligence - normalize the information, to map the assets to relevant information, and to link the assets to their contracts, projects, departments, and people. Tier 3 - Asset Lifecycle management - processes that control how you purchase, procure, and dispose of IT assets. This includes virtual devices and software, along with the associated software licenses. NIST has it as Tier 1 - Reporting, Analytics, Data storage Tier 2 - Data collection ie location/HW/SW Tier 3 - Enterprise assets - Servers, workstations, Laptops etc So for tracking mobile devices, according to these it could be Tier 3 as the diagrams seem to work backwards to what you would expect (devices at level 1 etc)

    2. K

       karan1193

       2022-12-01

       4 upvotes

       Based on the Link below it seems the answer is Tier 3 for mobile as endpoints. Tier 3 Systems Tier 3 systems are the assets (end points) on the enterprise network that are owned by the enterprise, such as workstations, switches, servers, users’ laptops, virtual machines, and other devices. All enterprise assets are monitored from the start of their lifecycle until disposal by the systems in the Tier 2. Device location, owner, installed software catalog, current security vulnerabilities, and abnormal traffic activity are captured to allow for better visibility by administrators. https://www.nccoe.nist.gov/publication/1800-5/VolB/#figure-5-1

    3. G

       GuardianAngel

       2024-02-03

       3 upvotes

       According to NIST - answer would be Tier 3 (link and publication below https://www.nccoe.nist.gov/publication/1800-/VolB/index.html#figure-5-1 NIST SPECIAL PUBLICATION 1800-5B IT Asset Management Figure 5-2, ITAM Reference Functionality, shows how data flows through the ITAM system. Tier 3 is composed of enterprise assets themselves. Tier 3 is made up of all of the assets being tracked including hardware, software, and virtual machines. Tier 2 includes the sensors and independent systems that feed data into the enterprise ITAM system. Tier 2 systems include passive and active collection sensor and agents. Tier 1 is the enterprise ITAM system that provides the aggregation of data from all Tier 2 systems into business and security intelligence.

    4. L

       Lux007

       2024-07-26

       2 upvotes

       Correct answer is A. The system reference architecture with four tiers, starting from 0 to 3, and including mobile devices is the OSI Zero Trust Architecture. The four tiers are: 0. Device Tier (End-user devices): Mobile devices (smartphones, tablets) Laptops Desktops IoT devices 1. Infrastructure Tier (Network and infrastructure): Network devices (routers, switches, firewalls) Servers Data centers Cloud infrastructure 2. Application Tier (Applications and services): Web applications Mobile applications APIs Microservices 3. Data Tier (Data storage and processing): Databases Data warehouses Data lakes Big data processing The OSI Zero Trust Architecture is a security-focused framework that assumes no trust between tiers, emphasizing authentication, authorization, and encryption to protect data and resources.

24. Question 24 of 25

    An organization is considering partnering with a third-party supplier of cloud services. The organization will only be providing the data and the third-party supplier will be providing the security controls. Which of the following BEST describes this service offering?

    • APlatform as a Service (PaaS)
    • BAnything as a Service (XaaS)
    • CInfrastructure as a Service (IaaS)
    • DSoftware as a Service (SaaS)

    Show answer

    Correct answer: D

    How others answered

    • D52%
    • A43%

    Only 52% agreed on this answer — treat it as contested rather than settled.

    Explanation

    In saas, the user provides data. take gmail for example, your mails are your data while the gmail platform is the service you are using.

    Adapted from community discussion by Toyeeb · 2023-04-20 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • redhat.com documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. J

       Joe_Cheng

       2023-03-28

       Selected D11 upvotes

       https://www.ispsystem.com/news/xaas You will know it when you see the photo

    2. T

       Toyeeb

       2023-04-20

       8 upvotes

       In saas, the user provides data. take gmail for example, your mails are your data while the gmail platform is the service you are using.

    3. S

       splash2357

       2024-07-23

       4 upvotes

       Examples of PaaS are Google AppEngine, Heroku, AWS lambda, AWS Elastic Beanstalk where you need to bring your own codes. Most of them require you provide your code to the platform and it will help you to run it. The PaaS provider will manage the server and the "executable used to run the code" (sorry for bad english, i dun know the exact term, maybe "runtime"?). You are responsible for the security of the application though. For example, you can upload a python web application (e.g. flask/django) to Google AppEngine/Heroku, you won't need to manage the server (e.g. server hardening, apply server update patches). But you do need to manage the security of your python web app :)

    4. P

       Peduk70

       2023-03-25

       4 upvotes

       A is correct. In PAAS user only provides the Data and Applications while in SAAS user provides nothing but merely utilizes the provided service such as web applications. https://www.redhat.com/en/topics/cloud-computing/public-cloud-vs-private-cloud-and-hybrid-cloud

25. Question 25 of 25

    What is considered a compensating control for not having electrical surge protectors installed?

    • AHaving dual lines to network service providers built to the site
    • BHaving a hot disaster recovery (DR) environment for the site
    • CHaving network equipment in active-active clusters at the site
    • DHaving backup diesel generators installed to the site

    Show answer

    Correct answer: B

    How others answered

    • B55%
    • D41%

    Only 55% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Key here is "the site". If surge hits and nothing is protecting the hardware the entire site could be down and PSU fried. DR site would be elsewhere and be unaffected.

    Adapted from community discussion by Humongous1593 · 2022-10-12 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISSP or CertExamHQ.

    1. B

       Bhuraw

       2022-10-29

       19 upvotes

       very very unreal scenario. They haven't money for Surge protectors but want DR capabilities

    2. H

       Humongous1593

       2022-10-12

       Selected B7 upvotes

       Key here is "the site". If surge hits and nothing is protecting the hardware the entire site could be down and PSU fried. DR site would be elsewhere and be unaffected.

    3. C

       Coolwater

       2022-10-25

       4 upvotes

       If you dont have surge protectors in the Main data center , do we run all our production workloads in DR site for a long time ? Either we have to fix the issue by installing a surge protector or find a compensating solution . The question is asking for Compansating solution. A diesel generator will produce energy without any surge (it has its own circuits to prevent such surges if any ) , Answer is D

    4. D

       Dam0s

       2023-10-03

       Selected B2 upvotes

       If an electrical surge occurs, the systems themselves could be fried. An alternate source of power like a diesel generator will not help. They only solution to frying your actual systems from these options is an alternate DR site.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISSP practice, question 1 of 25