Question 91 · 483 in bank
What is considered the BEST explanation when determining whether to provide remote network access to a third-party security service?
Show answer
Answer: C
ISC2 Certified Information Systems Security Professional483 questions across 49 pages are complete and free, with no account or card.
483 questions in this bank
Free access · progress saved on this device
What is considered the BEST explanation when determining whether to provide remote network access to a third-party security service?
Answer: C
The Chief Information Security Officer (CISO) is to establish a single, centralized, and relational repository to hold all information regarding the software and hardware assets. Which of the following s ions would be the BEST option?
Answer: B
The CMDB tracks IT assets from a service and operational perspective, while ITAM focuses on IT assets from a financial and cost perspective.
Source: Adapted from community discussion — stickerbush1970
The acquisition of personal data being obtained by a lawful and fair means is an example of what principle?
Answer: A
What type of investigation applies when malicious behavior is suspected between two organizations?
Answer: C
When malicious behavior is suspected between two organizations, the type of investigation that applies is typically a civil investigation. A civil investigation focuses on legal issues and disputes between parties, including breaches of contract, intellectual property infringement, or other non-criminal offenses. In the context of malicious behavior between organizations, a civil investigation may involve gathering evidence, conducting interviews, and pursuing legal action to resolve the dispute and seek damages or other remedies.
Source: Adapted from community discussion — Bach1968
Which of the following is the MOST appropriate control for asset data labeling procedures?
Answer: A
Which of the following techniques evaluates the secure design principles of network or software architectures?
Answer: C
Threat Modeling approaches on below is the foundation of secure design 1) Focus on assets 2) Focus on attackers 3) Focus on software/ application
Source: Adapted from community discussion — dev46
What is the BEST approach to anonymizing personally identifiable information (PII) in a test environment?
Answer: B
Which element of software supply chain management has the GREATEST security risk to organizations?
Answer: A
The correct answer is A: "Unsupported libraries are often used". The use of unsupported libraries in software development can pose a significant security risk to organizations. Unsupported libraries may have vulnerabilities that are not patched or addressed by the developer, which can be exploited by attackers. Additionally, unsupported libraries may not receive timely updates or support, which can leave them vulnerable to exploits. It is, therefore, essential for organizations to manage their use of libraries carefully and ensure that they are using supported and up-to-date libraries in their software development processes to minimize security risks.
Source: Adapted from community discussion — 74gjd_37
Which of the following departments initiates the request, approval, and provisioning business process?
Answer: C
When reviewing vendor certifications for handling and processing of company data, which of the following is the BEST Service Organization Controls (SOC) certification for the vendor to possess?
Answer: C
C is correct - sharing my notes from Prabh Nair (check out his coffee shot video) There is no type 1 or 2 for SOC 3, and it's used high-level report generally available on public domain/ website. SOC 1 & 2 has type 1 and type 2. Type 1 is the design of control while Type 2 is the effectiveness of the control. SOC 1 is good for financial/ books of account. SOC 2 talks about IT
Source: Adapted from community discussion — dev46
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISSP practice, question 91. 483 questions available.
Version 1.0.0. How we source questions