CISSP practice questions 121–130

1. Question 121 · 483 in bank

   Which section of the assessment report addresses separate vulnerabilities, weaknesses, and gaps?

   • AFindings definition section
   • BRisk review section
   • CExecutive summary with full details
   • DKey findings section

   Show answer

   Answer: D

   Next question

2. Question 122 · 483 in bank

   Which application type is considered high risk and provides a common way for malware and viruses to enter a network?

   • AInstant messaging or chat applications
   • BPeer-to-Peer (P2P) file sharing applications
   • CE-mail applications
   • DEnd-to-end applications

   Show answer

   Answer: B

   Explanation

   Agreed B is highly likely to be correct. I was tempted to select email. Another reason why I go with B is because option D is positioned to trick the candidate. "D. End-to-end applications" closest match to P2P, so answer is B

   Source: Adapted from community discussion — cccispman

   References

   • nist.gov documentation

   Next question

3. Question 123 · 483 in bank

   Why is data classification control important to an organization?

   • ATo enable data discovery
   • BTo ensure security controls align with organizational risk appetite
   • CTo ensure its integrity, confidentiality and availability
   • DTo control data retention in alignment with organizational policies and regulation

   Show answer

   Answer: B

   Next question

4. Question 124 · 483 in bank

   What are the three key benefits that application developers should derive from the northbound application programming interface (API) of software defined networking (SDN)?

   • ANetwork syntax, abstraction of network flow, and abstraction of network protocols
   • BNetwork syntax, abstraction of network commands, and abstraction of network protocols
   • CFamiliar syntax, abstraction of network topology, and definition of network protocols
   • DFamiliar syntax, abstraction of network topology, and abstraction of network protocols

   Show answer

   Answer: D

   Explanation

   The following key benefits of SDN to application developers are : -Familiar syntax provided by common APIs. -Abstraction of network topology, network flow, and network protocols because the control plane and infrastructure plane will handle those issues.

   Source: Adapted from community discussion — somkiatr

   Next question

5. Question 125 · 483 in bank

   To monitor the security of buried data lines inside the perimeter of a facility, which of the following is the MOST effective control?

   • AFencing around the facility with closed-circuit television (CCTV) cameras at all entry points
   • BGround sensors installed and reporting to a security event management (SEM) system
   • CRegular sweeps of the perimeter, including manual inspection of the cable ingress points
   • DSteel casing around the facility ingress points

   Show answer

   Answer: B

   Next question

6. Question 126 · 483 in bank

   Which of the following is a unique feature of attribute-based access control (ABAC)?

   • AA user is granted access to a system at a particular time of day.
   • BA user is granted access to a system based on username and password.
   • CA user is granted access to a system based on group affinity.
   • DA user is granted access to a system with biometric authentication.

   Show answer

   Answer: A

   Explanation

   Answer correct is C "An example of ABAC would be allowing only users who are type=employees and have department=HR to access the HR/Payroll system and only during business hours within the same timezone as the company." https://blog.identityautomation.com/rbac-vs-abac-access-control-models-iam-explained#:~:text=Defining%20Attribute%2DBased%20Access%20Control&text=An%20example%20of%20ABAC%20would,same%20timezone%20as%20the%20company.

   Source: Adapted from community discussion — JAckThePip

   Next question

7. Question 127 · 483 in bank

   An enterprise is developing a baseline cybersecurity standard its suppliers must meet before being awarded a contract. Which of the following statements is TRUE about the baseline cybersecurity standard?

   • AIt should be expressed as general requirements.
   • BIt should be expressed as technical requirements.
   • CIt should be expressed in business terminology.
   • DIt should be expressed in legal terminology.

   Show answer

   Answer: B

   Next question

8. Question 128 · 483 in bank

   Which of the following is the BEST approach to implement multiple servers on a virtual system?

   • AImplement one primary function per virtual server and apply individual security configuration for each virtual server.
   • BImplement multiple functions within the same virtual server and apply individual security configurations to each function.
   • CImplement one primary function per virtual server and apply high security configuration on the host operating system.
   • DImplement multiple functions per virtual server and apply the same security configuration for each virtual server.

   Show answer

   Answer: A

   Explanation

   The BEST approach to implement multiple servers on a virtual system is A. Requirement 2.2.1 of the PCI DSS states that organizations must implement only one primary function per server to prevent functions that require different security levels from coexisting on the same server. This requirement helps to reduce the risk of unauthorized access or data leakage between different functions. Moreover, Requirement 2.2.2 of the PCI DSS states that organizations must ensure that security configurations are not applied to other servers in a manner that would negatively impact the security of the cardholder data environment. This requirement emphasizes the importance of applying individual security configurations to each virtual server to ensure that the security of each server is not compromised.

   Source: Adapted from community discussion — 74gjd_37

   Next question

9. Question 129 · 483 in bank

   Which access control method is based on users issuing access requests on system resources, features assigned to those resources, the operational or situational context, and a set of policies specified in terms of those features and context?

   • AMandatory Access Control (MAC)
   • BAttribute Based Access Control (ABAC)
   • CRole Based Access Control (RBAC)
   • DDiscretionary Access Control (DAC)

   Show answer

   Answer: B

   Next question

10. Question 130 · 483 in bank

    Which of the following is the MOST common cause of system or security failures?

    • ALack of physical security controls
    • BLack of change control
    • CLack of logging and monitoring
    • DLack of system documentation

    Show answer

    Answer: B

    Explanation

    ISC2 identifies lack of change control as a common cause of security failures in its Common Body of Knowledge (CBK). It includes a section on Security Operations, which covers topics such as change management, configuration management, and incident management. Within this section, lack of change control is identified as a common cause of security failures. Additionally, many other sources in the field of information security also identify lack of change control as a common issue that can lead to security incidents.

    Source: Adapted from community discussion — 74gjd_37

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISSP practice, question 121. 483 questions available.