CISSP practice questions 131–140

1. Question 131 · 483 in bank

   What is a security concern when considering implementing software-defined networking (SDN)?

   • AIt has a decentralized architecture.
   • BIt increases the attack footprint.
   • CIt uses open source protocols.
   • DIt is cloud based.

   Show answer

   Answer: B

   Next question

2. Question 132 · 483 in bank

   The Chief Information Officer (CIO) has decided that as part of business modernization efforts the organization will move towards a cloud architecture. All business-critical data will be migrated to either internal or external cloud services within the next two years. The CIO has a PRIMARY obligation to work with personnel in which role in order to ensure proper protection of data during and after the cloud migration?

   • AChief Security Officer (CSO)
   • BInformation owner
   • CChief Information Security Officer (CISO)
   • DGeneral Counsel

   Show answer

   Answer: B

   Explanation

   I'd say B. It says primary obligation, not about hierarchy or sth. You can do this move without the CISO. Can you do it without the information owner? You are moving the information to cloud. owners are responsible with these information. You are obliged to do with this personnel. Sorry, dear ciso.

   Source: Adapted from community discussion — TheManiac

   References

   • Cisco documentation

   Next question

3. Question 133 · 483 in bank

   What is the BEST way to restrict access to a file system on computing systems?

   • AUse least privilege at each level to restrict access.
   • BRestrict access to all users.
   • CAllow a user group to restrict access.
   • DUse a third-party tool to restrict access.

   Show answer

   Answer: A

   Next question

4. Question 134 · 483 in bank

   A developer is creating an application that requires secure logging of all user activity. What is the BEST permission the developer should assign to the log file to ensure requirements are met?

   • AExecute
   • BRead
   • CWrite
   • DAppend

   Show answer

   Answer: D

   Explanation

   I think that it is D: Append Data allows or denies making changes to the end of the file but not changing, deleting, or overwriting existing data (applies to files only). You are no interested in the application delete previous logs.

   Source: Adapted from community discussion — Rollizo

   Next question

5. Question 135 · 483 in bank

   Which of the following is the PRIMARY reason for selecting the appropriate level of detail for audit record generation?

   • AAvoid lengthy audit reports
   • BEnable generation of corrective action reports
   • CFacilitate a root cause analysis (RCA)
   • DLower costs throughout the System Development Life Cycle (SDLC)

   Show answer

   Answer: C

   Next question

6. Question 136 · 483 in bank

   When performing an investigation with the potential for legal action, what should be the analyst's FIRST consideration?

   • AData decryption
   • BChain-of-custody
   • CAuthorization to collect
   • DCourt admissibility

   Show answer

   Answer: B

   Explanation

   The given answer is correct, because the question states "When performing an investigation " - it means the investigation process has already been started implying that you have been authorized to collect any pertinent info, therefore CoC is the right answer!

   Source: Adapted from community discussion — projtfer

   Next question

7. Question 137 · 483 in bank

   What is the correct order of execution for security architecture?

   • AGovernance, strategy and program management, operations, project delivery
   • BGovernance, strategy and program management, project delivery, operations
   • CStrategy and program management, project delivery, governance, operations
   • DStrategy and program management, governance, project delivery, operations

   Show answer

   Answer: B

   Next question

8. Question 138 · 483 in bank

   Building blocks for software-defined networks (SDN) require which of the following?

   • AThe SDN is composed entirely of client-server pairs.
   • BRandom-access memory (RAM) is used in preference to virtual memory.
   • CThe SDN is mostly composed of virtual machines (VM).
   • DVirtual memory is used in preference to random-access memory (RAM).

   Show answer

   Answer: C

   Explanation

   This is incorrect. While virtualization can be used in an SDN environment, it's not a core building block. SDN is primarily about separating the control plane from the data plane. SDN building blocks typically include: - SDN Controller: Centralized intelligence for managing network traffic. - Network Devices: Switches, routers, and other hardware that forward traffic based on controller instructions. - Northbound Interface: API for applications to interact with the SDN controller. - Southbound Interface: Protocol for communication between the controller and network devices. These components work together to create a flexible and programmable network. None of the options are entirely accurate.

   Source: Adapted from community discussion — deeden

   Next question

9. Question 139 · 483 in bank

   An international organization has decided to use a Software as a Service (SaaS) solution to support its business operations. Which of the following compliance standards should the organization use to assess the international code security and data privacy of the solution?

   • AService Organization Control (SOC) 2
   • BInformation Assurance Technical Framework (IATF)
   • CHealth Insurance Portability and Accountability Act (HIPAA)
   • DPayment Card Industry (PCI)

   Show answer

   Answer: A

   Next question

10. Question 140 · 483 in bank

    What is the MINIMUM standard for testing a disaster recovery plan (DRP)?

    • AQuarterly or more frequently depending upon the advice of the information security manager
    • BAs often as necessary depending upon the stability of the environment and business requirements
    • CAnnually or less frequently depending upon audit department requirements
    • DSemi-annually and in alignment with a fiscal half-year business cycle

    Show answer

    Answer: B

    Explanation

    According to the CISSP Common Body of Knowledge (CBK), there is no specific minimum frequency stipulated for testing a disaster recovery plan (DRP). However, it is recommended that DRPs should be tested regularly to ensure that they are effective and up-to-date. The frequency of testing should be based on the organization's business requirements, the stability of the environment, and the advice of the information security manager. There are several industry standards and regulations that provide guidance on DRP testing frequency. For example, the National Institute of Standards and Technology (NIST) recommends that DRPs should be tested at least annually. The Payment Card Industry Data Security Standard (PCI DSS) requires annual testing of DRPs as well. However, these are only recommendations and actual testing frequency may vary depending on the organization's needs and risk appetite. Therefore, the answer is "B".

    Source: Adapted from community discussion — 74gjd_37

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISSP practice, question 131. 483 questions available.