ISC2 Certified Information Systems Security Professional483 questions across 49 pages are complete and free, with no account or card.
483 questions in this bank
Free access · progress saved on this device
An authentication system that uses challenge and response was recently implemented on an organization's network, because the organization conducted an annual penetration test showing that testers were able to move laterally using authenticated credentials. Which attack method was MOST likely used to achieve this?
Answer: B
Which security audit standard provides the BEST way for an organization to understand a vendor's Information Systems (IS) in relation to confidentiality, integrity, and availability?
Answer: A
CISSP Official Study Guide pg 729 - "SOC 2 Engagements Assess the organization's controls that affect the security (confidentiality, integrity, and availability) and privacy of information stored in a system. SOC 2 audit results are confidential and are normally only shared outside the organization under an NDA."
Source: Adapted from community discussion — RVoigt
Which of the following would qualify as an exception to the "right to be forgotten" of the General Data Protection Regulation (GDPR)?
Answer: A
An organization is looking to include mobile devices in its asset management system for better tracking. In which system tier of the reference architecture would mobile devices be tracked?
Answer: B
Although I went for B: I assume they're talking about the IT Asset Management(ITAM) Tiers of which there are three: So there is no Tier 0 Tier 1 - Asset Data Collection - method to inventory every software application and virtual OS that runs on the hardware you have in your inventory Tier 2 - Asset Data Intelligence - normalize the information, to map the assets to relevant information, and to link the assets to their contracts, projects, departments, and people. Tier 3 - Asset Lifecycle management - processes that control how you purchase, procure, and dispose of IT assets. This includes virtual devices and software, along with the associated software licenses. NIST has it as Tier 1 - Reporting, Analytics, Data storage Tier 2 - Data collection ie location/HW/SW Tier 3 - Enterprise assets - Servers, workstations, Laptops etc So for tracking mobile devices, according to these it could be Tier 3 as the diagrams seem to work backwards to what you would expect (devices at level 1 etc)
Source: Adapted from community discussion — mark9999
Dumpster diving is a technique used in which stage of penetration testing methodology?
Answer: D
An application team is running tests to ensure that user entry fields will not accept invalid input of any length. What type of negative testing is this an example of?
Answer: A
Although both "Allowed number of characters" and "Reasonable data" are important concepts in input validation testing, they are not the same thing. "Allowed number of characters" testing focuses specifically on ensuring that user input does not exceed the maximum allowed length of a field. This is important because input that exceeds the maximum allowed length can potentially cause buffer overflow vulnerabilities or other security issues. On the other hand, "Reasonable data" testing focuses on ensuring that the input data is reasonable and meets the expected criteria. This can include testing for data types, formats, and content. For example, if a field is expecting a numeric value, "Reasonable data" testing would ensure that only numeric values are accepted. In the case of the scenario described, the application team is specifically testing the maximum length of input fields, which falls under "Allowed number of characters" testing. Therefore, it is more accurate to describe this testing as "Allowed number of characters" rather than "Reasonable data".
Source: Adapted from community discussion — 74gjd_37
Which of the following is performed to determine a measure of success of a security awareness training program designed to prevent social engineering attacks?
Answer: B
An organization is considering partnering with a third-party supplier of cloud services. The organization will only be providing the data and the third-party supplier will be providing the security controls. Which of the following BEST describes this service offering?
Answer: D
In saas, the user provides data. take gmail for example, your mails are your data while the gmail platform is the service you are using.
Source: Adapted from community discussion — Toyeeb
The security team is notified that a device on the network is infected with malware. Which of the following is MOST effective in enabling the device to be quickly located and remediated?
Answer: D
Which of the following factors should be considered characteristics of Attribute Based Access Control (ABAC) in terms of the attributes used?
Answer: D
CISSP Official Study Guide pg 686 - "ABAC models use policies that include multiple attributes for rules. Attributes can be almost any characteristic of users, the network, and devices on the network. For example, user attributes can include group membership, the department where they work, and devices they use such as desktop PCs or mobile devices. The network can be the local internal network, a wireless network, an intranet, or a wide area network (WAN). Devices can include firewalls, proxy servers, web servers, database servers, and more."
Source: Adapted from community discussion — RVoigt
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISSP practice, question 141. 483 questions available.
Version 1.0.0. How we source questions