Question 151 · 483 in bank
Which of the following threats would be MOST likely mitigated by monitoring assets containing open source libraries for vulnerabilities?
Show answer
Answer: C
ISC2 Certified Information Systems Security Professional483 questions across 49 pages are complete and free, with no account or card.
483 questions in this bank
Free access · progress saved on this device
Which of the following threats would be MOST likely mitigated by monitoring assets containing open source libraries for vulnerabilities?
Answer: C
Which of the following is the MOST significant key management problem due to the number of keys created?
Answer: A
C is the correct answer. no matter symmetric or asymmetric or even your VPN keys, or your routing protocol peering keys.... they all have to be safe guarded, even from internal users and IT guys, you dont wants your router to peer with a masquerade as partner knowing your keys.
Source: Adapted from community discussion — Moose01
As a design principle, which one of the following actors is responsible for identifying and approving data security requirement in a cloud ecosystem?
Answer: D
Systems Security Professional (CISSP) with identity and access management (IAM) responsibilities is asked by the Chief Information Security Officer (CISO) to perform a vulnerability assessment on a web application to pass a Payment Card Industry (PCI) audit. The CISSP has never performed this before. According to the (ISC) Code of Professional Ethics, which of the following should the CISSP do?
Answer: A
The CISSP cannot perform a vulnerability assessment on a web application to pass a Payment Card Industry (PCI) audit if they are not fully competent and qualified because it goes against the (ISC) Code of Professional Ethics. The code requires that a CISSP should render only those services for which they are fully competent and qualified. Performing a task that the CISSP is not fully competent and qualified to do can result in inadequate or incorrect assessment and recommendations, which can lead to security vulnerabilities and non-compliance with regulations such as PCI DSS. It is essential to ensure that the person performing the vulnerability assessment has the necessary knowledge, skills, and experience to carry out a comprehensive and accurate assessment.
Source: Adapted from community discussion — 74gjd_37
Which of the following is the MOST effective way to ensure the endpoint devices used by remote users are compliant with an organization's approved policies before being allowed on the network?
Answer: A
While performing a security review for a new product, an information security professional discovers that the organization's product development team is proposing to collect government-issued identification (ID) numbers from customers to use as unique customer identifiers. Which of the following recommendations should be made to the product development team?
Answer: C
C sounds like it is defining/leading towards tokenization. Take the government identifier and turn into a token. Ideally the token won't resemble the original sensitive gov id but could be used as a unique derived customer identifier
Source: Adapted from community discussion — izaman2022
Which one of the following BEST protects vendor accounts that are used for emergency maintenance?
Answer: A
The development team has been tasked with collecting data from biometric devices. The application will support a variety of collection data streams. During the testing phase, the team utilizes data from an old production database in a secure testing environment. What principle has the team taken into consideration?
Answer: C
The question says: "the team utilizes data from an old production database in a secure testing environment." If you are going to use REAL data from a production database in a testing/staging environment, you should consider the confidentiality of those data. C. Biometric data must be protected from disclosure.
Source: Adapted from community discussion — Li_Rong_Han
Which event magnitude is defined as deadly, destructive, and disruptive when a hazard interacts with human vulnerability?
Answer: D
Information security practitioners are in the midst of implementing a new firewall. Which of the following failure methods would BEST prioritize security in the event of failure?
Answer: B
he best failure method to prioritize security in the event of failure is B: "Fail-Closed". This means that in the event of a firewall failure, the firewall will deny all network traffic by default, ensuring that no unauthorized traffic is allowed through. This ensures that even if the firewall fails, the network is protected from potentially harmful traffic. Method A, Failover, is a process of automatically switching to a backup system in the event of a failure. While failover can be an effective way to ensure business continuity and minimize downtime, it may not necessarily prioritize security in the event of a firewall failure. Failover can be useful to ensure that network traffic continues to flow, but it does not necessarily guarantee that the traffic is secure. In some cases, the failover system may not be as secure as the primary system, which could result in unauthorized traffic being allowed through the firewall. Therefore, Fail-Closed is considered the best method to prioritize security in the event of a firewall failure as it ensures that no unauthorized traffic is allowed through, even if the firewall fails.
Source: Adapted from community discussion — 74gjd_37
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISSP practice, question 151. 483 questions available.
Version 1.0.0. How we source questions