CISSP practice questions 161–170

1. Question 161 · 483 in bank

   Which of the following BEST describes the purpose of software forensics?

   • ATo analyze possible malicious intent of malware
   • BTo perform cyclic redundancy check (CRC) verification and detect changed applications
   • CTo determine the author and behavior of the code
   • DTo review program code to determine the existence of backdoors

   Show answer

   Answer: C

   Next question

2. Question 162 · 483 in bank

   Which of the following services can be deployed via a cloud service or on-premises to integrate with Identity as a Service (IDaaS) as the authoritative source of user identities?

   • AMulti-factor authentication (MFA)
   • BDirectory
   • CUser database
   • DSingle sign-on (SSO)

   Show answer

   Answer: B

   Explanation

   Directory is the source, SSO is a process. Directory can be an AD container or GC domain controller that holds the directory structure and hence can be an authoritative source!

   Source: Adapted from community discussion — projtfer

   Next question

3. Question 163 · 483 in bank

   A web developer is completing a new web application security checklist before releasing the application to production. The task of disabling unnecessary services is on the checklist. Which web application threat is being mitigated by this action?

   • ASession hijacking
   • BSecurity misconfiguration
   • CBroken access control
   • DSensitive data exposure

   Show answer

   Answer: B

   Next question

4. Question 164 · 483 in bank

   Which of the following statements is TRUE about Secure Shell (SSH)?

   • ASSH supports port forwarding, which can be used to protect less secured protocols.
   • BSSH does not protect against man-in-the-middle (MITM) attacks.
   • CSSH is easy to deploy because it requires a Web browser only.
   • DSSH can be used with almost any application because it is concerned with maintaining a circuit.

   Show answer

   Answer: A

   Explanation

   Port forwarding via SSH (SSH tunneling) creates a secure connection between a local computer and a remote machine through which services can be relayed. Because the connection is encrypted, SSH tunneling is useful for transmitting information that uses an unencrypted protocol, such as IMAP, VNC, or IRC

   Source: Adapted from community discussion — Rollizo

   Next question

5. Question 165 · 483 in bank

   What is the BEST method to use for assessing the security impact of acquired software?

   • AThreat modeling
   • BCommon vulnerability review
   • CSoftware security compliance validation
   • DVendor assessment

   Show answer

   Answer: A

   Next question

6. Question 166 · 483 in bank

   Which of the following is the BEST way to protect an organization's data assets?

   • AEncrypt data in transit and at rest using up-to-date cryptographic algorithms.
   • BMonitor and enforce adherence to security policies.
   • CRequire Multi-Factor Authentication (MFA) and Separation of Duties (SoD).
   • DCreate the Demilitarized Zone (DMZ) with proxies, firewalls and hardened bastion hosts.

   Show answer

   Answer: B

   Explanation

   policy vs encryption = management vs technical staff. Which is more important? I choose policy because CISSP needs you to think like a manager..

   Source: Adapted from community discussion — godchild

   Next question

7. Question 167 · 483 in bank

   Which of the following ensures old log data is not overwritten?

   • ALog retention
   • BImplement Syslog
   • CIncrease log file size
   • DLog preservation

   Show answer

   Answer: D

   Next question

8. Question 168 · 483 in bank

   What is considered a compensating control for not having electrical surge protectors installed?

   • AHaving dual lines to network service providers built to the site
   • BHaving a hot disaster recovery (DR) environment for the site
   • CHaving network equipment in active-active clusters at the site
   • DHaving backup diesel generators installed to the site

   Show answer

   Answer: B

   Explanation

   Key here is "the site". If surge hits and nothing is protecting the hardware the entire site could be down and PSU fried. DR site would be elsewhere and be unaffected.

   Source: Adapted from community discussion — Humongous1593

   References

   • nist.gov documentation

   Next question

9. Question 169 · 483 in bank

   Under the General Data Protection Regulation (GDPR), what is the maximum amount of time allowed for reporting a personal data breach?

   • A24 hours
   • B48 hours
   • C72 hours
   • D96 hours

   Show answer

   Answer: C

   Next question

10. Question 170 · 483 in bank

    What is the FIRST step in risk management?

    • AIdentify the factors that have potential to impact business.
    • BEstablish the scope and actions required.
    • CIdentify existing controls in the environment.
    • DEstablish the expectations of stakeholder involvement.

    Show answer

    Answer: A

    Explanation

    A is correct. Five steps of risk management: 1. Identify the Risk 2. Analyze the Risk 3. Evaluate or Rank the Risk 4. Treat the Risk 5. Monitor and Review the Risk The initial step in the risk management process is to identify the risks that the business is exposed to in its operating environment. https://www.360factors.com/blog/five-steps-of-risk-management-process/

    Source: Adapted from community discussion — sec_007

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISSP practice, question 161. 483 questions available.