ISC2 Certified Information Systems Security Professional483 questions across 49 pages are complete and free, with no account or card.
483 questions in this bank
Free access · progress saved on this device
A financial organization that works according to agile principles has developed a new application for their external customer base to request a line of credit. A security analyst has been asked to assess the security risk of the minimum viable product (MVP). Which is the MOST important activity the analyst should assess?
Answer: D
Which of the following is the PRIMARY goal of logical access controls?
Answer: A
CISSP Official Study Guide pg 639 - " Information An organization's information includes all of its data. Data is stored in simple files on servers, computers, and smaller devices. It can also be stored in databases within a server farm. Logical access controls attempt to prevent unauthorized access to the information. "
Source: Adapted from community discussion — RVoigt
An application developer receives a report back from the security team showing their automated tools were able to successfully enter unexpected data into the organization's customer service portal, causing the site to crash. This is an example of which type of testing?
Answer: D
Which of the following is a covert channel type?
Answer: C
Storage channels are used by attackers to encode the information getting transferred and then decode it later. In TCP/IP stacks, some fields are left vacant or unused. Attackers utilize these unused fields as storage channels.
Source: Adapted from community discussion — [Removed]
Which of the following is the MOST effective strategy to prevent an attacker from disabling a network?
Answer: A
A software developer wishes to write code that will execute safely and only as intended. Which of the following programming language types is MOST likely to achieve this goal?
Answer: C
According to CISSP, the most likely programming language type to achieve the goal of executing safely and only as intended is a strongly typed language. Strongly typed languages require explicit declarations of variables and enforce strict rules for how variables can be used, making it more difficult for developers to make errors that could compromise the security of the code. In contrast, weakly typed languages have more flexible rules for variable declarations and use, making it easier for developers to make mistakes that could compromise the security of the code. Dynamically typed languages are similar to weakly typed languages in that they do not require explicit declarations of variables, but they also allow variables to change type during execution, which can increase the risk of security vulnerabilities. Statically typed languages are similar to strongly typed languages in that they require explicit declarations of variables and enforce strict rules for how variables can be used, but they also perform type checking at compile time rather than runtime, which can help to identify and fix potential security issues before the code is deployed.
Source: Adapted from community discussion — DJOEK
What is the FIRST step that should be considered in a Data Loss Prevention (DLP) program?
Answer: C
Which of the following roles is responsible for ensuring that important datasets are developed, maintained, and are accessible within their defined specifications?
Answer: A
D is correct. Data Owners are responsible for protecting data and implementing policies that define the appropriate use of the data. Data Custodians are responsible for the safe custody, transport, and storage of the data
Source: Adapted from community discussion — Peduk70
Which change management role is responsible for the overall success of the project and supporting the change throughout the organization?
Answer: C
What is static analysis intended to do when analyzing an executable file?
Answer: D
There are multiple places in the CISSP Official Study Guide where static analysis is discussed/defined, but pg 1114 sums it up - "Static analysis performs assessment of the code itself, analyzing the sequence of instructions for security flaws."
Source: Adapted from community discussion — RVoigt
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISSP practice, question 171. 483 questions available.
Version 1.0.0. How we source questions