CISSP practice questions 191–200

1. Question 191 · 483 in bank

   A large organization's human resources and security teams are planning on implementing technology to eliminate manual user access reviews and improve compliance. Which of the following options is MOST likely to resolve the issues associated with user access?

   • AImplement a Privileged Access Management (PAM) system.
   • BImplement a role-based access control (RBAC) system.
   • CImplement identity and access management (IAM) platform.
   • DImplement a single sign-on (SSO) platform.

   Show answer

   Answer: C

   Explanation

   C. Implement identity and access management (IAM) platform. An identity and access management (IAM) platform is designed to centralize and automate the management of user access to systems and resources. This can help eliminate manual user access reviews and improve compliance by automating the process of granting, modifying, and revoking user access based on defined policies and rules. It can also provide visibility into user access and activity, making it easier to identify and address any potential compliance issues.

   Source: Adapted from community discussion — DJOEK

   Next question

2. Question 192 · 483 in bank

   A cloud service accepts Security Assertion Markup Language (SAML) assertions from users to exchange authentication and authorization data between security domains. However, an attacker was able to spoof a registered account on the network and query the SAML provider. What is the MOST common attack leveraged against this flaw?

   • AAttacker leverages SAML assertion to register an account on the security domain.
   • BAttacker forges requests to authenticate as a different user.
   • CAttacker exchanges authentication and authorization data between security domains.
   • DAttacker conducts denial-of-service (DoS) against the security domain by authenticating as the same user repeatedly.

   Show answer

   Answer: B

   Explanation

   The MOST common attack leveraged against this flaw would be the attacker forging requests to authenticate as a different user (option B). This type of attack is known as a SAML spoofing attack, where the attacker is able to impersonate a legitimate user by sending a forged SAML assertion to the cloud service. This can allow the attacker to gain unauthorized access to resources within the security domain.

   Source: Adapted from community discussion — DJOEK

   Next question

3. Question 193 · 483 in bank

   An organization is implementing security review as part of system development. Which of the following is the BEST technique to follow?

   • APerform incremental assessments.
   • BEngage a third-party auditing firm.
   • CReview security architecture.
   • DConduct penetration testing.

   Show answer

   Answer: A

   Explanation

   Option A allows the organization to review and assess the security of the system as it is being developed, rather than waiting until the system is fully developed. This can help identify and address any security vulnerabilities or weaknesses early on in the development process. Option B, engaging a third-party auditing firm, can also be a useful technique in certain situations, but it is not necessarily the best option in all cases, especially if the organization is already performing its own security review as part of system development. Option C, reviewing security architecture, is a high-level activity that should be done before system development begins, rather than during the development process. Option D, conducting penetration testing, is a useful technique for evaluating the security of a fully developed system, but it is not necessarily the best option for reviewing security during system development.

   Source: Adapted from community discussion — DJOEK

   Next question

4. Question 194 · 483 in bank

   What Hypertext Transfer Protocol (HTTP) response header can be used to disable the execution of inline JavaScript and the execution of eval()-type functions?

   • AX-XSS-Protection
   • BContent-Security-Policy
   • CX-Frame-Options
   • DStrict-Transport-Security

   Show answer

   Answer: B

   Explanation

   B. Content-Security-Policy The Content-Security-Policy (CSP) HTTP response header can be used to disable the execution of inline JavaScript and the execution of eval()-type functions. This header allows website administrators to define which sources of content are allowed to be loaded on a page, such as scripts, images, and stylesheets. By disabling inline JavaScript and eval(), the CSP header can help prevent cross-site scripting (XSS) attacks. Other HTTP headers that can be used for security are: X-XSS-Protection, which can be used to enable the browser's built-in XSS protection. X-Frame-Options, which can be used to prevent a page from being rendered within an iframe on another site. Strict-Transport-Security, which can be used to enforce the use of HTTPS on a website.

   Source: Adapted from community discussion — Darealis

   Next question

5. Question 195 · 483 in bank

   A security professional was tasked with rebuilding a company's wireless infrastructure. Which of the following are the MOST important factors to consider while making a decision on which wireless spectrum to deploy?

   • AFacility size, intermodulation, and direct satellite service
   • BPerformance, geographic location, and radio signal interference
   • CExisting client devices, manufacturer reputation, and electrical interference
   • DHybrid frequency band, service set identifier (SSID), and interpolation

   Show answer

   Answer: B

   Explanation

   Performance refers to the speed, capacity, and latency of the wireless network. Geographic location refers to the physical environment and the regulatory framework of the wireless network. Different countries or regions may have different rules and standards for using the spectrum, such as licensing requirements, power limits, or channel allocations. The physical environment, such as terrain, buildings, or weather, may also affect the propagation and attenuation of the wireless signal. Radio signal interference refers to the noise or distortion caused by other devices or sources that use the same or adjacent frequencies. Interference can degrade the performance and security of the wireless network by causing errors, delays, or loss of data. C. Existing client devices may limit the compatibility and performance of the wireless network, but they can be upgraded or replaced if needed. Manufacturer reputation may affect the quality and support of the wireless equipment, but not the spectrum itself.

   Source: Adapted from community discussion — thanhlb

   Next question

6. Question 196 · 483 in bank

   A software development company has a short timeline in which to deliver a software product. The software development team decides to use open-source software libraries to reduce the development time. What concept should software developers consider when using open-source software libraries?

   • AOpen source libraries contain known vulnerabilities, and adversaries regularly exploit those vulnerabilities in the wild.
   • BOpen source libraries can be used by everyone, and there is a common understanding that the vulnerabilities in these libraries will not be exploited.
   • COpen source libraries contain unknown vulnerabilities, so they should not be used.
   • DOpen source libraries are constantly updated, making it unlikely that a vulnerability exists for an adversary to exploit.

   Show answer

   Answer: A

   Explanation

   A. Open source libraries contain known vulnerabilities, and adversaries regularly exploit those vulnerabilities in the wild. While it is true that open source libraries can be updated regularly, this does not guarantee that vulnerabilities will not exist or that they will not be exploited. In fact, the use of open source libraries can potentially increase the risk of vulnerabilities because they are widely used and known to many people, including adversaries. This means that if a vulnerability is discovered in an open source library, it may be more likely to be exploited compared to a proprietary library that is not widely known. Additionally, it is not uncommon for open source libraries to contain known vulnerabilities, as these libraries are often developed by a community of volunteers who may not have the resources or time to thoroughly test and secure the code. Therefore, it is important for software developers to consider the potential risks of using open source libraries, including the possibility of known vulnerabilities, when making decisions about which libraries to use.

   Source: Adapted from community discussion — DJOEK

   Next question

7. Question 197 · 483 in bank

   A security engineer is assigned to work with the patch and vulnerability management group. The deployment of a new patch has been approved and needs to be applied. The research is complete, and the security engineer has provided recommendations. Where should the patch be applied FIRST?

   • ALower environment
   • BDesktop environment
   • CServer environment
   • DProduction environment

   Show answer

   Answer: A

   Explanation

   Lower environments are complete replicas of production and are designed to test new releases before installing them in production. They're only accessible internally and not to external consumers. The idea is simple, you build out a smaller scale model of your production solution. A percentage of your user base is provisioned on this system and they use it for day-to-day operations. In every way, the “lower environment” solution should be treated like production. Meaning, it is connected into your production network and uses the same security measures applied in production, Integrates with LDAP, uses the corporate antivirus, etc. etc. It should be subjected to the same change control policies or a special subset of those policies. The main difference is that the lower environment is where new software versions, feature sets, configurations, etc. pop up after they are researched and vetted in the lab.

   Source: Adapted from community discussion — Jamati

   Next question

8. Question 198 · 483 in bank

   When assessing the audit capability of an application, which of the following activities is MOST important?

   • AIdentify procedures to investigate suspicious activity.
   • BDetermine if audit records contain sufficient information.
   • CVerify if sufficient storage is allocated for audit records.
   • DReview security plan for actions to be taken in the event of audit failure.

   Show answer

   Answer: B

   Explanation

   to me its B, the most important is the scope of the audit, the value it brings, is it sufficient to what the organization need inorder to call or even perform an actual audit. The requirement of disk size we can adjust as we needed, it can only be used to support the content of the information that the application can gather.

   Source: Adapted from community discussion — zo24

   Next question

9. Question 199 · 483 in bank

   Which of the following is the PRIMARY purpose of installing a mantrap within a facility?

   • AControl traffic
   • BControl air flow
   • CPrevent piggybacking
   • DPrevent rapid movement

   Show answer

   Answer: C

   Explanation

   The main objective of a mantrap is to prevent piggybacking, which refers to unauthorized individuals following closely behind an authorized person to gain entry to a restricted area without proper authentication. By allowing only one person at a time, the mantrap ensures that each individual must present their credentials, such as an access card or biometric identification, before proceeding further into the secure area.

   Source: Adapted from community discussion — Bach1968

   Next question

10. Question 200 · 483 in bank

    What BEST describes the confidentiality, integrity, availability triad?

    • AA vulnerability assessment to see how well the organization's data is protected
    • BThe three-step approach to determine the risk level of an organization
    • CThe implementation of security systems to protect the organization's data
    • DA tool used to assist in understanding how to protect the organization's data

    Show answer

    Answer: D

    Explanation

    Option C could be interpreted as implying that the confidentiality, integrity, and availability (CIA) triad refers to the implementation of security systems to protect an organization's data. While security systems are indeed employed to uphold these principles, the CIA triad itself is not a specific implementation or system but rather a foundational concept guiding security strategies. The CIA triad outlines three primary objectives essential to information security—ensuring data confidentiality, maintaining data integrity, and guaranteeing data availability. It's a principle or guideline used to shape the design, selection, and implementation of security measures and systems within an organization to protect its data and resources. Therefore, while security systems are implemented to align with the CIA triad, the triad itself represents the overarching principles rather than the specific tools or systems used for protection.

    Source: Adapted from community discussion — SpaceMonkey1

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISSP practice, question 191. 483 questions available.