CISSP practice questions 211–220

1. Question 211 · 483 in bank

   Which of the following is TRUE for an organization that is using a third-party federated identity service?

   • AThe organization specifies alone how to authenticate other organization's users
   • BThe organization defines internal standard for overall user identification
   • CThe organization establishes a trust relationship with the other organizations
   • DThe organization enforces the rules to other organization's user provisioning

   Show answer

   Answer: C

   Next question

2. Question 212 · 483 in bank

   Which of the following describes the BEST method of maintaining the inventory of software and hardware within the organization?

   • AMaintaining the inventory through a combination of asset owner interviews, open-source system management, and open-source management tools
   • BMaintaining the inventory through a combination of desktop configuration, administration management, and procurement management tools
   • CMaintaining the inventory through a combination of on premise storage configuration, cloud management, and partner management tools
   • DMaintaining the inventory through a combination of system configuration, network management, and license management tools

   Show answer

   Answer: D

   Next question

3. Question 213 · 483 in bank

   Which of the following outsourcing agreement provisions has the HIGHEST priority from a security operations perspective?

   • AConditions to prevent the use of subcontractors
   • BTerms for contract renegotiation in case of disaster
   • CRoot cause analysis for application performance issue
   • DEscalation process for problem resolution during incidents

   Show answer

   Answer: D

   Next question

4. Question 214 · 483 in bank

   Which of the following is the MOST comprehensive Business Continuity (BC) test?

   • AFull interruption
   • BFull simulation
   • CFull table top
   • DFull functional drill

   Show answer

   Answer: A

   Next question

5. Question 215 · 483 in bank

   A security practitioner needs to implement a solution to verify endpoint security protections and operating system (OS) versions. Which of the following is the BEST solution to implement?

   • AAn intrusion prevention system (IPS)
   • BNetwork Access Control (NAC)
   • CActive Directory (AD) authentication
   • DA firewall

   Show answer

   Answer: B

   Next question

6. Question 216 · 483 in bank

   During an internal audit of an organizational Information Security Management System (ISMS), nonconformities are identified. In which of the following management stages are nonconformities reviewed, assessed and/or corrected by the organization?

   • AAssessment
   • BPlanning
   • CImprovement
   • DOperation

   Show answer

   Answer: C

   Next question

7. Question 217 · 483 in bank

   When developing an external facing web-based system, which of the following would be the MAIN focus of the security assessment prior to implementation and production?

   • AEnsuring Secure Sockets Layer (SSL) certificates are signed by a certificate authority
   • BEnsuring Secure Sockets Layer (SSL) certificates are internally signed
   • CAssessing the Uniform Resource Locator (URL)
   • DEnsuring that input validation is enforced

   Show answer

   Answer: D

   Next question

8. Question 218 · 483 in bank

   A financial services organization has employed a security consultant to review processes used by employees across various teams. The consultant interviewed a member of the application development practice and found gaps in their threat model. Which of the following correctly represents a trigger for when a threat model should be revised?

   • AAfter operating system (OS) patches are applied
   • BA new developer is hired into the team.
   • CAfter a modification to the firewall rule policy
   • DA new data repository is added.

   Show answer

   Answer: D

   Next question

9. Question 219 · 483 in bank

   The Chief Information Security Officer (CISO) of an organization has requested that a Service Organization Control (SOC) report be created to outline the security and availability of a particular system over a 12-month period. Which type of SOC report should be utilized?

   • ASOC 1 Type 1
   • BSOC 1 Type 2
   • CSOC 2 Type 2
   • DSOC 3 Type 1

   Show answer

   Answer: C

   Next question

10. Question 220 · 483 in bank

    An organization recently upgraded to a Voice over Internet Protocol (VoIP) phone system. Management is concerned with unauthorized phone usage. The security consultant is responsible for putting together a plan to secure these phones. Administrators have assigned unique personal identification number (PIN) codes for each person in the organization. What is the BEST solution?

    • AHave the administrator enforce a policy to change the PIN regularly. Implement call detail records (CDR) reports to track usage.
    • BHave the administrator change the PIN regularly. Implement call detail records (CDR) reports to track usage.
    • CUse phone locking software to enforce usage and PIN policies. Inform the user to change the PIN regularly.
    • DImplement call detail records (CDR) reports to track usage.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISSP practice, question 211. 483 questions available.