CISSP practice questions 281–290

1. Question 281 · 483 in bank

   Which of the following is the BEST method to identify security controls that should be implemented for a web-based application while in development?

   • AAgile software development
   • BSecure software development
   • CApplication threat modeling
   • DPenetration testing

   Show answer

   Answer: C

   Next question

2. Question 282 · 483 in bank

   Which Open Systems Interconnection (OSI) layer(s) BEST corresponds to the network access layer in the Transmission Control Protocol/Internet Protocol (TCP/ IP) model?

   • AData Link and Physical Layers
   • BSession and Network Layers
   • CTransport Layer
   • DApplication, Presentation, and Session Layers

   Show answer

   Answer: A

   Next question

3. Question 283 · 483 in bank

   An organization's retail website provides its only source of revenue, so the disaster recovery plan (DRP) must document an estimated time for each step in the plan. Which of the following steps in the DRP will list the GREATEST duration of time for the service to be fully operational?

   • AUpdate the Network Address Translation (NAT) table.
   • BUpdate Domain Name System (DNS) server addresses with domain registrar.
   • CUpdate the Border Gateway Protocol (BGP) autonomous system number.
   • DUpdate the web server network adapter configuration.

   Show answer

   Answer: B

   Next question

4. Question 284 · 483 in bank

   In supervisory control and data acquisition (SCADA) systems, which of the following controls can be used to reduce device exposure to malware?

   • ADisallow untested code in the execution space of the SCADA device.
   • BDisable all command line interfaces.
   • CDisable Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) port 138 and 139 on the SCADA device.
   • DProhibit the use of unsecure scripting languages.

   Show answer

   Answer: A

   Next question

5. Question 285 · 483 in bank

   Which of the following secure transport protocols is often used to secure Voice over Internet Protocol (VoIP) communications on a network from end to end?

   • ASecure File Transfer Protocol (SFTP)
   • BSecure Real-time Transport Protocol (SRTP)
   • CGeneric Routing Encapsulation (GRE)
   • DInternet Protocol Security (IPSec)

   Show answer

   Answer: B

   Next question

6. Question 286 · 483 in bank

   A healthcare insurance organization chose a vendor to develop a software application. Upon review of the draft contract, the information security professional notices that software security is not addressed. What is the BEST approach to address the issue?

   • AUpdate the contract to require the vendor to perform security code reviews.
   • BUpdate the service level agreement (SLA) to provide the organization the right to audit the vendor.
   • CUpdate the contract so that the vendor is obligated to provide security capabilities.
   • DUpdate the service level agreement (SLA) to require the vendor to provide security capabilities.

   Show answer

   Answer: C

   Next question

7. Question 287 · 483 in bank

   Which of the following security tools will ensure authorized data is sent to the application when implementing a cloud-based application?

   • AHost-based intrusion prevention system (HIPS)
   • BAccess control list (ACL)
   • CData loss prevention (DLP)
   • DFile integrity monitoring (FIM)

   Show answer

   Answer: C

   Next question

8. Question 288 · 483 in bank

   A client server infrastructure that provides user-to-server authentication describes which one of the following?

   • ASecure Sockets Layer (SSL)
   • BUser-based authorization
   • CKerberos
   • DX.509

   Show answer

   Answer: C

   Next question

9. Question 289 · 483 in bank

   A system developer has a requirement for an application to check for a secure digital signature before the application is accessed on a user's laptop. Which security mechanism addresses this requirement?

   • ATrusted Platform Module (TPM)
   • BCertificate revocation list (CRL) policy
   • CKey exchange
   • DHardware encryption

   Show answer

   Answer: A

   Next question

10. Question 290 · 483 in bank

    Which of the following is a term used to describe maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions?

    • AInformation Security Continuous Monitoring (ISCM)
    • BRisk Management Framework (RMF)
    • CInformation Sharing & Analysis Centers (ISAC)
    • DInformation Security Management System (ISMS)

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISSP practice, question 281. 483 questions available.