Question 21 · 483 in bank
When developing an organization's information security budget, it is important that the:
Show answer
Answer: B
ISC2 Certified Information Systems Security Professional483 questions across 49 pages are complete and free, with no account or card.
483 questions in this bank
Free access · progress saved on this device
When developing an organization's information security budget, it is important that the:
Answer: B
A subscription service which provides power, climate control, raised flooring, and telephone wiring but NOT the computer and peripheral equipment is BEST described as a:
Answer: A
Hot site A facility that is fully configured and ready to operate within a few hours. Warm site A facility that is usually partially configured with some equipment, such as HVAC, and foundational infrastructure components, but does not include all the hardware needed to restore mission-critical business functions. These sites typically do not have data replicated to them, so backups would have to be delivered and restored onto the warm site systems after a disaster. Cold site A facility that supplies the basic environment, electrical wiring, HVAC, plumbing, and flooring but none of the equipment or additional services. A cold site is essentially an empty data center.
Source: Adapted from community discussion — DracoL
An international trading organization that holds an International Organization for Standardization (ISO) 27001 certification is seeking to outsource their security monitoring to a managed security service provider (MSSP). The trading organization's security officer is tasked with drafting the requirements that need to be included in the outsourcing contract. Which of the following MUST be included in the contract?
Answer: D
. The right to audit the MSSP's security process should be included in the outsourcing contract. This allows the organization to verify that the MSSP is meeting the requirements set out in the contract and is providing the level of service that has been agreed upon. The organization should also ensure that the contract includes provisions for reporting on security incidents and breach notifications. While including an overview of equipment and having an executive manager responsible for information security are important considerations, they are not as critical as the right to audit the MSSP's security process.
Source: Adapted from community discussion — Alex71
Which of the following is the PRIMARY type of cryptography required to support non-repudiation of a digitally signed document?
Answer: D
The question ask about "type of cryptography" - not hashing - that eliminates A & B You need Asymmetric cryptography for Nonrepudiation Sender encrypt message (digital signature) with private key and receive decrypt message with sender's public key. This validates integrity and Nonrepudiation. Note that Symmetric Nonrepduation does not provide Nonrepduation.
Source: Adapted from community discussion — dev46
What is the MOST effective method to enhance security of a single sign-on (SSO) solution that interfaces with critical systems?
Answer: A
B and C are easily eliminated A and D both sound right. But A could be right considering the keyword "enhance" - I would assume SSL is already in place for securing data to/ from critical systems. So, validating user authentication with multi-factor sounds right.
Source: Adapted from community discussion — dev46
Which of the following is MOST appropriate to collect evidence of a zero-day attack?
Answer: A
Honeypot is right The rest of the options would not collect evidence until the real attack happens. That's what a Zero-day attack means nobody is aware of the attack including the vendor.
Source: Adapted from community discussion — dev46
When assessing web vulnerabilities, how can navigating the dark web add value to a penetration test?
Answer: C
Penetration Tester are good people who know how to do bad things. So, "C" - They don't mind looking for related breaches and hacking on the dark web!
Source: Adapted from community discussion — franbarpro
The quality assurance (QA) department is short-staffed and is unable to test all modules before the anticipated release date of an application. What security control is MOST likely to be violated?
Answer: A
Violated the "Release Control" of Change Management. Release Control Once the changes are finalized, they must be approved for release through the release control procedure. An essential step of the release control process is to double-check and ensure that any code inserted as a programming aid during the change process (such as debugging code and/or backdoors) is removed before releasing the new software to production. This process also ensures that only approved changes are made to production systems. Release control should also include acceptance testing to ensure that any alterations to end-user work tasks are understood and functional.
Source: Adapted from community discussion — Roy_Xenon
In the "Do" phase of the Plan-Do-Check-Act model, which of the following is performed?
Answer: C
Which of the following criteria ensures information is protected relative to its importance to the organization?
Answer: A
Answer is A "Information must be classified in terms of legal requirements, value, criticality and sensitivity to any unauthorised disclosure or modification, ideally classified to reflect business activity rather than inhibit or complicate" https://www.isms.online/iso-27001/annex-a-8-asset-management/
Source: Adapted from community discussion — JAckThePip
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISSP practice, question 21. 483 questions available.
Version 1.0.0. How we source questions