CISSP practice questions 321–330

1. Question 321 · 483 in bank

   When MUST an organization's information security strategic plan be reviewed?

   • AWhenever there are major changes to the business
   • BQuarterly, when the organization's strategic plan is updated
   • CEvery three years, when the organization's strategic plan is updated
   • DWhenever there are significant changes to a major application

   Show answer

   Answer: A

   Next question

2. Question 322 · 483 in bank

   An established information technology (IT) consulting firm is considering acquiring a successful local startup. To gain a comprehensive understanding of the startup's security posture, which type of assessment provides the BEST information?

   • AA security audit
   • BA tabletop exercise
   • CA penetration test
   • DA security threat model

   Show answer

   Answer: A

   Next question

3. Question 323 · 483 in bank

   An organization plans to acquire a commercial off-the-shelf (COTS) system to replace their aging home-built reporting system. When should the organization's security team FIRST get involved in this acquisition's life cycle?

   • AWhen the system is verified and validated
   • BWhen the need for a system is expressed and the purpose of the system is documented
   • CWhen the system is deployed into production
   • DWhen the system is being designed, purchased, programmed, developed, or otherwise constructed

   Show answer

   Answer: B

   Next question

4. Question 324 · 483 in bank

   Which of the following is a PRIMARY security weakness in the design of Domain Name System (DNS)?

   • AEach DNS server must hold the address of the root servers.
   • BA DNS server can be disabled in a denial-of-service (DoS) attack.
   • CA DNS server does not authenticate source of information.
   • DA DNS server database can be injected with falsified checksums.

   Show answer

   Answer: C

   Next question

5. Question 325 · 483 in bank

   To minimize the vulnerabilities of a web-based application, which of the following FIRST actions will lock down the system and minimize the risk of an attack?

   • AApply the latest vendor patches and updates
   • BRun a vulnerability scanner
   • CReview access controls
   • DInstall an antivirus on the server

   Show answer

   Answer: A

   Next question

6. Question 326 · 483 in bank

   An organization has implemented a password complexity and an account lockout policy enforcing five incorrect logins tries within ten minutes. Network users have reported significantly increased account lockouts. Which of the following security principles is this company affecting?

   • AConfidentiality
   • BIntegrity
   • CAvailability
   • DAuthentication

   Show answer

   Answer: C

   Next question

7. Question 327 · 483 in bank

   In the last 15 years a company has experienced three electrical failures. The cost associated with each failure is listed below. Which of the following would be a reasonable annual loss expectation?

   

   • A3,500
   • B140,000
   • C14,000
   • D350,000

   Show answer

   Answer: C

   Next question

8. Question 328 · 483 in bank

   A security practitioner has been asked to model best practices for disaster recovery (DR) and business continuity. The practitioner has decided that a formal committee is needed to establish a business continuity policy. Which of the following BEST describes this stage of business continuity development?

   • ADeveloping and Implementing business continuity plans (BCP)
   • BProject Initiation and Management
   • CRisk Evaluation and Control
   • DBusiness impact analysis (BIA)

   Show answer

   Answer: B

   Next question

9. Question 329 · 483 in bank

   What physical characteristic does a retinal scan biometric device measure?

   • AThe amount of light reflected by the retina
   • BThe pattern of blood vessels at the back of the eye
   • CThe size, curvature, and shape of the retina
   • DThe pattern of light receptors It the back of the eye

   Show answer

   Answer: B

   Next question

10. Question 330 · 483 in bank

    Which of the following BEST represents a defense in depth concept?

    • ANetwork-based data loss prevention (DLP), Network Access Control (NAC), network-based Intrusion prevention system (NIPS), Port security on core switches
    • BHost-based data loss prevention (DLP), Endpoint anti-malware solution, Host-based integrity checker, Laptop locks, hard disk drive (HDD) encryption
    • CEndpoint security management, network intrusion detection system (NIDS), Network Access Control (NAC), Privileged Access Management (PAM), security information and event management (SIEM)
    • DWeb application firewall (WAF), Gateway network device tuning, Database firewall, Next-Generation Firewall (NGFW), Tier-2 demilitarized zone (DMZ) tuning

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISSP practice, question 321. 483 questions available.