CISSP practice questions 351–360

1. Question 351 · 483 in bank

   When conducting a third-party risk assessment of a new supplier, which of the following reports should be reviewed to confirm the operating effectiveness of the security, availability, confidentiality, and privacy trust principles?

   • AService Organization Control (SOC) 1, Type 2
   • BService Organization Control (SOC) 2, Type 2
   • CInternational Organization for Standardization (ISO) 27001
   • DInternational Organization for Standardization (ISO) 27002

   Show answer

   Answer: B

   Next question

2. Question 352 · 483 in bank

   Which of the following would be the BEST mitigation practice for man-in-the-middle (MITM) Voice over Internet Protocol (VoIP) attacks?

   • AUse Secure Shell (SSH) protocol
   • BUse File Transfer Protocol (FTP)
   • CUse Transport Layer Security (TLS) protocol
   • DUse Media Gateway Control Protocol (MGCP)

   Show answer

   Answer: C

   Next question

3. Question 353 · 483 in bank

   The Chief Information Security Officer (CISO) is concerned about business application availability. The organization was recently subject to a ransomware attack that resulted in the unavailability of applications and services for 10 working days that required paper-based running of all main business processes. There are now aggressive plans to enhance the Recovery Time Objective (RTO) and cater for more frequent data captures. Which of the following solutions should be implemented to fully comply to the new business requirements?

   • AVirtualization
   • BAntivirus
   • CHost-based intrusion prevention system (HIPS)
   • DProcess isolation

   Show answer

   Answer: A

   Next question

4. Question 354 · 483 in bank

   What is the MOST appropriate hierarchy of documents when implementing a security program?

   • APolicy, organization principle, standard, guideline
   • BStandard, policy, organization principle, guideline
   • COrganization principle, policy, standard, guideline
   • DOrganization principle, guideline, policy, standard

   Show answer

   Answer: C

   Next question

5. Question 355 · 483 in bank

   Which of the following is the MOST important consideration in selecting a security testing method based on different Radio-Frequency Identification (RFID) vulnerability types?

   • AAn understanding of the attack surface
   • BAdaptability of testing tools to multiple technologies
   • CThe quality of results and usability of tools
   • DThe performance and resource utilization of tools

   Show answer

   Answer: A

   Next question

6. Question 356 · 483 in bank

   An organization's internal audit team performed a security audit on the company's system and reported that the manufacturing application is rarely updated along with other issues categorized as minor. Six months later, an external audit team reviewed the same system with the same scope, but identified severe weaknesses in the manufacturing application's security controls. What is MOST likely to be the root cause of the internal audit team's failure in detecting these security issues?

   • AInadequate security patch testing
   • BInadequate test coverage analysis
   • CInadequate log reviews
   • DInadequate change control procedures

   Show answer

   Answer: B

   Next question

7. Question 357 · 483 in bank

   Which of the following is a limitation of the Bell-LaPadula model?

   • ASegregation of duties (SoD) is difficult to implement as the "no read-up" rule limits the ability of an object to access information with a higher classification.
   • BMandatory access control (MAC) is enforced at all levels making discretionary access control (DAC) impossible to implement.
   • CIt contains no provision or policy for changing data access control and works well only with access systems that are static in nature.
   • DIt prioritizes integrity over confidentiality which can lead to inadvertent information disclosure.

   Show answer

   Answer: C

   Next question

8. Question 358 · 483 in bank

   Which of the following vulnerability assessment activities BEST exemplifies the Examine method of assessment?

   • AAsking the Information System Security Officer (ISSO) to describe the organization's patch management processes
   • BEnsuring that system audit logs capture all relevant data fields required by the security controls baseline
   • CLogging into a web server using the default administrator account and a default password
   • DPerforming Port Scans of selected network hosts to enumerate active services

   Show answer

   Answer: B

   Next question

9. Question 359 · 483 in bank

   Which of the following BEST ensures the integrity of transactions to intended recipients?

   • APublic key infrastructure (PKI)
   • BBlockchain technology
   • CPre-shared key (PSK)
   • DWeb of trust

   Show answer

   Answer: B

   Next question

10. Question 360 · 483 in bank

    Recently, an unknown event has disrupted a single Layer-2 network that spans between two geographically diverse data centers. The network engineers have asked for assistance in identifying the root cause of the event. Which of the following is the MOST likely cause?

    • ASmurf attack
    • BMisconfigured routing protocol
    • CBroadcast domain too large
    • DAddress spoofing

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISSP practice, question 351. 483 questions available.