CISSP practice questions 361–370

1. Question 361 · 483 in bank

   A company is moving from the V model to Agile development. How can the information security department BEST ensure that secure design principles are implemented in the new methodology?

   • AInformation security requirements are captured in mandatory user stories.
   • BAll developers receive a mandatory targeted information security training.
   • CThe information security department performs an information security assessment after each sprint.
   • DThe non-financial information security requirements remain mandatory for the new model.

   Show answer

   Answer: A

   Next question

2. Question 362 · 483 in bank

   Which of the (ISC) Code of Ethics canons is MOST reflected when preserving the value of systems, applications, and entrusted information while avoiding conflicts of interest?

   • AProvide diligent and competent service to principles.
   • BAct honorably, honestly, justly, responsibly, and legally.
   • CAdvance and protect the profession.
   • DProtect society, the commonwealth, and the infrastructure.

   Show answer

   Answer: A

   Next question

3. Question 363 · 483 in bank

   Which of the following should exist in order to perform a security audit?

   • ANeutrality of the auditor
   • BIndustry framework to audit against
   • CExternal (third-party) auditor
   • DInternal certified auditor

   Show answer

   Answer: B

   Next question

4. Question 364 · 483 in bank

   When telephones in a city are connected by a single exchange, the caller can only connect with the switchboard operator. The operator then manually connects the call. This is an example of which type of network topology?

   • APoint-to-Point Protocol (PPP)
   • BBus
   • CStar
   • DTree

   Show answer

   Answer: C

   Next question

5. Question 365 · 483 in bank

   A firm within the defense industry has been directed to comply with contractual requirements for encryption of a government client's Controlled Unclassified Information (CUI). What encryption strategy represents how to protect data at rest in the MOST efficient and cost-effective manner?

   • APerform logical separation of program information, using virtualized storage solutions with encryption management in the back-end disk systems
   • BPerform logical separation of program information, using virtualized storage solutions with built-in encryption at the virtualization layer
   • CPerform physical separation of program information and encrypt only information deemed critical by the defense client
   • DImplement data at rest encryption across the entire storage area network (SAN)

   Show answer

   Answer: B

   Next question

6. Question 366 · 483 in bank

   Which audit type is MOST appropriate for evaluating the effectiveness of a security program?

   • AAnalysis
   • BThreat
   • CAssessment
   • DValidation

   Show answer

   Answer: C

   Next question

7. Question 367 · 483 in bank

   Before allowing a web application into the production environment, the security practitioner performs multiple types of tests to confirm that the web application performs as expected. To test the username field, the security practitioner creates a test that enters more characters into the field than is allowed. Which of the following BEST describes the type of test performed?

   • AMisuse case testing
   • BInterface testing
   • CWeb session testing
   • DPenetration testing

   Show answer

   Answer: A

   Next question

8. Question 368 · 483 in bank

   If the wide area network (WAN) is supporting converged applications like Voice over Internet Protocol (VoIP), which of the following becomes even MORE essential to the assurance of the network?

   • ABoundary routing
   • BClassless Inter-Domain Routing (CIDR)
   • CInternet Protocol (IP) routing lookups
   • DDeterministic routing

   Show answer

   Answer: D

   Next question

9. Question 369 · 483 in bank

   Why would a system be structured to isolate different classes of information from one another and segregate them by user jurisdiction?

   • AThe organization is required to provide different services to various third-party organizations.
   • BThe organization can avoid e-discovery processes in the event of litigation.
   • CThe organization's infrastructure is clearly arranged and scope of responsibility is simplified.
   • DThe organization can vary its system policies to comply with conflicting national laws.

   Show answer

   Answer: D

   Next question

10. Question 370 · 483 in bank

    An organization implements Network Access Control (NAC) using Institute of Electrical and Electronics Engineers (IEEE) 802.1x and discovers the printers do not support the IEEE 802.1x standard. Which of the following is the BEST resolution?

    • AImplement port security on the switch ports for the printers.
    • BDo nothing; IEEE 802.1x is irrelevant to printers.
    • CInstall an IEEE 802.1x bridge for the printers.
    • DImplement a virtual local area network (VLAN) for the printers.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISSP practice, question 361. 483 questions available.