CISSP practice questions 391–400

1. Question 391 · 483 in bank

   A bank failed to meet service-level agreements (SLA) with customers after suffering from a database failure of the transaction processing system (TPS) that resulted in delayed financial deposits. A regulatory agency overseeing the bank would like to determine if the cause of the delay was a material weakness. Which of the following documents is MOST relevant for the regulatory agency to review?

   • ABusiness continuity plan (BCP)
   • BBusiness impact analysis (BIA)
   • CContinuity of Operations Plan (COOP)
   • DEnterprise resource planning (ERP)

   Show answer

   Answer: A

   Next question

2. Question 392 · 483 in bank

   What is the MOST effective way to ensure that a cloud service provider does not access a customer’s data stored within its infrastructure?

   • AUse the organization’s encryption tools and data management controls.
   • BEnsure that the cloud service provider will contractually not access data unless given explicit authority.
   • CRequest audit logs on a regular basis.
   • DUtilize the cloud provider’s key management and elastic hardware security module (HSM) support.

   Show answer

   Answer: A

   Next question

3. Question 393 · 483 in bank

   Prohibiting which of the following techniques is MOST helpful in preventing users from obtaining confidential data by using statistical queries?

   • ASequences of queries that refer repeatedly to the same population
   • BRepeated queries that access multiple databases
   • CSelecting all records from a table and displaying all columns
   • DRunning queries that access sensitive data

   Show answer

   Answer: A

   Next question

4. Question 394 · 483 in bank

   Which of the following is a major component of the federated identity management (FIM) implementation model and used to establish a network between dozens of organizations?

   • AIdentity as a Service (IDaaS)
   • BAttribute-based access control (ABAC)
   • CCross-certification
   • DTrusted third party (TTP)

   Show answer

   Answer: D

   Next question

5. Question 395 · 483 in bank

   A Chief Information Security Officer (CISO) is considering various proposals for evaluating security weaknesses and vulnerabilities at the source code level. Which of the following items BEST equips the CISO to make smart decisions for the organization?

   • AThe Common Weakness Risk Analysis Framework (CWRAF)
   • BThe Common Vulnerabilities and Exposures (CVE)
   • CThe Common Weakness Enumeration (CWE)
   • DThe Open Web Application Security Project (OWASP) Top Ten

   Show answer

   Answer: A

   Next question

6. Question 396 · 483 in bank

   Which of the following methods is MOST effective in mitigating Cross-Site Scripting (XSS) vulnerabilities within HyperText Markup Language (HTML) websites?

   • AUse antivirus and endpoint protection on the server to secure the web-based application
   • BPlace the web-based system in a defined Demilitarized Zone (DMZ)
   • CUse .NET framework with .aspx extension to provide a higher level of security to the web application so that the web server display can be locked down
   • DNot returning any HTML tags to the browser client

   Show answer

   Answer: D

   Next question

7. Question 397 · 483 in bank

   Which of the following MOST accurately describes the Security Target (ST) in the Common Criteria framework?

   • AThe set of rules that define how resources or assets are managed and protected
   • BA product independent set of security criteria for a class of products
   • CThe product and documentation to be evaluated
   • DA document that includes a product specific set of security criteria

   Show answer

   Answer: D

   Next question

8. Question 398 · 483 in bank

   An organization has approved deployment of a virtual environment for the development servers and has established controls for restricting access to resources. In order to implement best security practices for the virtual environment, the security team MUST also implement which of the following steps?

   • AImplement a dedicated management network for the hypervisor.
   • BDeploy Terminal Access Controller Access Control System Plus (TACACS+) for authentication.
   • CImplement complex passwords using Privileged Access Management (PAM).
   • DCapture network traffic for the network interface.

   Show answer

   Answer: A

   Next question

9. Question 399 · 483 in bank

   Which of the following is a weakness of the Data Encryption Standard (DES)?

   • ABlock encryption scheme
   • BUse of same key for encryption and decryption
   • CPublicly disclosed algorithm
   • DInadequate key length

   Show answer

   Answer: D

   Next question

10. Question 400 · 483 in bank

    What are facets of trustworthy software in supply chain operations?

    • AFunctionality, safety, reliability, integrity, and accuracy
    • BConfidentiality, integrity, availability, authenticity, and possession
    • CSafety, reliability, availability, resilience, and security
    • DReparability, security, upgradability, functionality, and accuracy

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISSP practice, question 391. 483 questions available.