CISSP practice questions 411–420

1. Question 411 · 483 in bank

   Which of the following reports provides the BEST attestation of detailed controls when evaluating an Identity as a Service (IDaaS) solution?

   • AService Organization Control (SOC) 1
   • BService Organization Control (SOC) 2
   • CService Organization Control (SOC) 3
   • DStatement on Auditing Standards (SAS) 70

   Show answer

   Answer: B

   Next question

2. Question 412 · 483 in bank

   Single sign-on (SSO) for federated identity management (FIM) must be implemented and managed so that authorization mechanisms protect access to privileged information using OpenID Connect (OIDC) token or Security Assertion Markup Language (SAML) assertion. What is the BEST method to use to protect them?

   • APass data in a bearer assertion, only signed by the identity provider.
   • BTokens and assertion should use base64 encoding to assure confidentiality.
   • CUse a challenge and response mechanism such as Challenge Handshake Authentication Protocol (CHAP).
   • DThe access token or assertion should be encrypted to ensure privacy.

   Show answer

   Answer: D

   Next question

3. Question 413 · 483 in bank

   The client of a security firm reviewed a vulnerability assessment report and claims the report is inaccurate. The client states that the vulnerabilities listed are not valid because the host’s operating system (OS) was not properly detected. Where in the vulnerability assessment process did the error MOST likely occur?

   • AReport writing
   • BDetection
   • CEnumeration
   • DScanning

   Show answer

   Answer: D

   Next question

4. Question 414 · 483 in bank

   For a victim of a security breach to prevail in a negligence claim, what MUST the victim establish?

   • AConcern
   • BBreach of contract
   • CProximate cause
   • DHardship

   Show answer

   Answer: C

   Next question

5. Question 415 · 483 in bank

   A large international organization that collects information from its consumers has contracted with a Software as a Service (SaaS) cloud provider to process this data. The SaaS cloud provider uses additional data processing to demonstrate other capabilities it wishes to offer to the data owner. This vendor believes additional data processing activity is allowed since they are not disclosing to other organizations. Which of the following BEST supports this rationale?

   • AThe data was encrypted at all times and only a few cloud provider employees had access.
   • BAs the data owner, the cloud provider has the authority to direct how the data will be processed.
   • CAs the data processor, the cloud provider has the authority to direct how the data will be processed.
   • DThe agreement between the two parties is vague and does not detail how the data can be used.

   Show answer

   Answer: D

   Next question

6. Question 416 · 483 in bank

   A security engineer is conducting an audit of an organization’s Voice over Internet Protocol (VoIP) phone network due to a large increase in charges from their phone provider. The engineer discovers unauthorized endpoints have connected to the phone server from the public internet and placed hundreds of unauthorized calls to parties around the globe. Which type of attack occurred?

   • AControl eavesdropping
   • BToll fraud
   • CCall hijacking
   • DAddress spoofing

   Show answer

   Answer: B

   Next question

7. Question 417 · 483 in bank

   An organization is looking to improve threat detection on their wireless network. The company goal is to automate alerts to improve response efforts. Which of the following best practices should be implemented FIRST?

   • ADeploy a standalone guest Wi-Fi network.
   • BImplement multi-factor authentication (MFA) on all domain accounts.
   • CDeploy a wireless intrusion detection system (IDS).
   • DImplement 802.1x authentication.

   Show answer

   Answer: C

   Next question

8. Question 418 · 483 in bank

   Security personnel should be trained by emergency management personnel in what to do before and during a disaster, as well as their role in recovery efforts. Personnel should take required training for emergency response procedures and protocols. Which part of physical security design does this fall under?

   • ALegal concerns
   • BLoss prevention
   • CEmergency preparedness
   • DLiability for employee conduct

   Show answer

   Answer: C

   Next question

9. Question 419 · 483 in bank

   How is protection for hypervisor host and software administration functions BEST achieved?

   • AEnforce network controls using a host-based firewall.
   • BDeploy the management interface in a dedicated virtual network segment.
   • CThe management traffic pathway should have separate physical network interface cards (NIC) and network.
   • DDeny permissions to specific virtual machines (VM) groups and objects.

   Show answer

   Answer: C

   Next question

10. Question 420 · 483 in bank

    To ensure compliance with the General Data Protection Regulation (GDPR), who in the organization should the help desk manager confer with before selecting a Software as a Service (SaaS) solution?

    • AData owner
    • BDatabase administrator (DBA)
    • CData center manager
    • DData Protection Officer (DPO)

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISSP practice, question 411. 483 questions available.