CISSP practice questions 431–440

1. Question 431 · 483 in bank

   When developing an electronic health record (EHR) in the United States (US), which of the following would be the BEST source of information for any compliance requirements?

   • AWorld Health Organization (WHO)
   • BInternational Organization for Standardization (ISO)
   • CHealth and Human Services (HHS)
   • DAmerican Public Health Association (APHA)

   Show answer

   Answer: C

   Next question

2. Question 432 · 483 in bank

   An organization suspects it is receiving spoofed e-mails from a foreign-hosted web e-mail service. Where can the MOST relevant be found to begin the process of identifying the perpetrator?

   • AE-mail logs from foreign-hosted web server
   • BMessage header of received e-mails
   • CTraffic logs from the corporate firewall
   • DLog files of the corporate Simple Mail Transfer Protocol (SMTP) server

   Show answer

   Answer: B

   Next question

3. Question 433 · 483 in bank

   A new internal auditor is tasked with auditing the supply chain. The system owner stated that the last internal auditor was terminated because the auditor discovered too many deficient controls. The auditor reports this conversation to their manager. Which of the following audit integrity principles BEST applies to this situation?

   • ADemonstrate competence while performing professional duties.
   • BPerform professional duties with honesty, diligence, and responsibility.
   • CPerform professional duties in accordance with company policy.
   • DBe aware of any influences that may be exerted on professional judgement.

   Show answer

   Answer: D

   Next question

4. Question 434 · 483 in bank

   An organization implements supply chain risk management (SCRM) into all phases of the Systems Development Life Cycle (SDLC). What methodology is MOST important to ensure that SCRM requirements are met?

   • ASupplier self-assessment
   • BProcurement assessment
   • CVulnerability assessment
   • DThird-party assessment

   Show answer

   Answer: D

   Next question

5. Question 435 · 483 in bank

   An organization needs to evaluate the effectiveness of security controls implemented on a new system. Which of the following roles should the organization entrust to conduct the evaluation?

   • AAuthorizing Official (AO)
   • BSystem owner
   • CControl assessor
   • DInformation System Security Officer (ISSO)

   Show answer

   Answer: C

   Next question

6. Question 436 · 483 in bank

   During a disruptive event, which security continuity objectives will maintain an organization’s information security to a predetermined level?

   • ADisaster recovery plan (DRP)
   • BImpact assessment report
   • CInformation security continuity plan
   • DBusiness continuity plan (BCP)

   Show answer

   Answer: C

   Next question

7. Question 437 · 483 in bank

   An organization is implementing a bring your own device (BYOD) policy. What would be BEST for mitigating the risk of users managing their own devices and potentially bringing in malware?

   • ASetting up access control lists (ACL) for these devices.
   • BInstalling a firewall on the organization’s primary network.
   • CSetting up a separate network within the organization’s demilitarized zone (DMZ).
   • DSetting up a separate, external wired or wireless network dedicated to these devices.

   Show answer

   Answer: D

   Next question

8. Question 438 · 483 in bank

   An organization acquired used technological equipment. This equipment will be integrated with new and existing business processes. What is the MOST appropriate consideration to identify the equipment that requires protection?

   • ATotal monetary value of the acquisition
   • BThe age of the computing hardware
   • CStakeholder concerns of how the assets are used
   • DLength and extent of support by the vendor

   Show answer

   Answer: C

   Next question

9. Question 439 · 483 in bank

   Which of the following is one of the key objectives regarding data management roles and responsibilities?

   • ADetermine data quality metrics.
   • BDefine important data ownership regardless of functions.
   • CEstablish data ownership during the final phase of a project.
   • DInstall data accountability.

   Show answer

   Answer: B

   Next question

10. Question 440 · 483 in bank

    What BEST describes data ownership?

    • AGeographic sovereignty
    • BConfidentiality and integrity
    • CAccuracy and precision
    • DLegal responsibilities

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISSP practice, question 431. 483 questions available.