Question 51 · 483 in bank
In a disaster recovery (DR) test, which of the following would be a trait of crisis management?
Show answer
Answer: B
ISC2 Certified Information Systems Security Professional483 questions across 49 pages are complete and free, with no account or card.
483 questions in this bank
Free access · progress saved on this device
In a disaster recovery (DR) test, which of the following would be a trait of crisis management?
Answer: B
Which is MOST important when negotiating an Internet service provider (ISP) service-level agreement (SLA) by an organization that solely provides Voice over Internet Protocol (VoIP) services?
Answer: D
The MOST important factor when negotiating an Internet Service Provider (ISP) service-level agreement (SLA) by an organization that solely provides Voice over Internet Protocol (VoIP) services would be: D. Availability of network services In a business where the sole service is VoIP, network availability is critical. If the network is down, the entire business operation could come to a halt, making availability a primary concern. VoIP is extremely sensitive to network downtime, and therefore, ensuring that the network is available is of utmost importance. While MTTR, QoS between applications, and financial penalties in case of disruption are also important factors to consider, they are secondary to ensuring that the network services are available for the core business offering of VoIP. This is aligned with best practices for SLAs in critical service delivery as per CISSP certification guidelines.
Source: Adapted from community discussion — ExamTaker1995
Which of the following BEST describes the purpose of the reference monitor when defining access control to enforce the security model?
Answer: B
A company hired an external vendor to perform a penetration test of a new payroll system. The company's internal test team had already performed an in-depth application and security test of the system and determined that it met security requirements. However, the external vendor uncovered significant security weaknesses where sensitive personal data was being sent unencrypted to the tax processing systems. What is the MOST likely cause of the security issues?
Answer: D
Answer D) Failure to perform Interface Test System Interface Test ("SIT") A system or systems interface (also known as a system integration test) test is an end-to-end functional test of the connection between two or more systems to verify their connection and operation.
Source: Adapted from community discussion — YesPlease
Which of the following is security control volatility?
Answer: B
Which of the following is included in change management?
Answer: B
Not sure if the question was changed or what. But it says " Included in the change management process. " This is straight from the book. Test then Implement. I'm going with UAT Testing. 4. Test the change. Once the change is approved, it should be tested, preferably on a nonproduction server. Testing helps verify that the change doesn’t cause an unanticipated problem. 5. Schedule and implement the change. The change is scheduled so that it can be implemented with the least impact on the system and the system’s customer. This may require scheduling the change during off-duty or nonpeak hours. Testing should discover any problems, but it’s still possible that the change causes unforeseen problems. Because of this, it’s important to have a rollback plan. This allows personnel to undo the change and return the system to its previous state if necessary.
Source: Adapted from community discussion — lifesucks44
When auditing the Software Development Life Cycle (SDLC) which of the following is one of the high-level audit phases?
Answer: A
An organization wants to define as physical perimeter. What primary device should be used to accomplish this objective if the organization's perimeter MUST cost- efficiently deter casual trespassers?
Answer: A
3-4 feet deters casual trespassers. 6-7 feet too high to climb — may block vision. 8 feet with 3 strands of barbed wire will deter determined intruders and is generally considered as the standard height and configuration.
Source: Adapted from community discussion — mrgod
What is the term used to define where data is geographically stored in the cloud?
Answer: B
Which of the following vulnerabilities can be BEST detected using automated analysis?
Answer: D
D is the best answer. Typical source code vulnerabilities are best detected using automated analysis tools like static application security testing (SAST). A - Multi-step process attacks are complex and span business logic and workflows, difficult for automated tools to detect. B - Business logic flaws require understanding of application's intended behavior, hard to detect automatically. C - Valid CSRF tokens can look like false positives, automated tools may not determine legitimacy well. In contrast, typical code flaws like SQLi, XSS, insecure functions etc. are well detected by SAST which analyzes source code for known vulnerable patterns. Automated analysis excels at finding these typical vulnerabilities that have known signatures in code.
Source: Adapted from community discussion — InclusiveSTEAM
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISSP practice, question 51. 483 questions available.
Version 1.0.0. How we source questions