CISSP practice questions 61–70

1. Question 61 · 483 in bank

   Which of the following does the security design process ensure within the System Development Life Cycle (SDLC)?

   • AProper security controls, security objectives, and security goals are properly initiated.
   • BSecurity objectives, security goals, and system test are properly conducted.
   • CProper security controls, security goals, and fault mitigation are properly conducted.
   • DSecurity goals, proper security controls, and validation are properly initiated.

   Show answer

   Answer: A

   Next question

2. Question 62 · 483 in bank

   A project manager for a large software firm has acquired a government contract that generates large amounts of Controlled Unclassified Information (CUI). The organization's information security manager had received a request to transfer project-related CUI between systems of differing security classifications. What role provides the authoritative guidance for this transfer?

   • APM
   • BInformation owner
   • CData Custodian
   • DMission/Business Owner

   Show answer

   Answer: B

   Explanation

   The authoritative guidance for the transfer of Controlled Unclassified Information (CUI) between systems of differing security classifications is provided by the Information Owner. The Information Owner is responsible for ensuring that the information is appropriately protected and managed throughout its lifecycle, including during transfer between systems. In this case, the Information Owner should consult with the organization's information security manager and follow any applicable policies, procedures, and guidelines for handling CUI.

   Source: Adapted from community discussion — Alex71

   Next question

3. Question 63 · 483 in bank

   Which of the following is MOST important to follow when developing information security controls for an organization?

   • AUse industry standard best practices for security controls in the organization.
   • BExercise due diligence with regard to all risk management information to tailor appropriate controls.
   • CReview all local and international standards and choose the most stringent based on location.
   • DPerform a risk assessment and choose a standard that addresses existing gaps.

   Show answer

   Answer: B

   Next question

4. Question 64 · 483 in bank

   Which of the following determines how traffic should flow based on the status of the infrastructure layer?

   • AControl plane
   • BApplication plane
   • CTraffic plane
   • DData plane

   Show answer

   Answer: A

   Explanation

   A. Control plane - controls how data packets are forwarded (such as using a routing table) B. Application plane - On a network, the Application Plane is the layer that has applications and services that make requests for network functions from the Control Plane and the Data plane. C. Traffic plane - think it's data plane as it carries traffic D. Data plane - forwards the packet (a.k.a forwarding plane)

   Source: Adapted from community discussion — dev46

   Next question

5. Question 65 · 483 in bank

   When recovering from an outage, what is the Recovery Point Objective (RPO), in terms of data recovery?

   • AThe RPO is the minimum amount of data that needs to be recovered.
   • BThe RPO is the amount of time it takes to recover an acceptable percentage of data lost.
   • CThe RPO is a goal to recover a targeted percentage of data lost.
   • DThe RPO is the maximum amount of time for which loss of data is acceptable.

   Show answer

   Answer: D

   Next question

6. Question 66 · 483 in bank

   When testing password strength, which of the following is the BEST method for brute forcing passwords?

   • AConduct an offline attack on the hashed password information.
   • BUse a comprehensive list of words to attempt to guess the password.
   • CUse social engineering methods to attempt to obtain the password.
   • DConduct an online password attack until the account being used is locked.

   Show answer

   Answer: A

   Explanation

   Comon, guys, using of word list IS NOT A BRUTEFORCE. Brutforce is trying EVERY possible value. OSG: "A dictionary attack is an attempt to discover passwords by using every possible password in a predefined database or list of common or expected passwords." It makes B a dictionary attack. And question says "bruteforce". It's A.

   Source: Adapted from community discussion — rootic

   Next question

7. Question 67 · 483 in bank

   Which of the following attacks, if successful, could give an intruder complete control of a software-defined networking (SDN) architecture?

   • AA brute force password attack on the Secure Shell (SSH) port of the controller
   • BSending control messages to open a flow that does not pass a firewall from a compromised host within the network
   • CRemote Authentication Dial-In User Service (RADIUS) token replay attack
   • DSniffing the traffic of a compromised host inside the network

   Show answer

   Answer: A

   Next question

8. Question 68 · 483 in bank

   Which of the following is the name of an individual or group that is impacted by a change?

   • AChange agent
   • BEnd User
   • CStakeholder
   • DSponsor

   Show answer

   Answer: C

   Explanation

   "Stakeholders" include all parties interested in a project or change, which can encompass a variety of groups, including end users, sponsors, customers, employees, among others, who may be affected, influenced or have interest in the proposed change. "End users" are a specific subset of "stakeholders" who directly experience the implications of the change in their daily activities or functions.

   Source: Adapted from community discussion — 629f731

   Next question

9. Question 69 · 483 in bank

   Which of the following is the BEST option to reduce the network attack surface of a system?

   • ADisabling unnecessary ports and services
   • BEnsuring that there are no group accounts on the system
   • CUninstalling default software on the system
   • DRemoving unnecessary system user accounts

   Show answer

   Answer: A

   Next question

10. Question 70 · 483 in bank

    The European Union (EU) General Data Protection Regulation (GDPR) requires organizations to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The Data Owner should therefore consider which of the following requirements?

    • ANever to store personal data of EU citizens outside the EU
    • BData masking and encryption of personal data
    • COnly to use encryption protocols approved by EU
    • DAnonymization of personal data when transmitted to sources outside the EU

    Show answer

    Answer: B

    Explanation

    Option A states "Never store personal data of European Union citizens outside the European Union." Although the international transfer of personal data outside the EU is subject to restrictions under the General Data Protection Regulation (GDPR), the law does not strictly prohibit the storage of EU citizens' data outside the region. Rather than outright prohibiting the storage of data outside the EU, the GDPR states that when personal data is transferred outside the European Union to non-EU countries, appropriate safeguards must be implemented to ensure an adequate level of data protection. These safeguards may include standard contractual clauses, the use of approved certification instruments, or the assessment of the adequacy of the recipient country in terms of data protection.

    Source: Adapted from community discussion — 629f731

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISSP practice, question 61. 483 questions available.