Question 81 · 483 in bank
In software development, which of the following entities normally signs the code to protect the code integrity?
Show answer
Answer: A
ISC2 Certified Information Systems Security Professional483 questions across 49 pages are complete and free, with no account or card.
483 questions in this bank
Free access · progress saved on this device
In software development, which of the following entities normally signs the code to protect the code integrity?
Answer: A
A software engineer uses automated tools to review application code and search for application flaws, back doors, or other malicious code. Which of the following is the FIRST Software Development Life Cycle (SDLC) phase where this takes place?
Answer: B
I think the answer is "B" and here's why: Development Stage The development stage is the part where developers actually write code and build the application according to the earlier design documents and outlined specifications. This is where Static Application Security Testing or SAST tools come into play. Product program code is built per the design document specifications. In theory, all of the prior planning and outlined should make the actual development phase relatively straightforward. Developers will follow any coding guidelines as defined by the organization and utilize different tools such as compilers, debuggers, and interpreters. I thought of "C" - Testing phase - but the question says Which of the following is the FIRST?
Source: Adapted from community discussion — franbarpro
Which of the following technologies can be used to monitor and dynamically respond to potential threats on web applications?
Answer: C
A company developed a web application which is sold as a Software as a Service (SaaS) solution to the customer. The application is hosted by a web server running on a specific operating system (OS) on a virtual machine (VM). During the transition phase of the service, it is determined that the support team will need access to the application logs. Which of the following privileges would be the MOST suitable?
Answer: B
Agree with B. Admin access to web server allow access to all other application being hosted on that web server. Although there's only one SaaS mentioned, but correct... least privilege principle. Here's a simplified hierarchical breakdown from the hypervisor to the application folder: >Hypervisor: Manages virtual machines. >Operating System: Provides the base environment for applications. >Web Server: Software application responsible for serving web content. > Web Server Configuration Files: Store settings for the web server. > Log Files: Record server activity. > Application Folders: Contain specific web applications. > Application Code: Source code for the application. > Application Data: Configuration files, databases, and other data. > Application Logs: Specific logs for the application.
Source: Adapted from community discussion — deeden
A security architect is developing an information system for a client. One of the requirements is to deliver a platform that mitigates against common vulnerabilities and attacks. What is the MOST efficient option used to prevent buffer overflow attacks?
Answer: C
A security practitioner detects an Endpoint attack on the organization's network. What is the MOST reasonable approach to mitigate future Endpoint attacks?
Answer: B
The most reasonable approach to mitigate future Endpoint attacks would be to harden the client image before deployment. This means ensuring that the endpoint devices are properly configured, patched, and updated to reduce vulnerabilities that can be exploited by attackers. This approach would help to prevent future attacks and improve the overall security posture of the organization. The other options listed can also be helpful in improving security, but hardening the client image is the best first step to take in this scenario.
Source: Adapted from community discussion — 74gjd_37
In a quarterly system access review, an active privileged account was discovered that did not exist in the prior review on the production system. The account was created one hour after the previous access review. Which of the following is the BEST option to reduce overall risk in addition to quarterly access reviews?
Answer: C
What are the essential elements of a Risk Assessment Report (RAR)?
Answer: A
The essential elements of information in a risk assessment can be described in three sections of the risk assessment report (or whatever vehicle is chosen by organizations to convey the results of the assessment): (i) an executive summary; (ii) the main body containing detailed risk assessment results; and (iii) supporting appendices https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf
Source: Adapted from community discussion — rdy4u
A corporation does not have a formal data destruction policy. During which phase of a criminal legal proceeding will this have the MOST impact?
Answer: C
The security operations center (SOC) has received credible intelligence that a threat actor is planning to attack with multiple variants of a destructive virus. After obtaining a sample set of this virus' variants and reverse engineering them to understand how they work, a commonality was found. All variants are coded to write to a specific memory location. It is determined this virus is of no threat to the organization because they had the foresight to enable what feature on all endpoints?
Answer: A
The keyword is "feature" A. Address Space Layout Randomization (ASLR) - feature B. Trusted Platform Module (TPM) - it's a chip in motherboard, not a feture C. Virtualization - not a feature D. Process isolation - not a feature
Source: Adapted from community discussion — dev46
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISSP practice, question 81. 483 questions available.
Version 1.0.0. How we source questions