Leading CISSP Pdf For Certified Information Systems Security Professional (CISSP) Certification

NEW QUESTION 1

An organization is considering outsourcing applications and data to a Cloud Service Provider (CSP). Which of the following is the MOST important concern regarding privacy?

• A. The CSP determines data criticality.
• B. The CSP provides end-to-end encryption services.
• C. The CSP’s privacy policy may be developer by the organization.
• D. The CSP may not be subject to the organization’s country legation.

Answer: D

NEW QUESTION 2

Which of the following mandates the amount and complexity of security controls applied to a security risk?

• A. Security vulnerabilities
• B. Risk tolerance
• C. Risk mitigation
• D. Security staff

Answer: C

NEW QUESTION 3

What is the term commonly used to refer to a technique of authenticating one machine to another by forging packets from a trusted source?

• A. Man-in-the-Middle (MITM) attack
• B. Smurfing
• C. Session redirect
• D. Spoofing

Answer: D

NEW QUESTION 4

Which inherent password weakness does a One Time Password (OTP) generator overcome?

• A. Static passwords must be changed frequently.
• B. Static passwords are too predictable.
• C. Static passwords are difficult to generate.
• D. Static passwords are easily disclosed.

Answer: D

NEW QUESTION 5

Which Redundant Array c/ Independent Disks (RAID) Level does the following diagram represent?

• A. RAID 0
• B. RAID 1
• C. RAID 5
• D. RAID 10

Answer: D

NEW QUESTION 6

A Business Continuity Plan (BCP) is based on

• A. the policy and procedures manual.
• B. an existing BCP from a similar organization.
• C. a review of the business processes and procedures.
• D. a standard checklist of required items and objectives.

Answer: D

NEW QUESTION 7

Discretionary Access Control (DAC) is based on which of the following?

• A. Information source and destination
• B. Identification of subjects and objects
• C. Security labels and privileges
• D. Standards and guidelines

Answer: B

NEW QUESTION 8

What is the PRIMARY difference between security policies and security procedures?

• A. Policies are used to enforce violations, and procedures create penalties
• B. Policies point to guidelines, and procedures are more contractual in nature
• C. Policies are included in awareness training, and procedures give guidance
• D. Policies are generic in nature, and procedures contain operational details

Answer: D

NEW QUESTION 9

Which of the following entails identification of data end links to business processes, applications, and data stores as well as assignment of ownership responsibilities?

• A. Risk management
• B. Security portfolio management
• C. Security governance
• D. Risk assessment

Answer: A

NEW QUESTION 10

Which one of the following data integrity models assumes a lattice of integrity levels?

• A. Take-Grant
• B. Biba
• C. Harrison-Ruzzo
• D. Bell-LaPadula

Answer: B

NEW QUESTION 11

Within a large organization, what business unit is BEST positioned to initiate provisioning and deprovisioning of user accounts?

• A. Training department
• B. Internal audit
• C. Human resources
• D. Information technology (IT)

Answer: C

NEW QUESTION 12

Which of the following is used by the Point-to-Point Protocol (PPP) to determine packet formats?

• A. Layer 2 Tunneling Protocol (L2TP)
• B. Link Control Protocol (LCP)
• C. Challenge Handshake Authentication Protocol (CHAP)
• D. Packet Transfer Protocol (PTP)

Answer: B

NEW QUESTION 13

Which of the following factors contributes to the weakness of Wired Equivalent Privacy (WEP) protocol?

• A. WEP uses a small range Initialization Vector (IV)
• B. WEP uses Message Digest 5 (MD5)
• C. WEP uses Diffie-Hellman
• D. WEP does not use any Initialization Vector (IV)

Answer: A

NEW QUESTION 14

Which of the following is the BEST metric to obtain when gaining support for an Identify and Access Management (IAM) solution?

• A. Application connection successes resulting in data leakage
• B. Administrative costs for restoring systems after connection failure
• C. Employee system timeouts from implementing wrong limits
• D. Help desk costs required to support password reset requests

Answer: D

NEW QUESTION 15

During examination of Internet history records, the following string occurs within a Unique Resource Locator (URL): http://www.companysite.com/products/products.asp?productid=123 or 1=1
What type of attack does this indicate?

• A. Directory traversal
• B. Structured Query Language (SQL) injection
• C. Cross-Site Scripting (XSS)
• D. Shellcode injection

Answer: C

NEW QUESTION 16
......