【免费】CISSPExamdump2023Jun资源-CSDN文库

需积分: 0 191 浏览量 2023-09-18 21:18:27 上传评论收藏 1.23MB PDF 举报

资源推荐

资源详情

资源评论

Welcome to download the Newest 2passeasy CISSP dumps

https://www.2passeasy.com/dumps/CISSP/ (653 New Questions)

Exam Questions CISSP

Certified Information Systems Security Professional (CISSP)

https://www.2passeasy.com/dumps/CISSP/

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

Welcome to download the Newest 2passeasy CISSP dumps

https://www.2passeasy.com/dumps/CISSP/ (653 New Questions)

NEW QUESTION 1

- (Exam Topic 1)

A company whose Information Technology (IT) services are being delivered from a Tier 4 data center, is preparing a companywide Business Continuity Planning

(BCP). Which of the following failures should the IT manager be concerned with?

A. Application

B. Storage

C. Power

D. Network

Answer: C

NEW QUESTION 2

- (Exam Topic 1)

When assessing an organization’s security policy according to standards established by the International Organization for Standardization (ISO) 27001 and

27002, when can management responsibilities be defined?

A. Only when assets are clearly defined

B. Only when standards are defined

C. Only when controls are put in place

D. Only procedures are defined

Answer: A

NEW QUESTION 3

- (Exam Topic 1)

Which of the following represents the GREATEST risk to data confidentiality?

A. Network redundancies are not implemented

B. Security awareness training is not completed

C. Backup tapes are generated unencrypted

D. Users have administrative privileges

Answer: C

NEW QUESTION 4

- (Exam Topic 1)

All of the following items should be included in a Business Impact Analysis (BIA) questionnaire EXCEPT questions that

A. determine the risk of a business interruption occurring

B. determine the technological dependence of the business processes

C. Identify the operational impacts of a business interruption

D. Identify the financial impacts of a business interruption

Answer: B

NEW QUESTION 5

- (Exam Topic 1)

Which of the following actions will reduce risk to a laptop before traveling to a high risk area?

A. Examine the device for physical tampering

B. Implement more stringent baseline configurations

C. Purge or re-image the hard disk drive

D. Change access codes

Answer: D

NEW QUESTION 6

- (Exam Topic 1)

Intellectual property rights are PRIMARY concerned with which of the following?

A. Owner’s ability to realize financial gain

B. Owner’s ability to maintain copyright

C. Right of the owner to enjoy their creation

D. Right of the owner to control delivery method

Answer: D

NEW QUESTION 7

- (Exam Topic 2)

Which of the following is an effective control in preventing electronic cloning of Radio Frequency Identification (RFID) based access cards?

A. Personal Identity Verification (PIV)

B. Cardholder Unique Identifier (CHUID) authentication

C. Physical Access Control System (PACS) repeated attempt detection

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

Welcome to download the Newest 2passeasy CISSP dumps

https://www.2passeasy.com/dumps/CISSP/ (653 New Questions)

D. Asymmetric Card Authentication Key (CAK) challenge-response

Answer: C

NEW QUESTION 8

- (Exam Topic 2)

Which of the following is MOST important when assigning ownership of an asset to a department?

A. The department should report to the business owner

B. Ownership of the asset should be periodically reviewed

C. Individual accountability should be ensured

D. All members should be trained on their responsibilities

Answer: B

NEW QUESTION 9

- (Exam Topic 3)

The use of private and public encryption keys is fundamental in the implementation of which of the following?

A. Diffie-Hellman algorithm

B. Secure Sockets Layer (SSL)

C. Advanced Encryption Standard (AES)

D. Message Digest 5 (MD5)

Answer: A

NEW QUESTION 10

- (Exam Topic 3)

Who in the organization is accountable for classification of data information assets?

A. Data owner

B. Data architect

C. Chief Information Security Officer (CISO)

D. Chief Information Officer (CIO)

Answer: A

NEW QUESTION 10

- (Exam Topic 3)

What is the second phase of Public Key Infrastructure (PKI) key/certificate life-cycle management?

A. Implementation Phase

B. Initialization Phase

C. Cancellation Phase

D. Issued Phase

Answer: D

NEW QUESTION 11

- (Exam Topic 4)

An input validation and exception handling vulnerability has been discovered on a critical web-based system. Which of the following is MOST suited to quickly

implement a control?

A. Add a new rule to the application layer firewall

B. Block access to the service

C. Install an Intrusion Detection System (IDS)

D. Patch the application source code

Answer: A

NEW QUESTION 13

- (Exam Topic 4)

Which of the following is used by the Point-to-Point Protocol (PPP) to determine packet formats?

A. Layer 2 Tunneling Protocol (L2TP)

B. Link Control Protocol (LCP)

C. Challenge Handshake Authentication Protocol (CHAP)

D. Packet Transfer Protocol (PTP)

Answer: B

NEW QUESTION 17

- (Exam Topic 4)

In a Transmission Control Protocol/Internet Protocol (TCP/IP) stack, which layer is responsible for negotiating and establishing a connection with another node?

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

Welcome to download the Newest 2passeasy CISSP dumps

https://www.2passeasy.com/dumps/CISSP/ (653 New Questions)

A. Transport layer

B. Application layer

C. Network layer

D. Session layer

Answer: A

NEW QUESTION 20

- (Exam Topic 5)

Users require access rights that allow them to view the average salary of groups of employees. Which control would prevent the users from obtaining an individual

employee’s salary?

A. Limit access to predefined queries

B. Segregate the database into a small number of partitions each with a separate security level

C. Implement Role Based Access Control (RBAC)

D. Reduce the number of people who have access to the system for statistical purposes

Answer: C

NEW QUESTION 22

- (Exam Topic 6)

A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation. What MUST an administrator review to audit a user’s

access to data files?

A. Host VM monitor audit logs

B. Guest OS access controls

C. Host VM access controls

D. Guest OS audit logs

Answer: A

NEW QUESTION 23

- (Exam Topic 6)

Which of the following is a PRIMARY benefit of using a formalized security testing report format and structure?

A. Executive audiences will understand the outcomes of testing and most appropriate next steps for corrective actions to be taken

B. Technical teams will understand the testing objectives, testing strategies applied, and business risk associated with each vulnerability

C. Management teams will understand the testing objectives and reputational risk to the organization

D. Technical and management teams will better understand the testing objectives, results of each test phase, and potential impact levels

Answer: D

NEW QUESTION 27

- (Exam Topic 7)

What would be the MOST cost effective solution for a Disaster Recovery (DR) site given that the organization’s systems cannot be unavailable for more than 24

hours?

A. Warm site

B. Hot site

C. Mirror site

D. Cold site

Answer: A

NEW QUESTION 28

- (Exam Topic 7)

Which of the following is a PRIMARY advantage of using a third-party identity service?

A. Consolidation of multiple providers

B. Directory synchronization

C. Web based logon

D. Automated account management

Answer: D

NEW QUESTION 29

- (Exam Topic 7)

A continuous information security monitoring program can BEST reduce risk through which of the following?

A. Collecting security events and correlating them to identify anomalies

B. Facilitating system-wide visibility into the activities of critical user accounts

C. Encompassing people, process, and technology

D. Logging both scheduled and unscheduled system changes

Answer: B

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com

Welcome to download the Newest 2passeasy CISSP dumps

https://www.2passeasy.com/dumps/CISSP/ (653 New Questions)

NEW QUESTION 32

- (Exam Topic 7)

An organization is found lacking the ability to properly establish performance indicators for its Web hosting solution during an audit. What would be the MOST

probable cause?

A. Absence of a Business Intelligence (BI) solution

B. Inadequate cost modeling

C. Improper deployment of the Service-Oriented Architecture (SOA)

D. Insufficient Service Level Agreement (SLA)

Answer: D

NEW QUESTION 35

- (Exam Topic 7)

With what frequency should monitoring of a control occur when implementing Information Security Continuous Monitoring (ISCM) solutions?

A. Continuously without exception for all security controls

B. Before and after each change of the control

C. At a rate concurrent with the volatility of the security control

D. Only during system implementation and decommissioning

Answer: B

NEW QUESTION 38

- (Exam Topic 7)

What should be the FIRST action to protect the chain of evidence when a desktop computer is involved?

A. Take the computer to a forensic lab

B. Make a copy of the hard drive

C. Start documenting

D. Turn off the computer

Answer: C

NEW QUESTION 42

- (Exam Topic 8)

What is the BEST approach to addressing security issues in legacy web applications?

A. Debug the security issues

B. Migrate to newer, supported applications where possible

C. Conduct a security assessment

D. Protect the legacy application with a web application firewall

Answer: D

NEW QUESTION 44

- (Exam Topic 8)

A Java program is being developed to read a file from computer A and write it to computer B, using a third computer C. The program is not working as expected.

What is the MOST probable security feature of Java preventing the program from operating as intended?

A. Least privilege

B. Privilege escalation

C. Defense in depth

D. Privilege bracketing

Answer: A

NEW QUESTION 49

- (Exam Topic 8)

The configuration management and control task of the certification and accreditation process is incorporated in which phase of the System Development Life Cycle

(SDLC)?

A. System acquisition and development

B. System operations and maintenance

C. System initiation

D. System implementation

Answer: A

Explanation:

Reference https://online.concordiA.edu/computer-science/system-development-life-cycle-phases/

NEW QUESTION 54

- (Exam Topic 9)

Internet Protocol (IP) source address spoofing is used to defeat

Passing Certification Exams Made Easy visit - https://www.2PassEasy.com