Unique Top-selling CISSP Exams - New 2026 ISC Pratice Exam
ISC Certification Dumps CISSP Exam for Full Questions - Exam Study Guide
To qualify for the CISSP exam, candidates must have at least five years of professional experience in the field of information security. They must also adhere to the ISC2 code of ethics and pass the exam. CISSP exam consists of 250 multiple-choice questions that must be completed within six hours. Candidates who pass the exam are awarded the CISSP certification, which is valid for three years. They must then renew their certification by earning continuing education credits or by retaking the exam.
NEW QUESTION # 663
Which Orange Book evaluation level is described as "Verified Design"?
- A. B2.
- B. A1.
- C. B1.
- D. B3.
Answer: B
Explanation:
Level A1 is described as Verified Design.
The following answers are incorrect:
B3. This is incorrect because level B3 is described as Security Domains.
B2. This is incorrect because level B2 is described as Structured Protection. B1. This is incorrect because level B1 is described as Labeled Security.
NEW QUESTION # 664
What action should be taken by a business line that is unwilling to accept the residual risk in a system after implementing compensating controls?
- A. Implement operational safeguards.
- B. Find another business line willing to accept the residual risk.
- C. Notify the audit committee of the situation.
- D. Purchase insurance to cover the residual risk.
Answer: D
Explanation:
Residual risk is the risk that remains after implementing controls to mitigate the original risk. If a business line is unwilling to accept the residual risk in a system, one possible action is to purchase insurance to cover the potential losses or damages that may result from the residual risk. This is a form of risk transfer, which is one of the four risk management strategies, along with risk avoidance, risk mitigation, and risk acceptance.
Notifying the audit committee, implementing operational safeguards, and finding another business line are not valid actions to deal with residual risk . References: [CISSP All-in-One Exam Guide, Eighth Edition, Chapter
1, page 32]; [CISSP CBK, Fifth Edition, Chapter 2, page 151].
NEW QUESTION # 665
What is the term used to define where data is geographically stored in the cloud?
- A. Data subject rights
- B. Data privacy rights
- C. Data warehouse
- D. Data sovereignty
Answer: D
Explanation:
Data sovereignty is the term used to define where data is geographically stored in the cloud. Data sovereignty refers to the legal and regulatory framework that governs the data based on the location or jurisdiction where it resides. Data sovereignty can affect the cloud service provider's and the cloud customer's obligations and responsibilities regarding data protection, privacy, security, compliance, and access. For example, some countries may have strict data sovereignty laws that require the data to be stored and processed within their borders, and prohibit the data from being transferred or accessed by foreign entities.
NEW QUESTION # 666
Why is it important that senior management clearly communicates the formal Maximum Tolerable Downtime (MTD) decision?
- A. To demonstrate to the regulatory bodies that the company takes business continuity seriously
- B. To provide each manager with precise direction on selecting an appropriate recovery alternative
- C. To demonstrate to the board of directors that senior management is committed to continuity recovery efforts
- D. To provide a formal declaration from senior management as required by internal audit to demonstrate sound business practices
Answer: B
Explanation:
The reason why it is important that senior management clearly communicates the formal Maximum Tolerable Downtime (MTD) decision is to provide each manager with precise direction on selecting an appropriate recovery alternative. MTD is a metric that defines the maximum amount of time that a system or a process can be unavailable or disrupted before causing unacceptable consequences or losses to the organization. MTD is determined by senior management based on the business impact analysis, the risk assessment, and the organizational objectives and policies. MTD is communicated to each manager as part of the disaster recovery plan (DRP), which is a plan that defines the procedures and actions to restore the critical systems or processes after a disaster or a disruption. MTD helps each manager to select an appropriate recovery alternative, which is a strategy or a solution that enables the recovery of the system or the process within the MTD. For example, if the MTD for a system is 24 hours, the manager may select a recovery alternative that involves a backup site or a cloud service that can be activated within 24 hours. If the MTD for a system is 4 hours, the manager may select a recovery alternative that involves a redundant or a mirrored site that can be switched within 4 hours.
Therefore, it is important that senior management clearly communicates the formal MTD decision to provide each manager with precise direction on selecting an appropriate recovery alternative that meets the organizational needs and expectations. To demonstrate to the regulatory bodies that the company takes business continuity seriously, to demonstrate to the board of directors that senior management is committed to continuity recovery efforts, or to provide a formal declaration from senior management as required by internal audit to demonstrate sound business practices are not the reasons why it is important that senior management clearly communicates the formal MTD decision, as they are not related to the selection of an appropriate recovery alternative. These are possible benefits or outcomes of communicating the formal MTD decision, but they are not the main purpose or the reason for doing so. Communicating the formal MTD decision may help to demonstrate to the regulatory bodies that the company takes business continuity seriously, as it shows that the company has a clear and realistic metric for the recovery of the critical systems or processes.
Communicating the formal MTD decision may help to demonstrate to the board of directors that senior management is committed to continuity recovery efforts, as it shows that senior management has a strategic and proactive role in the disaster recovery planning and implementation. Communicating the formal MTD decision may help to provide a formal declaration from senior management as required by internal audit to demonstrate sound business practices, as it shows that senior management has a documented and approved metric for the recovery of the critical systems or processes. References: Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 19: Security Operations, page 1870.
NEW QUESTION # 667
Refer to the information below to answer the question.
A security practitioner detects client-based attacks on the organization's network. A plan will be necessary to address these concerns.
What is the BEST reason for the organization to pursue a plan to mitigate client-based attacks?
- A. Client hardening and management is easier on clients than on servers.
- B. Client privilege administration is inherently weaker than server privilege administration.
- C. Client-based attacks have higher financial impact.
- D. Client-based attacks are more common and easier to exploit than server and network based attacks.
Answer: D
NEW QUESTION # 668
Which Web Services Security (WS-Security) specification handles the management of security tokens and the underlying policies for granting access? Click on the correct specification in the image below.
Answer:
Explanation:
Explanation
WS-Authorization
Reference: Java Web Services: Up and Running" By Martin Kalin page 228
NEW QUESTION # 669
Which Orange book security rating is the FIRST to be concerned with covert channels?
- A. B3
- B. B1
- C. B2
- D. A1
Answer: C
Explanation:
Explanation/Reference:
Explanation:
In the Orange Book, covert channels in operating systems are not addressed until security level B2 and above because these are the systems that would be holding data sensitive enough for others to go through all the necessary trouble to access data in this fashion.
B2: Structured Protection: The security policy is clearly defined and documented, and the system design and implementation are subjected to more thorough review and testing procedures. This class requires more stringent authentication mechanisms and well-defined interfaces among layers. Subjects and devices require labels, and the system must not allow covert channels. A trusted path for logon and authentication processes must be in place, which means the subject communicates directly with the application or operating system, and no trapdoors exist. There is no way to circumvent or compromise this communication channel. Operator and administration functions are separated within the system to provide more trusted and protected operational functionality. Distinct address spaces must be provided to isolate processes, and a covert channel analysis is conducted. This class adds assurance by adding requirements to the design of the system.
The type of environment that would require B2 systems is one that processes sensitive data that require a higher degree of security. This type of environment would require systems that are relatively resistant to penetration and compromise.
Incorrect Answers:
A: Level B2, not A1 is the FIRST to be concerned with covert channels.
B: Level B2, not B3 is the FIRST to be concerned with covert channels.
D: Level B2, not B1 is the FIRST to be concerned with covert channels.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 395-396
NEW QUESTION # 670
Which of the following statements pertaining to a Criticality Survey is incorrect?
- A. Management's approval should be obtained before distributing the survey.
- B. It is implemented to gather input from all personnel that is going to be part of the recovery teams.
- C. The purpose of the survey must be clearly stated.
- D. Its intent is to find out what services and systems are critical to keeping the organization in business.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
The Criticality Survey is implemented through a standard questionnaire to gather input from the most knowledgeable people. Not all personnel that is going to be part of recovery teams is necessarily able to help in identifying critical functions of the organization. The intent of such a survey is to identify the services and systems that are critical to the organization. Having a clearly stated purpose for the survey helps in avoiding misinterpretations. Management's approval of the survey should be obtained before distributing it.
References: HARE, Chris, CISSP Study Guide: Business Continuity Planning Domain.
NEW QUESTION # 671
Which of the following is the MOST effective measure to prevent buffer overflow attacks?
- A. Perform code reviews.
- B. Reuse code objects when practical.
- C. Comply with change control procedures.
- D. Perform load testing.
Answer: A
NEW QUESTION # 672
What is the BEST method to detect the most common improper initialization problems in programming languages?
- A. Use and specify a strong character encoding.
- B. Perform input validation on any numeric inputs by assuring that they are within the expected range.
- C. Use data flow analysis to minimize the number of false positives.
- D. Use automated static analysis tools that target this type of weakness.
Answer: D
NEW QUESTION # 673
Refer to the information below to answer the question.
In a Multilevel Security (MLS) system, the following sensitivity labels are used in increasing levels of sensitivity: restricted, confidential, secret, top secret. Table A lists the clearance levels for four users, while Table B lists the security classes of four different files.
Which of the following is true according to the star property (*property)?
- A. User B can write to File 1
- B. User C can write to File 1
- C. User D can write to File 1
- D. User A can write to File 1
Answer: D
NEW QUESTION # 674
What is the PRIMARY difference between security policies and security procedures?
- A. Policies are generic in nature, and procedures contain operational details
- B. Policies point to guidelines, and procedures are more contractual in nature
- C. Policies are used to enforce violations, and procedures create penalties
- D. Policies are included in awareness training, and procedures give guidance
Answer: A
Explanation:
The primary difference between security policies and security procedures is that policies are generic in nature, and procedures contain operational details. Security policies are the high-level statements or rules that define the goals, objectives, and requirements of security for an organization. Security procedures are the low-level steps or actions that specify how to implement, enforce, and comply with the security policies.
NEW QUESTION # 675
Which of the following transmission media would NOT be affected by cross talk or interference?
- A. Radio System
- B. Satellite radiolink
- C. Copper cable
- D. Fiber optic cables
Answer: D
Explanation:
Only fiber optic cables are not affected by crosstalk or interference.
For your exam you should know the information about transmission media:
Copper Cable
Copper cable is very simple to install and easy to tap. It is used mostly for short distance and supports voice and data.
Copper has been used in electric wiring since the invention of the electromagnet and the telegraph in the 1820s.The invention of the telephone in 1876 created further demand for copper wire as an electrical conductor.
Copper is the electrical conductor in many categories of electrical wiring. Copper wire is used in power generation, power transmission, power distribution, telecommunications, electronics circuitry, and countless types of electrical equipment. Copper and its alloys are also used to make electrical contacts. Electrical wiring in buildings is the most important market for the copper industry. Roughly half of all copper mined is used to manufacture electrical wire and cable conductors.
Copper Cable
Image Source -
http://i00.i.aliimg.com/photo/v0/570456138/FRLS_HR_PVC_Copper_Cable.jpg
Coaxial cable
Coaxial cable, or coax (pronounced 'ko.aks), is a type of cable that has an inner conductor surrounded by a tubular insulating layer, surrounded by a tubular conducting shield. Many coaxial cables also have an insulating outer sheath or jacket. The term coaxial comes from the inner conductor and the outer shield sharing a geometric axis. Coaxial cable was invented by English engineer and mathematician Oliver Heaviside, who patented the design in 1880.Coaxial cable differs from other shielded cable used for carrying lower- frequency signals, such as audio signals, in that the dimensions of the cable are controlled to give a precise, constant conductor spacing, which is needed for it to function efficiently as a radio frequency transmission line.
Coaxial cable are expensive and does not support many LAN's. It supports data and video
Coaxial Cable
Image Source - http://www.tlc-direct.co.uk/Images/Products/size_3/CARG59.JPG
Fiber optics
An optical fiber cable is a cable containing one or more optical fibers that are used to carry light. The optical fiber elements are typically individually coated with plastic layers and contained in a protective tube suitable for the environment where the cable will be deployed. Different types of cable are used for different applications, for example long distance telecommunication, or providing a high-speed data connection between different parts of a building.
Fiber optics used for long distance, hard to splice, not vulnerable to cross talk and difficult to tap. It supports voice data, image and video.
Radio System
Radio systems are used for short distance,cheap and easy to tap.
Radio is the radiation (wireless transmission) of electromagnetic signals through the atmosphere or free space.
Information, such as sound, is carried by systematically changing (modulating) some property of the radiated waves, such as their amplitude, frequency, phase, or pulse width.
When radio waves strike an electrical conductor, the oscillating fields induce an alternating current in the conductor. The information in the waves can be extracted and transformed back into its original form.
Fiber Optics
Image Source - http://aboveinfranet.com/wp-content/uploads/2014/04/fiber-optic-cables- above-infranet-solutions.jpg
Microwave radio system
Microwave transmission refers to the technology of transmitting information or energy by the use of radio waves whose wavelengths are conveniently measured in small numbers of centimetre; these are called microwaves.
Microwaves are widely used for point-to-point communications because their small wavelength allows conveniently-sized antennas to direct them in narrow beams, which can be pointed directly at the receiving antenna. This allows nearby microwave equipment to use the same frequencies without interfering with each other, as lower frequency radio waves do. Another advantage is that the high frequency of microwaves gives the microwave band a very large information-carrying capacity; the microwave band has a bandwidth 30 times that of all the rest of the radio spectrum below it. A disadvantage is that microwaves are limited to line of sight propagation; they cannot pass around hills or mountains as lower frequency radio waves can.
Microwave radio transmission is commonly used in point-to-point communication systems on the surface of the Earth, in satellite communications, and in deep space radio communications. Other parts of the microwave radio band are used for radars, radio navigation systems, sensor systems, and radio astronomy.
Microwave radio systems are carriers for voice data signal, cheap and easy to tap.
Microwave Radio System
Image Source -
http://www.valiantcom.com/images/applications/e1_digital_microwave_radio.gif
Satellite Radio Link
Satellite radio is a radio service broadcast from satellites primarily to cars, with the signal broadcast nationwide, across a much wider geographical area than terrestrial radio stations. It is available by subscription, mostly commercial free, and offers subscribers more stations and a wider variety of programming options than terrestrial radio.
Satellite radio link uses transponder to send information and easy to tap.
The following answers are incorrect:
Copper Cable - Copper cable is very simple to install and easy to tap. It is used mostly for short distance and supports voice and data.
Radio System - Radio systems are used for short distance,cheap and easy to tap.
Satellite Radio Link - Satellite radio link uses transponder to send information and easy to tap.
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 265 &
Official ISC2 guide to CISSP CBK 3rd Edition Page number 233
NEW QUESTION # 676
A computer program used to process the weekly payroll contains an instruction that the amount of the gross pay cannot exceed $2,500 for any one employee. This instruction is an example of a control that is referred to as a:
- A. check digit
- B. sequence check
- C. record check
- D. limit check
Answer: D
NEW QUESTION # 677
Whose role is it to assign classification level to information?
- A. User
- B. Auditor
- C. Owner
- D. Security Administrator
Answer: C
Explanation:
Explanation/Reference:
Explanation:
The data owner (information owner) is usually a member of management who is in charge of a specific business unit, and who is ultimately responsible for the protection and use of a specific subset of information. The data owner has due care responsibilities and thus will be held responsible for any negligent act that results in the corruption or disclosure of the data. The data owner decides upon the classification of the data she is responsible for and alters that classification if the business need arises.
This person is also responsible for ensuring that the necessary security controls are in place, defining security requirements per classification and backup requirements, approving any disclosure activities, ensuring that proper access rights are being used, and defining user access criteria. The data owner approves access requests or may choose to delegate this function to business unit managers.
Incorrect Answers:
A: The security administrator is responsible for implementing and maintaining specific security network devices and software in the enterprise. It is not the role of the security administrator to assign classification level to information.
B: The user is any individual who routinely uses the data for work-related tasks. It is not the role of the user to assign classification level to information.
D: The auditor ensures that the correct controls are in place and are being maintained securely. It is not the role of the auditor to assign classification level to information.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 121-125
NEW QUESTION # 678
A 'Pseudo flaw' is which of the following?
- A. An omission when generating Psuedo-code.
- B. An apparent loophole deliberately implanted in an operating system program as a trap for intruders.
- C. Used for testing for bounds violations in application programming.
- D. A normally generated page fault causing the system to halt.
Answer: B
Explanation:
A Pseudo flaw is something that looks like it is vulnerable to attack, but really acts
as an alarm or triggers automatic actions when an intruder attempts to exploit the flaw.
The following answers are incorrect:
An omission when generating Psuedo-code. Is incorrect because it is a distractor.
Used for testing for bounds violations in application programming. Is incorrect, this is a testing
methodology.
A normally generated page fault causing the system to halt. This is incorrect because it is
distractor.
NEW QUESTION # 679
An organization suffers a security breach and must start the process of collecting evidence.
Which of the following is MOST effective in ensuring that any data collected have not been modified during the analysis phase?
- A. Network log audit
- B. Full Disk Encryption (FDE)
- C. Cryptographic hash
- D. Vulnerability scanning
Answer: C
NEW QUESTION # 680
An organization has implemented a new backup process which protects confidential data by encrypting the information stored on backup tapes. Which of the following is a MAJOR data confidentiality concern after the implementation of this new backup process?
- A. Tape backup compression
- B. Backup tape storage location
- C. Tape backup rotation
- D. Pre-existing backup tapes
Answer: D
Explanation:
Encrypting the information stored on backup tapes is a good way to protect the confidentiality of the data.
However, this does not address the issue of pre-existing backup tapes that may contain unencrypted or poorly encrypted data. These tapes may still be accessible by unauthorized parties or subject to theft or loss.
Therefore, the organization should also implement a secure disposal or destruction policy for the pre-existing backup tapes, or encrypt them with the same level of protection as the new backup process.
References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 8: Cryptography and Symmetric Key Algorithms, page 497; CISSP Official (ISC)2 Practice Tests, Third Edition, Domain 3: Security Architecture and Engineering, Question 3.12, page 154.
NEW QUESTION # 681
Which of the following is key when assessing weakness in authenticator recovery?
- A. Confidentiality
- B. Availability
- C. Non-repudiation
- D. Privacy
Answer: C
NEW QUESTION # 682
Configuration Management controls what?
- A. Auditing of changes to the Trusted Computing Base.
- B. Changes in the configuration access to the Trusted Computing Base.
- C. Control of changes to the Trusted Computing Base.
- D. Auditing and controlling any changes to the Trusted Computing Base.
Answer: D
Explanation:
All of these are components of Configuration Management.
The following answers are incorrect:
Auditing of changes to the Trusted Computing Base. Is incorrect because it refers only to auditing the changes, but nothing about controlling them.
Control of changes to the Trusted Computing Base. Is incorrect because it refers only to controlling the changes, but nothing about ensuring the changes will not lead to a weakness or fault in the system.
Changes in the configuration access to the Trusted Computing Base. Is incorrect because this does not refer to controlling the changes or ensuring the changes will not lead to a weakness or fault in the system.
NEW QUESTION # 683
Which one of the following is a core infrastructure and service element of Business Continuity Planning (BCP) required to effectively support the business processes of an organization?
- A. Internal and external support functions.
- B. The change management process.
- C. Backup and restoration functions.
- D. The risk management process.
Answer: D
Explanation:
Pg 383 Krutz Gold Edition. Backup is not BCP.
NEW QUESTION # 684
Which of the following practices provides the development of security and identification of threats in designing software?
- A. Stakeholder review
- B. Threat modeling
- C. Penetration testing
- D. Requirements review
Answer: B
NEW QUESTION # 685
......
Best way to practice test for ISC CISSP: https://www.dumpstorrent.com/CISSP-exam-dumps-torrent.html
CISSP Dump Ready - Exam Questions and Answers: https://drive.google.com/open?id=1_303kZ6MkgcqcJitzq6TJ3QmWcTzfX0Z