Updated May-2026 Test Engine to Practice CISSP Dumps & Practice Exam
Dumps Collection CISSP Test Engine Dumps Training With 1533 Questions
ISC CISSP Certification Exam is a rigorous and challenging exam that tests the knowledge and skills of security professionals in various domains related to information security. Certified Information Systems Security Professional (CISSP) certification is highly respected in the industry and is recognized by organizations worldwide. Becoming a CISSP demonstrates a professional's commitment to information security and can help them advance their careers and increase their earning potential.
NEW QUESTION # 515
The BEST method of demonstrating a company's security level to potential customers is
- A. a site visit by a customer's security team.
- B. a report from an external auditor.
- C. responding to a customer's security questionnaire.
- D. a formal report from an internal auditor.
Answer: B
NEW QUESTION # 516
What level of assurance for a digital certificate verifies a user's name, address, social security number, and other information against a credit bureau database?
- A. Level 3/Class 3
- B. Level 2/Class 2
- C. Level 4/Class 4
- D. Level 1/Class 1
Answer: B
Explanation:
Users can obtain certificates with various levels of assurance. Here is a list that describe each of them:
-
Class 1/Level 1 for individuals, intended for email, no proof of identity
For example, level 1 certificates verify electronic mail addresses. This is done through the use of a personal information number that a user would supply when asked to register. This level of certificate may also provide a name as well as an electronic mail address; however, it may or may not be a genuine name (i.e., it could be an alias). This proves that a human being will reply back if you send an email to that name or email address.
-
Class 2/Level 2 is for organizations and companies for which proof of identity is required
Level 2 certificates verify a user's name, address, social security number, and other information against a credit bureau database.
-
Class 3/Level 3 is for servers and software signing, for which independent verification and checking of identity and authority is done by the issuing certificate authority Level 3 certificates are available to companies. This level of certificate provides photo identification to accompany the other items of information provided by a level 2 certificate.
-
Class 4 for online business transactions between companies
-
Class 5 for private organizations or governmental security
References:
http://en.wikipedia.org/wiki/Digital_certificate veriSign introduced the concept of classes of digital
certificates:
Also see:
Source: TIPTON, Harold F. & KRAUSE, Micki, Information Security Management Handbook, 4th
edition (volume 1), 2000, CRC Press, Chapter 3, Secured Connections to External Networks
(page 54).
NEW QUESTION # 517
The Secure Hash Algorithm (SHA-1) of the Secure Hash Standard (NIST
FIPS PUB 180) processes data in block lengths of:
- A. 512 bits.
- B. 256 bits.
- C. 128 bits.
- D. 1024 bits.
Answer: A
Explanation:
The correct answer is 512 bits. If a block length is fewer than 512 bits, padding bits are added to make the block length equal to 512 bits. The other answers are distracters.
NEW QUESTION # 518
What is the most effective means of determining that controls are functioning properly within an operating system?
- A. Review of software control features and/or parameters
- B. Interview with computer operator
- C. Review of operating system manual
- D. Interview with product vendor
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Various operating system software products provide parameters and options for the tailoring of the system and activation of features such as activity logging. Parameters are important in determining how a system runs because they allow a standard piece of software to be customized to diverse environments. The reviewing of software control features and/or parameters is the most effective means of determining how controls are functioning within an operating system and of assessing and operating system's integrity.
The review of software control features and/or parameters would be part of your security audit. A security audit is typically performed by an independent third party to the management of the system. The audit determines the degree with which the required controls are implemented.
A security review is conducted by the system maintenance or security personnel to discover vulnerabilities within the system. A vulnerability occurs when policies are not followed, misconfigurations are present, or flaws exist in the hardware or software of the system. System reviews are sometimes referred to as a vulnerability assessment.
Incorrect Answers:
A: An interview with the computer operator is not an effective means of determining that controls are functioning properly within an operating system because the computer operator will not necessarily be aware of the detailed settings of the parameters.
C: The operating system manual should provide information as to what settings can be used but will not give any hint as to how parameters are actually set.
D: An interview with the product vendor is not an effective means of determining that controls are functioning properly within an operating system because the product vendor will not be aware of the detailed settings of the parameters.
NEW QUESTION # 519
Which of the following is the PRIMARY goal of logical access controls?
- A. Restrict access to an information asset.
- B. Ensure availability of an information asset.
- C. Ensure integrity of an information asset.
- D. Restrict physical access to an information asset.
Answer: A
Explanation:
Logical access controls are the policies, procedures, and mechanisms that regulate who can access an information asset and what actions they can perform on it. The primary goal of logical access controls is to restrict access to an information asset based on the principle of least privilege, which means that users should only have the minimum level of access required to perform their tasks. Ensuring integrity, restricting physical access, and ensuring availability are also important goals of information security, but they are not the primary goal of logical access controls.
NEW QUESTION # 520
What is one disadvantage of content-dependent protection of information?
- A. It exposes the system to data locking
- B. It limits the user's individual address space
- C. It requires additional password entry
- D. It increases processing overhead
Answer: D
Explanation:
Content-Dependent Access Control
"Just like the name sounds, access to objects is determined by the content within the object. This is used many times in databases and the type of Web-based material a firewall allows...If a table within the database contains information about employees' salaries, the managers were not allowed to view it, but they could view information about an employee's work history. The content of the database fields dictates which user can see specific information within the database tables." pg 161 Shon Harris: All-In-One CISSP Certification. Decisions will have to be made about the content, therefore increasing processing overhead.
NEW QUESTION # 521
Which one of the following is NOT one of the maturity levels of the
Software Capability Maturity Model (CMM)?
- A. Fundamental
- B. Managed
- C. Repeatable
- D. Defined
Answer: A
Explanation:
The correct answer is Fundamental, a distracter. The first level of the Software CMM is the Initiating level. At this level, processes are performed on an ad hoc basis. Answer the Repeatable level is the second maturity level in the model. In the third level, Defined, management practices are institutionalized and technical procedures are integrated into the organizational structurE. The Managed level has both product and processes quantitatively controlled. The fifth level of the Software CMM is the Optimized level, where continuous process improvement is institutionalized.
NEW QUESTION # 522
Which of the following statements pertaining to biometrics is FALSE?
- A. Biometrics are based on the Type 2 authentication mechanism.
- B. False acceptance rate is also known as Type II error.
- C. The crossover error rate is the point at which false rejection rate equals the false acceptance rate.
- D. Increased system sensitivity can cause a higher false rejection rate
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Type 2 authentication is based on something you have, like a token. Biometrics for part of Type 3 authentication, which is based on something you are. Something you are refers to an individual's physical traits.
Incorrect Answers:
A, B, C: These options are all TRUE with regards to biometrics.
References:
Conrad, Eric, Seth Misenar, Joshua Feldman, CISSP Study Guide, 2nd Edition, Syngress, Waltham, 2012, pp. 35-37 Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 187-189
NEW QUESTION # 523
Which of the following is NOT an administrative control?
- A. Logical access control mechanisms
- B. Screening of personnel
- C. Development of policies, standards, procedures and guidelines D. Change control procedures
Answer: A
Explanation:
It is considered to be a technical control.
Logical is synonymous with Technical Control. That was the easy answer.
There are three broad categories of access control: Administrative, Technical, and Physical.
Each category has different access control mechanisms that can be carried out manually or
automatically. All of these access control mechanisms should work in concert with each other to
protect an infrastructure and its data.
Each category of access control has several components that fall within it, as shown here:
Administrative Controls
Policy and procedures
Personnel controls
Supervisory structure
Security-awareness training
Testing
Physical Controls
Network segregation
Perimeter security
Computer controls
Work area separation
Data backups
Technical Controls
System access
Network architecture
Network access
Encryption and protocols
Control zone
Auditing
The following answers are incorrect : Screening of personnel is considered to be an administrative control Development of policies, standards, procedures and guidelines is considered to be an administrative control Change control procedures is considered to be an administrative control. Reference : Shon Harris AIO v3 , Chapter - 3 : Security Management Practices , Page : 52-54
NEW QUESTION # 524
When planning a penetration test, the tester will be MOST interested in which information?
- A. The main network access points
- B. Exploits that can attack weaknesses
- C. Places to install back doors
- D. Job application handouts and tours
Answer: B
NEW QUESTION # 525
What is a data warehouse?
- A. A table in a relational database system
- B. A remote facility used for storing backup tapes
- C. A hot backup building
- D. A repository of information from heterogeneous databases
Answer: D
Explanation:
The correct answer is a repository of information from heterogeneous databases. Answers "A remote facility used for storing backup tapes" and "A hot backup building" describe physical facilities for backup and recovery of information systems, and answer "A table in a relational database system" describes a relation in a relational database.
NEW QUESTION # 526
In order to assure authenticity, which of the following are required?
- A. Authentication and non-repudiation
- B. Confidentiality and authentication
- C. Confidentiality and integrity
- D. Integrity and non-repudiation
Answer: D
Explanation:
Section: Software Development Security
NEW QUESTION # 527
Which of the following services can be deployed via a cloud service or on-premises to integrate with Identity as a Service (IDaaS) as the authoritative source of user identities?
- A. Multi-factor authentication (MFA)
- B. Directory
- C. User database
- D. Single sign-on (SSO)
Answer: B
Explanation:
Directory is the source, SSO is a process. Directory can be an AD container or GC domain controller that holds the directory structure and hence can be an authoritative source!
NEW QUESTION # 528
Which access control would a lattice-based access control be an example of?
- A. Rule-based access control
- B. Non-discretionary access control
- C. Discretionary access control
- D. Mandatory access control
Answer: D
NEW QUESTION # 529
Which of the following is a direct monetary cost of a security incident?
- A. Equipment
- B. Information
- C. Morale
- D. Reputation
Answer: A
NEW QUESTION # 530
Which of the following will you consider as most secure?
- A. One time password
- B. Login ID
- C. Password
- D. Login phrase
Answer: A
Explanation:
Each time the user logs in, the token generates a unique password that is synchronized with the network server. If anyone tries to reuse this dynamic password, access is denied, the event is logged and the network remains secure.
NEW QUESTION # 531
Which of the following monitors network traffic in real time?
- A. firewall-based IDS
- B. network-based IDS
- C. host-based IDS
- D. application-based IDS
Answer: B
Explanation:
This type of IDS is called a network-based IDS because monitors network traffic in real time. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 48
NEW QUESTION # 532
Which of the following is a responsibility of a data steward?
- A. Conduct data governance interviews with the organization.
- B. Ensure that data decisions and impacts are communicated to the organization.
- C. Ensure alignment of the data governance effort to the organization.
- D. Document data governance requirements.
Answer: B
Explanation:
A responsibility of a data steward is to ensure that data decisions and impacts are communicated to the organization. A data steward is a role or a function that is responsible for managing and maintaining the quality and the usability of the data within a specific data domain or a business area, such as finance, marketing, or human resources. A data steward can provide some benefits for data governance, which is the process of establishing and enforcing the policies and standards for the collection, use, storage, and protection of data, such as enhancing the accuracy and the reliability of the data, preventing or detecting errors or inconsistencies, and supporting the audit and the compliance activities. A data steward can perform various tasks or duties, such as:
* Defining and documenting the data elements, attributes, definitions, and rules within the data domain or the business area, and ensuring that they are consistent and aligned with the data governance policies and standards.
* Monitoring and measuring the data quality and the data performance within the data domain or the business area, and identifying and resolving any data issues or problems, such as missing, inaccurate, or duplicate data.
* Coordinating and collaborating with the data owners, the data custodians, the data users, and the data governance team, and ensuring that the data decisions and impacts are communicated and understood by the organization, such as the data requirements, the data changes, or the data risks.
Ensuring that data decisions and impacts are communicated to the organization is a responsibility of a data steward, as it can help to ensure the transparency and the accountability of the data governance process, as well as to facilitate the coordination and the cooperation of the data governance stakeholders, such as the data owners, the data custodians, the data users, and the data governance team. Ensuring alignment of the data governance effort to the organization, conducting data governance interviews with the organization, and documenting data governance requirements are not responsibilities of a data steward, although they may be related or possible tasks or duties. Ensuring alignment of the data governance effort to the organization is a responsibility of the data governance team, which is a group of experts or advisors who are responsible for defining and implementing the data governance policies and standards, as well as for overseeing and evaluating the data governance process and performance. Conducting data governance interviews with the organization is a task or a technique that can be used by the data governance team, the data steward, or the data auditor, to collect and analyze the information and the feedback about the data governance process and performance, from the data governance stakeholders, such as the data owners, the data custodians, the data users, or the data consumers. Documenting data governance requirements is a task or a technique that can be used by the data governance team, the data owner, or the data user, to specify and describe the needs and the expectations of the data governance process and performance, such as the data quality, the data security, or the data compliance.
NEW QUESTION # 533
What is the highest amount a company should spend annually on countermeasures for protecting an asset valued at $1,000,000 from a threat that has an annualized rate of occurrence (ARO) of once every five years and an exposure factor (EF) of 30%?
- A. $60,000
- B. $1,500
- C. $150,000
- D. $300,000
Answer: A
Explanation:
The cost of a countermeasure should not be greater in cost than the risk it mitigates (ALE). For a quantitative risk assessment, the equation is ALE = ARO x SLE where the SLE is calculated as the product of asset value x exposure factor. An event that happen once every five years would have an ARO of .2 (1 divided by 5).
SLE = Asset Value (AV) x Exposure Fact (EF)
SLE = 1,000,000 x .30 = 300,000
ALE = SLE x Annualized Rate of Occurance (ARO)
ALE = 300,000 x .2 = 60,000
Know your acronyms:
ALE -- Annual loss expectancy
ARO -- Annual rate of occurrence
SLE -- Single loss expectancy
The following are incorrect answers:
$300,000 is incorrect. See the explanation of the correct answer for the correct calculation.
$150,000 is incorrect. See the explanation of the correct answer for the correct calculation.
$1,500 is incorrect. See the explanation of the correct answer for the correct calculation.
Reference(s) used for this question:
Mc Graw Hill, Shon Harris, CISSP All In One (AIO) book, Sixth Edition , Pages 87-88 and
Official ISC2 Guide to the CISSP Exam, (OIG), Pages 60-61
NEW QUESTION # 534
Which of the following is true related to network sniffing?
- A. Sniffers send IP fragments to a system that overlap with each other.
- B. Sniffers alter the source address of a computer to disguise and exploit weak authentication methods,
- C. Sniffers allow an attacker to monitor data passing across a network.
- D. Sniffers take over network connections.
Answer: C
Explanation:
Sniffing is the action of capture / monitor the traffic going over the network.
Because, in a normal networking environment, account and password information is passed along Ethernet in clear-text, it is not hard for an intruder to put a machine into promiscuous mode and by sniffing, compromise all the machines on the net by capturing password in an illegal fashion.
NEW QUESTION # 535
Organization A is adding a large collection of confidential data records that it received when it acquired Organization B to its data store. Many of the users and staff from Organization B are no longer available. Which of the following MUST Organization A 0do to property classify and secure the acquired data?
- A. Create placeholder accounts that represent former users from Organization B.
- B. Change the data classification for data acquired from Organization B.
- C. Archive audit records that refer to users from Organization A.
- D. Assign data owners from Organization A to the acquired data.
Answer: D
Explanation:
Data ownership is a key concept in data security and classification. Data owners are responsible for defining the value, sensitivity, and classification of the data, as well as the access rights and controls for the data. When Organization A acquires data from Organization B, it should assign data owners from its own organization to the acquired data, so that they can properly classify and secure the data according to Organization A's policies and standards. Creating placeholder accounts, archiving audit records, or changing the data classification are not sufficient or necessary steps to ensure the security of the acquired data.
NEW QUESTION # 536
What sort of attack is described by the following: An attacker has a list of broadcast addresses which it stores into an array, the attacker sends a spoofed icmp echo request to each of those addresses in series and starts again. The spoofed IP address used by the attacker as the source of the packets is the target/ victim IP address.
- A. LAND Attack
- B. Fraggle Attack
- C. Replay Attack
- D. Smurf Attack
Answer: D
Explanation:
Explanation/Reference:
Explanation:
In a Smurf Attack the attacker sends an ICMP ECHO REQUEST packet with a spoofed source address to a victim's network broadcast address. This means that each system on the victim's subnet receives an ICMP ECHO REQUEST packet. Each system then replies to that request with an ICMP ECHO REPLY packet to the spoof address provided in the packets-which is the victim's address. All of these response packets go to the victim system and overwhelm it because it is being bombarded with packets it does not necessarily know how to process. The victim system may freeze, crash, or reboot.
Incorrect Answers:
B: A fraggle attack is a variation of a Smurf attack where an attacker sends a large amount of UDP traffic to ports 7 (echo) and 19 (chargen) to an IP Broadcast Address, with the intended victim's spoofed source IP address.
C: A LAND attack involves sending a spoofed TCP SYN packet (connection initiation) with the target host's IP address to an open port as both source and destination. This causes the machine to reply to itself continuously.
D: A replay attack (also known as playback attack) is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 587
NEW QUESTION # 537
A weak key of an encryption algorithm has which of the following properties?
- A. It can only be used as a public key
- B. It has much more zeroes than ones
- C. It facilitates attacks against the algorithm
- D. It is too short, and thus easily crackable
Answer: C
NEW QUESTION # 538
What does the directive of the European Union on Electronic Signatures deal with?
- A. Non repudiation
- B. Encryption of secret data
- C. Encryption of classified data
- D. Authentication of web servers
Answer: A
Explanation:
Reference: FORD, Warwick & BAUM, Michael S., Secure Electronic Commerce: Building the Infrastructure for Digital Signatures and Encryption (2nd Edition), 2000, Prentice Hall
PTR, Page 589; Directive 1999/93/EC of 13 December 1999 on a Community framework for electronic signatures.
NEW QUESTION # 539
Which of the following practices provides the development of security and identification of threats in designing software?
- A. Stakeholder review
- B. Threat modeling
- C. Penetration testing
- D. Requirements review
Answer: B
Explanation:
Threat modeling is a practice that provides the development of security and identification of threats in designing software. Threat modeling is a systematic process of identifying, analyzing, and mitigating the potential threats and vulnerabilities that could affect a software system. Threat modeling helps to design secure software by applying security principles, such as defense in depth, least privilege, and fail-safe defaults, throughout the software development life cycle.
Stakeholder review, requirements review, and penetration testing are not practices that provide the development of security and identification of threats in designing software, although they may contribute to the overall security assurance of the software. Stakeholder review is a process of obtaining feedback and approval from the stakeholders of a software project, such as customers, users, managers, and developers. Requirements review is a process of verifying and validating the functional and non- functional requirements of a software system, such as performance, usability, reliability, and security. Penetration testing is a process of simulating real-world attacks on a software system to identify and exploit its vulnerabilities and weaknesses.
NEW QUESTION # 540
......
ISC CISSP Dumps Cover Real Exam Questions: https://interfacett.braindumpquiz.com/CISSP-exam-material.html