DumpLeader

Ensure Success with Money back Guarantee

http://www.dumpleader.com
Advance your career with IT Cert!
Latest CISSP Real Exam Questions, ISC CISSP Practice Test, Certified Information Systems Security Professional
IT Certification Guaranteed, The Easy Way!

Exam : CISSP

Title : Certified Information Systems

Security Professional

Vendor : ISC

Version : DEMO

CISSP, CISSP dumps, CISSP pdf 1

https://www.dumpleader.com/CISSP_exam.html
Latest CISSP Real Exam Questions, ISC CISSP Practice Test, Certified Information Systems Security Professional
IT Certification Guaranteed, The Easy Way!

NO.1 Which of the following is the MOST significant benefit to implementing a third-party federated
identity architecture?
A. Enable business objectives so departments can focus on mission rather than the business of
identity management
B. Reduction in operational costs to the agency
C. Data decrease related to storing personal information
D. Attribute assertions as agencies can request a larger set of attributes to fulfill service delivery
Answer: B

NO.2 Which of the following entities is ultimately accountable for data remanence vulnerabilities
with data replicated by a cloud service provider?
A. Data owner
B. Data processor
C. Data steward
D. Data custodian
Answer: A

NO.3 Which security approach will BEST minimize Personally Identifiable Information (PII) loss from
a data breach?
A. End-to-end data encryption for data in transit
B. Limited collection of individuals' confidential data
C. A strong breach notification process
D. Continuous monitoring of potential vulnerabilities
Answer: B

NO.4 Which of the following command line tools can be used in the reconnaisance phase of a
network vulnerability assessment?
A. dig
B. ipconfig
C. nbtstat
D. ifconfig
Answer: A

NO.5 What is the purpose of an Internet Protocol (IP) spoofing attack?

A. To send excessive amounts of data to a process, making it unpredictable
B. To disguise the destination address from a target's IP filtering devices
C. To intercept network traffic without authorization
D. To convince a system that it is communicating with a known entity
Answer: D

NO.6 Which of the following roles has the obligation to ensure that a third party provider is capable
of processing and handling data in a secure manner and meeting the standards set by the
organization?

CISSP, CISSP dumps, CISSP pdf 2

https://www.dumpleader.com/CISSP_exam.html
Latest CISSP Real Exam Questions, ISC CISSP Practice Test, Certified Information Systems Security Professional
IT Certification Guaranteed, The Easy Way!

A. Data Creator
B. Data User
C. Data Owner
D. Data Custodian
Answer: C

NO.7 What are the roles within a scrum methodology?

A. System owner, scrum master, and development team
B. Product owner, scrum master, and scrum team
C. Scrum master, quality assurance team, and scrum team
D. Scrum master, retirements manager, and development team
Answer: B

NO.8 The configuration management and control task of the certification and accreditation process
is incorporated in which phase of the System Development Life Cycle (SDLC)?
A. System operations and maintenance
B. System implementation
C. System acquisition and development
D. System initiation
Answer: C
Reference https://online.concordiA.edu/computer-science/system-development-life-cycle-phases/

NO.9 Which of the following is ensured when hashing files during chain of custody handling?
A. Availability
B. Accountability
C. Integrity
D. Non-repudiation
Answer: C

NO.10 Which of the following methods can be used to achieve confidentiality and integrity for data
in transit?
A. Multiprotocol Label Switching (MPLS)
B. Multi-factor authentication
C. Federated identity management
D. Internet Protocol Security (IPSec)
Answer: D

NO.11 Which of the following is the BEST Identity-as-a-Service (IDaaS) solution for validating users?
A. Security Assertion Markup Language (SAML)
B. Single Sign-On (SSO)
C. Open Authentication (OAuth)
D. Lightweight Directory Access Protocol (LDAP)
Answer: A

CISSP, CISSP dumps, CISSP pdf 3

https://www.dumpleader.com/CISSP_exam.html
Latest CISSP Real Exam Questions, ISC CISSP Practice Test, Certified Information Systems Security Professional
IT Certification Guaranteed, The Easy Way!

NO.12 Which of the following was developed to support multiple protocols as well as provide as well
as provide login, password, and error correction capabilities?
A. Point-to-Point Protocol (PPP)
B. Password Authentication Protocol (PAP)
C. Post Office Protocol (POP)
D. Challenge Handshake Authentication Protocol (CHAP)
Answer: D

NO.13 A large corporation is looking for a solution to automate access based on where the request is
coming from, who the user is, what device they are connecting with, and what and time of day they
are attempting this access. What type of solution would suit their needs?
A. Mandatory Access Control (MAC)
B. Network Access Control (NAC)
C. Discretionary Access Control (DAC)
D. Role Based Access Control (RBAC)
Answer: B

NO.14 Which of the following BEST avoids data remanence disclosure for cloud hosted resources?
A. Software based encryption with two factor authentication.
B. Strong encryption and deletion of the virtual host after data is deleted.
C. Hardware based encryption on dedicated physical servers.
D. Strong encryption and deletion of the keys after data is deleted.
Answer: D

NO.15 The restoration priorities of a Disaster Recovery Plan (DRP) are based on which of the
following documents?
A. Business Impact Analysis (BIA)
B. Business Continuity Plan (BCP)
C. Crisis management plan
D. Service Level Agreement (SLA)
Answer: B

NO.16 Which of the following is a direct monetary cost of a security incident?

A. Morale
B. Equipment
C. Information
D. Reputation
Answer: B

NO.17 A Business Continuity Plan (BCP) is based on

A. a standard checklist of required items and objectives.
B. an existing BCP from a similar organization.

CISSP, CISSP dumps, CISSP pdf 4

https://www.dumpleader.com/CISSP_exam.html
Latest CISSP Real Exam Questions, ISC CISSP Practice Test, Certified Information Systems Security Professional
IT Certification Guaranteed, The Easy Way!

C. a review of the business processes and procedures.

D. the policy and procedures manual.
Answer: C

NO.18 Which of the following is TRUE about Disaster Recovery Plan (DRP) testing?
A. Testing should continue even if components of the test fail.
B. Testing should not be done until the entire disaster plan can be tested.
C. Operational networks are usually shut down during testing.
D. The company is fully prepared for a disaster if all tests pass.
Answer: A

NO.19 Between which pair of Open System Interconnection (OSI) Reference Model layers are
routers used as a communications device?
A. Data-Link and Transport
B. Physical and Data-Link
C. Network and Session
D. Transport and Session
Answer: A

NO.20 Digital non-repudiation requires which of the following?

A. Symmetric encryption
B. Appropriate corporate policies
C. A trusted third-party
D. Multifunction access cards
Answer: C

NO.21 The design review for an application has been completed and is ready for release. What
technique should an organization use to assure application integrity?
A. Input validation
B. Device encryption
C. Digital signing
D. Application authentication
Answer: A

NO.22 What are the steps of a risk assessment?

A. identification, evaluation, mitigation
B. classification, identification, risk management
C. identification, analysis, evaluation
D. analysis, evaluation, mitigation
Answer: C
Section: Security Assessment and Testing

NO.23 Which security architecture strategy could be applied to secure an operating system (OS)

CISSP, CISSP dumps, CISSP pdf 5

https://www.dumpleader.com/CISSP_exam.html
Latest CISSP Real Exam Questions, ISC CISSP Practice Test, Certified Information Systems Security Professional
IT Certification Guaranteed, The Easy Way!

baseline for deployment within the corporate enterprise?

A. Principle of Secure Default
B. principle of Fail Secure
C. Principle of Least Privilege
D. Principle of Separation of Duty
Answer: B

NO.24 What security risk does the role-based access approach mitigate MOST effectively?
A. Segregation of duties conflicts within business applications
B. Excessive access rights to systems and data
C. Lack of system administrator activity monitoring
D. Inappropriate access requests
Answer: B

NO.25 Refer to the information below to answer the question.

An organization has hired an information security officer to lead their security department. The
officer has adequate people resources but is lacking the other necessary components to have an
effective security program. There are numerous initiatives requiring security involvement.
The effectiveness of the security program can PRIMARILY be measured through
A. audit requirements.
B. audit findings.
C. customer satisfaction.
D. risk elimination.
Answer: B

NO.26 A risk assessment report recommends upgrading all perimeter firewalls to mitigate a
particular finding. Which of the following BEST supports this recommendation?
A. The infrastructure budget can easily cover the upgrade costs.
B. The inherent risk is greater than the residual risk.
C. The expected loss from the risk exceeds mitigation costs.
D. The Annualized Loss Expectancy (ALE) approaches zero.
Answer: C

NO.27 What does the term "100-year floodplain" mean to emergency preparedness officials?
A. The odds of a flood at this level are 1 in 100 in any given year.
B. The area is expected to be safe from flooding for at least 100 years.
C. The last flood of any kind to hit the area was more than 100 years ago.
D. The odds are that the next significant flood will hit within the next 100 years.
Answer: A

NO.28 Which of the following is the PRIMARY reason for employing physical security personnel at
entry points in facilities where card access is in operation?
A. To identify present hazards requiring remediation.

CISSP, CISSP dumps, CISSP pdf 6

https://www.dumpleader.com/CISSP_exam.html
Latest CISSP Real Exam Questions, ISC CISSP Practice Test, Certified Information Systems Security Professional
IT Certification Guaranteed, The Easy Way!

B. To verify that only employees have access to the facility.

C. To monitor staff movement throughout the facility.
D. To provide a safe environment for employees.
Answer: D

NO.29 How does identity as a service (IDaaS) provide an easy mechanism for integrating identity
service into individual applications with minimal development effort?
A. By keeping all user information in easily accessible cloud repositories
B. By allowing the identification logic and storage of an identity's attributes to be maintained
externally
C. By allowing for internal provisioning of user accounts
D. By integrating internal provisioning procedures with external authentication processes
Answer: A

NO.30 What type of wireless network attack BEST describes an Electromagnetic Pulse (EMP) attack?
A. Data modification attack
B. Denial of Service (DoS) attack
C. Radio Frequency (RF) attack
D. Application-layer attack
Answer: B

CISSP, CISSP dumps, CISSP pdf 7

https://www.dumpleader.com/CISSP_exam.html