CISSP Online Practice Questions and Answers

Which of the following is a method of attacking internet (IP) v6 Layer 3 and Layer 4 ?

A. Synchronize sequence numbers (SVN) flooding

B. Internet Control Message Protocol (IOP) flooring

C. Domain Name Server [DNS) cache poisoning

D. Media Access Control (MAC) flooding

Which of the following is MOST appropriate for protecting confidentially of data stored on a hard drive?

A. Triple Data Encryption Standard (3DES)

B. Advanced Encryption Standard (AES)

C. Message Digest 5 (MD5)

D. Secure Hash Algorithm 2(SHA-2)

Which of the following is the BEST reason for the use of security metrics?

A. They ensure that the organization meets its security objectives.

B. They provide an appropriate framework for Information Technology (IT) governance.

C. They speed up the process of quantitative risk assessment.

D. They quantify the effectiveness of security processes.

What should be the INITIAL response to Intrusion Detection System/Intrusion Prevention System (IDS/IPS) alerts?

A. Ensure that the Incident Response Plan is available and current.

B. Determine the traffic's initial source and block the appropriate port.

C. Disable or disconnect suspected target and source systems.

D. Verify the threat and determine the scope of the attack.

In a financial institution, who has the responsibility for assigning the classification to a piece of information?

A. Chief Financial Officer (CFO)

B. Chief Information Security Officer (CISO)

C. Originator or nominated owner of the information

D. Department head responsible for ensuring the protection of the information

When conducting a third-party risk assessment of a new supplier, which of the following reports should be reviewed to confirm the operating effectiveness of the security, availability, confidentiality, and privacy trust principles?

A. Service Organization Control (SOC) 1, Type 2

B. Service Organization Control (SOC) 2, Type 2

C. International Organization for Standardization (ISO) 27001

D. International Organization for Standardization (ISO) 27002

An organization is planning to have an it audit of its as a Service (SaaS) application to demonstrate to external parties that the security controls around availability are designed. The audit report must also cover a certain period of time to show the operational effectiveness of the controls. Which Service Organization Control (SOC) report would BEST fit their needs?

A. SOC 1 Type 1

B. SOC 1 Type 2

C. SOC 2 Type 1

D. SOC 2 Type 2

Which of the following is the PRIMARY type of cryptography required to support non-repudiation of a digitally signed document?

A. Message digest (MD)

B. Asymmetric

C. Symmetric

D. Hashing

In designing the architecture of an access control system, it was determined that confidentiality and controlled access to information were the primary focus. Which of the following security models is the BEST choice for the organization?

A. Biba integrity model

B. Clark-Wilson model

C. Bell-LaPadula model

D. Brewer-Nash model

A security architect is implementing an authentication system for a distributed network of servers. This network will be accessed by users on workstations that cannot trust the identity of the user. Which solution should the security architect use to have the users trust one another?

A. One-way authentication

B. Kerberos

C. Mutual authentication

D. Single session software tokens