ISC Certified Information Systems Security Professional (CISSP)

QUESTION NO: 1
An Information Technology (IT) professional attends a cybersecurity seminar on current incident response methodologies. What code of ethics canon is being observed?

A. Advance and protect the profession B. Protect society, the commonwealth, and the infrastructure C. Provide diligent and competent service to principals D. Act honorable, honesty, justly, responsibly, and legally

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
A security consultant has been asked to research an organization's legal obligations to protect privacy-related information. What kind of reading material is MOST relevant to this project?

A. Privacy-related regulations enforced by governing bodies applicable to the organization B. Privacy best practices published by recognized security standards organizations C. The organization's current security policies concerning privacy issues D. Organizational procedures designed to protect privacy information

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
Drag and Drop Question
Given the various means to protect physical and logical assets, match the access management area to the technology.

Correct Answer:

QUESTION NO: 4
The use of proximity card to gain access to a building is an example of what type of security control?

A. Physical B. Procedural C. Logical D. Legal

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 5
What are the roles within a scrum methodoligy?

A. System owner, scrum master, and development team B. prduct owner, scrum master, and scrum team C. Scrum master, requirements manager, and development team D. Scrum master, quality assurance team, and scrum team

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 6
Which of the following is a limitation of the Common Vulnerability Scoring System (CVSS) as it relates to conducting code review?

A. It has normalized severity ratings. B. It has many worksheets and practices to implement. C. It aims to calculate the risk of published vulnerabilities. D. It requires a robust risk management framework to be put in place.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
Which of the following BEST describes "Continuous Integration/Continuous Deployment (CI/CD)" from a security perspective?

A. An automated software development pipeline that should incorporate security testing (e.g., SAST, dependency scanning) at each stage to catch vulnerabilities early B. A manual process for deploying code changes once per year C. A framework used only for infrastructure provisioning D. A methodology that eliminates the need for security testing

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
Which of the following BEST describes the purpose of "Egress Traffic Encryption" using a VPN for remote workers?

A. To speed up internet browsing for remote employees B. To eliminate the need for multifactor authentication C. To automatically patch remote devices D. To create a secure, encrypted tunnel protecting data confidentiality and integrity as it travels between a remote worker's device and the corporate network over an untrusted network

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 9
The Chief Information Officer (CIO) has decided that as part of business modernization efforts the organization will move towards a cloud architecture. All business-critical data will be migrated to either internal or external cloud services within the next two years. The CIO has a PRIMARY obligation to work with personnel in which role in order to ensure proper protection of data during and after the cloud migration?

A. Information owner B. Chief Security Officer (CSO) C. Chief Information Security Officer (CISO) D. General Counsel

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 10
A large university needs to enable student access to university resources from their homes.
Which of the following provides the BEST option for low maintenance and ease of deployment?

A. Provide students with Internet Protocol Security (IPSec) Virtual Private Network (VPN) client software. B. Require students to purchase home router capable of VPN. C. Use Secure Sockets Layer (SSL) VPN technology. D. Use Secure Shell (SSH) with public/private keys.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 11
Which of the following explains why record destruction requirements are included in a data retention policy?

A. To save cost for storage and backup B. To validate data ownership C. To comply with legal and business requirements D. To meet destruction guidelines

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 12
Which of the following BEST describes the "Take-Grant" access control model?

A. A model focused exclusively on network segmentation B. A model used only for physical security C. A formal model that uses a directed graph to represent how rights can be transferred ("taken" or
"granted") between subjects and objects D. A model that eliminates the concept of ownership entirely

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 13
A large organization's human resources and security teams are planning on implementing technology to eliminate manual user access reviews and improve compliance. Which of the following options is MOST likely to resolve the issues associated with user access?

A. Implement a role-based access control (RBAC) system. B. Implement a single sign-on (SSO) platform. C. Implement identity and access management (IAM) platform. D. Implement a Privileged Access Management (PAM) system.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 14
Which of the following protection is provided when using a Virtual Private Network (VPN) with Authentication Header (AH)?

A. Payload encryption B. Multi-factor authentication (MFA) C. Sender non-repudiation D. Sender confidentiality

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

ISC Certified Information Systems Security Professional (CISSP) - CISSP Exam Questions