CISSP-ISSMP - Information Systems Security Management Professional

Question 1

Which of the following security controls will you use for the deployment phase of the SDLC to build secure software?
Each correct answer represents a complete solution. Choose all that apply.

A. Security Certification and Accreditation (C&A)

B. Change and Configuration Control

C. Risk Adjustments

D. Vulnerability Assessment and Penetration Testing

Correct Answer: A,C,D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

An organization's disaster recovery plan specifies an RPO of 4 hours for its ERP system. Which backup strategy would BEST support this requirement?

A. Backups only after major releases

B. Backups every 4 hours or continuous data replication

C. Weekly full backups only

D. Annual backups

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

Which of the following BEST describes the concept of "risk transfer via contractual indemnification" and its limitation?

A. Indemnification shifts specified financial responsibility to another party contractually, but its value depends on the indemnifying party's financial capacity and the clause's specific scope/limitations

B. Indemnification clauses guarantee full recovery of all losses in every case

C. Indemnification is identical to insurance and requires no contract

D. Indemnification eliminates all forms of risk entirely

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

Mark works as a security manager for SoftTech Inc. He is performing a security awareness program. To be successful in performing the awareness program, he should take into account the needs and current levels of training and understanding of the employees and audience.
There are five key ways, which Mark should keep in mind while performing this activity.
Current level of computer usage
What the audience really wants to learn
How receptive the audience is to the security program
How to gain acceptance
Who might be a possible ally
Which of the following activities is performed in this security awareness process?

A. Audience participation

B. Separation of duties

C. Stunned owl syndrome

D. Audience segmentation

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

Which of the following BEST describes "attack surface reduction" as a strategic security objective?

A. Minimizing the number of potential entry points (services, ports, accounts, code) available to an attacker

B. Increasing the number of exposed services to improve visibility

C. Attack surface reduction applies only to network firewalls

D. It is achieved solely through employee training

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

Which of the following roles is used to ensure that the confidentiality, integrity, and availability of the services are maintained to the levels approved on the Service Level Agreement (SLA)?

A. The Change Manager

B. The Configuration Manager

C. The IT Security Manager

D. The Service Level Manager

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

Which of the following models uses a directed graph to specify the rights that a subject can transfer to an object or that a subject can take from another subject?

A. Biba Integrity Model

B. Take-Grant Protection Model

C. Bell-LaPadula Model

D. Access Matrix

Correct Answer: B

Question 8

A newly appointed CISO discovers that the previous security policy was never formally approved by executive management. What should the CISO do FIRST?

A. Seek formal executive approval/ratification of the policy to establish proper authority and enforceability

B. Continue enforcing the policy as-is since it has been informally followed

C. Enforce the policy only against non-management employees

D. Discard the policy entirely and start from scratch without review

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 9

You company suspects an employee of sending unauthorized emails to competitors. These emails are alleged to contain confidential company dat

A. Make copies of that employee's email.

B. Seize the employee's PC.

C. Which of the following is the most important step for you to take in preserving the chain of custody?

D. Preserve the email server including all logs.

E. Place spyware on the employee's PC to confirm these activities.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 10

Which of the following statements about Due Care policy is true?

A. It provides information about new viruses.

B. It is a method for securing database servers.

C. It identifies the level of confidentiality of information.

D. It is a method used to authenticate users on a network.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 11

Rachael is the project manager for a large project in her organization. A new change request has been proposed that will affect several areas of the project. One area of the project change impact is on work that a vendor has already completed. The vendor is refusing to make the changes as they've already completed the project work they were contracted to do. What can Rachael do in this instance?

A. Refer to the contract agreement for direction.

B. Fire the vendor for failing to complete the contractual obligation.

C. Threaten to sue the vendor if they don't complete the work.

D. Withhold the vendor's payments for the work they've completed.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 12

You work as the Network Administrator for a defense contractor. Your company works with sensitive materials and all IT personnel have at least a secret level clearance. You are still concerned that one individual could perhaps compromise the network (intentionally or unintentionally) by setting up improper or unauthorized remote access. What is the best way to avoid this problem?

A. Implement three way authentication.

B. Implement least privileges.

C. Implement RBAC.

D. Implement separation of duties.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 13

In which of the following SDLC phases is the system's security features configured and enabled, the system is tested and installed or fielded, and the system is authorized for processing?

A. Development/Acquisition Phase

B. Implementation Phase

C. Operation/Maintenance Phase

D. Initiation Phase

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

ISC CISSP-ISSMP - Information Systems Security Management Professional - CISSP-ISSMP Exam Practice Test

Latest Update

Useful Links

Contact Us