Free ISC2 CISSP Exam Questions

Question 1

Which event magnitude is defined as deadly, destructive, and disruptive when a hazard interacts with human vulnerability?

A : aster

B : tastrophe

C : isis

D : cident

Answer: B

Question 2

A security compliance manager of a large enterprise wants to reduce the time it takes to perform network,

system, and application security compliance audits while increasing quality and effectiveness of the results.

What should be implemented to BEST achieve the desired results?

A : nfiguration Management Database (CMDB)

B : urce code repository

C : nfiguration Management Plan (CMP)

D : tem performance monitoring application

Answer: A

Question 3

During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.

What is the best approach for the CISO?

During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.

What is the best approach for the CISO?

A : cument the system as high risk

B : rform a vulnerability assessment

C : rform a quantitative threat assessment

D : tate the information and move on

Answer: B

Question 4

Which of the following actions should be taken by a security professional when a mission critical computer network attack is suspected?

A : olate the network, log an independent report, fix the problem, and redeploy the computer.

B : olate the network, install patches, and report the occurrence.

C : ioritize, report, and investigate the occurrence.

D : rn the rooter off, perform forensic analysis, apply the appropriate fin, and log incidents.

Answer: C

Question 5

When conducting a security assessment of access controls, which activity is part of the data analysis phase?

A : esent solutions to address audit exceptions.

B : nduct statistical sampling of data transactions.

C : tegorize and identify evidence gathered during the audit.

D : llect logs and reports.

Answer: C