Free ISC2 CISSP Exam Questions

Question 1

What is the MINIMUM standard for testing a disaster recovery plan (DRP)?

A : mi-annually and in alignment with a fiscal half-year business cycle

B : nually or less frequently depending upon audit department requirements

C : arterly or more frequently depending upon the advice of the information security manager

D : often as necessary depending upon the stability of the environment and business requirements

Answer: D

Question 2

Users require access rights that allow them to view the average salary of groups of employees. Which control would prevent the users from obtaining an individual employee's salary?

A : mit access to predefined queries

B : gregate the database into a small number of partitions each with a separate security level

C : plement Role Based Access Control (RBAC)

D : duce the number of people who have access to the system for statistical purposes

Answer: C

Question 3

The development team has been tasked with collecting data from biometric devices. The application will support a variety of collection data streams. During the testing phase, the team utilizes data from an old production database in a secure testing environment. What principle has the team taken into consideration?

A : ometric data cannot be changed.

B : parate biometric data streams require increased security.

C : biometric devices are unknown.

D : ometric data must be protected from disclosure.

Answer: A

Question 4

During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.

What is the best approach for the CISO?

During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.

What is the best approach for the CISO?

A : cument the system as high risk

B : rform a vulnerability assessment

C : rform a quantitative threat assessment

D : tate the information and move on

Answer: B

Question 5

A large human resources organization wants to integrate their identity management with a trusted partner organization. The human resources organization wants to maintain the creation and management of the identities and may want to share with other partners in the future. Which of the following options BEST serves their needs?

A : derated identity

B : oud Active Directory (AD)

C : curity Assertion Markup Language (SAML)

D : ngle sign-on (SSO)

Answer: A