Free ISC2 CISSP Exam Questions

Question 1

Commercial off-the-shelf (COTS) software presents which of the following additional security concerns?

A : ndors take on the liability for COTS software vulnerabilities.

B : -house developed software is inherently less secure.

C : ploits for COTS software are well documented and publicly available.

D : TS software is inherently less secure.

Answer: C

Question 2

During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.

What is the best approach for the CISO?

During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant.

What is the best approach for the CISO?

A : cument the system as high risk

B : rform a vulnerability assessment

C : rform a quantitative threat assessment

D : tate the information and move on

Answer: B

Question 3

When conducting a security assessment of access controls, which activity is part of the data analysis phase?

A : esent solutions to address audit exceptions.

B : nduct statistical sampling of data transactions.

C : tegorize and identify evidence gathered during the audit.

D : llect logs and reports.

Answer: C

Question 4

Which of the following is the MOST common method of memory protection?

A : mpartmentalization

B : gmentation

C : ror correction

D : rtual Local Area Network (VLAN) tagging

Answer: B

Question 5

The Open Web Application Security Project's (OWASP) Software Assurance Maturity Model (SAMM) allows organizations to implement a flexible software security strategy to

measure organizational impact based on what risk management aspect?

A : k tolerance

B : k exception

C : k treatment

D : k response

Answer: D