Free CISSP Practice Test

An organization would like to implement an authorization mechanism that would simplify the assignment of various system access permissions for many users with similar job responsibilities. Which type of authorization mechanism would be the BEST choice for the organization to implement?

Which part of an operating system (OS) is responsible for providing security interfaces among the hardware, OS, and other parts of the computing system?

Clothing retailer employees are provisioned with user accounts that provide access to resources at partner businesses. All partner businesses use common identity and access management (IAM) protocols and differing technologies. Under the Extended Identity principle, what is the process flow between partner businesses to allow this IAM action?

Which of the following statements BEST describes least privilege principle in a cloud environment?

Which of the following is included in change management?

When reviewing vendor certifications for handling and processing of company data, which of the following is the BEST Service Organization Controls (SOC) certification for the vendor to possess?

An organization is looking to include mobile devices in its asset management system for better tracking. In which system tier of the reference architecture would mobile devices be tracked?

Within a large organization, what business unit is BEST positioned to initiate provisioning and deprovisioning of user accounts?

Which of the following is the BEST method to validate secure coding techniques against injection and overflow attacks?

In the "Do" phase of the Plan-Do-Check-Act model, which of the following is performed?

When resolving ethical conflicts, the information security professional MUST consider many factors. In what order should the considerations be prioritized?

An organization recently suffered from a web-application attack that resulted in stolen user session cookie information. The attacker was able to obtain the information when a user's browser executed a script upon visiting a compromised website. What type of attack MOST likely occurred?

What is the term used to define where data is geographically stored in the cloud?

Which of the following is MOST important to follow when developing information security controls for an organization?

Which of the following attacks, if successful, could give an intruder complete control of a software-defined networking (SDN) architecture?

The security architect is designing and implementing an internal certification authority to generate digital certificates for all employees. Which of the following is the
BEST solution to securely store the private keys?

A hospital enforces the Code of Fair Information Practices. What practice applies to a patient requesting their medical records from a web portal?

A security architect is developing an information system for a client. One of the requirements is to deliver a platform that mitigates against common vulnerabilities and attacks. What is the MOST efficient option used to prevent buffer overflow attacks?

In a quarterly system access review, an active privileged account was discovered that did not exist in the prior review on the production system. The account was created one hour after the previous access review. Which of the following is the BEST option to reduce overall risk in addition to quarterly access reviews?

Which of the following is the MOST appropriate control for asset data labeling procedures?

An organization is setting a security assessment scope with the goal of developing a Security Management Program (SMP). The next step is to select an approach for conducting the risk assessment. Which of the following approaches is MOST effective for the SMP?

Which of the following BEST describes centralized identity management?

The acquisition of personal data being obtained by a lawful and fair means is an example of what principle?

What level of Redundant Array of Independent Disks (RAID) is configured PRIMARILY for high-performance data reads and writes?

An enterprise is developing a baseline cybersecurity standard its suppliers must meet before being awarded a contract. Which of the following statements is TRUE about the baseline cybersecurity standard?

Which of the following is the PRIMARY reason for selecting the appropriate level of detail for audit record generation?

What is the correct order of execution for security architecture?

An authentication system that uses challenge and response was recently implemented on an organization's network, because the organization conducted an annual penetration test showing that testers were able to move laterally using authenticated credentials. Which attack method was MOST likely used to achieve this?

Which of the following is performed to determine a measure of success of a security awareness training program designed to prevent social engineering attacks?

Which of the following is the MOST effective way to ensure the endpoint devices used by remote users are compliant with an organization's approved policies before being allowed on the network?

Which of the following BEST describes the purpose of software forensics?

What process facilitates the balance of operational and economic costs of protective measures with gains in mission capability?

What is the PRIMARY reason for criminal law being difficult to enforce when dealing with cybercrime?

Which of the following is the BEST way to protect an organization's data assets?

A company is enrolled in a hard drive reuse program where decommissioned equipment is sold back to the vendor when it is no longer needed. The vendor pays more money for functioning drives than equipment that is no longer operational. Which method of data sanitization would provide the most secure means of preventing unauthorized data loss, while also receiving the most money from the vendor?

A company is attempting to enhance the security of its user authentication processes. After evaluating several options, the company has decided to utilize Identity as a Service (IDaaS). Which of the following factors leads the company to choose an IDaaS as their solution?

When recovering from an outage, what is the Recovery Point Objective (RPO), in terms of data recovery?

Which of the following does the security design process ensure within the System Development Life Cycle (SDLC)?

In software development, which of the following entities normally signs the code to protect the code integrity?

The existence of physical barriers, card and personal identification number (PIN) access systems, cameras, alarms, and security guards BEST describes this security approach?

Which of the following BEST describes when an organization should conduct a black box security audit on a new software protect?

What is considered the BEST explanation when determining whether to provide remote network access to a third-party security service?

Which of the following is the BEST option to reduce the network attack surface of a system?

A security professional can BEST mitigate the risk of using a Commercial Off-The-Shelf (COTS) solution by deploying the application with which of the following controls in place?

To monitor the security of buried data lines inside the perimeter of a facility, which of the following is the MOST effective control?

International bodies established a regulatory scheme that defines how weapons are exchanged between the signatories. It also addresses cyber weapons, including malicious software, Command and Control (C2) software, and internet surveillance software. This is a description of which of the following?

Dumpster diving is a technique used in which stage of penetration testing methodology?

Which one of the following BEST protects vendor accounts that are used for emergency maintenance?

The security team is notified that a device on the network is infected with malware. Which of the following is MOST effective in enabling the device to be quickly located and remediated?

A security professional needs to find a secure and efficient method of encrypting data on an endpoint. Which solution includes a root key?

Which of the following is the MOST effective strategy to prevent an attacker from disabling a network?

An application developer receives a report back from the security team showing their automated tools were able to successfully enter unexpected data into the organization's customer service portal, causing the site to crash. This is an example of which type of testing?

Using the cipher text and resultant cleartext message to derive the monoalphabetic cipher key is an example of which method of cryptanalytic attack?

In Federated Identity Management (FIM), which of the following represents the concept of federation?

What documentation is produced FIRST when performing an effective physical loss control process?

What is the MAIN purpose of a security assessment plan?

Which of the following is MOST appropriate to collect evidence of a zero-day attack?

The quality assurance (QA) department is short-staffed and is unable to test all modules before the anticipated release date of an application. What security control is MOST likely to be violated?

An organization has requested storage area network (SAN) disks for a new project. What Redundant Array of Independent Disks (RAID) level provides the BEST redundancy and fault tolerance?

An attack utilizing social engineering and a malicious Uniform Resource Locator (URL) link to take advantage of a victim's existing browser session with a web application is an example of which of the following types of attack?