Weekend Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

Free and Premium ISC CISSP-ISSMP Dumps Questions Answers

Page: 1 / 8
Total 218 questions

ISSMP®: Information Systems Security Management Professional Questions and Answers

Question 1

Rachael is the project manager for a large project in her organization. A new change request has been proposed that will affect several areas of the project. One area of the project change impact is on work that a vendor has already completed. The vendor is refusing to make the changes as they've already completed the project work they were contracted to do. What can Rachael do in this instance?

Options:

A.

Threaten to sue the vendor if they don't complete the work.

B.

Fire the vendor for failing to complete the contractual obligation.

C.

Withhold the vendor's payments for the work they've completed.

D.

Refer to the contract agreement for direction.

Buy Now
Question 2

You are the project manager for TTX project. You have to procure some electronics gadgets for the project. A relative of yours is in the retail business of those gadgets. He approaches you for your favor to get the order. This is the situation of ____.

Options:

A.

Conflict of interest

B.

Bribery

C.

Illegal practice

D.

Irresponsible practice

Question 3

Which of the following is the default port for Secure Shell (SSH)?

Options:

A.

UDP port 161

B.

TCP port 22

C.

UDP port 138

D.

TCP port 443

Question 4

Which of the following statements about the integrity concept of information security management are true? Each correct answer represents a complete solution. Choose three.

Options:

A.

It ensures that unauthorized modifications are not made to data by authorized personnel orprocesses.

B.

It determines the actions and behaviors of a single individual within a system

C.

It ensures that modifications are not made to data by unauthorized personnel or processes.

D.

It ensures that internal information is consistent among all subentities and also consistent with the real-world, external situation.

Question 5

Joseph works as a Software Developer for Web Tech Inc. He wants to protect the algorithms and the techniques of programming that he uses in developing an application. Which of the following laws are used to protect a part of software?

Options:

A.

Code Security law

B.

Trademark laws

C.

Copyright laws

D.

Patent laws

Question 6

You work as a Network Administrator for ABC Inc. The company uses a secure wireless network. John complains to you that his computer is not working properly. What type of security audit do you need to conduct to resolve the problem?

Options:

A.

Operational audit

B.

Dependent audit

C.

Non-operational audit

D.

Independent audit

Question 7

Which of the following security controls will you use for the deployment phase of the SDLC to build secure software? Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Vulnerability Assessment and Penetration Testing

B.

Security Certification and Accreditation (C&A)

C.

Change and Configuration Control

D.

Risk Adjustments

Question 8

Which of the following statements about Hypertext Transfer Protocol Secure (HTTPS) are true? Each correct answer represents a complete solution. Choose two.

Options:

A.

It uses TCP port 80 as the default port.

B.

It is a protocol used in the Universal Resource Locater (URL) address line to connect to a secure site.

C.

It uses TCP port 443 as the default port.

D.

It is a protocol used to provide security for a database server in an internal network.

Question 9

Mark is the project manager of the NHQ project in Spartech Inc. The project has an asset valued at $195,000 and is subjected to an exposure factor of 35 percent. What will be the Single Loss Expectancy of the project?

Options:

A.

$92,600

B.

$67,250

C.

$68,250

D.

$72,650

Question 10

Sarah has created a site on which she publishes a copyrighted material. She is ignorant that she is infringing copyright. Is she guilty under copyright laws?

Options:

A.

No

B.

Yes

Question 11

You company suspects an employee of sending unauthorized emails to competitors. These emails are alleged to contain confidential company dat a. Which of the following is the most important step for you to take in preserving the chain of custody?

Options:

A.

Preserve the email server including all logs.

B.

Seize the employee's PC.

C.

Make copies of that employee's email.

D.

Place spyware on the employee's PC to confirm these activities.

Question 12

Fill in the blank with an appropriate word. _________ are used in information security to formalize security policies.

Options:

A.

Models.

Question 13

Which of the following roles is responsible for review and risk analysis of all contracts on a regular basis?

Options:

A.

The Configuration Manager

B.

The Supplier Manager

C.

The Service Catalogue Manager

D.

The IT Service Continuity Manager

Question 14

Which of the following authentication protocols provides support for a wide range of authentication methods, such as smart cards and certificates?

Options:

A.

PAP

B.

EAP

C.

MS-CHAP v2

D.

CHAP

Question 15

Fill in the blank with an appropriate phrase.________ models address specifications, requirements, and design, verification and validation, and maintenance activities.

Options:

A.

Life cycle

Question 16

Which of the following can be prevented by an organization using job rotation and separation of duties policies?

Options:

A.

Collusion

B.

Eavesdropping

C.

Buffer overflow

D.

Phishing

Question 17

Which of the following BCP teams handles financial arrangement, public relations, and media inquiries in the time of disaster recovery?

Options:

A.

Software team

B.

Off-site storage team

C.

Applications team

D.

Emergency-management team

Question 18

Which of the following are examples of administrative controls that involve all levels of employees within an organization and determine which users have access to what resources and information? Each correct answer represents a complete solution. Choose three.

Options:

A.

Employee registration and accounting

B.

Disaster preparedness and recovery plans

C.

Network authentication

D.

Training and awareness

E.

Encryption

Question 19

Which of the following rate systems of the Orange book has no security controls?

Options:

A.

D-rated

B.

C-rated

C.

E-rated

D.

A-rated

Question 20

Which of the following deals is a binding agreement between two or more persons that is enforceable by law?

Options:

A.

Outsource

B.

Proposal

C.

Contract

D.

Service level agreement

Question 21

Peter works as a Computer Hacking Forensic Investigator. He has been called by an organization to conduct a seminar to give necessary information related to sexual harassment within the work place. Peter started with the definition and types of sexual harassment. He then wants to convey that it is important that records of the sexual harassment incidents should be maintained, which helps in further legal prosecution. Which of the following data should be recorded in this documentation? Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Names of the victims

B.

Location of each incident

C.

Nature of harassment

D.

Date and time of incident

Question 22

You work as a Forensic Investigator. Which of the following rules will you follow while working on a case? Each correct answer represents a part of the solution. Choose all that apply.

Options:

A.

Preparea chain of custody and handle the evidence carefully.

B.

Examine original evidence and never rely on the duplicate evidence.

C.

Never exceed the knowledge base of the forensic investigation.

D.

Follow the rules of evidence and never temper with the evidence.

Question 23

Which of the following methods for identifying appropriate BIA interviewees' includes examining the organizational chart of the enterprise to understand the functional positions?

Options:

A.

Organizational chart reviews

B.

Executive management interviews

C.

Overlaying system technology

D.

Organizational process models

Question 24

Which of the following statements is true about auditing?

Options:

A.

It is used to protect the network against virus attacks.

B.

It is used to track user accounts for file and object access, logon attempts, etc.

C.

It is used to secure the network or the computers on the network.

D.

It is used to prevent unauthorized access to network resources.

Question 25

Della works as a security manager for SoftTech Inc. She is training some of the newly recruited personnel in the field of security management. She is giving a tutorial on DRP. She explains that the major goal of a disaster recovery plan is to provide an organized way to make decisions if a disruptive event occurs and asks for the other objectives of the DRP. If you are among some of the newly recruited personnel in SoftTech Inc, what will be your answer for her question? Each correct answer represents a part of the solution. Choose three.

Options:

A.

Protect an organization from major computer services failure.

B.

Minimizethe risk to the organization from delays in providing services.

C.

Guarantee the reliability of standby systems through testing and simulation.

D.

Maximize the decision-making required by personnel during a disaster.

Question 26

You work as a Senior Marketing Manger for Umbrella Inc. You find out that some of the software applications on the systems were malfunctioning and also you were not able to access your remote desktop session. You suspected that some malicious attack was performed on the network of the company. You immediately called the incident response team to handle the situation who enquired the Network Administrator to acquire all relevant information regarding the malfunctioning. The Network Administrator informed the incident response team that he was reviewing the security of the network which caused all these problems. Incident response team announced that this was a controlled event not an incident. Which of the following steps of an incident handling process was performed by the incident response team?

Options:

A.

Containment

B.

Eradication

C.

Preparation

D.

Identification

Question 27

You work as the project manager for Bluewell Inc. You are working on NGQQ Project for your company. You have completed the risk analysis processes for the risk events. You and the project team have created risk responses for most of the identified project risks. Which of the following risk response planning techniques will you use to shift the impact of a threat to a third party, together with the responses?

Options:

A.

Risk mitigation

B.

Risk acceptance

C.

Risk avoidance

D.

Risk transference

Question 28

You are the Network Administrator for a software company. Due to the nature of your company's business, you have a significant number of highly computer savvy users. However, you have still decided to limit each user access to only those resources required for their job, rather than give wider access to the technical users (such as tech support and software engineering personnel). What is this an example of?

Options:

A.

The principle of maximum control.

B.

The principle of least privileges.

C.

Proper use of an ACL.

D.

Poor resource management.

Question 29

You work as a Web Administrator for Perfect World Inc. The company is planning to host an E-commerce Web site. You are required to design a security plan for it. Client computers with different operating systems will access the Web server. How will you configure the Web server so that it is secure and only authenticated users are able to access it? Each correct answer represents a part of the solution. Choose two.

Options:

A.

Use encrypted authentication.

B.

Use the SSL protocol.

C.

Use the EAP protocol.

D.

Use Basic authentication.

Question 30

You are documenting your organization's change control procedures for project management. What portion of the change control process oversees features and functions of the product scope?

Options:

A.

Configuration management

B.

Product scope management is outside the concerns of the project.

C.

Scope changecontrol system

D.

Project integration management

Question 31

You are the project manager of the HJK Project for your organization. You and the project team have created risk responses for many of the risk events in the project. Where should you document the proposed responses and the current status of all identified risks?

Options:

A.

Risk management plan

B.

Lessons learned documentation

C.

Risk register

D.

Stakeholder management strategy

Question 32

Which of the following involves changing data prior to or during input to a computer in an effort to commit fraud?

Options:

A.

Data diddling

B.

Wiretapping

C.

Eavesdropping

D.

Spoofing

Page: 1 / 8
Total 218 questions