Act now and download your ISC2 cissp exam cost test today! Do not waste time for the worthless ISC2 cissp requirements tutorials. Download Most recent ISC2 Certified Information Systems Security Professional (CISSP) exam with real questions and answers and begin to learn ISC2 cissp study plan with a classic professional.

Q61. When designing a networked Information System (IS) where there will be several different types of individual access, what is the FIRST step that should be taken to ensure all access control requirements are addressed? 

A. Create a user profile. 

B. Create a user access matrix. 

C. Develop an Access Control List (ACL). 

D. Develop a Role Based Access Control (RBAC) list. 

Answer: B 


Q62. A risk assessment report recommends upgrading all perimeter firewalls to mitigate a particular finding. Which of the following BEST supports this recommendation? 

A. The inherent risk is greater than the residual risk. 

B. The Annualized Loss Expectancy (ALE) approaches zero. 

C. The expected loss from the risk exceeds mitigation costs. 

D. The infrastructure budget can easily cover the upgrade costs. 

Answer: C 


Q63. Which of the following does the Encapsulating Security Payload (ESP) provide? 

A. Authorization and integrity 

B. Availability and integrity 

C. Integrity and confidentiality 

D. Authorization and confidentiality 

Answer: C 


Q64. Which of the following BEST represents the principle of open design? 

A. Disassembly, analysis, or reverse engineering will reveal the security functionality of the computer system. 

B. Algorithms must be protected to ensure the security and interoperability of the designed system. 

C. A knowledgeable user should have limited privileges on the system to prevent their ability to compromise security capabilities. 

D. The security of a mechanism should not depend on the secrecy of its design or implementation. 

Answer: D 


Q65. If compromised, which of the following would lead to the exploitation of multiple virtual machines? 

A. Virtual device drivers 

B. Virtual machine monitor 

C. Virtual machine instance 

D. Virtual machine file system 

Answer: B 


Q66. Which of the following is generally indicative of a replay attack when dealing with biometric authentication? 

A. False Acceptance Rate (FAR) is greater than 1 in 100,000 

B. False Rejection Rate (FRR) is greater than 5 in 100 

C. Inadequately specified templates 

D. Exact match 

Answer: D 


Q67. During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant. 

What is the best approach for the CISO? 

During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant. 

What is the best approach for the CISO? 

A. Document the system as high risk 

B. Perform a vulnerability assessment 

C. Perform a quantitative threat assessment 

D. Notate the information and move on 

Answer: B 


Q68. The goal of a Business Continuity Plan (BCP) training and awareness program is to 

A. enhance the skills required to create, maintain, and execute the plan. 

B. provide for a high level of recovery in case of disaster. 

C. describe the recovery organization to new employees. 

D. provide each recovery team with checklists and procedures. 

Answer: A 


Q69. Which of the following is a MAJOR consideration in implementing a Voice over IP (VoIP) network? 

A. Use of a unified messaging. 

B. Use of separation for the voice network. 

C. Use of Network Access Control (NAC) on switches. 

D. Use of Request for Comments (RFC) 1918 addressing. 

Answer: B 


Q70. What type of test assesses a Disaster Recovery (DR) plan using realistic disaster scenarios while maintaining minimal impact to business operations? 

A. Parallel 

B. Walkthrough 

C. Simulation 

D. Tabletop 

Answer: C