Use Simplilearn’s CISSP practice exam to test yourself in information security concepts. With these CISSP exam questions, you can define all aspects of IT security. These CISSP sample questions are free and represent the real certification. For professionals who like to study systematically, the practice sample questions are for you. You can take them multiple times and map your progress as you complete your course. Try it today!
CISSP®- Certified Information Systems Security Professional
The Certified Information Systems Security Professional (CISSP) certification is considered the gold standard in the field of informatio ...
1. This is a FREE test and can be attempted multiple times. But it is recommended to take the test when you are ready for best practice experience.
2. Test Duration: 360 Minutes
3. Number of questions: 250 Multiple Choice Questions
4. Each question has multiple options out of which one or more may be correct
5. You can pause the test in between and you are allowed to re-take the test later. Your test will resume from where you left, but the test time will be reduced by the amount of time you've taken in the previous attempt.
All test progress will be lost in case you close the browser without finishing the test. Please finish the test to access your results.
Answer: (a) Scanning is done to understand the type of network topology implemented at the target
Answer: (a) Disclosure, alteration, and destruction (DAD) are opposite to CIA
Answer: (b) The primary goal of a security awareness program is to make everyone aware of potential risk and exposure
Answer: (c)Theft of personally identifiable information (PII), such as credit card information is an example of confidentiality attack
Answer: (a) Ensuring availability includes preventing denial of service attacks.
Answer: (d) usually Computer attacks result in violation of only four different security properties: availability, confidentiality, integrity, and control
Answer: (c)The Health Insurance Portability and Accountability Act (HIPAA), requires that medical providers keep Personal and medical information of their patients private.
Answer: (d) Fault tolerance safeguards help us to combat threats to data reliability. In other words reliability is increased by fault tolerance.
Answer: (b) Failsafe
Answer: (d) The reference monitor or security kernel is the core of the TCB and is the most commonly used approach to build trusted computing systems
Answer: (c) The Security Kernel mediates all access relationship between subjects and objects of a system
Answer: (a) A Multi User operating system allows multiple users to access a computer system at the same time
Answer: (c) Dual backbones provides network link redundancy.
Answer: (a) When a computer uses more than one CPU in parallel to execute instructions it is known as Multiprocessing
Answer: (a) The employees should desist from answering to outsiders, any questions about disaster recovery procedures . Only people working in the company and with a role inside it should know about those procedures as the information is of private nature.
Answer: (d) Salami attack involves an employee shaving off pennies from multiple accounts and depositing the funds into his own bank account.
Answer: (a) One method to simplify the administration of access controls is to group it in subjects and objects
Answer: (a) Cryptography does not answer the concerns of availability of the information
Answer: (c) Insiders are mostly responsible for Data diddling(Modification of data)
Answer: (a) Since RAID 5 uses parity to provide fault tolerance through the array, once of the disks in it can become corrupted, and you usually can just take it out without turning off the system (Hot SWAP) and plug a spare disk on the bay
Answer: (b) Authorization specifies the access rights to resources
Answer: (a) 'Full' backup method provides a baseline for our systems to Restore; the full backup must be done at least once regardless of the method you are using to make backups.
Answer: (d) The principle of least privilege states that a process, a user or a program must be able to access only the information and resources that are necessary to perform its authorized task.
Answer: (b) This is not one of the statements of the ISC2 code of Ethics
Answer: (a) Orange Book is based on Bell-LaPadula. Using mathematics and set theory, the model precisely defines the notion of secure state, fundamental modes of access, and the rules for granting subjects specific modes of access to objects.
Answer: (b) Debugging programs are used to ensure that program coding flaws and bugs are detected and corrected. A bug is a coding error in a computer program. The process of finding bugs before program final users is called debugging.
Answer: (b) You cannot encrypt anything at physical layer because its physical, it is not protocol / software base Network, Data link and transport layer supports encryption.
Answer: (d) Cipher Block Chaining and Cipher Feedback can be best used to provide user authentication capabilities.
Answer: (c) With mandatory controls, only administrators and not owners of resources may make decisions that bear on or derive from policy. This kind of access control method is based on Security labels.
Answer: (c) Statefull inspection is a third generation firewall technology designed to be aware of, and inspect, not only the information being received, but the dynamic connection and transmission state of the information being received
Answer: (a) RAID 1 technique creates exact copy (or mirror) of a set of data on two disks
Answer: (a) From the users view, a cluster is a single server, but its only a logical one, you can have an array of 4 server in cluster all with the same IP address there is no difference for the client.
Answer: (b) Denormalization is the process of attempting to optimize the performance of data storage by adding redundant data. Once the database is denormalized it increases processing efficiency.
Answer: (a)Managers of Business operation department are ideal since they know the in and out of the business processes inside the company
Answer: (d) Buffer overflows are the most common type of DoS attack. Here, an attacker sends more data than the application's buffer can hold. When the amount of data exceeds the buffer size, the extra data overflows under the stack, often causing the application or the whole system to crash. In some cases, the data can be carefully crafted to include machine code that will execute when it overflows onto the stack.
Answer: (a) Statefull inspection firewalls provides tracking support for connectionless protocols through the use of session state databases.
Answer: (c) Its not a good practice to have Permanent documents in your e-mail, because you don't know if your mail is always backed up, and maybe the document must be available in a corporate repository.
Answer: (c) Encapsulating Security Payload (ESP) authentication must be used. ESP is a header that when its added to an IP datagram, protects the confidentiality, integrity and authenticity of the data
Answer: (a) The System Requirements definition phase of the development life cycle is the most influenced by a Security analyst, because in this phase all the requirements, including security ones, of the system to be development are set.
Answer: (c) Controls are put in your environment to minimize the impact of a potential loss, with them you can also mitigate the risk.
Answer: (a) Since circuit level gateways are not as high in the OSI model for the inspection as Application level firewalls, they are easier to maintain and configure.
Answer: (a) UDP is not implemented at Internet layer of TCP/IP model, it is implemented at Host-to-Host layer.
Answer: (b) Sniffing is the action of capture / monitor the data passing across a network
Answer: (a) If a user's sensitivity label is greater than or equal to the sensitivity label of the object, he is allowed access to the object, otherwise, he is denied access
Answer: (b) A contingency plan should address Residual Risk plan to minimize business impact when you are in a downtime situation. The identified Risks and the Potential Risks are not identified there, they are identified earlier.
Answer: (b) Application control provides a transparent feeling to endpoint applications when changes are needed, this is one of the features of it.
Answer: (c) The Spiral model is a meta-model that incorporates a number of the software development models. The spiral model for software engineering has evolved to encompass the best features of the classic waterfall model, while at the same time adding an element known as risk analysis.