The Actual Exam Version included actual exam questions verified by IT Experts. We verified questions and updated frequently each month and also based on members’ feedback to keep updating with the real exam. We are offering money back immediately if questions in our Actual Exam Version do not appear in your exam. Highly recommend you take the Actual Exam Version then go to the exam as soon as possible.
CISSP-ISSMP Information Systems Security Management Professional Actual Exam
QUESTION NO: 1
Which of the following fields of management focuses on establishing and maintaining consistency of a system’s or product’s performance and its functional and physical attributes with its requirements, design, and operational information throughout its life?
A. Configuration management
B. Risk management
C. Procurement management
D. Change management
QUESTION NO: 2
Which of the following are the ways of sending secure e-mail messages over the Internet? Each correct answer represents a complete solution. Choose two.
A. TLS
B. PGP
C. S/MIME
D. IPSec
QUESTION NO: 3
You work as a Senior Marketing Manager for Umbrella Inc. You find out that some of the software applications on the systems were malfunctioning and also you were not able to access your remote desktop session. You suspected that some malicious attack was performed on the network of the company. You immediately called the incident response team to handle the situation who enquired the Network Administrator to acquire all relevant information regarding the malfunctioning. The Network Administrator informed the incident response team that he was reviewing the security of the network which caused all these problems. Incident response team announced that this was a controlled event not an incident. Which of the following steps of an incident handling process was performed by the incident response team?
A. Containment
B. Eradication
C. Preparation
D. Identification
QUESTION NO: 4
Which of the following is the process performed between organizations that have unique hardware or software that cannot be maintained at a hot or warm site?
A. Cold sites arrangement
B. Business impact analysis
C. Duplicate processing facilities
D. Reciprocal agreements
QUESTION NO: 5
Which of the following involves changing data prior to or during input to a computer in an effort to commit fraud?
A. Data diddling
B. Wiretapping
C. Eavesdropping
D. Spoofing
QUESTION NO: 6
Which of the following penetration testing phases involves reconnaissance or data gathering?
A. Attack phase
B. Pre-attack phase
C. Post-attack phase
D. Out-attack phase
QUESTION NO: 7
Mark works as a security manager for SoftTech Inc. He is involved in the BIA phase to create a document to be used to help understand what impact a disruptive event would have on the business. The impact might be financial or operational. Which of the following are the objectives related to the above phase in which Mark is involved? Each correct answer represents a part of the solution. Choose threE.
A. Resource requirements identification
B. Criticality prioritization
C. Down-time estimation
D. Performing vulnerability assessment
QUESTION NO: 8
Which of the following recovery plans includes specific strategies and actions to deal with specific variances to assumptions resulting in a particular security problem, emergency, or state of affairs?
A. Business continuity plan
B. Disaster recovery plan
C. Continuity of Operations Plan
D. Contingency plan
QUESTION NO: 9
Which of the following protocols is used with a tunneling protocol to provide security?
A. FTP
B. IPX/SPX
C. IPSec
D. EAP
QUESTION NO: 10
Which of the following subphases are defined in the maintenance phase of the life cycle models?
A. Change control
B. Configuration control
C. Request control
D. Release control
QUESTION NO: 11
Which of the following terms refers to a mechanism which proves that the sender really sent a particular message?
A. Non-repudiation
B. Confidentiality
C. Authentication
D. Integrity
QUESTION NO: 12
Which of the following characteristics are described by the DIAP Information Readiness Assessment function? Each correct answer represents a complete solution. Choose all that apply.
A. It performs vulnerability/threat analysis assessment.
B. It identifies and generates IA requirements.
C. It provides data needed to accurately assess IA readiness.
D. It provides for entry and storage of individual system dat
QUESTION NO: 13
Joseph works as a Software Developer for Web Tech Inc. He wants to protect the algorithms and the techniques of programming that he uses in developing an application. Which of the following laws are used to protect a part of software?
A. Code Security law
B. Trademark laws
C. Copyright laws
D. Patent laws
QUESTION NO: 14
Which of the following is the best method to stop vulnerability attacks on a Web server?
A. Using strong passwords
B. Configuring a firewall
C. Implementing the latest virus scanner
D. Installing service packs and updates
QUESTION NO: 15
Which of the following is NOT a valid maturity level of the Software Capability Maturity Model (CMM)?
A. Managed level
B. Defined level
C. Fundamental level
D. Repeatable level
QUESTION NO: 16
Which of the following BCP teams is the first responder and deals with the immediate effects of the disaster?
A. Emergency-management team
B. Damage-assessment team
C. Off-site storage team
D. Emergency action team
QUESTION NO: 17
Which of the following security models dictates that subjects can only access objects through applications?
A. Biba-Clark model
B. Bell-LaPadula
C. Clark-Wilson
D. Biba model
QUESTION NO: 18
Which of the following relies on a physical characteristic of the user to verify his identity?
A. Social Engineering
B. Kerberos v5
C. Biometrics
D. CHAP
QUESTION NO: 19
Which of the following types of activities can be audited for security? Each correct answer represents a complete solution. Choose three.
A. Data downloading from the Internet
B. File and object access
C. Network logons and logoffs
D. Printer access
QUESTION NO: 20
You work as a Network Administrator for ABC Inc. The company uses a secure wireless network. John complains to you that his computer is not working properly. What type of security audit do you need to conduct to resolve the problem?
A. Operational audit
B. Dependent audit
C. Non-operational audit
D. Independent audit
QUESTION NO: 21
Which of the following laws is the first to implement penalties for the creator of viruses, worms, and other types of malicious code that causes harm to the computer systems?
A. Gramm-Leach-Bliley Act
B. Computer Fraud and Abuse Act
C. Computer Security Act
D. Digital Millennium Copyright Act
QUESTION NO: 22 CORRECT TEXT
SIMULATION
Fill in the blank with an appropriate phrase.________ models address specifications, requirements, and design, verification and validation, and maintenance activities.
Answer:
Life cycle
QUESTION NO: 23
You are the project manager of the GHE Project. You have identified the following risks with the characteristics as shown in the following figure:
How much capital should the project set aside for the risk contingency reserve?
A. $142,000
B. $232,000
C. $41,750
D. $23,750
QUESTION NO: 24
Which of the following statements about system hardening are true? Each correct answer represents a complete solution. Choose two.
A. It can be achieved by installing service packs and security updates on a regular basis.
B. It is used for securing the computer hardware.
C. It can be achieved by locking the computer room.
D. It is used for securing an operating system.
QUESTION NO: 25
Which of the following are the common roles with regard to data in an information classification program? Each correct answer represents a complete solution. Choose all that apply.
A. Editor
B. Custodian
C. Owner
D. Security auditor
E. User
QUESTION NO: 26
Which of the following processes is described in the statement below?
“It is the process of implementing risk response plans, tracking identified risks, monitoring residual risk, identifying new risks, and evaluating risk process effectiveness throughout the project.”
A. Monitor and Control Risks
B. Identify Risks
C. Perform Qualitative Risk Analysis
D. Perform Quantitative Risk Analysis
QUESTION NO: 27
Walter is the project manager of a large construction project. He’ll be working with several vendors on the project. Vendors will be providing materials and labor for several parts of the project. Some of the work in the project is very dangerous so Walter has implemented safety requirements for all of the vendors and his own project team. Stakeholders for the project have added new requirements, which have caused new risks in the project. A vendor has identified a new risk that could affect the project if it comes into fruition. Walter agrees with the vendor and has updated the risk register and created potential risk responses to mitigate the risk. What should Walter also update in this scenario considering the risk event?
A. Project contractual relationship with the vendor
B. Project management plan
C. Project communications plan
D. Project scope statement
QUESTION NO: 28
You are the project manager of the HJK Project for your organization. You and the project team have created risk responses for many of the risk events in the project. Where should you document the proposed responses and the current status of all identified risks?
A. Risk management plan
B. Lessons learned documentation
C. Risk register
D. Stakeholder management strategy
QUESTION NO: 29
Which of the following security controls will you use for the deployment phase of the SDLC to build secure software? Each correct answer represents a complete solution. Choose all that apply.
A. Vulnerability Assessment and Penetration Testing
B. Security Certification and Accreditation (C&A)
C. Change and Configuration Control
D. Risk Adjustments
QUESTION NO: 30
Which of the following can be prevented by an organization using job rotation and separation of duties policies?
A. Collusion
B. Eavesdropping
C. Buffer overflow
D. Phishing
What next?
https://www.awslagi.com/cissp-issmp-information-systems-security-management-professional-exam-question-part-1
https://www.awslagi.com/cissp-issmp-information-systems-security-management-professional-exam-question-part-2
https://www.awslagi.com/cissp-issmp-information-systems-security-management-professional-exam-question-part-3
