The Actual Exam Version included actual exam questions verified by IT Experts. We verified questions and updated frequently each month and also based on members’ feedback to keep updating with the real exam. We are offering money back immediately if questions in our Actual Exam Version do not appear in your exam. Highly recommend you take the Actual Exam Version then go to the exam as soon as possible.
CISSP-ISSMP Information Systems Security Management Professional Actual Exam
QUESTION NO: 31
Peter works as a Computer Hacking Forensic Investigator. He has been called by an organization to conduct a seminar to give necessary information related to sexual harassment within the work place. Peter started with the definition and types of sexual harassment. He then wants to convey that it is important that records of the sexual harassment incidents should be maintained, which helps in further legal prosecution. Which of the following data should be recorded in this documentation? Each correct answer represents a complete solution. Choose all that apply.
A. Names of the victims
B. Location of each incident
C. Nature of harassment
D. Date and time of incident
QUESTION NO: 32
Which of the following types of evidence is considered as the best evidence?
A. A copy of the original document
B. Information gathered through the witness’s senses
C. The original document
D. A computer-generated record
QUESTION NO: 33
What are the purposes of audit records on an information system? Each correct answer represents a complete solution. Choose two.
A. Troubleshooting
B. Investigation
C. Upgradation
D. Backup
QUESTION NO: 34
Which of the following refers to an information security document that is used in the United States Department of Defense (DoD) to describe and accredit networks and systems?
A. SSAA
B. FITSAF
C. FIPS
D. TCSEC
QUESTION NO: 35
Which of the following analysis provides a foundation for measuring investment of time, money and human resources required to achieve a particular outcome?
A. Vulnerability analysis
B. Cost-benefit analysis
C. Gap analysis
D. Requirement analysis
QUESTION NO: 36
A contract cannot have provisions for which one of the following?
A. Subcontracting the work
B. Penalties and fines for disclosure of intellectual rights
C. A deadline for the completion of the work
D. Illegal activities
QUESTION NO: 37
Your company is covered under a liability insurance policy, which provides various liability coverage for information security risks, including any physical damage of assets, hacking attacks, etc. Which of the following risk management techniques is your company using?
A. Risk mitigation
B. Risk transfer
C. Risk acceptance
D. Risk avoidance
QUESTION NO: 38
You work as a security manager for SoftTech Inc. You are conducting a security awareness campaign for your employees. One of the employees of your organization asks you the purpose of the security awareness, training and education program. What will be your answer?
A. It improves the possibility for career advancement of the IT stafF.
B. It improves the security of vendor relations.
C. It improves the performance of a company’s intranet.
D. It improves awareness of the need to protect system resources.
QUESTION NO: 39
You are responsible for network and information security at a metropolitan police station. The most important concern is that unauthorized parties are not able to access data. What is this called?
A. Availability
B. Encryption
C. Integrity
D. Confidentiality
QUESTION NO: 40
What component of the change management system is responsible for evaluating, testing, and documenting changes created to the project scope?
A. Scope Verification
B. Project Management Information System
C. Integrated Change Control
D. Configuration Management System
QUESTION NO: 41
Electronic communication technology refers to technology devices, such as computers and cell phones, used to facilitate communication. Which of the following is/are a type of electronic communication? Each correct answer represents a complete solution. Choose all that apply.
A. Internet telephony
B. Instant messaging
C. Electronic mail
D. Post-it note
E. Blogs
F. Internet teleconferencing
QUESTION NO: 42
You are the project manager of the HJK project for your organization. You and the project team have created risk responses for many of the risk events in the project. A teaming agreement is an example of what risk response?
A. Mitigation
B. Sharing
C. Acceptance
D. Transference
QUESTION NO: 43
Which of the following acts is a specialized privacy bill that affects any educational institution to accept any form of funding from the federal government?
A. HIPAA
B. COPPA
C. FERPA
D. GLBA
QUESTION NO: 44
Which of the following steps is the initial step in developing an information security strategy?
A. Perform a technical vulnerabilities assessment.
B. Assess the current levels of security awareness.
C. Perform a business impact analysis.
D. Analyze the current business strategy.
QUESTION NO: 45
Which of the following statements about the integrity concept of information security management are true? Each correct answer represents a complete solution. Choose threE.
A. It ensures that unauthorized modifications are not made to data by authorized personnel or processes.
B. It determines the actions and behaviors of a single individual within a system
C. It ensures that modifications are not made to data by unauthorized personnel or processes.
D. It ensures that internal information is consistent among all subentities and also consistent with the real-world, external situation.
QUESTION NO: 46
Which of the following contract types is described in the statement below? “This contract type provides no incentive for the contractor to control costs and hence is rarely utilized.”
A. Cost Plus Fixed Fee
B. Cost Plus Percentage of Cost
C. Cost Plus Incentive Fee
D. Cost Plus Award Fee
QUESTION NO: 47
Ned is the program manager for his organization and he’s considering some new materials for his program. He and his team have never worked with these materials before and he wants to ask the vendor for some additional information, a demon, and even some samples. What type of a document should Ned send to the vendor?
A. IFB
B. RFQ
C. RFP
D. RFI
QUESTION NO: 48
Against which of the following does SSH provide protection? Each correct answer represents a complete solution. Choose two.
A. IP spoofing
B. Broadcast storm
C. Password sniffing
D. DoS attack
QUESTION NO: 49
What is a stakeholder analysis chart?
A. It is a matrix that documents stakeholders’ threats, perceived threats, and communication needs.
B. It is a matrix that identifies all of the stakeholders and to whom they must report to.
C. It is a matrix that documents the stakeholders’ requirements, when the requirements were created, and when the fulfillment of the requirements took place..
D. It is a matrix that identifies who must communicate with whom.
QUESTION NO: 50
Which of the following strategies is used to minimize the effects of a disruptive event on a company, and is created to prevent interruptions to normal business activity?
A. Disaster Recovery Plan
B. Continuity of Operations Plan
C. Contingency Plan
D. Business Continuity Plan
QUESTION NO: 51
You are a project manager of a large construction project. Within the project you are working with several vendors to complete different phases of the construction. Your client has asked that you arrange for some of the materials a vendor is to install next week in the project to be changed. According to the change management plan what subsystem will need to manage this change request?
A. Cost
B. Resources
C. Contract
D. Schedule
QUESTION NO: 52
Which of the following roles is responsible for review and risk analysis of all contracts on a regular basis?
A. The Configuration Manager
B. The Supplier Manager
C. The Service Catalogue Manager
D. The IT Service Continuity Manager
QUESTION NO: 53
In which of the following SDLC phases is the system’s security features configured and enabled, the system is tested and installed or fielded, and the system is authorized for processing?
A. Initiation Phase
B. Development/Acquisition Phase
C. Implementation Phase
D. Operation/Maintenance Phase
QUESTION NO: 54
Which of the following laws or acts, formed in Australia, enforces prohibition against cyber stalking?
A. Malicious Communications Act (1998)
B. Anti-Cyber-Stalking law (1999)
C. Stalking Amendment Act (1999)
D. Stalking by Electronic Communications Act (2001)
QUESTION NO: 55
Which of the following response teams aims to foster cooperation and coordination in incident prevention, to prompt rapid reaction to incidents, and to promote information sharing among members and the community at large?
A. CSIRT
B. CERT
C. FIRST
D. FedCIRC
QUESTION NO: 56
Which of the following statements is related with the first law of OPSEC?
A. If you are not protecting it (the critical and sensitive information), the adversary wins!
B. If you don’t know what to protect, how do you know you are protecting it?
C. If you don’t know about your security resources you could not protect your network.
D. If you don’t know the threat, how do you know what to protect?
QUESTION NO: 57
Change Management is used to ensure that standardized methods and procedures are used for efficient handling of all changes. Who decides the category of a change?
A. The Problem Manager
B. The Process Manager
C. The Change Manager
D. The Service Desk
E. The Change Advisory Board
QUESTION NO: 58
Which of the following evidences are the collection of facts that, when considered together, can be used to infer a conclusion about the malicious activity/person?
A. Direct
B. Circumstantial
C. Incontrovertible
D. Corroborating
QUESTION NO: 59
Which of the following Acts enacted in United States amends Civil Rights Act of 1964, providing technical changes affecting the length of time allowed to challenge unlawful seniority provisions, to sue the federal government for discrimination and to bring age discrimination claims?
A. PROTECT Act
B. Sexual Predators Act
C. Civil Rights Act of 1991
D. The USA Patriot Act of 2001
QUESTION NO: 60
Which of the following policies helps reduce the potential damage from the actions of one person?
A. CSA
B. Risk assessment
C. Separation of duties
D. Internal audit
What next?
https://www.awslagi.com/cissp-issmp-information-systems-security-management-professional-exam-question-part-1
https://www.awslagi.com/cissp-issmp-information-systems-security-management-professional-exam-question-part-2
https://www.awslagi.com/cissp-issmp-information-systems-security-management-professional-exam-question-part-3
