CISSP Practice Test Questions Updated 1795 Questions
ISC CISSP Dumps - Secret To Pass in First Attempt
The CISSP exam covers a wide range of topics, including security and risk management, asset security, security engineering, communications and network security, identity and access management, security assessment and testing, security operations, and software development security. CISSP exam consists of 250 multiple-choice questions, and test-takers have six hours to complete the exam. To become certified, candidates must pass the exam and have at least five years of experience in the field of information security, or four years of experience and a college degree.
Exam Outline
According to the vendor, the CISSP test is available in two options: CAT (English exam) and Linear (test in other languages). As for the CAT variation, it has 100-150 questions in multiple-choice and advances innovative formats. The exam duration is 3 hours. The passing score for this test is 700 out of 1000 points. When it comes to the Linear exam, it will last for 6 hours with 250 items to complete. In all, the candidates who prepare for either exam variation are expected to have in-depth knowledge of software development security and its risks across eight security areas, which are as follows:
- Security for Software Development.
- Network Security along with Communication;
- Security of Assets;
- Risk Management alongside Security Concepts;
- Security Testing and Assessment;
- Engineering & Security Architecture;
Finally, you can schedule your CISSP certification exam by creating a Pearson VUE account. Make sure you can then select your nearest testing center.
NEW QUESTION # 135
The security term that is concerned with the same primary key existing at different classification levels in the same database is:
- A. Polymorphism.
- B. Polyinstantiation.
- C. Normalization.
- D. Inheritance.
Answer: B
Explanation:
The security term that is concerned with
the same primary key existing at different classification levels in the same database is polyinstantiation.
Answer Polymorphism is incorrect because
polymorphism is defined as objects of many different classes that are
related by some common superclass; thus, any object denoted by this
name is able to respond to some common set of operations in a different way.
Answer Normalization is incorrect because normalization refers to
removing redundant or incorrect data from a database.
Answer Inheritance is incorrect because inheritance refers to methods from a class inherited by another subclass.
NEW QUESTION # 136
Which of the following is a recommended alternative to an integrated email encryption system?
- A. Sign emails containing sensitive data
- B. Send sensitive data in separate emails
- C. Store sensitive information to be sent in encrypted drives
- D. Encrypt sensitive data separately in attachments
Answer: D
NEW QUESTION # 137
What fire suppression system can be used in computer rooms that will not damage computers and is safe for humans?
- A. Water
- B. FM200
- C. Halon
- D. CO2
Answer: B
Explanation:
Reference: http://www.fireline.com/fl_fm200firesuppression.html FM-200 Systems FM-200 Fire Suppression Systems - Halon Alternatives Fire Protection Systems
FM200 is a fire suppression system agent manufactured by Great Lakes Chemical.
How FM200 Suppresses Fire
FM200 suppresses fire by discharging as a gas onto the surface of combusting materials. Large amounts of heat energy are absorbed from the surface of the burning material, lowering it's temperature below the ignition point.
FM200 Fire Suppression Systems and the Environment
FM200 fire suppression systems have low atmospheric lifetimes, global warming, and ozone depletion potentials. Unlike Halon 1301 fire suppression systems, FM200 systems are environmentally friendly. They provide an effective, safe method of special hazards fire suppression where a non-residue producing clean agent is essential.
NEW QUESTION # 138
Which of the following could illegally capture network user passwords?
- A. Sniffing
- B. Data diddling
- C. Smurfing
- D. Spoofing
Answer: A
Explanation:
Sniffing is the action of capture the information going over the network. Most popular way of connecting computers is through Ethernet. Ethernet protocol works by sending packet information to all the hosts on the same circuit. The packet header contains the proper address of the destination machine. Only the machine with the matching address is suppose to accept the packet. A machine that is accepting all packets, no matter what the packet header says, is said to be in promiscuous mode. Because, in a normal networking environment, account and password information is passed along Ethernet in clear-text, it is not hard for an intruder to put a machine into promiscuous mode and by sniffing, compromise all the machines on the net by capturing password in an illegal fashion.
NEW QUESTION # 139
Address Resolution Protocol (ARP) interrogates the network by sending out a?
- A. broadcast.
- B. multicast.
- C. semicast.
- D. unicast.
Answer: A
Explanation:
ARP interrogates the network by sending out a broadcast seeking a network node that has a specific IP address, and asks it to reply with its hardware address. A broadcast message is sent to everyone whether or not the message was requested. A traditional unicast is a "one-to-one" or "narrowcast" message. A multicast is a "one-to-many" message that is traditionally only sent to those machine that requested the information. Semicast is an imposter answer. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 87.
NEW QUESTION # 140
While referring to Physical Security, what does Positive pressurization means?
- A. A series of measures that increase pressure on employees in order to make them more productive.
- B. The air goes out of a room when a door is opened and outside air does not go into the room.
- C. The pressure inside your sprinkler system is greater than zero.
- D. Causes the sprinkler system to go off.
Answer: B
Explanation:
Positive Pressurization is a condition that exists when more air is supplied to a space than is exhausted, so the air pressure within that space is greater than that in surrounding areas. This condition can cause the situation mentioned above in the answer
B, you can make air go out of a room but not enter to it from the outside.
NEW QUESTION # 141
A momentary power outage is a:
- A. surge
- B. spike
- C. blackout
- D. fault
Answer: D
Explanation:
A momentary power outage is a fault.
Power Excess
Spike --> Too much voltage for a short period of time.
Surge --> Too much voltage for a long period of time.
Power Loss
Fault --> A momentary power outage.
Blackout --> A long power interruption.
Power Degradation
Sag or Dip --> A momentary low voltage.
Brownout --> A prolonged power supply that is below normal voltage.
Reference(s) used for this question:
HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 3rd. Edition McGraw-
Hill/Osborne, 2005, page 368.
and
https://en.wikipedia.org/wiki/Power_quality
NEW QUESTION # 142
Which of the following does Temporal Key Integrity Protocol (TKIP) support?
- A. Coordination of IEEE 802.11 protocols
- B. Synchronization of multiple devices
- C. Wired Equivalent Privacy (WEP) systems
- D. Multicast and broadcast messages
Answer: D
Explanation:
Temporal Key Integrity Protocol (TKIP) supports multicast and broadcast messages by using a group temporal key that is shared by all the devices in the same wireless network. This key is used to encrypt and decrypt the messages that are sent to multiple recipients at once. TKIP also supports unicast messages by using a pairwise temporal key that is unique for each device and session. TKIP does not support coordination of IEEE 802.11 protocols, as it is a protocol itself that was designed to replace WEP. TKIP is compatible with WEP systems, but it does not support them, as it provides more security features than WEP. TKIP does not support synchronization of multiple devices, as it does not provide any clock or time synchronization mechanism
. References: 1: Temporal Key Integrity Protocol - Wikipedia 2: Wi-Fi Security: Should You Use WPA2-AES, WPA2-TKIP, or Both? - How-To Geek
NEW QUESTION # 143
The Open Group has defined functional objectives in support of a user
single sign-on (SSO) interface. Which of the following is NOT one of
those objectives and would possibly represent a vulnerability?
- A. It shall not predefine the timing of secondary sign-on operations.
- B. The interface shall be independent of the type of authentication information handled.
- C. Support shall be provided for a subject to establish a default user profile.
- D. Provision for user-initiated change of nonuser-configured authentication information.
Answer: D
Explanation:
User configuration of nonuser-configured authentication mechanisms is not supported by the Open Group SSO interface objectives. Authentication mechanisms include items such as smart cards and magnetic badges. Strict controls must be placed to prevent a user from changing configurations that are set by another authority. Objective a supports the incorporation of a variety of authentication schemes and technologies. Answer c states that the interface functional objectives do not require that all sign-on operations be performed at the same time as the primary sign on. This prevents the creation of user sessions with all the available services even though these services are not needed by the user.
The creation of a default user profile will make the sign-on more efficient and less time-consuming. In summary, the scope of the Open Group Single Sign-On Standards is to define services in support of: The development of applications to provide a common, single end-user sign-on interface for an enterprise. The development of applications for the coordinated management of multiple user account management information bases maintained by an enterprise.
NEW QUESTION # 144
Which of the following was developed in order to protect against fraud in electronic fund transfers (EFT)?
- A. Message Authentication Code (MAC)
- B. Secure Electronic Transaction (SET)
- C. Cyclic Redundency Check (CRC)
- D. Secure Hash Standard (SHS)
Answer: A
Explanation:
Reference: pg 218 Krutz: CISSP Prep Guide: Gold Edition
NEW QUESTION # 145
Which of the following is immune to the effects of electromagnetic interference (EMI) and therefore has a much longer effective usable length?
- A. Axial cable
- B. Coaxial cable
- C. Twisted Pair cable
- D. Fiber Optic cable
Answer: D
Explanation:
Fiber Optic cable is immune to the effects of electromagnetic interference (EMI) and therefore has a much longer effective usable length (up to two kilometers in some cases). Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 72.
NEW QUESTION # 146
Which of the following addresses a portion of the primary memory by specifying the actual address of the memory location?
- A. Indirect addressing
- B. indexed addressing
- C. direct addressing
- D. implied addressing
Answer: C
Explanation:
+------+-----+--------------------------------------+
| load | reg | address |
+ ------+-----+--------------------------------------+
(Effective address = address as given in instruction)
This requires space in an instruction for quite a large address. It is often available on CISC machines which have variable-length instructions, such as x86.
Some RISC machines have a special Load Upper Literal instruction which places a 16-bit constant in the top half of a register. An OR literal instruction can be used to insert a 16-bit constant in the lower half of that register, so that a full 32-bit address can then be used via the register-indirect addressing mode, which itself is provided as "base-plus-offset" with an offset of 0.
http://en.wikipedia.org/wiki/Addressing_mode (Very good coverage of the subject) also see:
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, page 186.
also see:
http://www.comsci.us/ic/notes/am.html
NEW QUESTION # 147
Which of the following cryptographic attacks describes when the attacker has a copy of the plaintext and the corresponding ciphertext?
- A. brute force
- B. ciphertext only
- C. chosen plaintext
- D. known plaintext
Answer: D
Explanation:
The goal to this type of attack is to find the cryptographic key that was used to encrypt the message. Once the key has been found, the attacker would then be able to decrypt all messages that had been encrypted using that key.
The known-plaintext attack (KPA) or crib is an attack model for cryptanalysis where the attacker has samples of both the plaintext and its encrypted version (ciphertext), and is at liberty to make use of them to reveal further secret information such as secret keys and code books. The term "crib" originated at Bletchley Park, the British World War II decryption operation
In cryptography, a brute force attack or exhaustive key search is a strategy that can in theory be used against any encrypted data by an attacker who is unable to take advantage of any weakness in an encryption system that would otherwise make his task easier. It involves systematically checking all possible keys until the correct key is found. In the worst case, this would involve traversing the entire key space, also called search space.
In cryptography, a ciphertext-only attack (COA) or known ciphertext attack is an attack model for cryptanalysis where the attacker is assumed to have access only to a set of ciphertexts.
The attack is completely successful if the corresponding plaintexts can be deduced, or even better, the key. The ability to obtain any information at all about the underlying plaintext is still considered a success. For example, if an adversary is sending ciphertext continuously to maintain traffic-flow security, it would be very useful to be able to distinguish real messages from nulls. Even making an informed guess of the existence of real messages would facilitate traffic analysis.
In the history of cryptography, early ciphers, implemented using pen-and-paper, were routinely broken using ciphertexts alone. Cryptographers developed statistical techniques for attacking ciphertext, such as frequency analysis. Mechanical encryption devices such as Enigma made these attacks much more difficult (although, historically, Polish cryptographers were able to mount a successful ciphertext-only cryptanalysis of the
Enigma by exploiting an insecure protocol for indicating the message settings).
Every modern cipher attempts to provide protection against ciphertext-only attacks. The vetting process for a new cipher design standard usually takes many years and includes exhaustive testing of large quantities of ciphertext for any statistical departure from random noise. See: Advanced Encryption Standard process. Also, the field of steganography evolved, in part, to develop methods like mimic functions that allow one piece of data to adopt the statistical profile of another. Nonetheless poor cipher usage or reliance on home- grown proprietary algorithms that have not been subject to thorough scrutiny has resulted in many computer-age encryption systems that are still subject to ciphertext-only attack.
Examples include:
Early versions of Microsoft's PPTP virtual private network software used the same RC4 key for the sender and the receiver (later versions had other problems). In any case where a stream cipher like RC4 is used twice with the same key it is open to ciphertext-only attack.
See: stream cipher attack
Wired Equivalent Privacy (WEP), the first security protocol for Wi-Fi, proved vulnerable to several attacks, most of them ciphertext-only.
A chosen-plaintext attack (CPA) is an attack model for cryptanalysis which presumes that the attacker has the capability to choose arbitrary plaintexts to be encrypted and obtain the corresponding ciphertexts. The goal of the attack is to gain some further information which reduces the security of the encryption scheme. In the worst case, a chosen-plaintext attack could reveal the scheme's secret key.
This appears, at first glance, to be an unrealistic model; it would certainly be unlikely that an attacker could persuade a human cryptographer to encrypt large amounts of plaintexts of the attacker's choosing. Modern cryptography, on the other hand, is implemented in software or hardware and is used for a diverse range of applications; for many cases, a chosen-plaintext attack is often very feasible. Chosen-plaintext attacks become extremely important in the context of public key cryptography, where the encryption key is public and attackers can encrypt any plaintext they choose.
Any cipher that can prevent chosen-plaintext attacks is then also guaranteed to be secure against known-plaintext and ciphertext-only attacks; this is a conservative approach to security.
Two forms of chosen-plaintext attack can be distinguished:
Batch chosen-plaintext attack, where the cryptanalyst chooses all plaintexts before any of them are encrypted. This is often the meaning of an unqualified use of "chosen-plaintext attack".
Adaptive chosen-plaintext attack, where the cryptanalyst makes a series of interactive queries, choosing subsequent plaintexts based on the information from the previous encryptions.
References:
Source: TIPTON, Harold, Official (ISC)2 Guide to the CISSP CBK (2007), page 271.
and
Wikipedia at the following links:
http://en.wikipedia.org/wiki/Chosen-plaintext_attack
http://en.wikipedia.org/wiki/Known-plaintext_attack
http://en.wikipedia.org/wiki/Ciphertext-only_attac
http://en.wikipedia.org/wiki/Brute_force_attack
NEW QUESTION # 148
Place in order, from BEST (1) to WORST (4), the following methods to reduce the risk of data remanence on magnetic media.
Answer:
Explanation:
NEW QUESTION # 149
Which of the following is the name of an individual or group that is impacted by a change?
- A. End User
- B. Stakeholder
- C. Change agent
- D. Sponsor
Answer: B
NEW QUESTION # 150
What uses a key of the same length as the message where each bit or character from the plaintext is encrypted by a modular addition?
- A. Cipher block chaining
- B. One-time pad
- C. Running key cipher
- D. Steganography
Answer: B
Explanation:
Explanation/Reference:
Explanation:
In cryptography, the one-time pad (OTP) is an encryption technique that cannot be cracked if used correctly. In this technique, a plaintext is paired with a random secret key (also referred to as a one-time pad). Then, each bit or character of the plaintext is encrypted by combining it with the corresponding bit or character from the pad using modular addition. If the key is truly random, is at least as long as the plaintext, is never reused in whole or in part, and is kept completely secret, then the resulting ciphertext will be impossible to decrypt or break. However, practical problems have prevented one-time pads from being widely used.
The "pad" part of the name comes from early implementations where the key material was distributed as a pad of paper, so that the top sheet could be easily torn off and destroyed after use.
The one-time pad has serious drawbacks in practice because it requires:
Truly random (as opposed to pseudorandom) one-time pad values, which is a non-trivial requirement.
Secure generation and exchange of the one-time pad values, which must be at least as long as the
message. (The security of the one-time pad is only as secure as the security of the one-time pad exchange).
Careful treatment to make sure that it continues to remain secret, and is disposed of correctly
preventing any reuse in whole or part-hence "one time".
Because the pad, like all shared secrets, must be passed and kept secure, and the pad has to be at least as long as the message, there is often no point in using one-time padding, as one can simply send the plain text instead of the pad (as both can be the same size and have to be sent securely).
Distributing very long one-time pad keys is inconvenient and usually poses a significant security risk. The pad is essentially the encryption key, but unlike keys for modern ciphers, it must be extremely long and is much too difficult for humans to remember. Storage media such as thumb drives, DVD-Rs or personal digital audio players can be used to carry a very large one-time-pad from place to place in a non- suspicious way, but even so the need to transport the pad physically is a burden compared to the key negotiation protocols of a modern public-key cryptosystem, and such media cannot reliably be erased securely by any means short of physical destruction (e.g., incineration).
The key material must be securely disposed of after use, to ensure the key material is never reused and to protect the messages sent. Because the key material must be transported from one endpoint to another, and persist until the message is sent or received, it can be more vulnerable to forensic recovery than the transient plaintext it protects.
Incorrect Answers:
A: Running key cipher does not use a key of the same length as the message.
C: Steganography is a method of hiding data in another media type so the very existence of the data is concealed. This is not what is described in the question.
D: Cipher block chaining is an encryption method where each block of text, the key, and the value based on the previous block are processed in the algorithm and applied to the next block of text. This is not what is described in the question.
References:
https://en.wikipedia.org/wiki/One-time_pad
NEW QUESTION # 151
Which of the following is the PRIMARY purpose of installing a mantrap within a facility?
- A. Control air flow
- B. Prevent rapid movement
- C. Control traffic
- D. Prevent plggybacking
Answer: D
NEW QUESTION # 152
An iterated block cipher encrypts by breaking the plaintext block into
two halves and, with a subkey, applying a round transformation to
one of the halves. Then, the output of this transformation is XORed with the remaining half. The round is completed by swapping the two halves. This type of cipher is known as:
- A. Diffie-Hellman
- B. RC4
- C. Feistel
- D. RC6
Answer: C
Explanation:
The question stem describes one round of a Feistel cipher. This algorithm was developed by an IBM team led by Horst Feistel. (h. Feistel,
Cryptography and Computer Privacy, Scientific American, v.228, n.5,
May 1973) The algorithm was called Lucifer and was the basis for the
Data Encryption Standard (DES). In answer a, RC4 is a variable keysize
stream cipher developed by Ronald Rivest. In this type of cipher, a
sequence of bits that are the key is bit-wise XORed with the plaintext.
* Diffie-Hellman describes the first public key algorithm
and is based on the difficulty of calculating discrete logarithms in a
finite field. (W. Diffie and M.e. Hellman, New Directions in Cryptography,
IEEE Transactions on Information Theory, v. IT-22, n. 6, Nov
1976). It is used for exchanging keys. RC6, in answer c, is a fast block cipher designed by Rivest, Sidney and Yin. In RC6, the block size, the key size and the number of rounds are variable. The key size can be no larger than 2040 bits. RC6 was one of the five finalists in the Advanced
Encryption Standard (AES) competition.
NEW QUESTION # 153
Which of the following is NOT part of user provisioning?
- A. Creation and deactivation of user accounts
- B. Business process implementation
- C. Maintenance and deactivation of user objects and attributes
- D. Delegating user administration
Answer: B
Explanation:
User provisioning refers to the creation, maintenance, and deactivation of user objects and attributes as they exist in one or more systems, directories, or applications, in response to business processes. User provisioning software may include one or more of the following components: change
propagation, self-service workflow, consolidated user administration, delegated user
administration, and federated change control.
User objects may represent employees, contractors, vendors, partners, customers, or other
recipients of a service.
Services may include electronic mail, access to a database, access to a file server or mainframe,
and so on
The following answers are all incorrect answers:
Creation and deactivation of user accounts
Maintenance and deactivation of user objects and attributes
Delegating user administration
The following reference(s) were/was used to create this question:
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 179). McGraw-Hill .
Kindle Edition.
NEW QUESTION # 154
......
ISC CISSP Exam Dumps [2025] Practice Valid Exam Dumps Question: https://www.pass4suresvce.com/CISSP-pass4sure-vce-dumps.html
CISSP Dumps - Grab Out For [NEW-2025] ISC Exam: https://drive.google.com/open?id=1kUcjMhphAR_7wxf712z0_iK4-vJrBIib