Ucertify cissp exam Questions are updated and all cissp forum answers are verified by experts. Once you have completely prepared with our cissp full form exam prep kits you will be ready for the real cissp verification exam without a problem. We have Improve ISC2 cissp certification cost dumps study guide. PASSED cissp exam fee First attempt! Here What I Did.


♥♥ 2021 NEW RECOMMEND ♥♥

Free VCE & PDF File for ISC2 CISSP Real Exam (Full Version!)

★ Pass on Your First TRY ★ 100% Money Back Guarantee ★ Realistic Practice Exam Questions

Free Instant Download NEW CISSP Exam Dumps (PDF & VCE):
Available on: http://www.surepassexam.com/CISSP-exam-dumps.html

Q201. The PRIMARY purpose of a security awareness program is to 

A. ensure that everyone understands the organization's policies and procedures. 

B. communicate that access to information will be granted on a need-to-know basis. 

C. warn all users that access to all systems will be monitored on a daily basis. 

D. comply with regulations related to data and information protection. 

Answer: A 


Q202. The use of proximity card to gain access to a building is an example of what type of security control? 

A. Legal 

B. Logical 

C. Physical 

D. Procedural 

Answer: C 


Q203. For a service provider, which of the following MOST effectively addresses confidentiality concerns for customers using cloud computing? 

A. Hash functions 

B. Data segregation 

C. File system permissions 

D. Non-repudiation controls 

Answer: B 


Q204. Refer.to the information below to answer the question. 

A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee's access. 

Which of the following solutions would have MOST likely detected the use of peer-to-peer programs when the computer was connected to the office network? 

A. Anti-virus software 

B. Intrusion Prevention System (IPS) 

C. Anti-spyware software 

D. Integrity checking software 

Answer: B 


Q205. A system has been scanned for vulnerabilities and has been found to contain a number of communication ports that have been opened without authority. To which of the following might this system have been subjected? 

A. Trojan horse 

B. Denial of Service (DoS) 

C. Spoofing 

D. Man-in-the-Middle (MITM) 

Answer: A 


Q206. When dealing with compliance with the Payment Card Industry-Data Security Standard (PCI-DSS), an organization that shares card holder information with a service provider MUST do which of the following? 

A. Perform a service provider PCI-DSS assessment on a yearly basis. 

B. Validate.the service provider's PCI-DSS compliance status on a regular basis. 

C. Validate.that the service providers security policies are in alignment with those.of the organization. 

D. Ensure that the service provider.updates and tests its Disaster Recovery Plan (DRP).on a yearly basis. 

Answer: B 


Q207. Which of the following is an essential step before performing Structured Query Language (SQL) penetration tests on a production system? 

A. Verify countermeasures have been deactivated. 

B. Ensure firewall logging has been activated. 

C. Validate target systems have been backed up. 

D. Confirm warm site is ready to accept connections. 

Answer: C 


Q208. Two companies wish to share electronic inventory and purchase orders in a supplier and client relationship. What is the BEST security solution for them? 

A. Write a Service Level Agreement (SLA) for the two companies. 

B. Set up a Virtual Private Network (VPN) between the two companies. 

C. Configure a firewall at the perimeter of each of the two companies. 

D. Establish a File Transfer Protocol (FTP) connection between the two companies. 

Answer: B 


Q209. Host-Based Intrusion Protection (HIPS) systems are often deployed in monitoring or learning mode during their initial implementation. What is the objective of starting in this mode? 

A. Automatically create exceptions for specific actions or files 

B. Determine which files are unsafe to access and blacklist them 

C. Automatically whitelist actions or files known to the system 

D. Build a baseline of normal or safe system events for review 

Answer: D 


Q210. During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant. 

What is the best approach for the CISO? 

During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant. 

What is the best approach for the CISO? 

A. Document the system as high risk 

B. Perform a vulnerability assessment 

C. Perform a quantitative threat assessment 

D. Notate the information and move on 

Answer: B