How to pass ISC2 ISSMP exam with the help of dumps?

Question # 1

Which of the following is a process that identifies critical information to determine if friendly actions can be observed by adversary intelligence systems? 

A. IDS  
B. OPSEC  
C. HIDS  
D. NIDS  

Show Answer

Question # 2

An organization monitors the hard disks of its employees' computers from time to time. Which policy does this pertain to?

A. Network security policy  
B. Backup policy  
C. Privacy policy  
D. User password policy  

Show Answer

Question # 3

Which of the following is a name, symbol, or slogan with which a product is identified?  

A. Copyright  
B. Trademark  
C. Trade secret  
D. Patent  

Show Answer

Question # 4

Which of the following roles is responsible for review and risk analysis of all contracts on a regular basis? 

A. The Configuration Manager  
B. The Supplier Manager  
C. The Service Catalogue Manager  
D. The IT Service Continuity Manager  

Show Answer

Question # 5

Which of the following sites are similar to the hot site facilities, with the exception that they are completely dedicated, self-developed recovery facilities?

A. Cold sites  
B. Orange sites  
C. Warm sites  
D. Duplicate processing facilities

Show Answer

Question # 6

Which of the following is a variant with regard to Configuration Management?  

A. A CI that has the same name as another CI but shares no relationship.  
B. A CI that particularly refers to a hardware specification.  
C. A CI that has the same essential functionality as another CI but a bit different in some small manner.
D. A CI that particularly refers to a software version.  

Show Answer

Question # 7

Mark works as a security manager for SoftTech Inc. He is performing a security awareness program. To be successful in performing the awareness program, he should take into account the needs and current levels of training and understanding of the employees and audience. There are five key ways, which Mark should keep in mind while performing this activity. Current level of computer usage What the audience really wants to learn How receptive the audience is to the security program How to gain acceptance Who might be a possible ally Which of the following activities is performed in this security awareness process? 

A. Separation of duties  
B. Stunned owl syndrome  
C. Audience participation  
D. Audience segmentation  

Show Answer

Question # 8

Sarah has created a site on which she publishes a copyrighted material. She is ignorant that she is infringing copyright. Is she guilty under copyright laws?

A. No  
B. Yes  

Show Answer

Question # 9

Which of the following types of evidence is considered as the best evidence?  

A. A copy of the original document  
B. Information gathered through the witness's senses  
C. The original document  
D. A computer-generated record

Show Answer

Question # 10

Which of the following subphases are defined in the maintenance phase of the life cycle models?

A. Change control  
B. Configuration control  
C. Request control  
D. Release control  

Show Answer

Question # 11

Which of the following relies on a physical characteristic of the user to verify his identity?  

A. Social Engineering  
B. Kerberos v5  
C. Biometrics  
D. CHAP  

Show Answer

Question # 12

Which of the following is NOT a valid maturity level of the Software Capability Maturity Model (CMM)?

A. Managed level  
B. Defined level  
C. Fundamental level  
D. Repeatable level  

Show Answer

Question # 13

Which of the following policies helps reduce the potential damage from the actions of one person? 

A. CSA  
B. Risk assessment  
C. Separation of duties  
D. Internal audit  

Show Answer

Question # 14

You are the Network Administrator for a college. You watch a large number of people (some not even students) going in and out of areas with campus computers (libraries, computer labs, etc.). You have had a problem with laptops being stolen. What is the most cost effective method to prevent this?

A. Video surveillance on all areas with computers.  
B. Use laptop locks.  
C. Appoint a security guard.  
D. Smart card access to all areas with computers.  

Show Answer

Question # 15

Part of your change management plan details what should happen in the change control system for your project. Theresa, a junior project manager, asks what the configuration management activities are for scope changes. You tell her that all of the following are valid configuration management activities except for which one?

A. Configuration Verification and Auditing  
B. Configuration Item Costing  
C. Configuration Identification  
D. Configuration Status Accounting

Show Answer

Question # 16

Which of the following is a formula, practice, process, design, instrument, pattern, or compilation of information which is not generally known, but by which a business can obtain an economic advantage over its competitors?

A. Utility model  
B. Cookie  
C. Copyright  
D. Trade secret  

Show Answer

Question # 17

Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?

A. Safeguard  
B. Single Loss Expectancy (SLE)  
C. Exposure Factor (EF)  
D. Annualized Rate of Occurrence (ARO)  

Show Answer

Question # 18

Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?

A. Safeguard  
B. Single Loss Expectancy (SLE)  
C. Exposure Factor (EF)  
D. Annualized Rate of Occurrence (ARO)  

Show Answer

Question # 19

Which of the following statements about system hardening are true? Each correct answer represents a complete solution. Choose two. 

A. It can be achieved by installing service packs and security updates on a regular basis.  
B. It is used for securing the computer hardware.  
C. It can be achieved by locking the computer room.  
D. It is used for securing an operating system.  

Show Answer

Question # 20

Which of the following types of cyber stalking damage the reputation of their victim and turn other people against them by setting up their own Websites, blogs or user pages for this purpose?

A. Encouraging others to harass the victim
B. False accusations  
C. Attempts to gather information about the victim  
D. False victimization  

Show Answer

Question # 21

How can you calculate the Annualized Loss Expectancy (ALE) that may occur due to a threat?

A. Single Loss Expectancy (SLE)/ Exposure Factor (EF)  
B. Asset Value X Exposure Factor (EF)  
C. Exposure Factor (EF)/Single Loss Expectancy (SLE)  
D. Single Loss Expectancy (SLE) X Annualized Rate of Occurrence (ARO)  

Show Answer

Question # 22

Which of the following processes is described in the statement below? "It is the process of implementing risk response plans, tracking identified risks, monitoring residual risk, identifying new risks, and evaluating risk process effectiveness throughout the project." 

A. Monitor and Control Risks  
B. Identify Risks  
C. Perform Qualitative Risk Analysis  
D. Perform Quantitative Risk Analysis  

Show Answer

Question # 23

Which of the following attacks can be mitigated by providing proper training to the employees in an organization? 

A. Social engineering  
B. Smurf  
C. Denial-of-Service  
D. Man-in-the-middle  

Show Answer

Question # 24

Which of the following are the types of access controls? Each correct answer represents a complete solution. Choose three.

A. Administrative  
B. Automatic  
C. Physical  
D. Technical  

Show Answer

Question # 25

Peter works as a Computer Hacking Forensic Investigator. He has been called by an organization to conduct a seminar to give necessary information related to sexual harassment within the work place. Peter started with the definition and types of sexual harassment. He then wants to convey that it is important that records of the sexual harassment incidents should be maintained, which helps in further legal prosecution. Which of the following data should be recorded in this documentation? Each correct answer represents a complete solution. Choose all that apply. 

A. Names of the victims  
B. Location of each incident  
C. Nature of harassment  
D. Date and time of incident  

Show Answer

Question # 26

John works as a security manager for Soft Tech Inc. He is working with his team on the disaster recovery management plan. One of his team members has a doubt related to the most cost effective DRP testing plan. According to you, which of the following disaster recovery testing plans is the most cost-effective and efficient way to identify areas of overlap in the plan before conducting more demanding training exercises?

A. Full-scale exercise  
B. Walk-through drill  
C. Evacuation drill  
D. Structured walk-through test

Show Answer

Question # 27

Which of the following statements are true about a hot site? Each correct answer  represents a complete solution. Choose all that apply.

A. It can be used within an hour for data recovery.  
B. It is cheaper than a cold site but more expensive than a worm site.  
C. It is the most inexpensive backup site.  
D. It is a duplicate of the original site of the organization, with full computer systems as well as near-complete backups of user data.

Show Answer

Question # 28

Which of the following penetration testing phases involves reconnaissance or data gathering? 

A. Attack phase  
B. Pre-attack phase  
C. Post-attack phase  
D. Out-attack phase  

Show Answer

Question # 29

Which of the following BCP teams provides clerical support to the other teams and serves as a message center for the user-recovery site?

A. Security team  
B. Data preparation and records team  
C. Administrative support team  
D. Emergency operations team  

Show Answer

Question # 30

Which of the following tools works by using standard set of MS-DOS commands and can create an MD5 hash of an entire drive, partition, or selected files?

A. Device Seizure  
B. Ontrack  
C. DriveSpy  
D. Forensic Sorter  

Show Answer

Question # 31

Eric is the project manager of the NQQ Project and has hired the ZAS Corporation to complete part of the project work for Eric's organization. Due to a change request the ZAS Corporation is no longer needed on the project even though they have completed nearly all of the project work. Is Eric's organization liable to pay the ZAS Corporation for the work they have completed so far on the project? 

A. Yes, the ZAS Corporation did not choose to terminate the contract work.  
B. It depends on what the outcome of a lawsuit will determine.  
C. It depends on what the termination clause of the contract stipulates.  
D. No, the ZAS Corporation did not complete all of the work.  

Show Answer

Question # 32

Which of the following statements is true about auditing?  

A. It is used to protect the network against virus attacks.  
B. It is used to track user accounts for file and object access, logon attempts, etc.  
C. It is used to secure the network or the computers on the network.  
D. It is used to prevent unauthorized access to network resources.  

Show Answer

Question # 33

In which of the following SDLC phases is the system's security features configured and enabled, the system is tested and installed or fielded, and the system is authorized for processing?

A. Initiation Phase  
B. Development/Acquisition Phase  
C. Implementation Phase  
D. Operation/Maintenance Phase

Show Answer

Question # 34

A. FTP  

B. IPX/SPX  
C. IPSec  
D. EAP  

Show Answer

Question # 35

Which of the following contract types is described in the statement below? "This contract type provides no incentive for the contractor to control costs and hence is rarely utilized."

A. Cost Plus Fixed Fee  
B. Cost Plus Percentage of Cost  
C. Cost Plus Incentive Fee  
D. Cost Plus Award Fee  

Show Answer

Question # 36

Which of the following steps are generally followed in computer forensic examinations? Each correct answer represents a complete solution. Choose three. 

A. Acquire  
B. Analyze  
C. Authenticate  
D. Encrypt  

Show Answer

Question # 37

Which of the following steps is the initial step in developing an information security strategy?

A. Perform a technical vulnerabilities assessment.  
B. Assess the current levels of security awareness.  
C. Perform a business impact analysis.  
D. Analyze the current business strategy.  

Show Answer

Question # 38

You are the program manager for your project. You are working with the project managers regarding the procurement processes for their projects. You have ruled out one particular contract type because it is considered too risky for the program. Which one of the following contract types is usually considered to be the most dangerous for the buyer? 

A. Cost plus incentive fee  
B. Fixed fee  
C. Cost plus percentage of costs  
D. Time and materials  

Show Answer

Question # 39

Which of the following SDLC phases consists of the given security controls. Misuse Case Modeling Security Design and Architecture Review Threat and Risk Modeling Security Requirements and Test Cases Generation

A. Design  
B. Maintenance  
C. Deployment  
D. Requirements Gathering  

Show Answer

Question # 40

Which of the following processes is used by remote users to make a secure connection to internal resources after establishing an Internet connection?

A. Packet filtering  
B. Tunneling  
C. Packet sniffing  
D. Spoofing  

Show Answer

Question # 41

Which of the following fields of management focuses on establishing and maintaining consistency of a system's or product's performance and its functional and physical attributes with its requirements, design, and operational information throughout its life?

A. Configuration management  
B. Risk management  
C. Procurement management  
D. Change management  

Show Answer

Question # 42

What component of the change management system is responsible for evaluating, testing, and documenting changes created to the project scope? 

A. Scope Verification  
B. Project Management Information System  
C. Integrated Change Control  
D. Configuraton Management System

Show Answer

Question # 43

In which of the following mechanisms does an authority, within limitations, specify what objects can be accessed by a subject?

A. Role-Based Access Control  
B. Discretionary Access Control  
C. Task-based Access Control  
D. Mandatory Access Control  

Show Answer

Question # 44

What are the purposes of audit records on an information system? Each correct answer represents a complete solution. Choose two. 

A. Troubleshooting  
B. Investigation  
C. Upgradation  
D. Backup  

Show Answer