最新的ISC Certification認證 CISSP考試題庫

問題1

The European Union (EU) General Data Protection Regulation (GDPR) requires organizations to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The Data Owner should therefore consider which of the following requirements?

A. Never to store personal data of EU citizens outside the EU

B. Anonymization of personal data when transmitted to sources outside the EU

C. Data masking and encryption of personal data

D. Only to use encryption protocols approved by EU

正確答案: C

說明：（僅 VCESoft 成員可見）

問題2

Which is the second phase of public key Infrastructure (pk1) key/certificate life-cycle management?

A. Initialization Phase

B. Cancellation Phase

C. Implementation phase

D. Issued Phase

正確答案: D

說明：（僅 VCESoft 成員可見）

問題3

The existence of physical barriers, card and personal identification number (PIN) access systems, cameras, alarms, and security guards BEST describes this security approach?

A. Security perimeter

B. Access control

C. Security information and event management (SIEM)

D. Defense-in-depth

正確答案: D

說明：（僅 VCESoft 成員可見）

問題4

The Chief Information Security Officer (CISO) is concerned about business application availability. The organization was recently subject to a ransomware attack that resulted in the unavailability of applications and services for 10 working days that required paper-based running of all main business processes. There are now aggressive plans to enhance the Recovery Time Objective (RTO) and cater for more frequent data captures. Which of the following solutions should be implemented to fully comply to the new business requirements?

A. Process isolation

B. Antivirus

C. Host-based intrusion prevention system (HIPS)

D. Virtualization

正確答案: D

說明：（僅 VCESoft 成員可見）

問題5

Which of the following is used to support the of defense in depth during development phase of a software product?

A. Maintenance

B. Polyinstantiation

C. Security auditing

D. Known vulnerability list

正確答案: B

說明：（僅 VCESoft 成員可見）

問題6

The Chief Information Security Officer (CISO) of an organization has requested that a Service Organization Control (SOC) report be created to outline the security and availability of a particular system over a 12-month period. Which type of SOC report should be utilized?

A. SOC 1 Type 1

B. SOC 2 Type 2

C. SOC 2 Type 2

D. SOC 3 Type 1

正確答案: B

說明：（僅 VCESoft 成員可見）

問題7

Which of the following BEST describes the purpose of "key stretching" techniques such as PBKDF2, bcrypt, or Argon2?

A. To generate longer encryption keys automatically

B. To deliberately increase the computational effort required to derive a key from a password, slowing down brute-force attacks

C. To compress cryptographic keys for storage efficiency

D. To synchronize encryption keys across distributed systems

正確答案: B

說明：（僅 VCESoft 成員可見）

問題8

Which of the following MUST a security professional do in order to quantify the value of a security program to organization management?

A. Rank priorities as high, medium, or low.

B. Communicate compliance obstacles.

C. Report en employee activities

D. Report using metrics.

正確答案: D

說明：（僅 VCESoft 成員可見）

問題9

Between which pair of Open System Interconnection (OSI) Reference Model layers are routers used as a communications device?

A. Data-Link and Transport

B. Transport and Session

C. Network and Session

D. Physical and Data-Link

正確答案: C

說明：（僅 VCESoft 成員可見）

最新的ISC Certified Information Systems Security Professional (CISSP) - CISSP免費考試真題

最新更新

站內鏈接

聯系我們