Mike Chapple - (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests

84 Helen is the owner of a U.S. website that provides information for middle and high school students preparing for exams. She is writing the site's privacy policy and would like to ensure that it complies with the provisions of the Children's Online Privacy Protection Act (COPPA). What is the cutoff age below which parents must give consent in advance of the collection of personal information from their children under COPPA?13151718

85 Tom is considering locating a business in the downtown area of Miami, Florida. He consults the FEMA flood plain map for the region, shown here, and determines that the area he is considering lies within a 100-year flood plain. What is the ARO of a flood in this area?1001 0.10.01

86 You discover that a user on your network has been using the Wireshark tool, as shown here. Further investigation revealed that he was using it for illicit purposes. What pillar of information security has most likely been violated?IntegrityDenialAvailabilityConfidentiality

87 Alan is performing threat modeling and decides that it would be useful to decompose the system into the core elements shown here. What tool is he using?Vulnerability assessmentFuzzingReduction analysisData modeling

88 Craig is selecting the site for a new data center and must choose a location somewhere within the United States. He obtained the earthquake risk map shown here from the United States Geological Survey. Which of the following would be the safest location to build his facility if he were primarily concerned with earthquake risk?New YorkNorth CarolinaIndianaFlorida

89 Which type of business impact assessment tool is most appropriate when attempting to evaluate the impact of a failure on customer confidence?QuantitativeQualitativeAnnualized loss expectancyReduction

90 Ryan is a security risk analyst for an insurance company. He is currently examining a scenario in which a malicious hacker might use a SQL injection attack to deface a web server due to a missing patch in the company's web application. In this scenario, what is the threat?Unpatched web applicationWeb defacement Malicious hackerOperating systemFor questions 91–93, please refer to the following scenario:Henry is the risk manager for Atwood Landing, a resort community in the midwestern United States. The resort's main data center is located in northern Indiana in an area that is prone to tornados. Henry recently undertook a replacement cost analysis and determined that rebuilding and reconfiguring the data center would cost $10 million.Henry consulted with tornado experts, data center specialists, and structural engineers. Together, they determined that a typical tornado would cause approximately $5 million of damage to the facility. The meteorologists determined that Atwood's facility lies in an area where they are likely to experience a tornado once every 200 years.

91 Based upon the information in this scenario, what is the exposure factor for the effect of a tornado on Atwood Landing's data center?10 percent25 percent50 percent75 percent

92 Based upon the information in this scenario, what is the annualized rate of occurrence for a tornado at Atwood Landing's data center?0.00250.0050.010.015

93 Based upon the information in this scenario, what is the annualized loss expectancy for a tornado at Atwood Landing's data center?$25,000$50,000$250,000$500,000

94 John is analyzing an attack against his company in which the attacker found comments embedded in HTML code that provided the clues needed to exploit a software vulnerability. Using the STRIDE model, what type of attack did he uncover?SpoofingRepudiationInformation disclosureElevation of privilege

95 Chris is worried that the laptops that his organization has recently acquired were modified by a third party to include keyloggers before they were delivered. Where should he focus his efforts to prevent this?His supply chainHis vendor contractsHis post-purchase build processThe original equipment manufacturer (OEM)

96 In her role as a developer for an online bank, Lisa is required to submit her code for testing and review. After it passes through this process and it is approved, another employee moves the code to the production environment. What security management does this process describe?Regression testingCode reviewChange managementFuzz testing

97 After completing the first year of his security awareness program, Charles reviews the data about how many staff completed training compared to how many were assigned the training to determine whether he hit the 95 percent completion rate he was aiming for. What is this type of measure called?A KPIA metricAn awareness controlA return on investment rate

98 Which of the following is not typically included in a prehire screening process?A drug testA background checkSocial media reviewFitness evaluation

99 Which of the following would normally be considered a supply chain risk? (Select all that apply.)Adversary tampering with hardware prior while being shipped to the end customerAdversary hacking into a web server run by the organization in an IaaS environmentAdversary using social engineering to compromise an employee of a SaaS vendor to gain access to customer accountsAdversary conducting a denial-of-service attack using a botnet

100 Match the following numbered laws or industry standards to their lettered description:Laws and industry standardsGLBAPCI DSSHIPAASOXDescriptionsA U.S. law that requires covered financial institutions to provide their customers with a privacy notice on a yearly basisA U.S. law that requires internal controls assessments, including IT transaction flows for publicly traded companiesAn industry standard that covers organizations that handle credit cardsA U.S. law that provides data privacy and security requirements for medical information

SUBDOMAINS:

2.1 Identify and classify information and assets

2.2 Establish information and asset handling requirements

2.3 Provision resources securely

2.4 Manage data lifecycle

2.5 Ensure appropriate asset retention (e.g. End-of-Life (EOL), End-of-Support (EOS))

2.6 Determine data security controls and compliance requirements

1 Angela is an information security architect at a bank and has been assigned to ensure that transactions are secure as they traverse the network. She recommends that all transactions use TLS. What threat is she most likely attempting to stop, and what method is she most likely using to protect against it?Man-in-the-middle, VPNPacket injection, encryptionSniffing, encryptionSniffing, TEMPEST

2 Control Objectives for Information and Related Technology (COBIT) is a framework for information technology (IT) management and governance. Which data management role is most likely to select and apply COBIT to balance the need for security controls against business requirements?Business ownersData processorsData ownersData stewards

3 Nadia's company is operating a hybrid cloud environment with some on-site systems and some cloud-based systems. She has satisfactory monitoring on-site, but needs to apply security policies to both the activities her users engage in and to report on exceptions with her growing number of cloud services. What type of tool is best suited to this purpose?A NGFWA CASBAn IDSA SOAR

4 When media is labeled based on the classification of the data it contains, what rule is typically applied regarding labels?The data is labeled based on its integrity requirements.The media is labeled based on the highest classification level of the data it contains.The media is labeled with all levels of classification of the data it contains.The media is labeled with the lowest level of classification of the data it contains.

5 Which one of the following administrative processes assists organizations in assigning appropriate levels of security control to sensitive information?Data classificationRemanenceTransmitting dataClearing