Free ISC CISSP-ISSMP Exam Dumps Questions & Answers

Which of the following is the BEST approach when a critical vulnerability is identified in a legacy system that cannot be patched due to vendor end-of-life status?

• A.  Accept the risk without documentation
• B.  Ignore the vulnerability since patching isn't possible
• C.  Implement compensating controls (e.g., network segmentation, enhanced monitoring) and develop a risk-based remediation/replacement plan
• D.  Immediately decommission the system without business consultation

Which of the following SDLC phases consists of the given security controls.
Misuse Case Modeling
Security Design and Architecture Review
Threat and Risk Modeling
Security Requirements and Test Cases Generation

• A.  Maintenance
• B.  Requirements Gathering
• C.  Deployment
• D.  Design

Which of the following types of activities can be audited for security? Each correct answer represents a complete solution. Choose three.

• A.  Printer access
• B.  Network logons and logoffs
• C.  File and object access
• D.  Data downloading from the Internet

Which of the following BEST describes the purpose of "alternate work-site strategies" (e.g., remote work) as part of business continuity for personnel disruptions (e.g., pandemic)?

• A.  Ensuring staff can continue critical functions remotely when a facility is inaccessible or a health crisis prevents on-site work
• B.  Alternate work-site strategies eliminate the need for DR planning
• C.  Remote work strategies are irrelevant to BCP
• D.  Alternate work-site planning applies only to IT disruptions, not personnel

Which of the following is the PRIMARY reason to conduct a lessons-learned session after a disaster recovery test, even if the test was "successful"?

• A.  To reduce the frequency of future testing
• B.  To satisfy insurance requirements only
• C.  To assign blame for any delays
• D.  To identify gaps and opportunities for improvement even in successful outcomes