CISSP - Exam Practice/Study Questions
CISSP - Exam Practice/Study Questions
Containing 146 terms and Definitions
Updated 2023-2024
What is the most effective defense against cross-site scripting attacks?
a) Limiting account privileges
b) User Authentication
c) Input validation
d)encryption - Answer: c) Input validation prevents cross-site scripting attacks by
limiting user input to a predefined range. This prevents the attacker from including
the HTML ˂SCRIPT˃ tag in the input.
, CISSP - Exam Practice/Study Questions
What phase of the Electronic Discovery Reference Model puts evidence in a
format that may be shared with others?
a) production
b) processing
c) revice
d) presentation - Answer: a) Production places the information in a format that
may be shared with others.
What form of security planning is designed to focus on timeframes of
approximately one year and may include scheduling of tasks, assignment of
responsibilities, hiring plans, maintenance plans, and even acquisition plans?
a)strategic
b) operational
c) tactical
d)administrative - Answer: c.) tactical planning is designed to focus on timeframes
of approximately one year and may include scheduling of tasks, assignment of
responsibilities, hiring plans, maintenance plans, and even acquisition plans.
Which is not a part of an electronic access control lock?
A. An electromagnet
B. A credential reader
C. A door sensor
D. A biometric scanner - Answer: d -An electronic access control (EAC) lock
comprises three elements: an electromagnet to keep the door closed, a credential
, CISSP - Exam Practice/Study Questions
reader to authenticate subjects and to disable the electromagnet, and a door-
closed sensor to reenable the electromagnet.
Which one of the following items is a characteristic of hot sites but not a
characteristic of warm sites?
a.Communications circuits
B. Workstations
C. Servers
D. Current data - Answer: d- current data
Which one of the following Data Encryption Standard (DES) operating modes can
be used for large messages with the assurance that an error early in the
encryption/decryption process won't spoil results throughout the
communication?
A. Cipher Block Chaining (CBC)
B. Electronic Code Book (ECB)
C. Cipher Feedback (CFB)
D. Output feedback (OFB) - Answer: d -Output feedback (OFB) mode prevents
early errors from interfering with future encryption/decryption. Cipher Block
Chaining and Cipher Feedback modes will carry errors throughout the entire
encryption/decryption process. Electronic Code Book (ECB) operation is not
suitable for large amounts of data.
Which one of the following items is not a critical piece of information in the chain
of evidence?
, CISSP - Exam Practice/Study Questions
A. General description of the evidence
B. Name of the person collecting the evidence
C. Relationship of the evidence to the crime
D. Time and date the evidence was collected - Answer: c -The chain of evidence
does not require that the evidence collector know or document the relationship
of the evidence to the crime.
Which firewall type looks exclusively at the message header to determine whether
to transmit or drop data?
A. Static packet filtering
B. Application-level gateway
C. Stateful inspection
D. Dynamic packet filtering - Answer: a -A static packet-filtering firewall filters
traffic by examining data from a message header.
What type of information is used to form the basis of an expert system's decision-
making process?
A. A series of weighted layered computations
B. Combined input from a number of human experts, weighted according to past
performance
C. A series of "if/then" rules codified in a knowledge base
D. A biological decision-making process that simulates the reasoning process used
by the human mind - Answer: c -Expert systems use a knowledge base consisting
of a series of "if/then" statements to form decisions based on the previous
experience of human experts.
CISSP - Exam Practice/Study Questions
Containing 146 terms and Definitions
Updated 2023-2024
What is the most effective defense against cross-site scripting attacks?
a) Limiting account privileges
b) User Authentication
c) Input validation
d)encryption - Answer: c) Input validation prevents cross-site scripting attacks by
limiting user input to a predefined range. This prevents the attacker from including
the HTML ˂SCRIPT˃ tag in the input.
, CISSP - Exam Practice/Study Questions
What phase of the Electronic Discovery Reference Model puts evidence in a
format that may be shared with others?
a) production
b) processing
c) revice
d) presentation - Answer: a) Production places the information in a format that
may be shared with others.
What form of security planning is designed to focus on timeframes of
approximately one year and may include scheduling of tasks, assignment of
responsibilities, hiring plans, maintenance plans, and even acquisition plans?
a)strategic
b) operational
c) tactical
d)administrative - Answer: c.) tactical planning is designed to focus on timeframes
of approximately one year and may include scheduling of tasks, assignment of
responsibilities, hiring plans, maintenance plans, and even acquisition plans.
Which is not a part of an electronic access control lock?
A. An electromagnet
B. A credential reader
C. A door sensor
D. A biometric scanner - Answer: d -An electronic access control (EAC) lock
comprises three elements: an electromagnet to keep the door closed, a credential
, CISSP - Exam Practice/Study Questions
reader to authenticate subjects and to disable the electromagnet, and a door-
closed sensor to reenable the electromagnet.
Which one of the following items is a characteristic of hot sites but not a
characteristic of warm sites?
a.Communications circuits
B. Workstations
C. Servers
D. Current data - Answer: d- current data
Which one of the following Data Encryption Standard (DES) operating modes can
be used for large messages with the assurance that an error early in the
encryption/decryption process won't spoil results throughout the
communication?
A. Cipher Block Chaining (CBC)
B. Electronic Code Book (ECB)
C. Cipher Feedback (CFB)
D. Output feedback (OFB) - Answer: d -Output feedback (OFB) mode prevents
early errors from interfering with future encryption/decryption. Cipher Block
Chaining and Cipher Feedback modes will carry errors throughout the entire
encryption/decryption process. Electronic Code Book (ECB) operation is not
suitable for large amounts of data.
Which one of the following items is not a critical piece of information in the chain
of evidence?
, CISSP - Exam Practice/Study Questions
A. General description of the evidence
B. Name of the person collecting the evidence
C. Relationship of the evidence to the crime
D. Time and date the evidence was collected - Answer: c -The chain of evidence
does not require that the evidence collector know or document the relationship
of the evidence to the crime.
Which firewall type looks exclusively at the message header to determine whether
to transmit or drop data?
A. Static packet filtering
B. Application-level gateway
C. Stateful inspection
D. Dynamic packet filtering - Answer: a -A static packet-filtering firewall filters
traffic by examining data from a message header.
What type of information is used to form the basis of an expert system's decision-
making process?
A. A series of weighted layered computations
B. Combined input from a number of human experts, weighted according to past
performance
C. A series of "if/then" rules codified in a knowledge base
D. A biological decision-making process that simulates the reasoning process used
by the human mind - Answer: c -Expert systems use a knowledge base consisting
of a series of "if/then" statements to form decisions based on the previous
experience of human experts.
