CISSP CERT LIBRARY TOPIC 15 COMPLETE
STUDY GUIDE 2026 | PRACTICE QUESTIONS
& ANSWERS
| GRADED A+ | GUARANTEED SUCCESS
Updated 2026 Questions and Answers
100% Verified Exam Prep and Comprehensive
Rationales Included
,Alternate encoding such as hexadecimal representations Answer : D
is MOST often observed in which NEXT QUESTION
of the following forms of attack?
A. Smurf
B. Rootkit exploit
C. Denial of Service (DoS)
D. Cross site scripting (XSS)
An organization has hired a security services firm to Answer : A
conduct a penetration test. Which of NEXT QUESTION
the following will the organization provide to the tester?
A. Limits and scope of the testing.
B. Physical location of server room and wiring closet.
C. Logical location of filters and concentrators.
D. Employee directory and organizational chart.
What physical characteristic does a retinal scan biometric Answer : C
device measure? NEXT QUESTION
A. The amount of light reflected by the retina
B. The size, curvature, and shape of the retina
C. The pattern of blood vessels at the back of the eye
D. The pattern of light receptors at the back of the eye
p
g
p
y
Which of the following is the BEST countermeasure to Answer : D
brute force login attacks? NEXT QUESTION
A. Changing all canonical passwords
B. Decreasing the number of concurrent user sessions
C. Restricting initial password delivery only in person
D. Introducing a delay after failed system access attempts
Passive Infrared Sensors (PIR) used in a non-climate Answer : C
controlled environment should NEXT QUESTION
A. reduce the detected object temperature in relation to
the background temperature.
B. increase the detected object temperature in relation to
the background temperature.
C. automatically compensate for variance in background
temperature.
D. detect objects of a specific temperature independent
of the background temperature.
,How can lessons learned from business continuity Answer : A
training and actual recovery incidents
BEST be used?
A. As a means for improvement NEXT QUESTION
B. As alternative options for awareness and training
C. As indicators of a need for policy
D. As business function gap indicators
When designing a networked Information System (IS) Answer : B
where there will be several different NEXT QUESTION
types of individual access, what is the FIRST step that
should be taken to ensure all access
control requirements are addressed?
A. Create a user profile.
B. Create a user access matrix.
C. Develop an Access Control List (ACL).
D. Develop a Role Based Access Control (RBAC) list.
The three PRIMARY requirements for a penetration test Answer : A
are NEXT QUESTION
A. A defined goal, limited time period, and approval of
management
B. A general objective, unlimited time, and approval of the
network administrator
C. An objective statement, disclosed methodology, and
fixed cost
D. A stated objective, liability waiver, and disclosed
methodology
Which of the following are required components for Answer : C
implementing software configuration NEXT QUESTION
management systems?
A. Audit control and signoff
B. User training and acceptance
C. Rollback and recovery processes
D. Regression testing and evaluation
, An organization is selecting a service provider to assist in Answer : D
the consolidation of multiple NEXT QUESTION
computing sites including development, implementation
and ongoing support of various
p
g
g
p
,p
g g pp
computer systems. Which of the following MUST be
verified by the Information Security
Department?
A. The service provider's policies are consistent with
ISO/IEC27001 and there is evidence that the service
provider is following those policies.
B. The service provider will segregate the data within its
systems and ensure that each region's policies are met.
C. The service provider will impose controls and
protections that meet or exceed the current systems
controls and produce audit logs as verification.
D. The service provider's policies can meet the
requirements imposed by the new environment even if
they differ from the organization's current policies.
What is the FIRST step in developing a security test and Answer : C
its evaluation? NEXT QUESTION
A. Determine testing methods
B. Develop testing procedures
C. Identify all applicable security requirements
D. Identify people, processes, and products not in
compliance
Which of the following is the BEST reason to review audit Answer : C
logs periodically? NEXT QUESTION
A. Verify they are operating properly
B. Monitor employee productivity
C. Identify anomalies in use patterns
D. Meet compliance regulations
Which of the following is the BEST solution to provide Answer : D
redundancy for telecommunications NEXT QUESTION
links?
A. Provide multiple links from the same
telecommunications vendor.
B. Ensure that the telecommunications links connect to
the network in one location.
C. Ensure that the telecommunications links connect to
the network in multiple locations.
D. Provide multiple links from multiple
telecommunications vendors.
STUDY GUIDE 2026 | PRACTICE QUESTIONS
& ANSWERS
| GRADED A+ | GUARANTEED SUCCESS
Updated 2026 Questions and Answers
100% Verified Exam Prep and Comprehensive
Rationales Included
,Alternate encoding such as hexadecimal representations Answer : D
is MOST often observed in which NEXT QUESTION
of the following forms of attack?
A. Smurf
B. Rootkit exploit
C. Denial of Service (DoS)
D. Cross site scripting (XSS)
An organization has hired a security services firm to Answer : A
conduct a penetration test. Which of NEXT QUESTION
the following will the organization provide to the tester?
A. Limits and scope of the testing.
B. Physical location of server room and wiring closet.
C. Logical location of filters and concentrators.
D. Employee directory and organizational chart.
What physical characteristic does a retinal scan biometric Answer : C
device measure? NEXT QUESTION
A. The amount of light reflected by the retina
B. The size, curvature, and shape of the retina
C. The pattern of blood vessels at the back of the eye
D. The pattern of light receptors at the back of the eye
p
g
p
y
Which of the following is the BEST countermeasure to Answer : D
brute force login attacks? NEXT QUESTION
A. Changing all canonical passwords
B. Decreasing the number of concurrent user sessions
C. Restricting initial password delivery only in person
D. Introducing a delay after failed system access attempts
Passive Infrared Sensors (PIR) used in a non-climate Answer : C
controlled environment should NEXT QUESTION
A. reduce the detected object temperature in relation to
the background temperature.
B. increase the detected object temperature in relation to
the background temperature.
C. automatically compensate for variance in background
temperature.
D. detect objects of a specific temperature independent
of the background temperature.
,How can lessons learned from business continuity Answer : A
training and actual recovery incidents
BEST be used?
A. As a means for improvement NEXT QUESTION
B. As alternative options for awareness and training
C. As indicators of a need for policy
D. As business function gap indicators
When designing a networked Information System (IS) Answer : B
where there will be several different NEXT QUESTION
types of individual access, what is the FIRST step that
should be taken to ensure all access
control requirements are addressed?
A. Create a user profile.
B. Create a user access matrix.
C. Develop an Access Control List (ACL).
D. Develop a Role Based Access Control (RBAC) list.
The three PRIMARY requirements for a penetration test Answer : A
are NEXT QUESTION
A. A defined goal, limited time period, and approval of
management
B. A general objective, unlimited time, and approval of the
network administrator
C. An objective statement, disclosed methodology, and
fixed cost
D. A stated objective, liability waiver, and disclosed
methodology
Which of the following are required components for Answer : C
implementing software configuration NEXT QUESTION
management systems?
A. Audit control and signoff
B. User training and acceptance
C. Rollback and recovery processes
D. Regression testing and evaluation
, An organization is selecting a service provider to assist in Answer : D
the consolidation of multiple NEXT QUESTION
computing sites including development, implementation
and ongoing support of various
p
g
g
p
,p
g g pp
computer systems. Which of the following MUST be
verified by the Information Security
Department?
A. The service provider's policies are consistent with
ISO/IEC27001 and there is evidence that the service
provider is following those policies.
B. The service provider will segregate the data within its
systems and ensure that each region's policies are met.
C. The service provider will impose controls and
protections that meet or exceed the current systems
controls and produce audit logs as verification.
D. The service provider's policies can meet the
requirements imposed by the new environment even if
they differ from the organization's current policies.
What is the FIRST step in developing a security test and Answer : C
its evaluation? NEXT QUESTION
A. Determine testing methods
B. Develop testing procedures
C. Identify all applicable security requirements
D. Identify people, processes, and products not in
compliance
Which of the following is the BEST reason to review audit Answer : C
logs periodically? NEXT QUESTION
A. Verify they are operating properly
B. Monitor employee productivity
C. Identify anomalies in use patterns
D. Meet compliance regulations
Which of the following is the BEST solution to provide Answer : D
redundancy for telecommunications NEXT QUESTION
links?
A. Provide multiple links from the same
telecommunications vendor.
B. Ensure that the telecommunications links connect to
the network in one location.
C. Ensure that the telecommunications links connect to
the network in multiple locations.
D. Provide multiple links from multiple
telecommunications vendors.
