Full CISSP-ISSMP Practice Test and 447 unique questions with explanations waiting just for you!
CISSP Concentrations Dumps CISSP-ISSMP Exam for Full Questions - Exam Study Guide
NEW QUESTION # 61
Which of the following BEST describes why an organization should maintain a documented
"incident response playbook" for specific threat scenarios (e.g., ransomware, business email compromise)?
- A. Generic incident response plans are always sufficient for every scenario
- B. Scenario-specific playbooks provide detailed, pre-defined action steps tailored to common attack types, improving response speed and consistency
- C. Playbooks eliminate the need for analyst judgment entirely
- D. Playbooks are only useful for compliance audits, not actual response
Answer: B
Explanation:
While a general IR plan covers overall process, scenario-specific playbooks (e.g., for ransomware, BEC, DDoS) provide detailed technical and procedural steps tailored to that threat type, enabling faster, more consistent response.
NEW QUESTION # 62
Eric is the project manager of the NQQ Project and has hired the ZAS Corporation to complete part of the project work for Eric's organization.
Due to a change request the ZAS Corporation is no longer needed on the project even though they have completed nearly all of the project work. Is Eric's organization liable to pay the ZAS Corporation for the work they have completed so far on the project?
- A. It depends on what the outcome of a lawsuit will determine.
- B. Yes, the ZAS Corporation did not choose to terminate the contract work.
- C. No, the ZAS Corporation did not complete all of the work.
- D. It depends on what the termination clause of the contract stipulates.
Answer: D
Explanation:
To make a payment or not to make it depends on what the termination clause of the contract stipulates.
Answer option D is incorrect. The termination clause of the contract is the best input for this decision.
Answer option A is incorrect. While the ZAS Corporation did not choose to terminate the contract work the contract terms may stipulate other terms for early termination. Answer option B is incorrect. There's no indication of a lawsuit yet.
Reference: Chapter 12. A Guide to the Project Management Body of Knowledge, (PMBOK Guide), Fourth Edition, ISBN:9781933890517, Section 12.4.
NEW QUESTION # 63
You are advising a school district on disaster recovery plans. In case a disaster affects the main IT centers for the district they will need to be able to work from an alternate location. However, budget is an issue. Which of the following is most appropriate for this client?
- A. Cold site
- B. Off site
- C. Hot site
- D. Warm site
Answer: A
NEW QUESTION # 64
James works as a security manager for SoftTech Inc. He has been working on the continuous process improvement and on the ordinal scale for measuring the maturity of the organization involved in the software processes. According to James, which of the following maturity levels of software CMM focuses on the continuous process improvement?
- A. Optimizing level
- B. Defined level
- C. Initiating level
- D. Repeatable level
Answer: A
Explanation:
The optimizing level of the software CMM focuses on the continuous process improvement.
The maturity levels of CMM are as follows:
1.Initiating level: At this level, processes are performed on an ad hoc basis. 2.Repeatable level:
At this level, project management practices are institutionalized. 3.Defined level: At this level, technical practices are integrated with management practices institutionalized.
4.Managed level: At this level, product and process are quantitatively controlled. 5.Optimizing level: At this level, process improvement is institutionalized.
NEW QUESTION # 65
Which of the following elements of BCP process includes the areas of plan implementation, plan testing, and ongoing plan maintenance, and also involves defining and documenting the continuity strategy?
- A. Plan approval and implementation
- B. Business impact assessment
- C. Scope and plan initiation
- D. Business continuity plan development
Answer: D
NEW QUESTION # 66
Which of the following BEST describes "threat modeling"?
- A. A method for calculating employee performance
- B. A physical security patrol schedule
- C. A financial forecasting technique
- D. A structured process of identifying, analyzing, and prioritizing potential threats to a system during design
Answer: D
Explanation:
Threat modeling (e.g., STRIDE, DREAD) is used early in system design to systematically identify potential threats, attack vectors, and countermeasures before implementation.
NEW QUESTION # 67
You work as the Network Administrator for a defense contractor. Your company works with sensitive materials and all IT personnel have at least a secret level clearance. You are still concerned that one individual could perhaps compromise the network (intentionally or unintentionally) by setting up improper or unauthorized remote access. What is the best way to avoid this problem?
- A. Implement RBAC.
- B. Implement separation of duties.
- C. Implement three way authentication.
- D. Implement least privileges.
Answer: B
NEW QUESTION # 68
Which of the following BEST describes the value of involving "Human Resources" in contingency planning, beyond payroll continuity?
- A. HR involvement is only relevant for IT-related incidents
- B. HR supports personnel notification, emergency contact management, employee assistance, and staffing contingency plans during a disruptive event
- C. HR's role is limited strictly to post-event disciplinary actions
- D. HR has no meaningful role in contingency planning
Answer: B
NEW QUESTION # 69
Which of the following penetration testing phases involves reconnaissance or data gathering?
- A. Post-attack phase
- B. Attack phase
- C. Pre-attack phase
- D. Out-attack phase
Answer: C
NEW QUESTION # 70
Which of the following are the process steps of OPSEC? Each correct answer represents a part of the solution. Choose all that apply.
- A. Analysis of Vulnerabilities
- B. Display of associated vulnerability components
- C. Identification of Critical Information
- D. Assessment of Risk
Answer: A,C,D
NEW QUESTION # 71
During contract negotiation with a cloud service provider, which clause is MOST important for ensuring the organization can retrieve its data upon contract termination?
- A. Force majeure clause
- B. Non-compete clause
- C. Indemnification clause
- D. Data portability / exit clause
Answer: D
Explanation:
An exit/data portability clause ensures the organization can retrieve or transfer its data in a usable format when the relationship ends, preventing vendor lock-in or data loss.
NEW QUESTION # 72
Which of the following is the process performed between organizations that have unique hardware or software that cannot be maintained at a hot or warm site?
- A. Duplicate processing facilities
- B. Cold sites arrangement
- C. Business impact analysis
- D. Reciprocal agreements
Answer: D
NEW QUESTION # 73
James works as a security manager for SoftTech Inc. He has been working on the continuous process improvement and on the ordinal scale for measuring the maturity of the organization involved in the software processes. According to James, which of the following maturity levels of software CMM focuses on the continuous process improvement?
- A. Optimizing level
- B. Defined level
- C. Initiating level
- D. Repeatable level
Answer: A
Explanation:
Explanation/Reference:
NEW QUESTION # 74
Which of the following BEST describes why "data minimization" is a key privacy principle relevant to security risk reduction?
- A. Data minimization increases breach risk
- B. Collecting and retaining only data necessary for a specific purpose reduces the potential impact of a breach and simplifies compliance
- C. Collecting maximum data always improves security
- D. Data minimization applies only to biometric data
Answer: B
Explanation:
The less unnecessary personal/sensitive data an organization holds, the smaller the potential impact if a breach occurs, and the simpler compliance with retention and access requirements becomes.
NEW QUESTION # 75
Which of the following BCP teams provides clerical support to the other teams and serves as a message center for the user-recovery site?
- A. Emergency operations team
- B. Administrative support team
- C. Data preparation and records team
- D. Security team
Answer: B
NEW QUESTION # 76
......
Authentic Best resources for CISSP-ISSMP Online Practice Exam: https://www.easy4engine.com/CISSP-ISSMP-test-engine.html
