[Q20-Q40] Try 100% Updated CISMP-V9 Exam Questions [2023]

07Jan 2023 by admin No Comments

4.5/5 - (2 votes)

Try 100% Updated CISMP-V9 Exam Questions [2023]

Pass CISMP-V9 Exam – Real Questions and Answers

NEW QUESTION 20
As well as being permitted to access, create, modify and delete information, what right does an Information Owner NORMALLY have in regard to their information?

To assign access privileges to others.

To modify associated information that may lead to inappropriate disclosure.

To access information held in the same format and file structure.

To delete all indexed data in the dataset.

NEW QUESTION 21
Why should a loading bay NEVER be used as a staff entrance?

Loading bays are intrinsically vulnerable, so minimising the people traffic makes securing the areas easier and more effective.

Loading bays are often dirty places, and staff could find their clothing damaged or made less appropriate for the office.

Most countries have specific legislation covering loading bays and breaching this could impact on insurance status.

Staff should always enter a facility via a dedicated entrance to ensure smooth access and egress.

NEW QUESTION 22
Which of the following is NOT an information security specific vulnerability?

Use of HTTP based Apache web server.

Unpatched Windows operating system.

Confidential data stored in a fire safe.

Use of an unlocked filing cabinet.

NEW QUESTION 23
A system administrator has created the following “array” as an access control for an organisation.
Developers: create files, update files.
Reviewers: upload files, update files.
Administrators: upload files, delete fifes, update files.
What type of access-control has just been created?

Task based access control.

Role based access control.

Rule based access control.

Mandatory access control.

NEW QUESTION 24
What term is used to describe the act of checking out a privileged account password in a manner that bypasses normal access controls procedures during a critical emergency situation?

Privileged User Gateway

Enterprise Security Management

Multi Factor Authentication.

Break Glass

NEW QUESTION 25
Why have MOST European countries developed specific legislation that permits police and security services to monitor communications traffic for specific purposes, such as the detection of crime?

Under the European Convention of Human Rights, the interception of telecommunications represents an interference with the right to privacy.

GDPR overrides all previous legislation on information handling, so new laws were needed to ensure authorities did not inadvertently break the law.

Police could previously intercept without lawful authority any communications in the course of transmission through a public post or telecoms system.

Surveillance of a conversation or an online message by law enforcement agents was previously illegal due to the 1950 version of the Human Rights Convention.

NEW QUESTION 26
What form of training SHOULD developers be undertaking to understand the security of the code they have written and how it can improve security defence whilst being attacked?

Red Team Training.

Blue Team Training.

Black Hat Training.

Awareness Training.

NEW QUESTION 27
When an organisation decides to operate on the public cloud, what does it lose?

The right to audit and monitor access to its information.

Control over Intellectual Property Rights relating to its applications.

Physical access to the servers hosting its information.

The ability to determine in which geographies the information is stored.

NEW QUESTION 28
In business continuity (BC) terms, what is the name of the individual responsible for recording all pertinent information associated with a BC exercise or real plan invocation?

Recorder.

Desk secretary.

Scribe.

Scrum Master.

NEW QUESTION 29
Ensuring the correctness of data inputted to a system is an example of which facet of information security?

Confidentiality.

Integrity.

Availability.

Authenticity.

NEW QUESTION 30
A security analyst has been asked to provide a triple A service (AAA) for both wireless and remote access network services in an organization and must avoid using proprietary solutions.
What technology SHOULD they adapt?

TACACS+

RADIUS.

Oauth.

MS Access Database.

NEW QUESTION 31
How might the effectiveness of a security awareness program be effectively measured?
1) Employees are required to take an online multiple choice exam on security principles.
2) Employees are tested with social engineering techniques by an approved penetration tester.
3) Employees practice ethical hacking techniques on organisation systems.
4) No security vulnerabilities are reported during an audit.
5) Open source intelligence gathering is undertaken on staff social media profiles.

3, 4 and 5.

2, 4 and 5.

1, 2 and 3.

1, 2 and 5.

NEW QUESTION 32
What advantage does the delivery of online security training material have over the distribution of printed media?

Updating online material requires a single edit. Printed material needs to be distributed physically.

Online training material is intrinsically more accurate than printed material.

Printed material is a ‘discoverable record’ and could expose the organisation to litigation in the event of an incident.

Online material is protected by international digital copyright legislation across most territories.

NEW QUESTION 33
In a security governance framework, which of the following publications would be at the HIGHEST level?

Procedures.

Standards

Policy.

Guidelines

NEW QUESTION 34
When preserving a crime scene for digital evidence, what actions SHOULD a first responder initially make?

Remove power from all digital devices at the scene to stop the data changing.

Photograph all evidence and triage to determine whether live data capture is necessary.

Remove all digital evidence from the scene to prevent unintentional damage.

Don’t touch any evidence until a senior digital investigator arrives.
https://www.ncjrs.gov/pdffiles1/nij/219941.pdf

NEW QUESTION 35
When establishing objectives for physical security environments, which of the following functional controls SHOULD occur first?

Delay.

Drop.

Deter.

Deny.

NEW QUESTION 36
When considering the disposal of confidential data, equipment and storage devices, what social engineering technique SHOULD always be taken into consideration?

Spear Phishing.

Shoulder Surfing.

Dumpster Diving.

Tailgating.

NEW QUESTION 37
Which of the following statutory requirements are likely to be of relevance to all organisations no matter which sector nor geographical location they operate in?

Sarbanes-Oxley.

GDPR.

HIPAA.

FSA.

NEW QUESTION 38
What types of web application vulnerabilities continue to be the MOST prolific according to the OWASP Top 10?

Poor Password Management.

Insecure Deserialsiation.

Injection Flaws.

Security Misconfiguration

NEW QUESTION 39
What are the different methods that can be used as access controls?
1. Detective.
2. Physical.
3. Reactive.
4. Virtual.
5. Preventive.

1, 2 and 4.

1, 2 and 3.

1, 2 and 5.

3, 4 and 5.

NEW QUESTION 40
Which of the following is often the final stage in the information management lifecycle?

Disposal.

Creation.

Use.

Publication.
https://timg.co.nz/blog-the-information-management-life-cycle/

CISMP-V9 Exam Questions Get Updated [2023] with Correct Answers: https://www.practicematerial.com/CISMP-V9-exam-materials.html

Leave a Reply Cancel reply