CISSP

How should sensitive information be classified?

What is the focus of security operations in a security lifecycle?

If a barrel containing oil-soaked rags were suddenly to catch fire, what class of fire would that be?

The process of hiding charecters of plaintext with non-cipher charecters is referred to as:

What is the purpose of job rotation in operations security?

What is the purpose of penetration testing?

Which cryptographic method is recommended forcollecting evidence?

Which tool is essential for detecting network intrusions in real-time?

Which encryption method uses one key for encryption and decryption?

What is the best method to securely decommission storage devices containing sensitive data?

What is the Secure Software Development Lifecycle (SDLC)?

What is the FIRST step in incident response?

What is the main purpose of SAML in IAM?

What principle limits access to only what's necessary to perform a job?

Which principle ensures users cannot deny actions they performed?

Which access model is based on security labels and clearances?

What is the main purpose of classification in asset security?

Which layer of the OSI model handles routing?

An app fails open when a control crashes. What’s violated?

What is the purpose of Business Impact Analysis (BIA) in Business Continuity Planning (BCP)?

What does "due care" mean in a security context?

What is the primary concern when implementing physical security controls in a facility?

What is the function of a digital signature?

Which strategy enables quick recovery from IT disasters?

A terminated user still has access. Which process is flawed?

Which of the following is an example of a detective security control?

What is the purpose of multi-factor authentication (MFA)?

A user reports access to data beyond their scope. What principle is violated?

What type of testing is performed without system knowledge?

When Using CO2, Halon or FM200, which of the following must be included?

A CRM was deployed without pen testing. What’s the main risk?

What does RBAC use to manage access?

A company uses MFA, RBAC, and session timeouts. What’s being applied?

Which control prevents unauthorized users from accessing network resources?

What is cross-site scripting (XSS)?

Which type of testing can be used to assess the security of applications during development?

What is the primary goal of secure coding practices?

What is the function of a data owner?

What principle ensures that only authorized personnel access systems based on their role?

Logs show login attempts after hours. What should be done?

What is the goal of a layered security (Defense in Depth) approach?

What is the difference between vulnerability scanning and penetration testing?

How does "Privacy by Design" affect software development under GDPR?

Which data state requires encryption to protect it from interception?

What is the best practice when developing secure software?

What is the purpose of logging in security management?

What should be performed regularly to validate existing access rights?

Which of the following practices is essential for securing APIs in software development?

What is the purpose of conducting regular vulnerability assessments?

Which model enforces "no read up, no write down"?

What is a man-in-the-middle (MITM) attack?

What is the function of defense-in-depth?

External traffic to a suspicious IP is seen. What should be checked first?

How should access be managed for temporary contractors?

What technology is essential for creating secure remote access to a network?

How should an organization respond immediately after detecting a breach?

How does risk transference work in risk management?

Logs show a user accessed data using someone else's credentials. What’s the issue?

Which risk remains after implementing security measures?

What is the purpose of network segmentation?