CISSP Final

In an infrastructure-as-a-service (IaaS) cloud model, who bears primary responsibility for securing physical and information assets?

• Responsibility primarily rests with the customer

• Responsibility primarily rests with the provider

• Responsibility is shared between the customer and provider

• Responsibility primarily rests with the cloud access security broker

In a federated identity access management solution, what task is most commonly handled by the identity provider (IdP)?

• Identification

• Authorization

• Provisioning

• Authentication

You are working with a team of software and hardware developers on the creation of a new product that will deploy sensors to factory floors and then analyze the data from those sensors using a back-end SaaS solution. Before you develop the software, you would like to understand the potential paths that an attacker could take to undermine the security of the system. What activity would best provide you with this perspective?

• Threat hunting

• Threat modeling

• Penetration testing

• Vulnerability scanning

You recently performed a vulnerability assessment and found hundreds of vulnerabilities in your organization's infrastructure. It will take months to address all of these issues. What factors should you use to prioritize these vulnerabilities?

• Likelihood and probability

• Impact and exploitability

• Impact and CVSS score

• Likelihood and impact

You are attempting to secure a wired network belonging to your organization. You would like to deploy technology that limits network access to authorized users. Which one of the following technologies would best meet that need?

• WiFi Protected Access v2 (WPA2)

• WiFi Protected Access v3 (WPA3)

• IEEE 802.1x

• MAC filtering

A user connected a device to your network and, when they open their web browser, are redirected to a website advising them that they have been placed on an isolation network because their system does not meet the organization's security requirements. They are unable to access any network resources until they remediate their device to comply with the organization's security policy. What type of security solution is in use on this network?

• Intrusion Prevention System (IPS)

• Configuration Management (CM) platform

• Network Access Control (NAC)

• Endpoint Detection and Response (EDR) platform

You have been asked to assist in the investigation of a security incident that took place in your organization. You are handed a laptop computer that is powered off and asked to analyze the data contained on its hard drive. What action should you take first?

• Remove the hard drive from the device

• Power on the laptop

• Connect to the hard drive with a forensic software package

• Connect a write blocker to the device

Carla is conducting an assessment of an organization using the Software Assurance Maturity Model (SAMM). She notes that the organization seems to have difficulty with defect management and will be reporting that finding. Which business function of SAMM includes defect management?

• Implementation

• Governance

• Verification

• Operations

You are working with the team developing a new web application and you would like to perform a test that evaluates whether the application is able to successfully handle malicious input that it receives through that interface. Which one of the following activities would best meet this need?

• Input validation

• Parameterized queries

• Stored procedures

• Fuzz testing

What is the primary goal of change management in an organization?

• Reducing the likelihood of service disruptions

• Communicating to all affected stakeholders

• Creating an auditable record

• Organizing the work associated with a change