Winter Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: netbudy65

Note! ISC has retired the CISSP-ISSMP Exam Contact us through Live Chat or email us for more information.

CISSP-ISSMP ISSMP®: Information Systems Security Management Professional Questions and Answers

Questions 4

You work as a project manager for SoftTech Inc. A threat with a dollar value of $150,000 is expected to happen in your project and the frequency of threat occurrence per year is 0.001. What will be the annualized loss expectancy in your project?

Options:

A.

$180.25

B.

$150

C.

$100

D.

$120

Buy Now
Questions 5

Which of the following fields of management focuses on establishing and maintaining consistency of a system's or product's performance and its functional and physical attributes with its requirements, design, and operational information throughout its life?

Options:

A.

Configuration management

B.

Risk management

C.

Procurement management

D.

Change management

Buy Now
Questions 6

Which of the following is a process that identifies critical information to determine if friendly actions can be observed by adversary intelligence systems?

Options:

A.

IDS

B.

OPSEC

C.

HIDS

D.

NIDS

Buy Now
Questions 7

Which of the following laws or acts, formed in Australia, enforces prohibition against cyber stalking?

Options:

A.

Malicious Communications Act (1998)

B.

Anti-Cyber-Stalking law (1999)

C.

Stalking Amendment Act(1999)

D.

Stalking by Electronic Communications Act (2001)

Buy Now
Questions 8

Which of the following Acts enacted in United States amends Civil Rights Act of 1964, providing technical changes affecting the length of time allowed to challenge unlawful seniority provisions, to sue the federal government for discrimination and to bring age discrimination claims?

Options:

A.

PROTECT Act

B.

Sexual Predators Act

C.

Civil Rights Act of 1991

D.

The USA Patriot Act of 2001

Buy Now
Questions 9

Management has asked you to perform a risk audit and report back on the results. Bonny, a project team member asks you what a risk audit is. What do you tell Bonny?

Options:

A.

A risk audit is a review of all the risks that have yet to occur and what their probability of happening are.

B.

A risk audit is a review of the effectiveness of the risk responses in dealing with identified risks and their root causes, as well as the effectiveness of the risk management process.

C.

A risk audit is a review of all the risk probability and impact for the risks, which are still present in the project but which have not yet occurred.

D.

A risk audit is an audit of all the risks that have occurred in the project and what their true impact on cost and time has been.

Buy Now
Questions 10

You are the program manager for your project. You are working with the project managers regarding the procurement processes for their projects. You have ruled out one particular contract type because it is considered too risky for the program. Which one of the following contract types is usually considered to be the most dangerous for the buyer?

Options:

A.

Cost plus incentive fee

B.

Fixed fee

C.

Cost plus percentage of costs

D.

Time and materials

Buy Now
Questions 11

Which of the following BCP teams provides clerical support to the other teams and serves as a message center for the user-recovery site?

Options:

A.

Security team

B.

Data preparation and records team

C.

Administrative support team

D.

Emergency operations team

Buy Now
Questions 12

Fill in the blank with an appropriate phrase.___________ is the process of using a strategy and plan of what patches should be applied to which systems at a specified time. Correct

Options:

A.

Patch management

Buy Now
Questions 13

You work as the Network Administrator for a defense contractor. Your company works with sensitive materials and all IT personnel have at least a secret level clearance. You are still concerned that one individual could perhaps compromise the network (intentionally or unintentionally) by setting up improper or unauthorized remote access. What is the best way to avoid this problem?

Options:

A.

Implement separation of duties.

B.

Implement RBAC.

C.

Implement three way authentication.

D.

Implement least privileges.

Buy Now
Questions 14

Which of the following BCP teams handles financial arrangement, public relations, and media inquiries in the time of disaster recovery?

Options:

A.

Software team

B.

Off-site storage team

C.

Applications team

D.

Emergency-management team

Buy Now
Questions 15

Which of the following governance bodies provides management, operational and technical controls to satisfy security requirements?

Options:

A.

Senior Management

B.

Business Unit Manager

C.

Information Security Steering Committee

D.

Chief Information Security Officer

Buy Now
Questions 16

Which of the following statements about system hardening are true? Each correct answer represents a complete solution. Choose two.

Options:

A.

It can be achieved by installing service packs and security updates on a regular basis.

B.

It is used for securing the computer hardware.

C.

It can be achieved by locking the computer room.

D.

It is used for securing an operating system.

Buy Now
Questions 17

Which of the following is the process performed between organizations that have unique hardware or software that cannot be maintained at a hot or warm site?

Options:

A.

Cold sites arrangement

B.

Business impact analysis

C.

Duplicate processing facilities

D.

Reciprocal agreements

Buy Now
Questions 18

Which of the following methods can be helpful to eliminate social engineering threat? Each correct answer represents a complete solution. Choose three.

Options:

A.

Password policies

B.

Vulnerability assessments

C.

Data encryption

D.

Data classification

Buy Now
Questions 19

Which of the following documents is described in the statement below? "It is developed along with all processes of the risk management. It contains the results of the qualitative risk analysis, quantitative risk analysis, and risk response planning."

Options:

A.

Risk register

B.

Risk management plan

C.

Quality management plan

D.

Project charter

Buy Now
Questions 20

Which of the following U.S. Federal laws addresses computer crime activities in communication lines, stations, or systems?

Options:

A.

18 U.S.C. 1362

B.

18 U.S.C. 1030

C.

18 U.S.C. 1029

D.

18 U.S.C. 2701

E.

18 U.S.C. 2510

Buy Now
Questions 21

Mark works as a security manager for SofTech Inc. He is working in a partially equipped office space which contains some of the system hardware, software, telecommunications, and power sources. In which of the following types of office sites is he working?

Options:

A.

Mobile site

B.

Warm site

C.

Cold site

D.

Hot site

Buy Now
Questions 22

Which of the following tools works by using standard set of MS-DOS commands and can create an MD5 hash of an entire drive, partition, or selected files?

Options:

A.

Device Seizure

B.

Ontrack

C.

DriveSpy

D.

Forensic Sorter

Buy Now
Questions 23

In which of the following contract types, the seller is reimbursed for all allowable costs for performing the contract work and receives a fixed fee payment which is calculated as a percentage of the initial estimated project costs?

Options:

A.

Firm Fixed Price Contracts

B.

Cost Plus Fixed Fee Contracts

C.

Fixed Price Incentive Fee Contracts

D.

Cost Plus Incentive Fee Contracts

Buy Now
Questions 24

Which of the following response teams aims to foster cooperation and coordination in incident prevention, to prompt rapid reaction to incidents, and to promote information sharing among members and the community at large?

Options:

A.

CSIRT

B.

CERT

C.

FIRST

D.

FedCIRC

Buy Now
Questions 25

Eric is the project manager of the NQQ Project and has hired the ZAS Corporation to complete part of the project work for Eric's organization. Due to a change request the ZAS Corporation is no longer needed on the project even though they have completed nearly all of the project work. Is Eric's organization liable to pay the ZAS Corporation for the work they have completed so far on the project?

Options:

A.

Yes, the ZAS Corporation did not choose to terminate the contract work.

B.

It depends on what the outcome of a lawsuit will determine.

C.

It dependson what the termination clause of the contract stipulates.

D.

No, the ZAS Corporation did not complete all of the work.

Buy Now
Questions 26

You work as a Product manager for Marioiss Inc. You have been tasked to start a project for securing the network of your company. You want to employ configuration management to efficiently manage the procedures of the project. What will be the benefits of employing configuration management for completing this project? Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

It provides object, orient, decide and act strategy.

B.

It provides a live documentation of the project.

C.

It provides the risk analysis of project configurations.

D.

It provides the versions for network devices.

Buy Now
Questions 27

John is a black hat hacker. FBI arrested him while performing some email scams. Under which of the following US laws will john be charged?

Options:

A.

18 U.S.C. 1362

B.

18 U.S.C. 1030

C.

18 U.S.C. 2701

D.

18 U.S.C. 2510

Buy Now
Questions 28

Which of the following protocols are used to provide secure communication between a client and a server over the Internet? Each correct answer represents a part of the solution. Choose two.

Options:

A.

TLS

B.

HTTP

C.

SNMP

D.

SSL

Buy Now
Questions 29

Which of the following statements is related with the second law of OPSEC?

Options:

A.

If you are not protecting it (the critical and sensitive information), the adversary wins!

B.

If you don't know what to protect, how do you know you are protecting it?

C.

If you don't know about your security resources you could not protect your network.

D.

If you don't know the threat, how do you know what to protect?

Buy Now
Questions 30

You work as a security manager for SoftTech Inc. You are conducting a security awareness campaign for your employees. One of the employees of your organization asks you the purpose of the security awareness, training and education program. What will be your answer?

Options:

A.

It improves the possibility for career advancement of the IT staff.

B.

It improves the security of vendor relations.

C.

It improves the performance of a company's intranet.

D.

It improves awareness of the need to protect system resources.

Buy Now
Questions 31

Your project has several risks that may cause serious financial impact should they happen. You have studied the risk events and made some potential risk responses for the risk events but management wants you to do more. They'd like for you to create some type of a chart that identified the risk probability and impact with a financial amount for each risk event. What is the likely outcome of creating this type of chart?

Options:

A.

Quantitative analysis

B.

Contingency reserve

C.

Risk response

D.

Risk response plan

Buy Now
Questions 32

Which of the following signatures watches for the connection attempts to well-known, frequently attacked ports?

Options:

A.

Port signatures

B.

Digital signatures

C.

Header condition signatures

D.

String signatures

Buy Now
Exam Code: CISSP-ISSMP
Exam Name: ISSMP®: Information Systems Security Management Professional
Last Update: Nov 21, 2024
Questions: 218