View Full ISC CISSP Exam Dumps and Practice Test Dumps.

 

Question 101

Which security principle requires organizations to maintain appropriate safeguards throughout the entire lifecycle of an information asset?

1. Asset lifecycle management
2. Separation of duties
3. Complete mediation
4. Open design

Correct Answer: 1

Explanation

Asset lifecycle management ensures that information and associated assets are appropriately protected from acquisition or creation through use, storage, maintenance, and eventual disposal. Security requirements can change as an asset moves through different lifecycle stages. For example, newly created sensitive information may require strict access controls, while retired storage media may require secure sanitization or destruction. Proper lifecycle management also helps organizations track ownership, classification, retention, and handling requirements. This approach reduces the likelihood that security protections will be overlooked as assets change status or ownership.

Question 102

Which role is generally responsible for determining the classification and overall protection requirements of an organization’s information asset?

1. Custodian
2. User
3. Data owner
4. Auditor

Correct Answer: 3

Explanation

The data owner is typically responsible for determining the classification of information and establishing requirements for its protection, handling, and access. The owner may delegate operational tasks to custodians, but remains accountable for defining what protection is appropriate. A custodian is responsible for implementing and maintaining controls according to the owner’s requirements. Users access information as authorized, while auditors independently evaluate controls and compliance. Clearly assigning ownership helps organizations establish accountability and ensures that sensitive information receives protection consistent with its business value and risk.

Question 103

Which role is primarily responsible for implementing the security controls specified by the information owner?

1. Data custodian
2. Data subject
3. Data controller
4. Auditor

Correct Answer: 1

Explanation

A data custodian is responsible for the operational management and protection of information according to requirements established by the data owner. Custodians may perform tasks such as configuring access controls, maintaining backups, applying security settings, monitoring systems, and ensuring appropriate storage and transmission protections. The data owner determines classification and protection requirements, while the custodian implements those requirements. Separating ownership from custodial responsibilities improves accountability and prevents confusion about who establishes policy versus who operates the technical safeguards used to protect organizational information.

Question 104

Which type of data classification is normally intended for information that can be freely shared with the general public without causing significant harm?

1. Confidential
2. Restricted
3. Internal
4. Public

Correct Answer: 4

Explanation

Public information is intended for unrestricted disclosure and can generally be shared outside the organization without causing significant security, legal, or business harm. Examples may include published marketing material, public announcements, and information intentionally released through official channels. Internal information is generally intended for organizational use, while confidential or restricted information requires stronger protection because unauthorized disclosure could cause greater harm. Classification schemes differ among organizations, so the exact labels and handling requirements should always be defined by organizational policy and applicable legal or regulatory requirements.

Question 105

Which process determines how long information should be maintained before it is securely destroyed or otherwise disposed of?

1. Data retention
2. Data masking
3. Data aggregation
4. Data normalization

Correct Answer: 1

Explanation

Data retention defines how long information should be kept based on business needs, legal requirements, contractual obligations, regulatory rules, and organizational policies. Retaining information indefinitely can increase storage costs and exposure if the information is compromised. Once the approved retention period expires, data should be securely destroyed, anonymized, or otherwise disposed of according to established requirements. Retention schedules should consider different information types because financial records, customer information, security logs, and employee records may have different requirements. Proper retention supports both operational needs and privacy principles.

Question 106

Which technique replaces sensitive information with a non-sensitive substitute value that can be mapped back to the original information when authorized?

1. Encryption
2. Tokenization
3. Hashing
4. Steganography

Correct Answer: 2

Explanation

Tokenization replaces sensitive data with a surrogate value called a token. The token itself generally has little or no meaningful value outside the system that maintains the mapping to the original information. When authorized, the original value can be retrieved through the appropriate tokenization system. Tokenization is commonly used to reduce exposure of payment card information and other sensitive data. Encryption transforms data using cryptographic keys, hashing creates a one-way digest, and steganography hides information within another medium. Tokenization can reduce the amount of sensitive information directly exposed to applications.

Question 107

A company needs to protect sensitive information while it is being transmitted between two systems over an untrusted network. Which security property is most directly required?

1. Data availability
2. Data confidentiality
3. Data retention
4. Data classification

Correct Answer: 2

Explanation

Confidentiality protects information from unauthorized disclosure. When sensitive data travels across an untrusted network, encryption can help prevent unauthorized parties from reading intercepted communications. Protocols such as TLS can provide encrypted communications for many applications, while secure VPN technologies can protect network traffic between locations. Confidentiality should be combined with integrity and authentication controls where appropriate because encryption alone does not necessarily establish who is communicating or whether data has been altered. The specific protection should match the sensitivity of the information and the communication environment.

Question 108

Which technology is commonly used to establish an encrypted tunnel between remote users or networks across an untrusted public network?

1. VPN
2. VLAN
3. NAT
4. DNS

Correct Answer: 1

Explanation

A Virtual Private Network, or VPN, creates a protected communication channel across an untrusted network such as the public internet. Depending on the technology, VPNs can provide confidentiality, integrity, authentication, and secure connectivity between remote users, offices, or networks. Remote-access VPNs commonly connect individual users to organizational resources, while site-to-site VPNs connect networks. VLANs logically separate local network segments, NAT translates network addresses, and DNS resolves names. VPN security depends on strong authentication, secure cryptographic protocols, proper configuration, and appropriate endpoint protection.

Question 109

Which protocol is commonly used to securely access email messages from a mail server while keeping messages synchronized across multiple devices?

1. POP3
2. SMTP
3. IMAP over TLS
4. TFTP

Correct Answer: 3

Explanation

IMAP, particularly when protected with TLS, allows users to access and synchronize email stored on a mail server across multiple devices. Messages and mailbox states can remain synchronized so actions performed on one device can be reflected on others. SMTP is primarily used for sending and relaying email rather than retrieving mailbox content. POP3 traditionally downloads messages and may be configured to remove them from the server, making it less suitable for multi-device synchronization. TFTP is an uncomplicated file-transfer protocol and does not provide email functionality.

Question 110

Which email security technology helps prevent unauthorized senders from using an organization’s domain in fraudulent messages?

1. SPF
2. DHCP
3. SNMP
4. NTP

Correct Answer: 1

Explanation

Sender Policy Framework, or SPF, allows a domain owner to publish information identifying authorized mail servers that may send email on behalf of the domain. Receiving mail systems can compare the sending server against the published SPF policy and use the result as part of their filtering decisions. SPF can help reduce certain forms of domain spoofing but does not independently authenticate the visible From address in every situation. Other email security mechanisms, such as DKIM and DMARC, can complement SPF and provide additional protections against impersonation and fraudulent email.

Question 111

Which email security mechanism allows a receiving mail server to verify that a message was signed by an authorized sending domain and was not altered after signing?

1. DKIM
2. DNSSEC
3. S/MIME
4. SSH

Correct Answer: 1

Explanation

DomainKeys Identified Mail, or DKIM, uses cryptographic signatures to allow receiving mail systems to verify that an authorized domain associated with the message signed the message and that signed content was not modified in transit. The sending domain publishes a public key through DNS, while the corresponding private key is used to create the signature. DKIM can help establish message authenticity at the domain level and detect modification. It works alongside technologies such as SPF and DMARC to strengthen email security and domain protection.

Question 112

Which email security standard uses policies to specify how receiving systems should handle messages that fail authentication checks such as SPF or DKIM?

1. TLS
2. DMARC
3. SFTP
4. RADIUS

Correct Answer: 2

Explanation

Domain-based Message Authentication, Reporting, and Conformance, or DMARC, allows domain owners to publish policies describing how receiving mail systems should handle messages that fail relevant authentication checks. DMARC can use SPF and DKIM results along with domain alignment requirements to help detect and reduce email spoofing. Policies can instruct receivers to monitor, quarantine, or reject messages depending on the organization’s configuration. DMARC also supports reporting, giving domain owners visibility into authentication results and potential abuse involving their domains.

Question 113

Which protocol is primarily responsible for translating human-readable domain names into IP addresses?

1. DNS
2. LDAP
3. DHCP
4. RADIUS

Correct Answer: 1

Explanation

The Domain Name System, or DNS, translates human-readable names such as example.com into IP addresses that network systems can use to communicate. DNS can also provide other records, including mail server information, aliases, and service-related information. DNS is critical to the operation of modern networks and internet services. Security considerations include protecting DNS infrastructure, preventing unauthorized modifications, and using technologies such as DNSSEC where appropriate. LDAP manages directory information, DHCP provides network configuration, and RADIUS supports centralized authentication and authorization.

Question 114

Which technology protects DNS responses against unauthorized modification by allowing clients to validate the authenticity and integrity of DNS data?

1. DNSSEC
2. DHCP
3. NAT
4. FTP

Correct Answer: 1

Explanation

DNS Security Extensions, or DNSSEC, adds cryptographic validation to DNS information so resolvers can verify that DNS responses originate from the appropriate authoritative source and have not been modified. DNSSEC uses digital signatures and a chain of trust to support authenticity and integrity of DNS data. It does not encrypt normal DNS queries or responses, so confidentiality requires separate mechanisms. DHCP assigns network configuration, NAT translates addresses, and FTP transfers files. DNSSEC is particularly useful for reducing certain forms of DNS spoofing and response manipulation.

Question 115

Which security mechanism can prevent unauthorized users from viewing the contents of a confidential database even if they obtain direct access to the underlying storage files?

1. Database encryption
2. Network segmentation
3. Security awareness training
4. Vulnerability scanning

Correct Answer: 1

Explanation

Database encryption protects sensitive database information by transforming stored data into ciphertext that cannot be meaningfully read without the required cryptographic keys. Depending on the architecture, organizations may encrypt entire databases, specific columns, files, or storage volumes. Encryption can provide valuable protection if storage media or database files are accessed without authorization. However, encryption does not replace access controls because authorized applications and users may still receive plaintext data. Key management is also critical because poorly protected encryption keys can undermine the protection provided by encrypted storage.

Question 116

Which key management practice is most important when an encryption key is suspected of being compromised?

1. Increase password length
2. Rotate or revoke the affected key
3. Disable system logging
4. Delete all backups

Correct Answer: 2

Explanation

When an encryption key is suspected of compromise, the affected key should generally be revoked, disabled, or replaced according to the organization’s key management procedures. A new key can then be established and used to protect future data or communications. The exact response depends on the cryptographic system, key type, and potential exposure. Key management should include generation, distribution, storage, rotation, revocation, archival, and destruction processes. Simply changing user passwords does not necessarily address a compromised cryptographic key. Incident response procedures should also be initiated when appropriate.

Question 117

Which type of cryptographic attack attempts to determine a secret key by trying many possible keys until one successfully decrypts the protected data?

1. Brute-force attack
2. Replay attack
3. Downgrade attack
4. Side-channel attack

Correct Answer: 1

Explanation

A brute-force cryptographic attack attempts to discover a secret key by systematically trying possible key values until the correct key is found. The feasibility of brute force depends heavily on key length, algorithm strength, implementation, and available computing resources. Modern cryptographic algorithms use sufficiently large key spaces to make exhaustive searching impractical when properly implemented. Replay attacks reuse previously captured valid communications, downgrade attacks attempt to force weaker security mechanisms, and side-channel attacks analyze indirect information such as timing, power consumption, or electromagnetic emissions.

Question 118

Which attack attempts to capture valid authentication information and reuse it later to gain unauthorized access?

1. Replay attack
2. Dictionary attack
3. Watering-hole attack
4. Smurf attack

Correct Answer: 1

Explanation

A replay attack occurs when an attacker captures legitimate authentication information or communications and later retransmits them to impersonate an authorized party or repeat an action. Countermeasures can include timestamps, sequence numbers, nonces, challenge-response mechanisms, and protocols designed to ensure that previously captured messages cannot be reused successfully. A dictionary attack targets passwords using lists of likely values, while a watering-hole attack compromises websites frequented by intended victims. A Smurf attack is a type of distributed denial-of-service attack involving network traffic amplification.

Question 119

Which security mechanism is designed to ensure that a communication cannot be reused successfully after its original transaction has completed?

1. Nonce
2. Static password
3. Public certificate
4. Access control list

Correct Answer: 1

Explanation

A nonce is a unique or unpredictable value used in a cryptographic protocol to help ensure that messages are fresh and cannot simply be replayed. The receiving system can verify that the nonce is valid for the current transaction and reject messages containing an already-used value. Nonces are commonly used in authentication protocols, challenge-response systems, and cryptographic operations. Their security depends on appropriate generation and handling. Static passwords, certificates, and access control lists serve different purposes and do not inherently provide replay protection.

Question 120

Which security concept describes the practice of continuously monitoring systems to identify suspicious behavior that may indicate an active attack?

1. Security monitoring
2. Data retention
3. Asset classification
4. Software licensing

Correct Answer: 1

Explanation

Security monitoring involves continuously or regularly observing systems, networks, applications, and security events to identify suspicious activity, policy violations, or indicators of compromise. Monitoring can use logs, endpoint telemetry, network traffic, authentication events, alerts, and other data sources. Security teams may use SIEM, EDR, IDS, or other technologies to collect and analyze this information. Effective monitoring supports early detection and incident response, but it should be combined with defined escalation procedures and trained personnel. Monitoring requirements should also account for privacy, legal, and retention obligations.