View Full ISC CISSP Exam Dumps and Practice Test Dumps.

 

Question 161

Which security principle requires an organization to collect only the personal information necessary for a specific legitimate purpose?

1. Data minimization
2. Data aggregation
3. Data remanence
4. Data dispersion

Correct Answer: 1

Explanation

Data minimization requires organizations to collect, process, and retain only the personal information necessary for an identified legitimate purpose. Limiting unnecessary data reduces privacy exposure, storage requirements, and the potential impact of a data breach. Organizations should define the purpose for collecting information and avoid gathering additional information merely because it might become useful later. Data minimization should be considered during application design, data collection, retention, sharing, and disposal. It supports privacy protection and can also reduce the organization’s overall security and compliance burden.

Question 162

An organization labels information as Public, Internal, Confidential, and Restricted. What is the primary purpose of this classification system?

1. Determine employee salaries
2. Establish appropriate protection requirements
3. Measure network bandwidth
4. Calculate system availability

Correct Answer: 2

Explanation

Information classification categorizes data according to its sensitivity, value, or business importance so that appropriate security controls can be applied. Public information may require limited protection, while Restricted or Confidential information may require stronger access controls, encryption, monitoring, and handling procedures. Classification helps organizations avoid applying the same security requirements to every piece of information. Data owners typically determine classifications according to organizational policy, while custodians implement the required controls. Classification should also be reviewed when the information’s sensitivity or business context changes.

Question 163

Who is generally responsible for determining the classification and acceptable use requirements for organizational information?

1. Data owner
2. Network administrator
3. Security guard
4. End user

Correct Answer: 1

Explanation

The data owner is generally responsible for determining how organizational information should be classified and what protection requirements apply to it. The owner may establish access requirements, retention expectations, and acceptable handling procedures according to organizational policies and legal obligations. A data custodian typically implements and maintains the controls specified by the owner. End users must follow the established requirements but normally do not determine the official classification. Clearly assigning ownership helps ensure accountability for information throughout its lifecycle and supports consistent application of security controls.

Question 164

Which role is primarily responsible for implementing and maintaining security controls for information according to requirements established by the data owner?

1. Data subject
2. Data custodian
3. External auditor
4. Business partner

Correct Answer: 2

Explanation

A data custodian is responsible for implementing and maintaining the technical and operational controls required to protect information. These responsibilities can include backups, access controls, storage management, encryption, system configuration, and other safeguards. The data owner generally determines the classification, business requirements, and acceptable access conditions, while the custodian implements those requirements. Separating ownership from custodianship provides clearer accountability and prevents technical administrators from independently deciding business-level data requirements. The exact responsibilities may vary according to organizational structure and applicable regulations.

Question 165

Which privacy concept requires an organization to use collected personal information only for the purpose for which it was originally obtained, unless additional authorization exists?

1. Purpose limitation
2. Availability
3. Asset valuation
4. Network isolation

Correct Answer: 1

Explanation

Purpose limitation requires personal information to be collected and used for specified, legitimate purposes rather than being repurposed arbitrarily. Before using data for a new purpose, an organization may need additional authorization, notice, consent, or another lawful basis depending on applicable requirements. Purpose limitation helps prevent unnecessary secondary uses and supports responsible privacy management. Organizations should document why information is collected and establish procedures that restrict inappropriate reuse. This principle works alongside data minimization, retention controls, access restrictions, and transparency requirements.

Question 166

Which technique replaces sensitive payment card information with a non-sensitive representative value that has no exploitable mathematical relationship to the original data?

1. Tokenization
2. Compression
3. Hash cracking
4. Data deduplication

Correct Answer: 1

Explanation

Tokenization replaces sensitive information with a token that represents the original value. The token itself generally does not contain the original information or provide a mathematical means of deriving it. A protected tokenization system maintains the relationship between the token and original value within a controlled environment. Tokenization is commonly used to reduce exposure of payment information and other sensitive data in systems that do not need the original value. It differs from encryption because encrypted data can generally be transformed back using the appropriate cryptographic key.

Question 167

Which technique transforms data into a fixed-length value that is designed to detect changes to the original information?

1. Hashing
2. Tokenization
3. Encoding
4. Compression

Correct Answer: 1

Explanation

Hashing transforms input data into a fixed-length digest using a mathematical algorithm. A secure cryptographic hash function is designed so that even a small change to the input produces a substantially different digest. Hashes are commonly used to verify data integrity, store passwords with appropriate additional protections, and support digital signatures. Hashing is not encryption because a secure hash is intended to be one-way rather than reversible. Organizations should select modern, appropriate algorithms and avoid obsolete functions when stronger alternatives are available.

Question 168

Which cryptographic method uses the same secret key for both encryption and decryption?

1. Asymmetric encryption
2. Symmetric encryption
3. Hashing
4. Digital signing

Correct Answer: 2

Explanation

Symmetric encryption uses the same secret key, or corresponding shared secret material, to encrypt and decrypt information. It is generally efficient and well suited for protecting large amounts of data. The major challenge is securely distributing and managing the secret key between authorized parties. AES is a widely used symmetric encryption algorithm. Asymmetric cryptography instead uses a related public and private key pair. In many secure protocols, asymmetric cryptography is used to establish or exchange secrets, while symmetric algorithms provide efficient protection for the actual data.

Question 169

Which cryptographic approach uses a public key and a corresponding private key for security operations?

1. Symmetric cryptography
2. Asymmetric cryptography
3. Message digesting
4. Data masking

Correct Answer: 2

Explanation

Asymmetric cryptography uses mathematically related public and private keys. The public key can generally be distributed openly, while the private key must be protected by its owner. Depending on the algorithm and operation, asymmetric cryptography can support encryption, digital signatures, authentication, and secure key establishment. RSA and elliptic-curve algorithms are examples of asymmetric cryptographic approaches. Compared with symmetric encryption, asymmetric operations are generally more computationally expensive, so systems often combine both approaches to achieve secure and efficient communication.

Question 170

Which technology is commonly used to establish an encrypted and authenticated connection between a web browser and a web server?

1. FTP
2. HTTP
3. TLS
4. Telnet

Correct Answer: 3

Explanation

Transport Layer Security, or TLS, provides cryptographic protection for network communications and is widely used to secure web traffic. When HTTPS is used, HTTP operates over a TLS-protected connection. TLS can provide confidentiality, integrity, and server authentication through digital certificates. Depending on the configuration and protocol version, client authentication can also be supported. Plain HTTP does not inherently provide encryption, while Telnet and traditional FTP do not provide the same level of modern transport protection by default. Proper certificate validation and secure protocol configuration remain important.

Question 171

Which protocol is specifically designed to provide secure remote command-line access to a system?

1. Telnet
2. SSH
3. HTTP
4. SNMPv1

Correct Answer: 2

Explanation

Secure Shell, or SSH, provides encrypted remote access to systems and can support secure command-line administration, file transfer, tunneling, and related functions. SSH protects authentication and session data against interception when properly configured. It is commonly used by administrators to manage servers remotely. Telnet provides remote terminal access without strong built-in encryption and can expose credentials and commands to network interception. SSH security also depends on appropriate authentication, key management, configuration, patching, and restriction of unnecessary administrative access.

Question 172

Which authentication factor is represented by a password or PIN?

1. Something you have
2. Something you are
3. Something you know
4. Somewhere you are

Correct Answer: 3

Explanation

A password or PIN is an example of the “something you know” authentication factor because the user must possess knowledge of a secret value. Other authentication factors include something you have, such as a hardware token or smartphone, and something you are, such as a fingerprint or facial characteristic. Strong authentication often combines two or more independent factor types. Simply using two passwords does not provide true multifactor authentication because both credentials belong to the same factor category. Proper factor independence is essential when designing MFA controls.

Question 173

Which authentication factor is represented by a hardware security token that generates or stores authentication credentials?

1. Something you have
2. Something you know
3. Something you are
4. Something you do

Correct Answer: 1

Explanation

A hardware security token represents the “something you have” authentication factor because successful authentication depends on possession of the physical device. Examples include hardware OTP tokens and certain cryptographic security keys. Possession factors can strengthen authentication when combined with another independent factor, such as a password or biometric characteristic. Organizations should establish procedures for lost or stolen tokens, including revocation and replacement. A possession factor alone does not necessarily provide multifactor authentication; MFA requires multiple independent factor categories.

Question 174

Which biometric characteristic is generally considered a behavioral biometric rather than a physiological biometric?

1. Fingerprint
2. Retina pattern
3. Voice pattern
4. Iris pattern

Correct Answer: 3

Explanation

Voice pattern is commonly classified as a behavioral biometric because it reflects characteristics associated with how an individual speaks. Fingerprints, retinal patterns, and iris patterns are generally considered physiological biometrics because they are based on physical characteristics. Biometric systems compare a presented characteristic against an enrolled template and calculate whether the match satisfies a defined threshold. Biometrics can provide strong identity verification, but they also introduce privacy and enrollment considerations. Organizations should protect biometric templates carefully because biometric characteristics cannot simply be replaced like passwords.

Question 175

Which attack attempts to gain unauthorized access by trying many possible passwords until one succeeds?

1. Replay attack
2. Brute-force attack
3. Salami attack
4. Man-in-the-middle attack

Correct Answer: 2

Explanation

A brute-force attack systematically attempts many possible passwords, keys, or other authentication values until the correct one is discovered. The feasibility of such attacks depends on factors such as password complexity, key length, rate limiting, account lockout, multifactor authentication, and the attacker’s available computing resources. Strong password policies, MFA, monitoring, and appropriate throttling can reduce the effectiveness of brute-force attempts. A dictionary attack is a related technique that focuses on likely words and commonly used passwords rather than trying every possible combination.

Question 176

An attacker captures a valid authentication message and later retransmits it to gain unauthorized access. What type of attack is this?

1. Replay attack
2. Buffer overflow
3. Privilege escalation
4. SQL injection

Correct Answer: 1

Explanation

A replay attack occurs when an attacker captures valid communication or authentication information and retransmits it later to impersonate an authorized party or repeat a previously accepted transaction. Countermeasures include timestamps, sequence numbers, nonces, session identifiers, challenge-response mechanisms, and cryptographic protections that prevent captured messages from being reused successfully. Encryption alone does not necessarily prevent replay if an attacker can capture and retransmit valid encrypted messages. Secure protocol design must therefore address both confidentiality and the freshness of communications.

Question 177

Which value is commonly used in cryptographic protocols to ensure that a message or transaction is fresh and not simply a reused previous message?

1. Nonce
2. Salt
3. Ciphertext
4. Certificate

Correct Answer: 1

Explanation

A nonce is a value intended to be used only once within a particular cryptographic context. Nonces can help prevent replay attacks by ensuring that a previously captured message cannot simply be reused as a valid response. They are commonly incorporated into challenge-response authentication and various cryptographic protocols. A nonce should be generated and managed according to the requirements of the protocol. A salt serves a different purpose, commonly adding uniqueness to password hashing. Certificates primarily bind identities or attributes to public keys through trusted mechanisms.

Question 178

Which security mechanism monitors network or system activity and automatically blocks traffic that matches known malicious patterns?

1. Intrusion prevention system
2. Intrusion detection system
3. Security information repository
4. Vulnerability scanner

Correct Answer: 1

Explanation

An intrusion prevention system, or IPS, monitors activity and can take automated action to block or prevent detected malicious traffic. Depending on its implementation, an IPS may identify threats through signatures, behavioral analysis, protocol analysis, or other detection techniques. An intrusion detection system generally detects and alerts on suspicious activity without directly blocking it. Vulnerability scanners identify weaknesses rather than necessarily preventing active attacks. IPS deployment requires careful tuning because overly aggressive rules can block legitimate traffic and create operational problems.

Question 179

Which security technology collects and correlates security events from multiple systems to help analysts identify suspicious activity?

1. SIEM
2. RAID
3. NAC
4. HSM

Correct Answer: 1

Explanation

A Security Information and Event Management, or SIEM, platform collects and correlates security-related events from multiple sources such as servers, applications, network devices, authentication systems, and security controls. Correlation can help identify patterns that may not be visible when examining individual logs. SIEM platforms can support alerting, investigation, compliance reporting, and security monitoring. Their effectiveness depends on appropriate data sources, time synchronization, detection rules, retention, and skilled analysis. A SIEM does not automatically eliminate threats; it primarily provides centralized visibility and analytical capabilities.

Question 180

Which control prevents unauthorized software from executing by allowing only explicitly approved applications to run?

1. Network segmentation
2. Application allowlisting
3. Data classification
4. Vulnerability scanning

Correct Answer: 2

Explanation

Application allowlisting permits only approved software to execute on a system while blocking applications that are not explicitly authorized. This can significantly reduce the risk of malware and unauthorized software execution, particularly on systems with predictable workloads. Allowlisting can be implemented using application identities, cryptographic hashes, publishers, paths, or other criteria depending on the technology. Maintaining an accurate approved-software list is essential because legitimate applications and versions may change. Allowlisting is a preventive control and can complement endpoint monitoring, patch management, and least privilege.