ISSMP Information Systems Security Management Professional Question and Answers

Which of the following processes provides a standard set of activities, general tasks, and a management structure to certify and accredit systems, which maintain the information assurance and the security posture of a system or site?

Which of the following U.S. Federal laws addresses computer crime activities in communication lines, stations, or systems?

Which of the following evidences are the collection of facts that, when considered together, can be used to infer a conclusion about the malicious activity/person?

Management has asked you to perform a risk audit and report back on the results. Bonny, a project team member asks you what a risk audit is. What do you tell Bonny?

Which of the following statutes is enacted in the U.S., which prohibits creditors from collecting data from applicants, such as national origin, caste, religion etc?

Which of the following types of activities can be audited for security? Each correct answer represents a complete solution. Choose three.

Which of the following architecturally related vulnerabilities is a hardware or software mechanism, which was installed to permit system maintenance and to bypass the system's security protections?

Which of the following security models focuses on data confidentiality and controlled access to classified information?

Which of the following terms describes a repudiation of a contract that occurs before the time when performance is due?

You work as a security manager for SoftTech Inc. You are conducting a security awareness campaign for your employees. Which of the following ideas will you consider the best when conducting a security awareness campaign?

You work as the project manager for Bluewell Inc. You are working on NGQQ Project for your company. You have completed the risk analysis processes for the risk events. You and the project team have created risk responses for most of the identified project risks. Which of the following risk response planning techniques will you use to shift the impact of a threat to a third party, together with the responses?

Which of the following liabilities is a third-party liability in which an individual may be responsible for an action by another party?

An organization monitors the hard disks of its employees' computers from time to time. Which policy does this pertain to?

Which of the following relies on a physical characteristic of the user to verify his identity?

Which of the following rate systems of the Orange book has no security controls?

Which of the following roles is responsible for review and risk analysis of all contracts on a regular basis?

You are the project manager of the NGQQ Project for your company. To help you communicate project status to your stakeholders, you are going to create a stakeholder register. All of the following information should be included in the stakeholder register except for which one?

Mark works as a security manager for SofTech Inc. He is working in a partially equipped office space which contains some of the system hardware, software, telecommunications, and power sources. In which of the following types of office sites is he working?

You are the Network Administrator for a college. You watch a large number of people (some not even students) going in and out of areas with campus computers (libraries, computer labs, etc.). You have had a problem with laptops being stolen. What is the most cost effective method to prevent this?

The incident response team has turned the evidence over to the forensic team. Now, it is the time to begin looking for the ways to improve the incident response process for next time. What are the typical areas for improvement? Each correct answer represents a complete solution. Choose all that apply.

You are documenting your organization's change control procedures for project management. What portion of the change control process oversees features and functions of the product scope?

Which of the following is the best method to stop vulnerability attacks on a Web server?

Which of the following are the levels of military data classification system? Each correct answer represents a complete solution. Choose all that apply.

Which of the following needs to be documented to preserve evidences for presentation in court?

Which of the following statements best describes the consequences of the disaster recovery plan test?

Which of the following is the default port for Secure Shell (SSH)?

Which of the following plans is designed to protect critical business processes from natural or man-made failures or disasters and the resultant loss of capital due to the unavailability of normal business processes?

Which of the following is used to back up forensic evidences or data folders from the network or locally attached hard disk drives?

Which of the following enables an inventor to legally enforce his right to exclude others from using his invention?