최신ISC CISSP-ISSMP - Information Systems Security Management Professional - CISSP-ISSMP무료샘플문제

A. Only technical controls require effectiveness testing

B. Control effectiveness is irrelevant once implementation is complete

C. If a control exists, it is automatically assumed to be effective

D. A control may be formally implemented (exists) but fail to operate as intended (ineffective) due to misconfiguration, gaps, or process failure

A. To comply with employee vacation policies

B. To simplify network diagrams

C. To reduce hardware costs

D. To prevent untested or insecure changes from directly impacting production systems and data

A. Vulnerability analysis

B. Gap analysis

C. Requirement analysis

D. Cost-benefit analysis

A. Post-attack phase

B. Out-attack phase

C. Pre-attack phase

D. Attack phase

A. Discretionary Access Control

B. Task-based Access Control

C. Mandatory Access Control

D. Role-Based Access Control

A. It determines actions and behaviors of a single individual within a system.

B. It ensures that modifications are not made to data by unauthorized personnel or processes.

C. It ensures that unauthorized modifications are not made to data by authorized personnel or processes.

D. It ensures reliable and timely access to resources.

A. Segregation eliminates the need for chain of custody procedures

B. Independence reduces conflict of interest risk when the investigation may involve IT staff themselves or systems they administer

C. IT operations should always lead insider threat investigations

D. Segregation is never necessary since IT and security share the same goals

A. HR supports personnel notification, emergency contact management, employee assistance, and staffing contingency plans during a disruptive event

B. HR's role is limited strictly to post-event disciplinary actions

C. HR involvement is only relevant for IT-related incidents

D. HR has no meaningful role in contingency planning

A. Ontrack

B. Forensic Sorter

C. DriveSpy

D. Device Seizure

A. If you don't know what to protect, how do you know you are protecting it?

B. If you don't know about your security resources you cannot protect your network.

C. If you are not protecting it (the critical and sensitive information), the adversary wins!

D. If you don't know the threat, how do you know what to protect?