2022 Updated Verified Pass CISMP-V9 Exam – Real Questions & Answers [Q39-Q63] – IT Certification Exam Questions & Answers

Rate this post

2022 Updated Verified Pass CISMP-V9 Exam – Real Questions and Answers

Dumps Moneyack Guarantee – CISMP-V9 Dumps Approved Dumps

NO.39 When securing a wireless network, which of the following is NOT best practice?

Using WPA encryption on the wireless network.

Use MAC tittering on a SOHO network with a smart group of clients.

Dedicating an access point on a dedicated VLAN connected to a firewall.

Turning on SSID broadcasts to advertise security levels.

NO.40 In business continuity, what is a battle box?

A portable container that holds Items and information useful in the event of an organisational disaster.

An armoured box that holds all an organisation’s backup databases.

A collection of tools and protective equipment to be used in the event of civil disturbance.

A list of names and addresses of staff to be utilised should industrial action prevent access to a building.
http://www.battlebox.biz/why.asp

NO.41 Which three of the following characteristics form the AAA Triad in Information Security?
1. Authentication
2. Availability
3. Accounting
4. Asymmetry
5. Authorisation

1, 2 and 3.

2, 4, and 5.

1, 3 and 4.

1, 3 and 5.

NO.42 Which of the following describes a qualitative risk assessment approach?

A subjective assessment of risk occurrence likelihood against the potential impact that determines the overall severity of a risk.

The use of verifiable data to predict the risk occurrence likelihood and the potential impact so as to determine the overall severity of a risk.

The use of Monte-Carlo Analysis and Layers of Protection Analysis (LOPA) to determine the overall severity of a risk.

The use of Risk Tolerance and Risk Appetite values to determine the overall severity of a risk

NO.43 In business continuity (BC) terms, what is the name of the individual responsible for recording all pertinent information associated with a BC exercise or real plan invocation?

Recorder.

Desk secretary.

Scribe.

Scrum Master.

NO.44 Which of the following testing methodologies TYPICALLY involves code analysis in an offline environment without ever actually executing the code?

Dynamic Testing.

Static Testing.

User Testing.

Penetration Testing.

NO.45 What type of attack attempts to exploit the trust relationship between a user client based browser and server based websites forcing the submission of an authenticated request to a third party site?

XSS.

Parameter Tampering

SQL Injection.

CSRF.

NO.46 What Is the PRIMARY reason for organisations obtaining outsourced managed security services?

Managed security services permit organisations to absolve themselves of responsibility for security.

Managed security services are a de facto requirement for certification to core security standards such as ISG/IEC 27001

Managed security services provide access to specialist security tools and expertise on a shared, cost-effective basis.

Managed security services are a powerful defence against litigation in the event of a security breach or incident

NO.47 How might the effectiveness of a security awareness program be effectively measured?
1) Employees are required to take an online multiple choice exam on security principles.
2) Employees are tested with social engineering techniques by an approved penetration tester.
3) Employees practice ethical hacking techniques on organisation systems.
4) No security vulnerabilities are reported during an audit.
5) Open source intelligence gathering is undertaken on staff social media profiles.

3, 4 and 5.

2, 4 and 5.

1, 2 and 3.

1, 2 and 5.

NO.48 Select the document that is MOST LIKELY to contain direction covering the security and utilisation of all an organisation’s information and IT equipment, as well as email, internet and telephony.

Cryptographic Statement.

Security Policy Framework.

Acceptable Usage Policy.

Business Continuity Plan.

NO.49 One traditional use of a SIEM appliance is to monitor for exceptions received via syslog.
What system from the following does NOT natively support syslog events?

Enterprise Wireless Access Point.

Windows Desktop Systems.

Linux Web Server Appliances.

Enterprise Stateful Firewall.

NO.50 Which of the following is considered to be the GREATEST risk to information systems that results from deploying end-to-end Internet of Things (IoT) solutions?

Use of ‘cheap” microcontroller based sensors.

Much larger attack surface than traditional IT systems.

Use of proprietary networking protocols between nodes.

Use of cloud based systems to collect loT data.

NO.51 Which standard deals with the implementation of business continuity?

ISO/IEC 27001

COBIT

IS0223G1.

BS5750.

NO.52 Which algorithm is a current specification for the encryption of electronic data established by NIST?

RSA.

AES.

DES.

PGP.
https://www.nist.gov/publications/advanced-encryption-standard-aes

NO.53 What Is the PRIMARY security concern associated with the practice known as Bring Your Own Device (BYOD) that might affect a large organisation?

Most BYOD involves the use of non-Windows hardware which is intrinsically insecure and open to abuse.

The organisation has significantly less control over the device than over a corporately provided and managed device.

Privately owned end user devices are not provided with the same volume nor frequency of security patch updates as a corporation.

Under GDPR it is illegal for an individual to use a personal device when handling personal information under corporate control.

NO.54 Which of the following types of organisation could be considered the MOST at risk from the theft of electronic based credit card data?

Online retailer.

Traditional market trader.

Mail delivery business.

Agricultural producer.

NO.55 When calculating the risk associated with a vulnerability being exploited, how is this risk calculated?

Risk = Likelihood * Impact.

Risk = Likelihood / Impact.

Risk = Vulnerability / Threat.

Risk = Threat * Likelihood.

NO.56 What term is used to describe the act of checking out a privileged account password in a manner that bypasses normal access controls procedures during a critical emergency situation?

Privileged User Gateway

Enterprise Security Management

Multi Factor Authentication.

Break Glass

NO.57 Which security framework impacts on organisations that accept credit cards, process credit card transactions, store relevant data or transmit credit card data?

PCI DSS.

TOGAF.

ENISA NIS.

Sarbanes-Oxiey
https://digitalguardian.com/blog/what-pci-compliance

NO.58 Which of the following is NOT considered to be a form of computer misuse?

Illegal retention of personal data.

Illegal interception of information.

Illegal access to computer systems.

Downloading of pirated software.

NO.59 Why should a loading bay NEVER be used as a staff entrance?

Loading bays are intrinsically vulnerable, so minimising the people traffic makes securing the areas easier and more effective.

Loading bays are often dirty places, and staff could find their clothing damaged or made less appropriate for the office.

Most countries have specific legislation covering loading bays and breaching this could impact on insurance status.

Staff should always enter a facility via a dedicated entrance to ensure smooth access and egress.

NO.60 What form of risk assessment is MOST LIKELY to provide objective support for a security Return on Investment case?

ISO/IEC 27001.

Qualitative.

CPNI.

Quantitative

NO.61 When preserving a crime scene for digital evidence, what actions SHOULD a first responder initially make?

Remove power from all digital devices at the scene to stop the data changing.

Photograph all evidence and triage to determine whether live data capture is necessary.

Remove all digital evidence from the scene to prevent unintentional damage.

Don’t touch any evidence until a senior digital investigator arrives.
https://www.ncjrs.gov/pdffiles1/nij/219941.pdf

NO.62 When considering outsourcing the processing of data, which two legal “duty of care” considerations SHOULD the original data owner make?
1 Third party is competent to process the data securely.
2. Observes the same high standards as data owner.
3. Processes the data wherever the data can be transferred.
4. Archive the data for long term third party’s own usage.

2 and 3.

3 and 4.

1 and 4.

1 and 2.

NO.63 Which of the following compliance legal requirements are covered by the ISO/IEC 27000 series?
1. Intellectual Property Rights.
2. Protection of Organisational Records
3. Forensic recovery of data.
4. Data Deduplication.
5. Data Protection & Privacy.

1, 2 and 3

3, 4 and 5

2, 3 and 4

1, 2 and 5

Loading …

What is the exam cost of the BCS CISMP-V9 Certification Exam

The total cost is 164.25 USD and may be subject to change.

BCS CISMP-V9 Certification

How can you start preparation for BCS CISMP-V9 Certification

Introduction of BCS CISMP-V9 Certification

The BCS CISMP-V9 Exam is designed to test your ability to apply knowledge of information security to mitigate risks. This certification requires an expert level of understanding in Network Security, Threats and Vulnerabilities, Malware Protection, Application Security, Access Controls, and Identity Management which are also covered in our BCS CISMP-V9 Dumps. It is recommended for professionals who have been working in the information security field for at least five years or who have completed a bachelor’s degree majoring in computer science with a specialization in cybersecurity courses.

Updated PDF (New 2022) Actual BCS CISMP-V9 Exam Questions: https://www.it-tests.com/CISMP-V9.html