CISSP Free Practice Test

- (Exam Topic 9)
Which of the following is the MOST important consideration when storing and processing Personally Identifiable Information (PII)?

1. A. Encrypt and hash all PII to avoid disclosure and tampering.
2. B. Store PII for no more than one year.
3. C. Avoid storing PII in a Cloud Service Provider.
4. D. Adherence to collection limitation laws and regulations.

Correct Answer: D

- (Exam Topic 13)
What capability would typically be included in a commercially available software package designed for access control?

1. A. Password encryption
2. B. File encryption
3. C. Source library control
4. D. File authentication

Correct Answer: A

- (Exam Topic 14)
Which inherent password weakness does a One Time Password (OTP) generator overcome?

1. A. Static passwords must be changed frequently.
2. B. Static passwords are too predictable.
3. C. Static passwords are difficult to generate.
4. D. Static passwords are easily disclosed.

Correct Answer: D

- (Exam Topic 14)
What is the threat modeling order using process for Attack simu-lation and threat analysis (PASTA)?

1. A. Application decomposition, threat analysis, vulnerability detection, attack enumeration, risk/impact analysis
2. B. Threat analysis, vulnerability detection, application decomposition, attack enumeration, risk/Impact analysis
3. C. Risk/impact analysis, application decomposition, threat analysis, vulnerability detection, attack enumeration
4. D. Application decomposition, threat analysis, risk/impact analysis, vulnerability detection, attack enumeration

Correct Answer: A

- (Exam Topic 8)
When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?

1. A. After the system preliminary design has been developed and the data security categorization has been performed
2. B. After the vulnerability analysis has been performed and before the system detailed design begins
3. C. After the system preliminary design has been developed and before the data security categorization begins
4. D. After the business functional analysis and the data security categorization have been performed

Correct Answer: D