Updated Aug-2026 Exam CISSP Dumps – Pass Your Certification Exam [Q716-Q738]

Rate this post

Updated Aug-2026 Exam CISSP Dumps – Pass Your Certification Exam

Latest Real ISC CISSP Exam Dumps Questions

QUESTION 716
What is the MOST common component of a vulnerability management framework?

Risk analysis

Patch management

Threat analysis

Backup management

QUESTION 717
A software developer installs a game on their organization-provided smartphone. Upon installing the game, the software developer is prompted to allow the game access to call logs, Short Message Service (SMS) messaging, and Global Positioning System (GPS) location data. What has the game MOST likely introduced to the smartphone?

Alerting

Vulnerability

Geo-fencing

Monitoring

QUESTION 718
Drag the following Security Engineering terms on the left to the BEST definition on the right.

QUESTION 719
Which of the following actions should be performed when implementing a change to a database schema in a production system?

Test in development, determine dates, notify users, and implement in production

Apply change to production, run in parallel, finalize change in production, and develop a back-out strategy

Perform user acceptance testing in production, have users sign off, and finalize change

Change in development, perform user acceptance testing, develop a back-out strategy, and implement change

QUESTION 720
An organization recently upgraded to a Voice over Internet Protocol (VoIP) phone system. Management is concerned with unauthorized phone usage. security consultant is responsible for putting together a plan to secure these phones. Administrators have assigned unique personal identification number codes for each person in the organization. What is the BEST solution?

Use phone locking software to enforce usage and PIN policies.

Inform the user to change the PIN regularly. Implement call detail records (CDR) reports to track usage.

Have the administrator enforce a policy to change the PIN regularly. Implement call detail records (CDR) reports to track usage.

Have the administrator change the PIN regularly. Implement call detail records (CDR) reports to track usage.

QUESTION 721
Which choice below is usually the number one used criterion to determine
the classification of an information object?

Age

Personal association

Useful life

Value

QUESTION 722
Which of the following is the BEST reason for writing an information security policy?

To support information security governance

To reduce the number of audit findings

To deter attackers

To implement effective information security controls

QUESTION 723
Which of the following is NOT a common category/classification of threat to an IT system?

Human

Natural

Technological

Hackers

QUESTION 724
Personally Identifiable Information (PIT) is becoming an extremely valuable asset to both organizations and hackers. Which of the following controls will BEST protect Pll from being leaked or intercepted?

Grant access to data on a reed-to-know basis.

Regularly encrypt and backup Pll database.

Implement secure data transfer mechanism.

Create a policy and procedure describing the proper handling of Pll.

QUESTION 725
Which of the following standards concerns digital certificates?

X.400

X.25

X.509

X.75

QUESTION 726
Which of the following resources is BEST located within a network’s Demilitarized Zone (DMZ)?

File Server

Domain Name System (DNS) Server

Dynamic Host Configuration Protocol (DHCP) Server

Database Gerver

QUESTION 727
What is the Maximum Tolerable Downtime (MTD)?

Maximum elapsed time required to complete recovery of application data

Minimum elapsed time required to complete recovery of application data

Maximum elapsed time required to move back to primary site after a major disruption

It is maximum delay businesses can tolerate and still remain viable

The Maximum Tolerable Downtime (MTD) is the maximum length of time a BUSINESS FUNCTION can endure without being restored, beyond which the BUSINESS is no longer viable
NIST SAYS: The ISCP Coordinator should analyze the supported mission/business processes and with the process owners, leadership and business managers determine the acceptable downtime if a given process or specific system data were disrupted or otherwise unavailable. Downtime can be identified in several ways.
Maximum Tolerable Downtime (MTD). The MTD represents the total amount of time the system owner/authorizing official is willing to accept for a mission/business process outage or disruption and includes all impact considerations. Determining MTD is important because it could leave contingency planners with imprecise direction on selection of an appropriate recovery method, and the depth of detail which will be required when developing recovery procedures, including their scope and content.
Other BCP and DRP terms you must be familiar with are: Recovery Time Objective (RTO). RTO defines the maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources, supported mission/business processes, and the MTD. Determining the information system resource RTO is important for selecting appropriate technologies that are best suited for meeting the MTD. When it is not feasible to immediately meet the RTO and the MTD is inflexible, a Plan of Action and Milestone should be initiated to document the situation and plan for its mitigation.
Recovery Point Objective (RPO). The RPO represents the point in time, prior to a disruption or system outage, to which mission/business process data can be recovered (given the most recent backup copy of the data) after an outage. Unlike RTO, RPO is not considered as part of MTD. Rather, it is a factor of how much data loss the mission/business process can tolerate during the recovery process. Because the RTO must ensure that the MTD is not exceeded, the RTO must normally be shorter than the MTD. For example, a system outage may prevent a particular process from being completed, and because it takes time to reprocess the data, that additional processing time must be added to the RTO to stay within the time limit established by the MTD.
References used for this question: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Page 276. and http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata-Nov11-2010.pdf

QUESTION 728
A message can be encrypted and digitally signed, which provides:

Confidentiality, Authentication, Non-repudiation, and Integrity.

Confidentiality and Authentication

Confidentiality and Non-repudiation

Confidentiality and Integrity.

Explanation/Reference:
Confidentiality ensures that a message can only be read by the intended recipient. Encrypting a message provides confidentiality.
A digital signature provides Authentication, Non-repudiation, and Integrity.
The purpose of digital signatures is to detect unauthorized modifications of data, and to authenticate the identity of the signatories and non-repudiation. These functions are accomplished by generating a block of data that is usually smaller than the size of the original data. This smaller block of data is bound to the original data and to the identity of the sender. This binding verifies the integrity of data and provides non- repudiation. To quote the National Institute Standards and Technology (NIST) Digital Signature Standard (DSS): Digital signatures are used to detect unauthorized modifications to data and to authenticate the identity of the signatory. In addition, the recipient of signed data can use a digital signature in proving to a third party that the signature was in fact generated by the signatory.
Different steps and algorithms provide different types of security services:
A message can be encrypted, which provides confidentiality.

A message can be hashed, which provides integrity

A message can be digitally signed, which provides authentication, nonrepudiation, and integrity.

A message can be encrypted and digitally signed, which provides confidentiality, authentication,

nonrepudiation, and integrity
Incorrect Answers:
B: A digital signature provides Authentication, Non-repudiation, and Integrity; not just Authentication.
C: A digital signature provides Authentication, Non-repudiation, and Integrity; not just Non-repudiation.
D: A digital signature provides Authentication, Non-repudiation, and Integrity; not just Integrity.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 829-830 Krutz, Ronald L. and Russel Dean Vines, The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, New York, 2001, p. 151

QUESTION 729
What is the MOST important goal of conducting security assessments?

To prepare the organization for an external audit, particularly by a regulatory entity

To discover unmitigated security vulnerabilities, and propose paths for mitigating them

To align the security program with organizational risk appetite

To demonstrate proper function of security controls and processes to senior management

QUESTION 730
What principle requires that changes to the plaintext affect many parts of the ciphertext?

Diffusion

Encapsulation

Obfuscation

Permutation

QUESTION 731
A shared resource matrix is a technique commonly used to locate:

Malicious code

Security flaws

Trap doors

Covert channels

QUESTION 732
Including a Trusted Platform Module (TPM) in the design of a computer system is an example of a technique to what?

Interface with the Public Key Infrastructure (PKI)

Improve the quality of security software

Prevent Denial of Service (DoS) attacks

Establish a secure initial state

QUESTION 733
What is a programmable logic device (PLD)?

Random Access Memory (RAM) that contains the software to perform specific tasks

An integrated circuit with connections or internal logic gates that can be changed through a programming process

A volatile device

A program resident on disk memory that executes a specific function

QUESTION 734
Refer to the information below to answer the question.
Desktop computers in an organization were sanitized for re-use in an equivalent security environment. The data was destroyed in accordance with organizational policy and all marking and other external indications of the sensitivity of the data that was formerly stored on the magnetic drives were removed.
After magnetic drives were degaussed twice according to the product manufacturer’s directions, what is the MOST LIKELY security issue with degaussing?

Commercial products often have serious weaknesses of the magnetic force available in the degausser product.

Degausser products may not be properly maintained and operated.

The inability to turn the drive around in the chamber for the second pass due to human error.

Inadequate record keeping when sanitizing mediA.

QUESTION 735
When recovering from an outage, what is the Recovery Point Objective (RPO), in terms of data recovery?

The RPO is the maximum amount of time for which loss of data is acceptable.

The RPO is the minimum amount of data that needs to be recovered.

The RPO is a goal to recover a targeted percentage of data lost.

The RPO is the amount of time it takes to recover an acceptable percentage of data lost.

QUESTION 736
Which of the following can be defined as the process of rerunning a portion of the test scenario or test plan to ensure that changes or corrections have not introduced new errors?

Unit testing

Pilot testing

Regression testing

Parallel testing

QUESTION 737
In order to enable users to perform tasks and duties without having to go through extra steps it is important that the security controls and mechanisms that are in place have a degree of?

Complexity

Non-transparency

Transparency

Simplicity

The security controls and mechanisms that are in place must have a degree of transparency.
This enables the user to perform tasks and duties without having to go through extra steps because of the presence of the security controls. Transparency also does not let the user know too much about the controls, which helps prevent him from figuring out how to circumvent them. If the controls are too obvious, an attacker can figure out how to compromise them more easily.
Security (more specifically, the implementation of most security controls) has long been a sore point with users who are subject to security controls. Historically, security controls have been very intrusive to users, forcing them to interrupt their work flow and remember arcane codes or processes (like long passwords or access codes), and have generally been seen as an obstacle to getting work done. In recent years, much work has been done to remove that stigma of security controls as a detractor from the work process adding nothing but time and money. When developing access control, the system must be as transparent as possible to the end user. The users should be required to interact with the system as little as possible, and the process around using the control should be engineered so as to involve little effort on the part of the user.
For example, requiring a user to swipe an access card through a reader is an effective way to ensure a person is authorized to enter a room. However, implementing a technology
(such as RFID) that will automatically scan the badge as the user approaches the door is more transparent to the user and will do less to impede the movement of personnel in a busy area.
In another example, asking a user to understand what applications and data sets will be required when requesting a system ID and then specifically requesting access to those resources may allow for a great deal of granularity when provisioning access, but it can hardly be seen as transparent. A more transparent process would be for the access provisioning system to have a role-based structure, where the user would simply specify the role he or she has in the organization and the system would know the specific resources that user needs to access based on that role. This requires less work and interaction on the part of the user and will lead to more accurate and secure access control decisions because access will be based on predefined need, not user preference.
When developing and implementing an access control system special care should be taken to ensure that the control is as transparent to the end user as possible and interrupts his work flow as little as possible.
The following answers were incorrect:
All of the other detractors were incorrect.
Reference(s) used for this question:
HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 6th edition. Operations
Security, Page 1239-1240
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (Kindle Locations
25278-25281). McGraw-Hill. Kindle Edition.
Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition :
Access Control ((ISC)2 Press) (Kindle Locations 713-729). Auerbach Publications. Kindle
Edition.

QUESTION 738
To comply with industry requirements, a security assessment on the cloud server should identify which protocols and weaknesses are being exposed to attackers on the Internet.
Which of the following tools is the MOST appropriate to complete the assessment?

Use tcpdump and parse the output file in a protocol analyzer.

Use an IP scanner and target the cloud WAN network addressing

Run netstat in each cloud server and retrieve the running processes.

Use nmap and set the servers’ public IPs as the targets.