Mar-2023 Free BCS CISMP-V9 Exam Question Practice Exams [Q48-Q69] – Unlimited Lifetime Access Free Exams PDF

5/5 - (3 votes)

Mar-2023 Free BCS CISMP-V9 Exam Question Practice Exams

Ace CISMP-V9 Certification with 102 Actual Questions

Introduction of BCS CISMP-V9 Certification Exam

BCS CISMP-V9 certification exam is an industry-recognized certification for information security that also serves as a terminal degree program in the field of information security. BCS CISMP-V9 certification exam was developed to test your understanding of information security, and how to apply it. BCS CISMP-V9 certification exam is a dual certification where one certification required for job roles includes the information/information security area, and another requirement required for higher-level positions in information security includes the entire cybersecurity spectrum which are all included in BCS CISMP-V9 Dumps. The most important advantage of the BCS CISMP-V9 certification exam is that it allows you to pursue several career paths. It is recommended for professionals who have been working in the information security field for at least five years or who have completed a bachelor’s degree majoring in computer science with a specialization in cybersecurity courses.

Q48. Which of the following is considered to be the GREATEST risk to information systems that results from deploying end-to-end Internet of Things (IoT) solutions?

Use of ‘cheap” microcontroller based sensors.

Much larger attack surface than traditional IT systems.

Use of proprietary networking protocols between nodes.

Use of cloud based systems to collect loT data.

Q49. Which of the following subjects is UNLIKELY to form part of a cloud service provision laaS contract?

User security education.

Intellectual Property Rights.

End-of-service.

Liability

Q50. By what means SHOULD a cloud service provider prevent one client accessing data belonging to another in a shared server environment?

By ensuring appropriate data isolation and logical storage segregation.

By using a hypervisor in all shared severs.

By increasing deterrent controls through warning messages.

By employing intrusion detection systems in a VMs.

Q51. What Is the first yet MOST simple and important action to take when setting up a new web server?

Change default system passwords.

Fully encrypt the hard disk.

Apply hardening to all applications.

Patch the OS to the latest version

Q52. Which of the following international standards deals with the retention of records?

PCI DSS.

RFC1918.

IS015489.

ISO/IEC 27002.

Q53. Which standard deals with the implementation of business continuity?

ISO/IEC 27001

COBIT

IS0223G1.

BS5750.

Q54. What is the name of the method used to illicitly target a senior person in an organisation so as to try to coerce them Into taking an unwanted action such as a misdirected high-value payment?

Whaling.

Spear-phishing.

C-suite spamming.

Trawling.

Q55. Which of the following uses are NOT usual ways that attackers have of leveraging botnets?

Generating and distributing spam messages.

Conducting DDOS attacks.

Scanning for system & application vulnerabilities.

Undertaking vishing attacks

Q56. A system administrator has created the following “array” as an access control for an organisation.
Developers: create files, update files.
Reviewers: upload files, update files.
Administrators: upload files, delete fifes, update files.
What type of access-control has just been created?

Task based access control.

Role based access control.

Rule based access control.

Mandatory access control.

Q57. How might the effectiveness of a security awareness program be effectively measured?
1) Employees are required to take an online multiple choice exam on security principles.
2) Employees are tested with social engineering techniques by an approved penetration tester.
3) Employees practice ethical hacking techniques on organisation systems.
4) No security vulnerabilities are reported during an audit.
5) Open source intelligence gathering is undertaken on staff social media profiles.

3, 4 and 5.

2, 4 and 5.

1, 2 and 3.

1, 2 and 5.

Q58. Which of the following statutory requirements are likely to be of relevance to all organisations no matter which sector nor geographical location they operate in?

Sarbanes-Oxley.

GDPR.

HIPAA.

FSA.

Q59. Which of the following is MOST LIKELY to be described as a consequential loss?

Reputation damage.

Monetary theft.

Service disruption.

Processing errors.

Q60. In order to better improve the security culture within an organisation with a top down approach, which of the following actions at board level is the MOST effective?

Appointment of a Chief Information Security Officer (CISO).

Purchasing all senior executives personal firewalls.

Adopting an organisation wide “clear desk” policy.

Developing a security awareness e-learning course.

Q61. In order to maintain the currency of risk countermeasures, how often SHOULD an organisation review these risks?

Once defined, they do not need reviewing.

A maximum of once every other month.

When the next risk audit is due.

Risks remain under constant review.

Q62. What Is the PRIMARY difference between DevOps and DevSecOps?

Within DevSecOps security is introduced at the end of development immediately prior to deployment.

DevSecOps focuses solely on iterative development cycles.

DevSecOps includes security on the same level as continuous integration and delivery.

DevOps mandates that security is integrated at the beginning of the development lifecycle.
https://www.viva64.com/en/b/0710/#:~:text=DevOps%20is%20a%20methodology%20aiming,in%20the%20software%20development%20process.&text=DevSecOps%20is%20a%20further%20development,code%20quality%20and%20reliability%20assurance.

Q63. When an organisation decides to operate on the public cloud, what does it lose?

The right to audit and monitor access to its information.

Control over Intellectual Property Rights relating to its applications.

Physical access to the servers hosting its information.

The ability to determine in which geographies the information is stored.

Q64. What types of web application vulnerabilities continue to be the MOST prolific according to the OWASP Top 10?

Poor Password Management.

Insecure Deserialsiation.

Injection Flaws.

Security Misconfiguration

Q65. Which types of organisations are likely to be the target of DDoS attacks?

Cloud service providers.

Any financial sector organisations.

Online retail based organisations.

Any organisation with an online presence.

Q66. What Is the KEY purpose of appending security classification labels to information?

To provide guidance and instruction on implementing appropriate security controls to protect the information.

To comply with whatever mandatory security policy framework is in place within the geographical location in question.

To ensure that should the information be lost in transit, it can be returned to the originator using the correct protocols.

To make sure the correct colour-coding system is used when the information is ready for archive.

Q67. For which security-related reason SHOULD staff monitoring critical CCTV systems be rotated regularly during each work session?

To reduce the chance of collusion between security staff and those being monitored.

To give experience to monitoring staff across a range of activities for training purposes.

Health and Safety regulations demand that staff are rotated to prevent posture and vision related harm.

The human attention span during intense monitoring sessions is about 20 minutes.

Q68. How does the use of a “single sign-on” access control policy improve the security for an organisation implementing the policy?

Password is better encrypted for system authentication.

Access control logs are centrally located.

Helps prevent the likelihood of users writing down passwords.

Decreases the complexity of passwords users have to remember.

Q69. When a digital forensics investigator is conducting art investigation and handling the original data, what KEY principle must they adhere to?

Ensure they are competent to be able to do so and be able to justify their actions.

Ensure they are being observed by a senior investigator in all actions.

Ensure they do not handle the evidence as that must be done by law enforcement officers.

Ensure the data has been adjusted to meet the investigation requirements.

Loading …