CISSP Free Practice Exam

5 questions would be shown from a total of 30 free practice questions to prepare you for CISSP exam. Enjoy!

1 / 5

1. Which of the following is true of Service Organization Control (SOC) reports?
Explanation/Reference:

A. SOC 3 Type 2 reports assess internal controls for financial reporting

B. SOC 1 Type 2 reports assess the security, confidentiality, integrity, and availability of an organization’s controls

C. SOC 2 Type 2 reports assess internal controls for financial reporting

D. SOC 2 Type 2 reports include information of interest to the service organization’s management

Reference: http://ssae16.businesscatalyst.com/SSAE16_reports.html

2 / 5

2. What testing technique enables the designer to develop mitigation strategies for potential vulnerabilities?
Explanation/Reference:

A. Threat modeling

B. Penetration testing

C. Source code review

D. Manual inspections and reviews

Reference: https://owasp.org/www-project-web-security-testing-guide/assets/archive/ OWASP_Testing_Guide_v4.pdf (15)

3 / 5

3. Which of the following BEST describes the responsibilities of a data owner?
Explanation/Reference:

A. Ensuring accessibility to appropriate users, maintaining appropriate levels of data security

B. Ensuring quality and validation through periodic audits for ongoing data integrity

C. Determining the impact the information has on the mission of the organization

D. Maintaining fundamental data availability, including data storage and archiving

Reference: http://resources.infosecinstitute.com/category/certifications-training/cissp/domains/asset-security/ data-and-system-ownership/#gref

4 / 5

4. Which of the following is the BEST definition of Cross-Site Request Forgery (CSRF)?
Explanation/Reference:

A. An attack which forces an end user to execute unwanted actions on a web application in which they are currently authenticated

B. An attack that makes an illegal request across security zones and thereby forges itself into the security database of the system

C. An attack that forges a false Structure Query Language (SQL) command across systems

D. An attack that injects a script into a web page to execute a privileged command

Reference: https://portswigger.net/web-security/csrf

5 / 5

5. An application team is running tests to ensure that user entry fields will not accept invalid input of any length.
Explanation/Reference:
What type of negative testing is this an example of?

A. Session testing

B. Allowed number of characters

C. Reasonable data

D. Population of required fields

Reference: https://www.softwaretestinghelp.com/what-is-negative-testing/

Free sign-up(click) to

1. skip this part 2. access all free questions 3. show explanations

Your score is

The average score is 54%

CISSP Free Practice Test

Log in and start practising

Free sign-up(click) to

1. skip this part 2. access all free questions 3. show explanations

Company

Learn More

Click below to chat on WhatsApp

CISSP Free Practice Test

Log in and start practising

Free sign-up(click) to

1. skip this part 2. access all free questions 3. show explanations

Company

Learn More

Click below to chat on WhatsApp

More learning resources are waiting for you!