Maximum Grades By Making ready With CISSP-ISSMP Dumps UPDATED 2026
Prepare CISSP-ISSMP Exam Questions [2026] Recently Updated Questions
NEW QUESTION # 184
Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?
- A. Exposure Factor (EF)
- B. Annualized Rate of Occurrence (ARO)
- C. Safeguard
- D. Single Loss Expectancy (SLE)
Answer: B
NEW QUESTION # 185
Which of the following processes is described in the statement below? "It is the process of implementing risk response plans, tracking identified risks, monitoring residual risk, identifying new risks, and evaluating risk process effectiveness throughout the project."
- A. Identify Risks
- B. Monitor and Control Risks
- C. Perform Qualitative Risk Analysis
- D. Perform Quantitative Risk Analysis
Answer: B
Explanation:
Monitor and Control Risk is the process of implementing risk response plans, tracking identified risks, monitoring residual risk, identifying new risks, and evaluating risk process effectiveness throughout the project. It can involve choosing alternative strategies, executing a contingency or fallback plan, taking corrective action, and modifying the project management plan. Answer option C is incorrect. This is the process of prioritizing risks for further analysis or action by accessing and combining their probability of occurrence and impact. Answer option B is incorrect.
This is the process of determining which risks may affect the project and documenting their characteristics.
Answer option D is incorrect. This is the process of numerically analyzing the effect of identified risks on overall project objectives.
Reference: "A Guide to the Project Management Body of Knowledge, (PMBOK Guide), Fourth Edition."
NEW QUESTION # 186
Which of the following is a variant with regard to Configuration Management?
- A. A CI that has the same essential functionality as another CI but a bit different in some small manner.
- B. A CI that particularly refers to a hardware specification.
- C. A CI thathas the same name as another CI but shares no relationship.
- D. A CI that particularly refers to a software version.
Answer: A
NEW QUESTION # 187
Which of the following analysis provides a foundation for measuring investment of time, money and human resources required to achieve a particular outcome?
- A. Requirement analysis
- B. Gap analysis
- C. Vulnerability analysis
- D. Cost-benefit analysis
Answer: B
Explanation:
Gap analysis is a tool that helps a company to compare its actual performance with its potential performance. It is a formal study of what a business is doing currently and where it wants to go in the future. Gap analysis provides a foundation for measuring investment of time, money and human resources required to achieve a particular outcome.
The goal of gap analysis is to identify the gap between the optimized allocation and integration of the inputs, and the current level of allocation. This helps provide the company with insight into areas, which could be improved. The gap analysis process involves determining, documenting and approving the variance between business requirements and current capabilities. Answer option A is incorrect. Vulnerability analysis is also known as vulnerability assessment. It is a process that defines systematic examination of a critical infrastructure, identifies and classifies the security vulnerabilities in a computer, network, or communications infrastructure. In addition, vulnerability analysis forecasts the effectiveness of proposed countermeasures, identifies the security deficiencies, evaluates the security alternatives, and verifies the adequacy of such measures after implementation.
Answer option B is incorrect. A cost benefit analysis is a technique related to the cost effectiveness of different alternatives in order to see whether the benefits outweigh the costs. Its aim is to gauge the efficiency of the intervention relative to the status quo.
NEW QUESTION # 188
Which of the following strategies is used to minimize the effects of a disruptive event on a company, and is created to prevent interruptions to normal business activity?
- A. Business Continuity Plan
- B. Contingency Plan
- C. Continuity of Operations Plan
- D. Disaster Recovery Plan
Answer: A
NEW QUESTION # 189
Which of the following BEST describes the concept of "risk transfer via contractual indemnification" and its limitation?
- A. Indemnification clauses guarantee full recovery of all losses in every case
- B. Indemnification is identical to insurance and requires no contract
- C. Indemnification shifts specified financial responsibility to another party contractually, but its value depends on the indemnifying party's financial capacity and the clause's specific scope/limitations
- D. Indemnification eliminates all forms of risk entirely
Answer: C
Explanation:
An indemnification clause is only as good as the counterparty's ability to pay and the specific scope of what's covered (often with caps/exclusions); it's a risk transfer tool with practical limitations, not a guarantee of full recovery.
NEW QUESTION # 190
Which of the following is a name, symbol, or slogan with which a product is identified?
- A. Patent
- B. Copyright
- C. Trade secret
- D. Trademark
Answer: D
NEW QUESTION # 191
Which of the following is the best method to stop vulnerability attacks on a Web server?
- A. Using strong passwords
- B. Installing service packs and updates
- C. Configuring a firewall
- D. Implementing the latest virus scanner
Answer: B
NEW QUESTION # 192
Which of the following statements reflect the 'Code of Ethics Canons' in the '(ISC)2 Code of Ethics'? Each correct answer represents a complete solution. Choose all that apply.
- A. Give guidance for resolving good versus good and bad versus bad dilemmas.
- B. Provide diligent and competent service to principals.
- C. Act honorably, honestly, justly, responsibly, and legally.
- D. Protect society, the commonwealth, and the infrastructure.
Answer: B,C,D
NEW QUESTION # 193
Drop the appropriate value to complete the formula.
Answer:
Explanation:
Explanation:
A Single Loss Expectancy (SLE) is the value in dollar ($) that is assigned to a single event.
The SLE can be calculated by the following formula.
SLE = Asset Value ($) X Exposure Factor (EF)
The Exposure Factor (EF) represents the % of assets loss caused by a threat.
The EF is required to calculate the Single Loss Expectancy (SLE).
The Annualized Loss Expectancy (ALE) can be calculated by multiplying the Single Loss Expectancy (SLE) with the Annualized Rate of Occurrence (ARO).
Annualized Loss Expectancy (ALE) = Single Loss Expectancy (SLE) X Annualized Rate of Occurrence (ARO) Annualized Rate of Occurrence (ARO) is a number that represents the estimated frequency in which a threat is expected to occur. It is calculated based upon the probability of the event occurring and the number of employees that could make that event occur.
Reference: "http.//en.wikipedia.org/wiki/Risk_management"
NEW QUESTION # 194
Which of the following BCP teams provides clerical support to the other teams and serves as a message center for the user-recovery site?
- A. Administrative support team
- B. Data preparation and records team
- C. Security team
- D. Emergency operations team
Answer: A
NEW QUESTION # 195
Which of the following steps is the initial step in developing an information security strategy?
- A. Perform a technical vulnerabilities assessment.
- B. Assess the current levels of security awareness.
- C. Analyze the current business strategy.
- D. Perform a business impact analysis.
Answer: C
Explanation:
Prior to assessing technical vulnerabilities or levels of security awareness, an information security manager needs to gain an understanding of the current business strategy and direction.
Answer options A and B are incorrect. These are the invalid answers because prior to assessing technical vulnerabilities or levels of security awareness, an information security manager needs to gain an understanding of the current business strategy and direction. Answer option C is incorrect. A business impact analysis is performed prior to developing a business continuity plan, but this would not be an appropriate first step in developing an information security strategy.
Reference: CISM Review Manual 2010, Contents: "Information Security Governance"
NEW QUESTION # 196
Which of the following architecturally related vulnerabilities is a hardware or software mechanism, which was installed to permit system maintenance and to bypass the system's security protections?
- A. Lack of parameter checking
- B. Time of Check to Time of Use (TOC/TOU) attack
- C. Maintenance hook
- D. Covert channel
Answer: C
Explanation:
Maintenance hook is a hardware or software mechanism, which is installed to permit system maintenance and to bypass the system's security protections. This vulnerability is sometimes referred to as a trapdoor.
Answer option D is incorrect. Covert channel is an unintended communication lane between two or more subjects sharing a common resource, which supports the transfer of information in such a manner that violates the system's security policy.
Answer option B is incorrect. Lack of parameter checking is the failure to check the size of input streams specified by parameters.
Answer option C is incorrect. Time of Check to Time of Use (TOC/TOU) is an attack that exploits the difference in the time in which the security controls were applied and the time the authorized service was used.
Reference: CISM Review Manual 2010, Contents. "Information Security Program Management"
NEW QUESTION # 197
Eric is the project manager of the NQQ Project and has hired the ZAS Corporation to complete part of the project work for Eric's organization.
Due to a change request the ZAS Corporation is no longer needed on the project even though they have completed nearly all of the project work. Is Eric's organization liable to pay the ZAS Corporation for the work they have completed so far on the project?
- A. Yes, the ZAS Corporation did not choose to terminate the contract work.
- B. It depends on what the outcome of a lawsuit will determine.
- C. No, the ZAS Corporation did not complete all of the work.
- D. It depends on what the termination clause of the contract stipulates.
Answer: D
Explanation:
To make a payment or not to make it depends on what the termination clause of the contract stipulates.
Answer option D is incorrect. The termination clause of the contract is the best input for this decision.
Answer option A is incorrect. While the ZAS Corporation did not choose to terminate the contract work the contract terms may stipulate other terms for early termination. Answer option B is incorrect. There's no indication of a lawsuit yet.
Reference: Chapter 12. A Guide to the Project Management Body of Knowledge, (PMBOK Guide), Fourth Edition, ISBN:9781933890517, Section 12.4.
NEW QUESTION # 198
Which of the following plans provides procedures for recovering business operations immediately following a disaster?
- A. Continuity of operation plan
- B. Business continuity plan
- C. Disaster recovery plan
- D. Business recovery plan
Answer: D
Explanation:
The business recovery plan is used to provide measures for recovery in business operations directly following a disaster. Unlike the BCP, it lacks procedures to ensure continuity of critical processes throughout an emergency or disruption.
Answer option B is incorrect. Business Continuity Planning (BCP) is the creation and validation of a practiced logistical plan for how an organization will recover and restore partially or completely interrupted critical (urgent) functions within a predetermined time after a disaster or extended disruption. The logistical plan is called a business continuity plan. Answer option A is incorrect. A disaster recovery plan should contain data, hardware, and software that can be critical for a business. It should also include the plan for sudden loss such as hard disc crash. The business should use backup and data recovery utilities to limit the loss of data. Answer option C is incorrect. The Continuity Of Operation Plan (COOP) refers to the preparations and institutions maintained by the United States government, providing survival of federal government operations in the case of catastrophic events. It provides procedures and capabilities to sustain an organization's essential. COOP is the procedure documented to ensure persistent critical operations throughout any period where normal operations are unattainable.
Reference: CISM Review Manual 2010, Contents. "Incident management and response"
NEW QUESTION # 199
You work as a security manager for SoftTech Inc. You are conducting a security awareness campaign for your employees. Which of the following ideas will you consider the best when conducting a security awareness campaign?
- A. Provide technical details on exploits.
- B. Provide customized messages for different groups.
- C. Target senior managers and business process owners.
- D. Target system administrators and the help desk.
Answer: B
Explanation:
Providing customized messages for different groups is the best idea to be considered by any security manager while conducting a security awareness campaign. This method helps ensure that the message offered fulfills the overall need of the organization and that the business unit feels that the message is intended for their requirements.
NEW QUESTION # 200
......
Give push to your success with CISSP-ISSMP exam questions: https://www.exams-boost.com/CISSP-ISSMP-valid-materials.html