ISC CISSP

Which security principle grants only the permissions required for a task?

Which combination provides two different authentication factor types?

What is a cryptographic hash primarily used to verify?

A business owner accepts a documented residual risk within delegated authority. What does this decision mean?

A company can tolerate losing at most 30 minutes of recent transaction data. Which recovery objective addresses this requirement?

A critical service must resume within two hours after disruption. Which objective expresses this target?

Which role normally determines the business classification of an information asset?

An employee can request a payment but a different employee must approve it. Which control is illustrated?

Which activity best demonstrates that a disaster recovery plan is usable?

A record must remain readable for seven years. Which encryption consideration matters beyond choosing an algorithm?

Why should security requirements enter a project before implementation starts?

A building uses badges, guards and door alarms. Which principle does the combination illustrate?

Which evidence-handling practice supports accountability for a collected device?

Which statement correctly distinguishes due care from due diligence in common security usage?

Why should an organization inventory data flows before a privacy assessment?

Which metric directly estimates the expected yearly financial loss for one risk scenario?

An asset is valued at $200,000 and a scenario's exposure factor is 25%. What is the single loss expectancy?

What is the main purpose of a business impact analysis?

Which access model assigns permissions primarily through job functions?

Why should privileged access be periodically recertified?