CISSP Practice Test

CISSP Practice Test practice questions, page 16 of 20, with answer review and explanations.

Question 76

An international organization has decided to use a Software as a Service (SaaS) solution to support its business operations. Which of the following compliance standards should the organization use to assess the international code security and data privacy of the solution?

  1. Service Organization Control (SOC) 2
  2. Information Assurance Technical Framework (IATF)
  3. Health Insurance Portability and Accountability Act (HIPAA)
  4. Payment Card Industry (PCI)

Question 77

An authentication system that uses challenge and response was recently implemented on an organization's network, because the organization conducted an annual penetration test showing that testers were able to move laterally using authenticated credentials. Which attack method was MOST likely used to achieve this?

  1. Hash collision
  2. Pass the ticket
  3. Brute force
  4. Cross-Site Scripting (XSS)

Question 78

Which of the following would qualify as an exception to the "right to be forgotten" of the General Data Protection Regulation (GDPR)?

  1. For the establishment, exercise, or defense of legal claims
  2. The personal data has been lawfully processed and collected
  3. For the reasons of private interest
  4. The personal data remains necessary to the purpose for which it was collected

Question 79

Dumpster diving is a technique used in which stage of penetration testing methodology?

  1. Attack
  2. Reporting
  3. Planning
  4. Discovery

Question 80

Which of the following is performed to determine a measure of success of a security awareness training program designed to prevent social engineering attacks?

  1. Employee evaluation of the training program
  2. Internal assessment of the training program's effectiveness
  3. Multiple choice tests to participants
  4. Management control of reviews