BCS Foundation Certificate in Information Security Management Principles V9.0 CISMP-V9 Exam Questions

1. What physical security control would be used to broadcast false emanations to mask the presence of true electromagentic emanations from genuine computing equipment?

2. In software engineering, what does ‘Security by Design”mean?

3. Which of the following is the MOST important reason for undertaking Continual Professional Development (CPD)within the Information Securitysphere?

4. What form of training SHOULD developers be undertaking to understand the security of the code they have written and how it can improve security defence whilst being attacked?

5. What advantage does the delivery of online security training material have over the distribution of printed media?

6. Why have MOST European countries developed specific legislation that permits police and security services to monitor communications traffic for specific purposes, such as the detection of crime?

7. Which algorithm is a current specification for the encryption of electronic data established by NIST?

8. When calculating the risk associated with a vulnerability being exploited, how is this risk calculated?

9. In a security governance framework, which of the following publications would be at the HIGHEST level?

10. Which term is used to describe the set of processes that analyses code to ensure defined coding practices are being followed?

11. How does network visualisation assist in managing information security?

12. What type of attack could directly affect the confidentiality of an unencrypted VoIP network?

13. What form of attack against an employee has the MOST impact on their compliance with the organisation’s "code of conduct"?

14. Which of the following uses are NOT usual ways that attackers have of leveraging botnets?

15. Whatis the name of the method used to illicitly target a senior person in an organisation so as to try to coerce them Into taking an unwanted action such as a misdirected high-value payment?

16. Which of the following is a framework and methodology for Enterprise Security Architecture and Service Management?

17. Preventive.

18. Which term describes the acknowledgement and acceptance of ownership of actions, decisions, policies and deliverables?

19. When a digital forensics investigator is conducting art investigation and handling the original data, what KEY principle must they adhere to?

20. Which of the following is NOT a valid statement to include in an organisation’s security policy?

21. Which of the following is NOT considered to be a form of computer misuse?

22. What Is the PRIMARY reason for organisations obtaining outsourced managed security services?

23. In terms of security culture, what needs to be carried out as an integral part of security by all members of an organisation and is an essential component to any security regime?

24. Which term describes a vulnerability that is unknown and therefore has no mitigating control which is immediately and generally available?

25. Which security concept provides redundancy in the event a security control failure or the exploitation of a vulnerability?

26. Data Protection & Privacy.

27. Which of the following controls would be the MOST relevant and effective in detecting zero

day attacks?

28. What form of risk assessment is MOST LIKELY to provide objective support for a security Return on Investment case?

29. Which of the following cloud delivery models is NOT intrinsically "trusted" in terms of security by clients using the service?

30. Which of the following is MOST LIKELY to be described as a consequential loss?

31. Which of the following testing methodologies TYPICALLY involves code analysis in an offline environment without ever actually executing the code?

32. When considering the disposal of confidential data, equipment and storage devices, what social engineering technique SHOULD always betaken into consideration?

33. One traditional use of a SIEM appliance is to monitor for exceptions received via syslog.

What system from the following does NOT natively support syslog events?

34. Which of the following types of organisation could be considered the MOST at risk from the theft of electronic based credit card data?

35. Which security framework impacts on organisations that accept credit cards, process credit card transactions, store relevant data or transmitcredit card data?