A company is implementing a system for employees to submit expense reports. The finance department needs to be able to prove that an employee submitted a specific report and that the report was not altered after submission. Which control should be used?

Use a hash of the report and store it in a database.

Encrypt the report with the employee's public key.

Store the reports in a read-only folder.

Use a digital signature on each expense report.

A financial institution processes wire transfers. The security team wants to ensure that transaction data is not altered during transmission and that the sender cannot deny having initiated a transfer. Which control should be implemented?

Use digital signatures on each transaction message.

Use a hash function to create a message digest for each transaction.

Use symmetric encryption to encrypt the transaction data.

Use a virtual private network (VPN) for all transaction traffic.

A software vendor distributes updates to its customers. The customers need to verify that the updates genuinely come from the vendor and have not been tampered with. Which mechanism should the vendor use?

Publish the hash of each update on the vendor's website.

Sign the updates with the vendor's private key and provide the public key to customers.

Encrypt the updates with a symmetric key shared with all customers.

Use a secure FTP server for customers to download updates.

Which of the following correctly lists the five pillars of information security?

Confidentiality, integrity, availability, authenticity, nonrepudiation

Confidentiality, integrity, availability, auditability, recoverability

Confidentiality, integrity, availability, authentication, authorization

Confidentiality, integrity, availability, privacy, accountability

Certified Information Systems Security Professional

Domain 1Objective 2

1.2 - Understand and Apply Security Concepts CISSP Practice Questions (Page 2)

Part of the Security and Risk Management domain, which accounts for 16% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 1–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

6concepts

16%of the exam

Questions 6–10

6foundation · easy
Which security concept prevents an individual from denying that they performed an action or sent a message?
Select an answer first
7application · medium
A company is implementing a system for employees to submit expense reports. The finance department needs to be able to prove that an employee submitted a specific report and that the report was not altered after submission. Which control should be used?
Select an answer first
8application · medium
A financial institution processes wire transfers. The security team wants to ensure that transaction data is not altered during transmission and that the sender cannot deny having initiated a transfer. Which control should be implemented?
Select an answer first
9application · medium
A software vendor distributes updates to its customers. The customers need to verify that the updates genuinely come from the vendor and have not been tampered with. Which mechanism should the vendor use?
Select an answer first
10foundation · easy
Which of the following correctly lists the five pillars of information security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.