Free Practice Questions for ISC2 CSSLP Exam

Mark is the project manager of the NHQ project in StarTech Inc. The project has an asset valued at $195,000 and is subjected to an exposure factor of 35 percent. What will be the Single Loss Expectancy of the project?

• $68,250
• $92,600
• $72,650
• $67,250

Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. Which of the following are the U.S. Federal Government information security standards? Each correct answer represents a complete solution. Choose all that apply.

• IR Incident Response
• Information systems acquisition, development, and maintenance
• SA System and Services Acquisition
• CA Certification, Accreditation, and Security Assessments

Frank is the project manager of the NHH Project. He is working with the project team to create a plan to document the procedures to manage risks throughout the project. This document will define how risks will be identified and quantified. It will also define how contingency plans will be implemented by the project team. What document is Frank and the NHH Project team creating in this scenario?

• Risk management plan
• Project plan
• Project management plan
• Resource management plan

What are the security advantages of virtualization, as described in the NIST Information Security and Privacy Advisory Board (ISPAB) paper 'Perspectives on Cloud Computing and Standards'?Each correct answer represents a complete solution. Choose three.

• It increases capabilities for fault tolerant computing.
• It adds a layer of security for defense-in-depth.
• It decreases exposure of weak software.
• It decreases configuration effort.

Which of the following documents were developed by NIST for conducting Certification & Accreditation (C&A)? Each correct answer represents a complete solution. Choose all that apply.

• NIST Special Publication 800-60
• NIST Special Publication 800-53
• NIST Special Publication 800-37A
• NIST Special Publication 800-59
• NIST Special Publication 800-37
• NIST Special Publication 800-53A

Which of the following plans is designed to protect critical business processes from natural or man-made failures or disasters and the resultant loss of capital due to the unavailability of normal business processes?

• Contingency plan
• Business continuity plan
• Crisis communication plan
• Disaster recovery plan

FIPS 199 defines the three levels of potential impact on organizations. Which of the following potential impact levels shows limited adverse effects on organizational operations, organizational assets, or individuals?

• Moderate
• Low
• Medium
• High

Which of the following describes a residual risk as the risk remaining after a risk mitigation has occurred?

• DIACAP
• SSAA
• DAA
• ISSO

Which of the following are the phases of the Certification and Accreditation (C&A) process?Each correct answer represents a complete solution. Choose two.

• Continuous Monitoring
• Auditing
• Detection
• Initiation

Which of the following NIST Special Publication documents provides a guideline on questionnaires and checklists through which systems can be evaluated for compliance against specific control objectives?

• NIST SP 800-37
• NIST SP 800-26
• NIST SP 800-53A
• NIST SP 800-59
• NIST SP 800-53
• NIST SP 800-60