CISSP Practice Test 1 — 10 Questions

Question 1

Which of the following is the primary purpose of the CIA triad in information security?

Accepted Answer

To define the core objectives of information security. The CIA triad—Confidentiality, Integrity, and Availability—provides a foundational model for developing security policies and ensuring that data is protected from unauthorized access, tampering, and downtime.

Answer

To establish a framework for risk management

Answer

To ensure compliance with regulatory requirements

Answer

To balance security controls with usability

Question 2

An organization is implementing role-based access control (RBAC). Which two components are fundamental to the RBAC model? (Select TWO.)

Accepted Answer

Constraints such as separation of duties. Constraints such as separation of duties are fundamental to RBAC because they enforce organizational policies by preventing conflicts of interest (e.g., a user cannot both create and approve a purchase order). This is a core component of the RBAC model as defined in the NIST RBAC standard (ANSI INCITS 359-2004), which includes core RBAC, hierarchical RBAC, and constrained RBAC. Constraints ensure that role assignments and permissions adhere to security rules beyond simple role-user mapping.

Answer

Access control lists (ACLs)

Answer

Subjects, objects, and operations

Answer

Security labels and clearances

Question 3

A security analyst discovers that an attacker has gained domain admin privileges by forging a Kerberos TGT using the KRBTGT account hash. Which attack has occurred?

Accepted Answer

Golden ticket attack. A Golden Ticket attack occurs when an attacker compromises the KRBTGT account's password hash and uses it to forge a legitimate-looking Kerberos Ticket Granting Ticket (TGT). Because the KRBTGT account signs all TGTs in the domain, a forged TGT is trusted by every Kerberos-enabled service, granting the attacker persistent domain-wide access — often as domain admin — without needing to authenticate normally.

Answer

Pass-the-ticket attack

Answer

Silver ticket attack

Answer

Kerberos brute force attack

Question 4

A hospital chain collects and stores electronic health records (EHR) for millions of patients. The EHR system is hosted in a private cloud and accessed by doctors, nurses, and administrative staff from various locations. Recently, an internal audit found that several employees shared their login credentials with colleagues to expedite workflows. The hospital must comply with HIPAA and state privacy laws. The security officer wants to implement a solution that minimizes the risk of unauthorized access due to shared credentials while still allowing efficient access for patient care. Which of the following is the BEST approach?

Accepted Answer

Implement single sign-on (SSO) integrated with role-based access control (RBAC) and enforce audit logging of all access. SSO integrated with RBAC reduces the attack surface of shared credentials by centralizing authentication and enforcing least-privilege access based on job roles. Audit logging provides non-repudiation and traceability, which deters credential sharing and satisfies HIPAA's requirement to track access to ePHI. This combination directly addresses the root cause (shared credentials) while maintaining workflow efficiency through seamless authentication.

Answer

Enforce a policy requiring password changes every 30 days and complexity requirements

Answer

Replace passwords with biometric authentication (fingerprint and iris scans) for all users

Answer

Disable remote access to the EHR system and require all access to occur only from within the hospital's LAN

Question 5

An organization's security policy requires that privileged accounts have their passwords changed every 30 days and be monitored. Which solution effectively manages these requirements?

Accepted Answer

Privileged Access Management (PAM) solution. A Privileged Access Management (PAM) solution is specifically designed to manage privileged accounts, enforce password rotation policies (e.g., every 30 days), and provide detailed monitoring and auditing of privileged sessions. It automates password changes, vaults credentials, and logs all access, directly meeting the policy requirements for privileged accounts.

Answer

Role-based access control

Answer

Enterprise password manager

Answer

Single sign-on for administrators

Question 6

An organization is developing a business continuity plan (BCP). The IT department has identified a critical application that must be restored within 4 hours of a disruption. Which metric defines the maximum acceptable time that the application can be unavailable?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable downtime for a critical application after a disruption. In this scenario, the IT department has specified that the application must be restored within 4 hours, which directly aligns with the RTO metric. RTO is a key BCP parameter that drives resource allocation and recovery strategy design.

Answer

Recovery Point Objective (RPO)

Answer

Mean Time to Repair (MTTR)

Answer

Mean Time Between Failures (MTBF)

Answer

Service Level Agreement (SLA)

Question 7

A company wants to ensure that its security policy is effectively enforced across all departments. Currently, the policy is published on the intranet and included in the employee handbook. However, the security team notices that many employees are not following the policy, leading to security incidents. Which of the following would be the most effective way to improve policy enforcement?

Accepted Answer

Require annual signed acknowledgment of the policy. Requiring annual signed acknowledgment ensures that employees are aware of and agree to comply with the policy. This creates a record of acceptance and can be used in disciplinary actions. Publishing on intranet or handbook alone does not guarantee reading or acceptance. Random audits with penalties may enforce compliance but without awareness, employees may not know what is expected.

Answer

Include the policy in the employee handbook

Answer

Conduct random audits and penalize non-compliance

Answer

Publish the policy on the intranet only

Question 8

A network analyst suspects a host on the internal network is sending abnormal amounts of traffic. Which tool should be used to capture and analyze the packets?

Accepted Answer

Wireshark. Wireshark is the correct tool because it is a packet analyzer that captures live network traffic and provides deep inspection of individual packets, including headers and payloads. This allows the analyst to examine the abnormal traffic patterns, identify source/destination IPs, protocols, and payload content to diagnose the issue.

Answer

Nmap

Answer

Netstat

Answer

Traceroute

Question 9

In the context of physical security, which of the following is an example of a preventive control?

Accepted Answer

Mantrap door. A mantrap door is a preventive physical security control because it actively prevents unauthorized entry by requiring authentication and verification before allowing passage through a series of interlocking doors. Unlike monitoring or detection systems, a mantrap physically blocks access until the user is validated, thereby stopping a breach before it occurs.

Answer

Security guards monitoring

Answer

CCTV cameras

Answer

Intrusion detection system

Question 10

Which THREE of the following are valid considerations when implementing data loss prevention (DLP) controls to protect sensitive data? (Select three.)

Accepted Answer

User training to reduce false positives and increase acceptance. User training is a critical component of a successful DLP implementation. Without proper training, users may inadvertently trigger false positives by mishandling data or may attempt to bypass controls they perceive as overly restrictive. Training helps users understand classification labels and proper data handling procedures, reducing the operational burden on security teams and increasing overall acceptance of DLP policies.

Answer

Integration with all third-party applications

Answer

Blocking all data transfers to external devices