CISSP Practice Test 10 — 10 Questions

Question 1

A company is conducting a security assessment of its network infrastructure. Which of the following activities are typically performed during a vulnerability assessment? (Select TWO.)

Accepted Answer

Identification of missing security patches. A is correct because vulnerability assessments focus on identifying and cataloging weaknesses without exploitation. Missing security patches are a common finding from automated scanning tools like Nessus or OpenVAS, which compare system configurations against known vulnerability databases (e.g., CVE). This aligns with the assessment's goal of discovering vulnerabilities, not exploiting them.

Answer

Attempting to crack password hashes

Answer

Social engineering attacks against employees

Answer

Exploiting identified vulnerabilities to gain unauthorized access

Question 2

Which of the following is a key component of the rules of engagement for a penetration test?

Accepted Answer

Written authorization from management. Rules of engagement must include written authorization, scope, and emergency stop criteria.

Answer

Use of only automated tools

Answer

Guarantee of no system disruption

Answer

Identification of all vulnerabilities

Question 3

During an audit, it is discovered that a database containing personally identifiable information (PII) has been retained for 10 years beyond the regulatory requirement. The data owner has not approved the retention extension. Which data lifecycle principle is primarily being violated?

Accepted Answer

Storage limitation. Storage limitation requires that data be retained only as long as necessary; exceeding the retention period violates this principle.

Answer

Data minimization

Answer

Purpose limitation

Answer

Integrity

Question 4

A healthcare organization uses a custom application to manage patient records. The application uses a database with encrypted columns for sensitive data. The security team discovers that an insider has been copying encrypted data to an external drive. While the data is encrypted, the encryption key is stored in a configuration file accessible to the application. Which additional control would best mitigate this risk?

Accepted Answer

Store the encryption key in a hardware security module (HSM) with access policies.. Storing the encryption key in an HSM with access policies ensures the key is never in cleartext accessible to the application or user; it also enforces access controls and auditing. Role-based access on the config file is insufficient because the application still needs to read the key. TDE protects data at rest but does not protect the key. Auditing is detective, not preventive.

Answer

Enable audit logging on the application.

Answer

Implement role-based access control on the configuration file.

Answer

Use transparent data encryption (TDE) at the database level.

Question 5

In an OAuth 2.0 authorization code flow with PKCE, what is the primary purpose of the code verifier and code challenge?

Accepted Answer

To ensure the client that requested the code is the same one redeeming it. PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks, especially for public clients like mobile apps.

Answer

To encrypt the authorization code

Answer

To authenticate the end user

Answer

To generate the ID token

Question 6

A security architect is designing a system for a government agency that requires strict confidentiality controls. Data must be classified at multiple levels (e.g., Top Secret, Secret, Confidential). Users at a lower classification should not be able to read data at a higher classification, and users at a higher classification should not be able to write data to a lower classification. Which security model enforces these rules?

Accepted Answer

Bell-LaPadula model. The Bell-LaPadula model is a state machine model focused on confidentiality. It enforces 'no read up' and 'no write down' to prevent unauthorized access to higher classification data and prevent downgrading of classified information.

Answer

Biba model

Answer

Clark-Wilson model

Answer

Brewer-Nash model

Question 7

A security architect is evaluating hypervisor security for a multi-tenant cloud environment. Which type of hypervisor is considered more secure because it runs directly on the hardware without a host operating system, reducing the attack surface?

Accepted Answer

Type 1 hypervisor. Type 1 hypervisors (bare-metal) run directly on hardware, eliminating the OS layer that could be exploited. Examples: VMware ESXi, Hyper-V.

Answer

Virtual machine monitor

Answer

Containers

Answer

Type 2 hypervisor

Question 8

Under HIPAA, a covered entity must have a Business Associate Agreement (BAA) with which of the following?

Accepted Answer

A cloud service provider hosting ePHI. A BAA is required with a business associate, which is a person or entity that performs certain functions or activities involving the use or disclosure of PHI on behalf of a covered entity. A cloud service provider that stores ePHI is a business associate.

Answer

A janitorial service that cleans the office

Answer

A government regulator conducting an audit

Answer

A patient requesting their medical records

Question 9

Under the GDPR, what is the maximum time frame for notifying the supervisory authority of a personal data breach?

Accepted Answer

72 hours. Article 33 of the GDPR requires notification within 72 hours of becoming aware of the breach.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 10

An organization is implementing a new access control system. The security team wants to ensure that users cannot deny having performed an action. Which security principle is being addressed?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a party cannot deny the authenticity of their signature or the sending of a message. In access control, this is often achieved through audit logs and digital signatures.

Answer

Availability

Answer

Integrity

Answer

Confidentiality