CISSP Practice Test 10 — 10 Questions

Question 1

A medium-sized financial services company recently deployed a new identity governance and administration (IGA) solution to manage user access across on-premises Active Directory and cloud-based SaaS applications. The IGA system uses a role-based access control (RBAC) model with hundreds of roles defined. The company has a policy that all access certifications must be completed quarterly. During the first quarterly certification, the access reviewers complain that they are overwhelmed by the number of entitlements they need to review, and many certifications are not completed on time. The security team also notices that some users have accumulated excessive privileges because role assignments were not properly reviewed. The company wants to streamline the certification process without sacrificing security. Which of the following is the BEST course of action?

Accepted Answer

Implement a risk-based certification approach that focuses on high-risk access and uses automated certification for low-risk access. Option C is correct because a risk-based certification approach prioritizes high-risk entitlements for manual review while automating the certification of low-risk access, reducing reviewer fatigue and ensuring critical privileges are scrutinized. This aligns with the principle of 'defense in depth' and addresses the core issue of overwhelming certification volume without compromising security, as low-risk access can be certified based on predefined policies and automated workflows.

Answer

Increase the certification frequency to monthly and assign more reviewers

Answer

Eliminate role-based access and assign permissions directly to users

Answer

Automate all certifications by using scripts that approve access if no violations are detected

Question 2

A financial institution is required to perform regular penetration tests on its online banking platform. The testing must be as realistic as possible while minimizing risk to production data. Which of the following approaches BEST meets these requirements?

Accepted Answer

Build a replica of the production environment and test against it with realistic attack scenarios.. Option D is correct because building a replica (staging) environment allows the penetration test to simulate realistic attack scenarios without any risk to production data or system availability. This approach ensures the test can include destructive or disruptive techniques (e.g., SQL injection, privilege escalation) that would be unsafe on a live system, while still accurately reflecting the production architecture and configurations.

Answer

Conduct the test on the production environment using anonymized production data.

Answer

Use an automated vulnerability scanner on the production environment.

Answer

Perform the test during off-peak hours on the production system with read-only access.

Question 3

A security team is planning a social engineering test for their organization. Which of the following scenarios would BEST assess the effectiveness of security awareness training?

Accepted Answer

Sending a phishing email that mimics a common internal communication.. Sending a phishing email that mimics a common internal communication directly tests whether employees can recognize and report a realistic social engineering attempt, which is the primary goal of security awareness training. This scenario evaluates the human firewall by simulating the most prevalent attack vector—email-based phishing—and measures the effectiveness of training in reducing click-through rates and increasing reporting behavior.

Answer

Calling employees and pretending to be IT support to obtain passwords.

Answer

Attempting to tailgate into a secure facility.

Answer

Searching through trash bins for sensitive documents.

Question 4

A security assessor is conducting a penetration test and needs to identify live hosts on a network without causing disruption. Which of the following techniques should the assessor use FIRST?

Accepted Answer

Ping sweep using ICMP echo requests.. A ping sweep using ICMP echo requests (ICMP Type 8) is the most appropriate first step for identifying live hosts on a network because it is a standard, low-disruption method that quickly determines host availability. ICMP echo requests are typically allowed by default on many networks and do not initiate full protocol handshakes or service interactions, minimizing the risk of triggering alarms or causing instability. This aligns with the penetration testing methodology of starting with passive or low-impact reconnaissance before escalating to more intrusive techniques.

Answer

ARP scan to discover hosts on the local subnet.

Answer

Vulnerability scan of all IP addresses in the target range.

Answer

Full TCP port scan on common ports.

Question 5

Which TWO of the following are key objectives of a security assessment? (Select exactly 2.)

Accepted Answer

Identify vulnerabilities in systems and applications.. A is correct because identifying vulnerabilities is a primary objective of a security assessment, such as a vulnerability scan or penetration test, which systematically discovers weaknesses in systems and applications (e.g., missing patches, misconfigurations, or insecure code). B is correct because assessing the effectiveness of existing security controls (e.g., firewalls, IDS/IPS, access controls) is a core goal, often achieved through control testing or validation to determine if controls are properly implemented and functioning as intended.

Answer

Exploit vulnerabilities to gain unauthorized access.

Answer

Prioritize threats based on business impact.

Answer

Implement new security controls to address findings.

Question 6

A system administrator receives the vulnerability scan report snippet shown in the exhibit. Which of the following actions should the administrator take to remediate the vulnerability?

Accepted Answer

Modify the SSH configuration to disable weak ciphers and enable strong ciphers.. The vulnerability scan report likely identifies weak cryptographic algorithms (e.g., CBC-mode ciphers or MD5-based MACs) in the SSH configuration. Remediation requires disabling these weak ciphers and enabling strong ones (e.g., AES-CTR, ChaCha20-Poly1305) in the sshd_config file, as simply upgrading the SSH service version may not change the cipher list. Option B directly addresses the cryptographic weakness without unnecessarily disabling or hiding the service.

Answer

Upgrade the SSH service to the latest version.

Answer

Disable SSH access to the host.

Answer

Change the SSH port from 22 to a non-standard port.

Question 7

A company has implemented a new web application firewall (WAF) and wants to test its effectiveness. Which of the following testing methods would provide the MOST accurate assessment?

Accepted Answer

Conduct a penetration test that includes attempts to bypass the WAF.. A penetration test that actively attempts to bypass the WAF provides the most accurate assessment because it simulates a real attacker's behavior, testing the WAF's ability to detect and block evasion techniques such as HTTP parameter pollution, encoding obfuscation, and SQL injection payload splitting. This method validates the WAF's effectiveness under realistic adversarial conditions, revealing gaps that passive or disabled-state testing cannot uncover.

Answer

Perform a vulnerability scan on the web application with the WAF disabled.

Answer

Review the WAF logs for any blocked attacks.

Answer

Run an automated web application scanner against the application with the WAF enabled.

Question 8

An organization is implementing a new backup strategy for its critical servers. The backup must support rapid restoration of individual files and allow for a recovery point objective (RPO) of no more than 15 minutes. Which backup method should be used for daily operations?

Accepted Answer

Continuous data protection (CDP). Continuous data protection (CDP) is the only backup method that can guarantee a recovery point objective (RPO) of 15 minutes or less because it captures every write to disk in real time or near-real time, enabling restoration to any point within the protection window. Full, differential, and incremental backups all rely on periodic snapshots, which inherently introduce gaps that exceed a 15-minute RPO unless the interval is shorter than 15 minutes, which is impractical for daily operations.

Answer

Full backup every 24 hours

Answer

Differential backup every 6 hours

Answer

Incremental backup every 4 hours

Question 9

A security analyst receives the IDS alert shown in the exhibit. The analyst checks the web server logs and finds that the request returned a 200 OK status. Which of the following should the analyst do NEXT?

Accepted Answer

Isolate the web server and investigate for data breach.. The IDS alert indicates a SQL injection attempt, and the web server returned a 200 OK status, which means the request was processed successfully. This combination strongly suggests that the injection may have succeeded, potentially leading to a data breach. The correct next step is to isolate the web server and investigate for evidence of data exfiltration or unauthorized access, as per incident response procedures.

Answer

Tune the IDS to reduce false positives for SQL injection signatures.

Answer

Delete the alert and continue monitoring.

Answer

Ignore the alert because the IDS is known to produce false positives.

Question 10

A SOC analyst receives an alert for a suspicious outbound connection from a server in the DMZ to an external IP on port 443. The server is a web application server that should only communicate internally. The analyst checks the process and finds it is 'svchost.exe' running from a non-standard path. What is the most appropriate immediate action?

Accepted Answer

Isolate the server from the network. Option A is correct because isolating the server immediately contains the threat, preventing potential data exfiltration or lateral movement from a compromised host. The suspicious outbound connection from a DMZ server to an external IP on port 443 (HTTPS) combined with 'svchost.exe' running from a non-standard path strongly indicates malware masquerading as a legitimate Windows process. In security operations, containment is the priority before investigation to minimize damage.

Answer

Initiate a full incident response investigation

Answer

Disregard the alert because svchost.exe is a legitimate Windows process

Answer

Terminate the suspicious process