CISSP Practice Test 5 — 10 Questions

Question 1

A company uses Role-Based Access Control (RBAC) for its ERP system. A user in the 'Accounts Payable' role needs to temporarily approve purchase orders up to $10,000 while the 'Purchasing Manager' is on leave. What is the BEST way to grant this access?

Accepted Answer

Temporarily assign the 'Purchasing Approver' role to the user with an expiration date. Option B is correct because it follows the principle of least privilege by temporarily assigning the 'Purchasing Approver' role to the user with an expiration date, ensuring that the elevated permissions are automatically revoked after the leave period. This approach maintains RBAC integrity without permanently altering role definitions or sharing credentials.

Answer

Share the Purchasing Manager's account credentials with the user

Answer

Modify the 'Accounts Payable' role to include purchase order approval permissions

Answer

Create a new role with the exact permissions needed and assign it to the user

Question 2

Refer to the exhibit. A user 'jdoe' is a member of the Domain Users group but not of the Administrators or Remote Desktop Users groups. The user reports they cannot log on locally to a domain-joined Windows server, but they can log on via RDP. Based on the GPO results, what is the MOST likely reason?

Accepted Answer

The user is not a member of the local Users group or Administrators group. The user 'jdoe' can log on via RDP but not locally because the default security policy on a domain-joined Windows server grants the 'Allow log on locally' right only to the local Administrators group and the local Users group. Since 'jdoe' is a member of Domain Users, which is mapped to the local Users group on a domain-joined server, the user should normally have local logon rights. However, the exhibit shows GPO results that likely indicate the local Users group has been removed from the 'Allow log on locally' policy, or the user is not actually a member of the local Users group (e.g., the server is configured to not map Domain Users to the local Users group). The most direct reason is that the user is not a member of either the local Users group or the local Administrators group, which are the only groups granted local logon by default.

Answer

The user is a member of the Remote Desktop Users group

Answer

The user is a member of a group that is denied local logon

Answer

The user is denied logon through Remote Desktop Services

Question 3

A security analyst discovers that a service account in Active Directory has not had its password changed in 5 years and has domain admin privileges. The account is used by a legacy application that does not support modern authentication protocols. Which of the following is the MOST secure approach to manage this account?

Accepted Answer

Decommission the legacy application and migrate to a modern alternative that supports secure authentication. Option D is correct because the best security is to decommission the account and modernize the application. Option A is wrong because group Managed Service Accounts (gMSAs) require Windows Server 2012 or later and application support. Option B is wrong because a long, complex password still has risk of theft and is not automatically rotated. Option C is wrong because disabling the account would break the application.

Answer

Convert the account to a group Managed Service Account (gMSA)

Answer

Set a very long, complex password and store it in a password manager

Answer

Disable the account and create a new service account with limited privileges

Question 4

Which THREE of the following are common methods used in security assessment and testing? (Select exactly 3.)

Accepted Answer

Penetration testing. Penetration testing is a common method in security assessment and testing that simulates real-world attacks to identify exploitable vulnerabilities. Unlike vulnerability scanning, which only identifies potential weaknesses, penetration testing actively exploits them to validate security controls and measure the impact of a breach.

Answer

Risk analysis

Answer

Forensic analysis

Question 5

An AWS security engineer is reviewing the above S3 bucket policy. What is the net effect of this policy on requests to read objects in the 'confidential' folder?

Accepted Answer

Only IPs in 10.100.0.0/16 can read confidential objects. The S3 bucket policy grants read access to the 'confidential' folder for all principals within the 10.0.0.0/8 IP range, but then explicitly denies access to IPs within the 10.100.0.0/16 subnet. Because explicit Deny overrides any Allow, the net effect is that only IPs in 10.0.0.0/8 that are NOT in 10.100.0.0/16 can read objects. This matches option D.

Answer

Only IPs in 10.0.0.0/8 but outside 10.100.0.0/16 can read confidential objects

Answer

No IPs can read confidential objects because the Deny applies to all

Answer

All IPs in the 10.0.0.0/8 range can read confidential objects

Question 6

A security engineer is designing a new SIEM correlation rule to detect potential data exfiltration. The rule should trigger when a single internal host sends more than 10 MB of data to an external IP address within a 5-minute window, but only if the external IP is not on a whitelist of known business partners. Which approach best minimizes false positives while ensuring effective detection?

Accepted Answer

Use a baseline of normal traffic per host and trigger only when the volume exceeds the baseline by a significant margin. Option C is correct because using a baseline of normal traffic per host adapts to different users' behaviors, reducing false positives from legitimate large transfers. Option A is wrong because applying the rule to all internal hosts would generate many false positives from servers that routinely transfer large files. Option B is wrong because a static threshold does not account for varying normal usage. Option D is wrong because excluding only known partner IPs may miss exfiltration to unknown but legitimate external services.

Answer

Apply the rule to all internal hosts with the same threshold

Answer

Trigger only when the destination IP is in a threat intelligence feed of known malicious IPs

Answer

Set a static threshold of 10 MB for all hosts, but exclude traffic to common cloud storage providers

Question 7

An organization is migrating from a waterfall to an Agile development methodology. Which of the following is a key security advantage of Agile?

Accepted Answer

Security issues can be addressed incrementally throughout development. In Agile development, security testing and remediation are integrated into each iteration (sprint), allowing teams to identify and fix vulnerabilities incrementally rather than waiting until the end. This continuous feedback loop reduces the risk of late-stage security surprises and aligns with the principle of 'shifting left' on security.

Answer

Security testing is performed only at the end of the project

Answer

Security requirements are finalized upfront

Answer

Security documentation is minimized to reduce overhead

Question 8

Based on the exhibit, what security control is being demonstrated?

Accepted Answer

Account lockout threshold. The exhibit shows a login attempt counter that increments with each failed authentication, and after a specific number of failures (e.g., 5), the account is locked for a defined period. This is the classic behavior of an account lockout threshold, which is a preventive security control that mitigates brute-force password guessing attacks by temporarily disabling the account after exceeding the allowed number of failed attempts.

Answer

Session timeout

Answer

CAPTCHA implementation

Answer

Input validation

Question 9

An organization needs to ensure that its employees understand their responsibilities regarding information security. Which of the following is the MOST effective way to achieve this?

Accepted Answer

Implement a security awareness program with regular training and assessments.. A security awareness program with regular training and assessments is the most effective way to ensure employees understand their responsibilities because it establishes a continuous learning cycle. Unlike one-time events, it reinforces secure behaviors through repetition, real-world scenarios, and measurable assessments, aligning with the NIST SP 800-50 framework for building a security-conscious culture.

Answer

Distribute a security policy document and require a signature.

Answer

Conduct a one-time annual security briefing.

Answer

Display security posters in common areas.

Question 10

A multinational corporation is expanding its operations into a new country with strict data protection laws. The company needs to ensure compliance while maintaining operational efficiency. Which of the following is the BEST approach to manage this risk?

Accepted Answer

Adopt a privacy-by-design framework and conduct a Data Protection Impact Assessment (DPIA) before launching operations.. Option D is correct because a privacy-by-design framework ensures data protection is embedded into systems and processes from the outset, while a Data Protection Impact Assessment (DPIA) systematically identifies and mitigates privacy risks specific to the new jurisdiction. This proactive, risk-based approach aligns with regulatory requirements like the GDPR and demonstrates due diligence, reducing the likelihood of non-compliance and operational disruption.

Answer

Accept the risk of non-compliance as a cost of doing business and set aside a contingency fund for fines.

Answer

Assign legal counsel to review local laws and implement a one-time compliance checklist.

Answer

Create a uniform global privacy policy that satisfies all jurisdictions with minimal adjustments.