CISSP Practice Test 11 — 15 Questions

Question 1

Which principle ensures that a user is granted only the permissions necessary to perform their job functions?

Accepted Answer

Least privilege. The principle of least privilege states that users should have the minimum level of access required.

Answer

Need-to-know

Answer

Separation of duties

Answer

Zero standing privileges

Question 2

An organization uses a system where access decisions are based on user attributes (e.g., job title, clearance), resource attributes (e.g., classification), and environmental factors (e.g., time of day). This is an example of:

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) considers multiple attributes for access decisions.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 3

A company uses smart cards for authentication to workstations. A user inserts their smart card but is prompted for a PIN. The user enters the correct PIN but authentication fails. The smart card is not expired. What is the most likely cause?

Accepted Answer

The user's certificate is revoked. When a smart card is used for authentication, the PIN unlocks the private key stored on the card, but the actual authentication typically relies on a certificate chain and the validity of the user's certificate. If the certificate has been revoked (e.g., due to compromise or termination), the Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) check will fail, causing authentication to be denied even though the PIN is correct and the card is not expired.

Answer

The PIN is incorrectly stored on the card

Answer

The smart card driver is outdated

Answer

The workstation's clock is off by more than 5 minutes

Question 4

A security analyst discovers an attack where an attacker sets up a rogue wireless access point with a legitimate SSID to trick users into connecting. Once connected, the attacker captures credentials. This type of attack is known as:

Accepted Answer

Evil twin attack. This is an evil twin attack because the attacker creates a rogue access point that broadcasts the same SSID as a legitimate network, tricking users into connecting to it. Once connected, the attacker can capture credentials or other sensitive data by acting as a man-in-the-middle. The key differentiator is the impersonation of a legitimate SSID to deceive users, not just the presence of an unauthorized AP.

Answer

Deauthentication attack

Answer

Rogue AP attack

Answer

Karma attack

Question 5

An organization is implementing a BCP. After completing the BIA, which of the following is the next logical step in the planning process?

Accepted Answer

Develop recovery strategies. After the BIA identifies critical processes and recovery requirements, the next step is to develop strategies to meet those requirements, such as selecting recovery sites and technologies.

Answer

Test the plan

Answer

Conduct a risk assessment

Answer

Train personnel

Question 6

A data owner has classified a dataset as 'Confidential' in a commercial organization. Which of the following best describes the primary responsibility of the data owner for this dataset?

Accepted Answer

Determining the data's classification and ensuring it is labeled appropriately. The data owner is accountable for data classification and assigning protection requirements, while the custodian implements controls.

Answer

Ensuring the data is accurate and complete

Answer

Implementing technical controls to protect the data

Answer

Performing daily backups of the data

Question 7

A security administrator needs to ensure that data stored on a server is unrecoverable after decommissioning. The server uses SSDs. Which sanitization method is MOST appropriate?

Accepted Answer

Physical destruction (shredding). SSDs cannot be reliably overwritten due to wear leveling; physical destruction or cryptographic erasure is recommended.

Answer

Quick format

Answer

Standard overwriting with multiple passes

Answer

Degaussing

Question 8

A security engineer is evaluating a new third-party software component for use in a critical application. Which document is most important to review to understand the component's supply chain security?

Accepted Answer

Software Bill of Materials (SBOM). A Software Bill of Materials (SBOM) lists all components, libraries, and dependencies used in the software. It is essential for assessing supply chain risk and identifying known vulnerabilities.

Answer

End User License Agreement (EULA)

Answer

Service Level Agreement (SLA)

Answer

Data Processing Agreement (DPA)

Question 9

A security analyst is tasked with identifying vulnerabilities in a network without exploiting them. Which type of assessment is most appropriate?

Accepted Answer

Vulnerability assessment. A vulnerability assessment identifies and reports vulnerabilities without exploitation, unlike penetration testing which exploits to demonstrate impact.

Answer

Security audit

Answer

Penetration test

Answer

Security review

Question 10

An organization is implementing a new access control system. Which of the following represents the correct order of the AAA framework components?

Accepted Answer

Authentication, Authorization, Accounting. The AAA framework stands for Authentication, Authorization, and Accounting, in that order. First, a user's identity is verified, then permissions are checked, and finally activities are logged.

Answer

Authorization, Authentication, Accounting

Answer

Authentication, Accounting, Authorization

Answer

Accounting, Authentication, Authorization

Question 11

A government agency requires a security model that prevents users from reading documents at a higher classification level and from writing to documents at a lower classification level. Which model enforces these constraints?

Accepted Answer

Bell-LaPadula. Bell-LaPadula enforces no read up (simple security property) and no write down (*-property) to ensure confidentiality.

Answer

Brewer-Nash

Answer

Clark-Wilson

Answer

Biba

Question 12

A security analyst is investigating a potential covert timing channel in a system. Which of the following characteristics best describes this type of channel?

Accepted Answer

It modulates the time between events to encode information. A covert timing channel uses the timing of events (e.g., response times) to transmit information, bypassing security controls.

Answer

It requires high bandwidth to be effective

Answer

It uses storage locations not normally accessible to the sender and receiver

Answer

It uses encryption to hide the content of the communication

Question 13

A security analyst is investigating a potential data leak via covert channels. Which of the following is an example of a timing covert channel?

Accepted Answer

Varying the spacing between keystrokes. A timing covert channel uses variations in timing (e.g., response time) to encode information, rather than storing data in shared resources.

Answer

Modifying unused fields in network packets

Answer

Encoding data in the TCP sequence number

Answer

Writing data to a shared disk file

Question 14

During a digital forensics investigation, which of the following data sources has the highest order of volatility?

Accepted Answer

CPU registers. CPU registers hold the most volatile data, followed by cache, RAM, swap, disk, remote logging, and physical media.

Answer

Remote logging server

Answer

Network packets in transit

Answer

Hard disk drive

Question 15

Which access control model assigns permissions based on a user's job function?

Accepted Answer

RBAC. Role-Based Access Control (RBAC) uses roles that group permissions according to job functions.

Answer

MAC

Answer

DAC

Answer

ABAC