CISSP Practice Test 11 — 15 Questions

Question 1

Which document is mandatory, high-level, and sets the direction for security within an organization?

Accepted Answer

Policy. A security policy is a mandatory, high-level document that defines an organization's security objectives, principles, and management intent. It sets direction and assigns responsibility without prescribing specific technical implementations. Standards, procedures, and baselines all derive from and must comply with the policy, making policy the authoritative top-level document.

Answer

Standard

Answer

Procedure

Answer

Baseline

Question 2

A company has a data retention policy requiring customer transaction records to be kept for 7 years. After 7 years, the data should be destroyed. Which phase of the data lifecycle governs this action?

Accepted Answer

Destroy. The destroy phase of the data lifecycle explicitly governs the secure disposal of data once its retention period ends. In this scenario, after 7 years, the policy mandates destruction, so the action falls under the Destroy phase. This phase ensures data is irrecoverable and compliant with legal and regulatory requirements.

Answer

Use

Answer

Share

Answer

Archive

Question 3

A business continuity plan (BCP) differs from a disaster recovery plan (DRP) in that the BCP primarily focuses on:

Accepted Answer

Maintaining critical business processes during a disruption. A Business Continuity Plan (BCP) is broader in scope and focuses on maintaining critical business processes — people, facilities, suppliers, and operations — during and after a disruption. The Disaster Recovery Plan (DRP) is a subset focused specifically on restoring IT systems and infrastructure. Thus, maintaining critical business processes is the BCP's primary focus.

Answer

Securing physical facilities

Answer

Restoring IT systems and infrastructure

Answer

Replacing hardware and software

Question 4

A government contractor handles data classified as 'Secret'. According to government data classification levels, which of the following is the correct order from most restrictive to least restrictive?

Accepted Answer

Top Secret, Secret, Confidential, Unclassified. The U.S. government classification hierarchy, defined by Executive Order 13526, ranks information from most to least restrictive as Top Secret, Secret, Confidential, and Unclassified. Top Secret covers information whose unauthorized disclosure could cause 'exceptionally grave damage' to national security, while Secret and Confidential correspond to 'serious' and 'damage' respectively. Unclassified sits at the bottom with no restriction. Option B is the only choice that lists this order correctly.

Answer

Confidential, Secret, Top Secret, Unclassified

Answer

Unclassified, Confidential, Secret, Top Secret

Answer

Secret, Top Secret, Confidential, Unclassified

Question 5

A security architect is designing a physical security perimeter for a data center. Which of the following is an example of Crime Prevention Through Environmental Design (CPTED) principle?

Accepted Answer

Designing the landscape to provide clear sightlines from the guard post. CPTED focuses on designing the physical environment to reduce crime and fear of crime by influencing human behavior. Clear sightlines from a guard post are a classic CPTED principle—natural surveillance—which allows guards to observe the area without obstruction, deterring potential intruders. This is a design-based approach, not just adding security hardware.

Answer

Using high fences with barbed wire around the facility

Answer

Deploying motion sensors and CCTV cameras

Answer

Installing biometric locks on all server room doors

Question 6

A company wants to ensure its internal web application is free from security flaws during development. Which testing approach analyzes source code without executing the program?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code, bytecode, or binaries without executing the program, which is exactly what the question describes. It is integrated into the IDE or CI/CD pipeline to catch flaws like SQL injection, XSS, and hardcoded secrets early in the SDLC, shifting security left.

Answer

IAST

Answer

RASP

Answer

DAST

Question 7

A security auditor is reviewing the results of a recently completed internal vulnerability scan. The scan report shows several hosts with the same vulnerability. Which of the following actions should the auditor take FIRST?

Accepted Answer

Manually verify the vulnerability on a sample of affected hosts.. The auditor must first manually verify the vulnerability on a sample of affected hosts because automated vulnerability scans can produce false positives due to factors like incomplete banner grabbing, outdated plugin signatures, or network-level interference. Confirming the finding ensures that subsequent remediation efforts are based on accurate, validated data, preventing wasted resources on non-existent issues.

Answer

Immediately apply patches to all affected hosts.

Answer

Remove the hosts from the network until the vulnerability is resolved.

Answer

Re-run the scan with a different scanner.

Question 8

A company uses a qualitative risk analysis matrix where likelihood ranges from 1 to 5 and impact ranges from 1 to 5. A risk with a likelihood of 4 and an impact of 5 would fall into which risk level if the matrix defines high risk as scores above 15, medium as 10-15, and low as below 10?

Accepted Answer

High. The risk score is calculated as likelihood × impact = 4 × 5 = 20. The matrix defines high risk as scores above 15, and 20 exceeds 15, so the risk falls into the High category. This is a straightforward application of the qualitative risk scoring formula used in the scenario.

Answer

Medium

Answer

Critical

Answer

Low

Question 9

Which physical security design principle emphasizes that the physical environment should be designed to discourage criminal activity by using natural surveillance, access control, and territorial reinforcement?

Accepted Answer

CPTED. CPTED (Crime Prevention Through Environmental Design) is the discipline that uses natural surveillance (sightlines that make intruders visible), natural access control (directing flow through defined entry points), and territorial reinforcement (fences, signage, landscaping that signal private space) to deter criminal activity. It is a design philosophy applied to the physical environment itself, not a technology or a layered-defense strategy.

Answer

TEMPEST

Answer

Fail-safe

Answer

Layered defense

Question 10

Which of the following is the correct order of priority for the ISC2 Code of Ethics Canons?

Accepted Answer

Protect society, act honorably, provide diligent service, advance the profession. The ISC2 Code of Ethics Canons are ordered by priority: Protect society, the common good, necessary public trust and confidence, and the infrastructure; Act honorably, honestly, justly, responsibly, and legally; Provide diligent and competent service to principals; and Advance and protect the profession. Option B correctly lists this order.

Answer

Advance the profession, protect society, act honorably, provide diligent service

Answer

Provide diligent service, protect society, act honorably, advance the profession

Answer

Act honorably, provide diligent service, protect society, advance the profession

Question 11

A company is designing a database that will contain personally identifiable information (PII). To reduce privacy risk, they decide to add controlled noise to query results. This technique is known as:

Accepted Answer

Differential privacy. Differential privacy is a technique that adds controlled noise to query results to protect individual privacy while allowing aggregate analysis. It ensures that the inclusion or exclusion of a single individual's data does not significantly affect the output, thereby reducing privacy risk. This matches the scenario of adding noise to query results for PII.

Answer

Data masking

Answer

Tokenization

Answer

Anonymization

Question 12

Which cryptographic algorithm is an example of a symmetric stream cipher?

Accepted Answer

RC4. RC4 is a symmetric stream cipher that generates a pseudorandom keystream and XORs it with plaintext one byte at a time. It was widely used in WEP, WPA (TKIP), and SSL/TLS before being deprecated due to keystream biases. Stream ciphers encrypt data bit-by-bit or byte-by-byte, unlike block ciphers which process fixed-size blocks.

Answer

AES

Answer

3DES

Answer

RSA

Question 13

During a security audit, it is discovered that a network firewall is allowing traffic based on source IP address only, without inspecting application-layer data. Which type of firewall is this?

Accepted Answer

Packet filter. A packet filter firewall operates at Layer 3 (Network) and Layer 4 (Transport) of the OSI model, making decisions solely based on source and destination IP addresses, ports, and protocols. It does not inspect application-layer data (Layer 7), which matches the scenario where traffic is allowed based on source IP address only. This is the simplest and fastest type of firewall, but it lacks the ability to block attacks embedded in application payloads.

Answer

Circuit-level gateway

Answer

Application gateway

Answer

Stateful inspection

Question 14

In qualitative risk analysis, a risk is assessed with a likelihood of 4 (on a scale of 1-5) and an impact of 5. The risk matrix defines scores of 15-25 as high. What is the risk rating?

Accepted Answer

High. In qualitative risk analysis, the risk score is calculated by multiplying likelihood by impact. Here, likelihood = 4 and impact = 5, so the risk score = 4 × 5 = 20. The risk matrix defines scores of 15–25 as high, so a score of 20 falls into the high category. Therefore, the risk rating is High.

Answer

Low

Answer

Medium

Answer

Critical

Question 15

In a software-defined network (SDN) architecture, the control plane is separated from the data plane. A network administrator is troubleshooting packet forwarding delays. Which plane is directly responsible for forwarding packets?

Accepted Answer

Data plane. In SDN, the data plane (also called the forwarding plane) is directly responsible for forwarding packets based on flow table entries installed by the controller. It handles per-packet operations like looking up destination addresses, applying actions (e.g., output to port, drop, modify header), and forwarding at line rate. Packet forwarding delays are typically caused by data plane issues such as flow table misses, hardware forwarding pipeline congestion, or inefficient TCAM lookups.

Answer

Application plane

Answer

Control plane

Answer

Management plane