CISSP Practice Test 12 — 15 Questions

Question 1

Match each security assessment type to its description.

Question 2

Match each OSI layer to its function.

Question 3

Drag and drop the steps for conducting a business impact analysis (BIA) in the correct order.

Question 4

Drag and drop the steps of the incident response process in the correct order.

Question 5

Drag and drop the steps for setting up a VPN using IPsec in tunnel mode in the correct order.

Question 6

Drag and drop the steps for a forensic investigation in the correct order.

Question 7

Drag and drop the steps for a disaster recovery (DR) plan activation in the correct order.

Question 8

Drag and drop the steps for a secure password change procedure in the correct order.

Question 9

A security analyst notices repeated failed login attempts from an internal IP address on the domain controller. After enabling account lockout, the lockouts continue but the source IP changes. What is the best next step?

Accepted Answer

Analyze the log events to identify the attack pattern and implement additional controls such as MFA. Option A is correct because the changing source IP indicates a distributed attack, likely a password spraying or brute-force attempt from multiple compromised hosts. Analyzing log events helps identify the attack pattern (e.g., timing, targeted accounts, source IP ranges) so you can implement additional controls like MFA, which mitigates credential-based attacks regardless of source IP changes. Account lockout alone is insufficient when attackers rotate IPs, as lockout policies are per-account and per-source, not adaptive to distributed sources.

Answer

Increase the account lockout threshold

Answer

Ignore the event as it is likely a false positive

Answer

Disable the user account being targeted

Question 10

Drag and drop the steps for implementing mandatory access control (MAC) in a secure system in the correct order.

Question 11

Match each security control to its category (preventive, detective, corrective).

Question 12

Match each cryptographic algorithm to its type.

Question 13

Match each security policy to its purpose.

Question 14

Match each access control type to its description.

Question 15

Match each business continuity term to its definition.