CISSP Practice Test 12 — 15 Questions

Question 1

Under the ISC2 Code of Ethics, which canon has the highest priority?

Accepted Answer

Protect society. The ISC2 Code of Ethics lists canons in order: Protect society, Act honourably, Provide diligent service, Advance the profession.

Answer

Advance the profession

Answer

Provide diligent service

Answer

Act honorably

Question 2

A security team is reviewing application security and needs to analyze source code without executing the application. Which technique should they use?

Accepted Answer

Static Application Security Testing (SAST). SAST analyzes source code statically, without running the application.

Answer

Dynamic Application Security Testing (DAST)

Answer

Interactive Application Security Testing (IAST)

Answer

Runtime Application Self-Protection (RASP)

Question 3

A security officer is developing a risk management plan. Which TWO of the following are valid risk response strategies? (Select TWO.)

Accepted Answer

Transfer. Valid risk response strategies include Transfer and Accept. Avoid is a standard strategy but is not listed as correct in this context because the question expects the two distinct options that are clearly valid among the given choices. Ignore and Eliminate are not standard risk response strategies.

Answer

Avoid

Answer

Ignore

Answer

Eliminate

Question 4

Which component of the AAA framework is responsible for determining what resources a user can access and what actions they can perform?

Accepted Answer

Authorization. AAA stands for Authentication, Authorization, and Accounting. Authorization is the process of granting or denying access to resources based on policies.

Answer

Auditing

Answer

Authentication

Answer

Accounting

Question 5

A company is preparing for a PCI DSS assessment. Which TWO of the following are likely to be required as part of the assessment?

Accepted Answer

Annual on-site assessment by a QSA. PCI DSS requires external ASV vulnerability scans quarterly and an annual on-site assessment by a QSA.

Answer

Monthly internal vulnerability scans

Answer

SOC 2 Type II report

Answer

Annual penetration test of all systems

Question 6

Match each threat type to its description.

Accepted Answer

Phishing: Mass email sent to many users to trick them into revealing personal information.. The correct matches are: Phishing with mass email (A), Spear Phishing with targeted attacks (C), and Whaling with executive targets (D). Option B is incorrect because it describes spear phishing, not phishing. Option E is also incorrect as it misassigns whaling as mass email.

Answer

Phishing: Targeted attack on a specific individual

Answer

Whaling: Mass email sent to many users

Question 7

Under GDPR, which TWO of the following are valid lawful bases for processing personal data?

Accepted Answer

Consent. GDPR Article 6 lists lawful bases including consent, contract, legal obligation, vital interests, public task, and legitimate interests.

Answer

Data subject's employment

Answer

Data processor's request

Answer

Data controller's profit

Question 8

Which THREE of the following are components of a Privileged Access Management (PAM) solution?

Accepted Answer

Session recording. PAM typically includes password vaulting (secure credential storage), session recording (monitoring privileged sessions), and just-in-time access (elevated privileges on demand).

Answer

User self-service password reset

Answer

Single sign-on for web applications

Question 9

A security architect is evaluating physical security controls for a facility handling sensitive data. Which of the following are examples of layered physical security controls? (Choose THREE)

Accepted Answer

Perimeter fence. Layered security uses multiple barriers: perimeter (fence), external (lighting), building (locks), secure area (mantrap), and IT area (cage). Biometrics and guards are also layers.

Answer

Single-factor authentication for all doors

Answer

Unsecured windows on ground floor

Question 10

Match each security assessment type to its description.

Accepted Answer

Vulnerability Assessment: Automated scan to identify known vulnerabilities. Correct matches: Vulnerability Assessment uses automated scans; Penetration Test involves exploitation; Security Audit reviews policies; Risk Assessment evaluates risks. Common confusions mix vulnerability assessments with penetration tests.

Answer

Vulnerability Assessment: Simulated attack to exploit vulnerabilities and assess impact

Answer

Penetration Test: Automated scan to identify known vulnerabilities

Question 11

Which TWO of the following are characteristics of a Privileged Access Management (PAM) solution? (Choose two.)

Accepted Answer

Session recording. PAM includes password vaulting and session recording; just-in-time access is also a characteristic, but note: the question asks for TWO, so select the correct two.

Answer

Self-service password reset

Answer

Single sign-on for all users

Answer

OpenID Connect authentication

Question 12

A security analyst is performing an access review. Which THREE of the following are best practices for user access recertification? (Choose three.)

Accepted Answer

Managers confirm that employees still need their current access. Recertification should confirm business need, review actual access, and be periodic.

Answer

Remove all access and re-provision as needed

Answer

Automatically approve access if no response

Question 13

Drag and drop the steps for a secure password change procedure in the correct order.

Accepted Answer

Verify identity → Enter new password → Enforce password history → Hash storage → Log. Password change: verify identity, enter new password, enforce history, hash storage, log.

Answer

Verify identity → Enforce password history → Enter new password → Hash storage → Log

Answer

Enter new password → Verify identity → Hash storage → Enforce password history → Log

Answer

Verify identity → Enter new password → Hash storage → Log → Enforce password history

Question 14

Which TWO of the following are essential components of a disaster recovery plan? (Choose two.)

Accepted Answer

Recovery Point Objective (RPO). Options A and C are correct. Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are key metrics. Business continuity plan is a separate but related plan; cold sites and SLAs are not components of a DRP itself.

Answer

Business continuity plan

Answer

Service Level Agreement (SLA)

Answer

Cold site configuration

Question 15

A security engineer is hardening a system against side-channel attacks that exploit variations in execution time or power consumption. Which TWO mitigations are specifically designed to counter such attacks? Select two.

Accepted Answer

Constant-time algorithms. Constant-time programming ensures operations take the same time regardless of inputs, and noise injection obscures power consumption patterns.

Answer

Data Execution Prevention (DEP)

Answer

Address Space Layout Randomization (ASLR)

Answer

Input validation