CISSP Practice Test 13 — 15 Questions

Question 1

Match each security model to its primary characteristic.

Question 2

Match each threat type to its description.

Question 3

A medium-sized financial services company has a flat network topology with no segmentation between the corporate LAN and the server farm. The security team recently deployed a host-based intrusion detection system (HIDS) on all critical servers. Over the past week, the HIDS has generated multiple high-severity alerts indicating outbound connections from a database server to an external IP address in a foreign country, occurring every hour and lasting only a few seconds. The database server contains sensitive customer data. The company's incident response plan (IRP) has not been updated in two years, and the CISO wants to ensure a response that minimizes business disruption while protecting data. The IT team is small, and the security analyst on duty suspects a data exfiltration attempt but is unsure. What should the analyst do FIRST?

Accepted Answer

Disconnect the database server from the network at the switch port and preserve the system state for forensic analysis. Option B is correct because isolating the server (disconnecting from the network) stops any ongoing data exfiltration immediately while preserving forensic evidence. Option A may trigger more data loss; Option C is premature before containment; Option D is important but delays containment.

Answer

Run a full antivirus scan on the database server and update the HIDS signatures

Answer

Review the firewall logs to identify all external IPs the server has contacted

Answer

Immediately notify the company's legal department and public relations team

Question 4

Refer to the exhibit. A security analyst detects unusual process creation. Which attack technique is most likely being observed?

Accepted Answer

LSASS credential dumping using Mimikatz. The exhibit shows that a cmd.exe process was spawned by lsass.exe, which is abnormal. lsass.exe is the Local Security Authority Subsystem Service. The parent process being lsass.exe indicates that an attacker may have injected code into lsass.exe to execute commands. The privileges assigned to the logon session include SeDebugPrivilege and SeTcbPrivilege, which are high privileges. This is indicative of a Pass-the-Hash or credential dumping attack where the attacker uses LSASS to extract credentials or execute commands with SYSTEM privileges.

Answer

Privilege escalation via SeDebugPrivilege

Answer

Pass-the-Hash attack

Answer

Kerberos Golden Ticket attack

Question 5

Which TWO security controls are most effective in preventing VLAN hopping attacks?

Accepted Answer

Set the native VLAN to an unused VLAN ID.. Setting the native VLAN to an unused VLAN ID prevents VLAN hopping via double-tagging attacks. In a double-tagging attack, an attacker sends frames with two 802.1Q tags; the first switch strips the outer tag, forwarding the frame on the native VLAN (which is typically VLAN 1). By changing the native VLAN to an unused ID, any double-tagged frame arriving on an access port will have its outer tag removed and be forwarded onto that unused VLAN, where no legitimate hosts exist, thus breaking the attack path.

Answer

Use VLAN access control lists (VACLs) to filter traffic between VLANs.

Answer

Implement DHCP snooping on all VLANs.

Answer

Enable Spanning Tree Protocol (STP) on all switches.

Question 6

Which TWO of the following are essential components of a successful security awareness program?

Accepted Answer

Metrics to measure the program's effectiveness. Metrics to measure the program's effectiveness (Option A) are essential because they provide quantifiable data—such as phishing click rates, incident reporting trends, and policy violation statistics—that allow the organization to evaluate whether the awareness program is changing behavior and reducing risk. Without metrics, the program cannot be improved or justified to stakeholders, making it a core component of a successful security awareness initiative.

Answer

Implementation of technical controls like antivirus

Answer

Annual one-time training sessions

Answer

Punitive measures for security violations

Question 7

Which TWO of the following are examples of administrative controls? (Select exactly 2)

Accepted Answer

Security awareness training. Security awareness training (B) is an administrative control because it involves policies, procedures, and human behavior management to reduce risk. Background checks (E) are also administrative controls, as they are part of personnel security policies that vet employees before granting access. Both are documented in the organization's security policy framework and are not technical or physical mechanisms.

Answer

Firewall rules

Answer

Security guards at entrances

Answer

Encryption of data at rest

Question 8

Refer to the exhibit. The VPN tunnel is not coming up. What is the most likely configuration error?

Accepted Answer

The crypto map is applied to the Tunnel interface instead of the physical interface.. The crypto map must be applied to the physical interface (e.g., GigabitEthernet0/0) that connects to the VPN peer, not to the Tunnel interface. The Tunnel interface is a logical construct used for overlay routing (e.g., GRE or IPsec VTI), but the crypto map defines the IPsec security associations on the actual egress interface. Applying it to the Tunnel interface prevents the IPsec process from matching outbound traffic to the correct physical path, so the tunnel never establishes.

Answer

The encryption algorithm AES 256 is not supported.

Answer

The hash algorithm SHA256 is not supported.

Answer

The Diffie-Hellman group 14 is not strong enough.

Question 9

A network architect is designing a secure connection between two data centers across an untrusted WAN. The requirement is to encrypt all traffic and authenticate both endpoints. Which protocol should be used?

Accepted Answer

IPsec tunnel mode. IPsec tunnel mode is the correct choice because it encrypts the entire IP packet, including the original IP header, and encapsulates it within a new IP header for secure transport across an untrusted WAN. It also provides mutual authentication of both endpoints using IKE (Internet Key Exchange) with pre-shared keys or certificates, satisfying the requirement for encrypting all traffic and authenticating both data centers.

Answer

SSH

Answer

MPLS

Answer

SSL/TLS

Question 10

A network engineer is configuring a firewall to allow HTTP traffic from the internet to a web server (10.0.0.10). The firewall has three interfaces: outside (ISP), DMZ (10.0.0.0/24), and inside (192.168.1.0/24). The web server is in the DMZ. Which rule is correct?

Accepted Answer

Rule: Source interface Outside, Source any, Destination 10.0.0.10, Port 80, Action allow. Option B is correct because HTTP traffic from the internet arrives on the outside interface, and the firewall rule must match the source interface (Outside), allow any source IP, and specify the destination IP (10.0.0.10) and port 80. This permits inbound web traffic to the DMZ web server while maintaining security boundaries.

Answer

Rule: Source interface Inside, Source any, Destination 10.0.0.10, Port 80, Action allow

Answer

Rule: Source interface Outside, Source 192.168.1.0/24, Destination 10.0.0.10, Port 80, Action allow

Answer

Rule: Source interface DMZ, Source any, Destination 10.0.0.10, Port 80, Action allow

Question 11

Refer to the exhibit. A user reports they cannot authenticate to a web application after receiving a new token. The error log shows the above entries. Which of the following is the MOST likely cause?

Accepted Answer

The token was signed with a different secret key than the one used by the verifier. The error log entries indicate a signature validation failure, which occurs when the token was signed with a secret key that differs from the one the verifier uses. In JSON Web Token (JWT) authentication, the verifier must possess the exact same secret (for HMAC) or the corresponding public key (for RSA/ECDSA) to validate the signature; a mismatch causes authentication to fail. This is the most likely cause because the user received a new token, suggesting a key rotation or misconfiguration where the signing key was changed without updating the verifier.

Answer

The token uses a different signing algorithm than expected

Answer

The token has expired

Answer

The token's issuer claim does not match the expected issuer

Question 12

During a vulnerability scan, a security analyst discovers that a web server is running an outdated version of Apache with known remote code execution vulnerabilities. The server is in production and cannot be patched immediately due to dependency conflicts. What is the best compensating control to reduce risk while a permanent fix is developed?

Accepted Answer

Implement a web application firewall (WAF) to block known attack patterns. A Web Application Firewall (WAF) is the best compensating control because it can inspect HTTP/HTTPS traffic at the application layer (Layer 7) and block known attack patterns targeting the outdated Apache version, such as specific payloads for CVE-2017-9798 or CVE-2021-41773. Unlike other options, a WAF provides virtual patching without modifying the vulnerable server, directly mitigating the remote code execution risk while a permanent fix is developed.

Answer

Disable all unnecessary modules and services on the server

Answer

Enable detailed logging and alerting for the server

Answer

Isolate the server in a separate VLAN with strict ACLs

Question 13

A security analyst discovers that a business unit is storing sensitive data on a file share without classification labels. What is the first step to remediate?

Accepted Answer

Notify the data owner to classify the data. The data owner must classify the data first. Other actions are premature before classification. Encrypting or moving might be appropriate after classification. Deleting without authorization could destroy needed data.

Answer

Move the data to a secure server

Answer

Immediately delete the data

Answer

Encrypt the file share

Question 14

Which TWO of the following are valid data de-identification techniques?

Accepted Answer

Data masking. Data masking is a valid de-identification technique because it irreversibly obscures specific data values, such as replacing real credit card numbers with fictional ones, while preserving the data format for testing or analytics. Unlike encryption, masking does not allow reversal to the original value, ensuring the data is no longer personally identifiable. It is commonly used in non-production environments to protect sensitive information.

Answer

Encryption

Answer

Access control

Answer

Backup

Question 15

Refer to the exhibit. Which access control model is described?

Accepted Answer

Mandatory Access Control (MAC). The exhibit describes a system where access decisions are based on security labels (e.g., classification levels like Top Secret, Secret, Confidential) and clearances assigned to subjects, with the system enforcing the policy. This is the defining characteristic of Mandatory Access Control (MAC), where the operating system or security kernel centrally controls access based on predefined rules, and users cannot override these controls. The reference to labels and clearances without user discretion confirms MAC as the correct model.

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)