CISSP Practice Test 13 — 15 Questions

Question 1

A company uses VLANs to separate traffic between the IT, HR, and Finance departments. A user in the HR VLAN reports that she cannot access a file server located in the IT VLAN. The file server's default gateway is correctly set to the IT VLAN interface. All workstations have correct IP addresses and subnet masks. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

No routing is configured between the HR and IT VLANs.. VLANs create separate broadcast domains, so traffic between different VLANs must be routed. Since the HR workstation is in a different VLAN than the file server, and no routing is configured between the HR and IT VLANs, the HR workstation cannot reach the file server even though the server's default gateway is correctly set. This is the most likely cause because all other network settings (IP addresses, subnet masks, switch port configurations) are described as correct.

Answer

Spanning Tree Protocol (STP) is blocking the link between the HR and IT switches.

Answer

The HR workstation has an incorrect subnet mask.

Answer

The HR VLAN switch port is incorrectly configured with the wrong VLAN ID.

Question 2

A multinational corporation maintains site-to-site IPsec VPN tunnels between its headquarters and three regional branch offices. Over the past week, the tunnels have been dropping intermittently, causing disruption to real-time applications. The network team checked logs and found frequent 'Phase 2 rekey failure' messages. The tunnels are configured with IKEv1 and preshared keys. The headquarters uses a Cisco ASA, and the branches use various vendors' firewalls. The team verified that firewall policies allow IPsec traffic, and there is no packet loss on the WAN links. Which action should the team take to resolve the issue most effectively?

Accepted Answer

Adjust the Dead Peer Detection (DPD) intervals and Phase 2 lifetime settings to be consistent across all sites.. The frequent 'Phase 2 rekey failure' messages indicate a mismatch in IPsec security association (SA) parameters between the Cisco ASA and the branch firewalls. IKEv1 Phase 2 lifetimes and Dead Peer Detection (DPD) intervals must be consistent across all peers; otherwise, one side may attempt to rekey or declare the peer dead while the other expects a different timing, causing intermittent tunnel drops. Adjusting these values to match across all sites resolves the rekey failures without compromising security or requiring a protocol migration.

Answer

Increase the MTU on the WAN interfaces to 1500 bytes on all firewalls.

Answer

Change the encryption algorithm from AES-256 to 3DES on all peers.

Answer

Migrate all VPN connections from IPsec to SSL VPN using clientless access.

Question 3

A company is selecting a disaster recovery site for critical applications that must be restored within 4 hours with minimal data loss. Which site type best meets these requirements?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, network connectivity, and real-time data replication, enabling recovery within minutes to hours and minimal data loss. This matches the requirement of restoring critical applications within 4 hours with minimal data loss, as hot sites maintain near-synchronous or synchronous replication (e.g., using synchronous replication over Fibre Channel or iSCSI with RPOs in seconds).

Answer

Cold site

Answer

Reciprocal agreement

Answer

Warm site

Question 4

You are the security architect for a multinational corporation that handles highly sensitive intellectual property (IP) and personally identifiable information (PII) for clients in multiple jurisdictions, including GDPR and CCPA regions. The company recently experienced a data breach where an attacker exfiltrated 50 GB of data from a file server by exploiting a vulnerability in the backup software. The backup software had been configured with default credentials and was accessible from the internet. The security team has implemented compensating controls, but management wants to prevent such incidents in the future. You have been asked to recommend a long-term strategy to protect sensitive data assets. The budget is limited, and the solution must minimize user friction. Current environment: On-premises Active Directory with Windows file servers, some data in AWS S3, and a mix of laptops and mobile devices. The organization uses Microsoft 365 for email and collaboration. Which of the following is the BEST course of action?

Accepted Answer

Deploy a data classification and labeling solution integrated with endpoint and network DLP to automatically detect and protect sensitive data. Data classification and labeling, integrated with endpoint and network DLP, directly addresses the root cause: the inability to distinguish sensitive data from non-sensitive data. By automatically classifying and labeling IP and PII, the organization can enforce policy-based protections (e.g., blocking exfiltration, applying encryption) without relying solely on perimeter controls. This minimizes user friction by automating detection and response, and it scales across on-premises, cloud (AWS S3), and Microsoft 365 environments, aligning with GDPR and CCPA requirements for data protection.

Answer

Implement multi-factor authentication (MFA) for all administrative accounts and backup interfaces

Answer

Encrypt all data at rest using AES-256 and implement strict key management policies

Answer

Segment the backup network from the production network and enforce strict firewall rules

Question 5

A financial institution mandates that all administrative access to network devices must go through a privileged access management (PAM) solution. The PAM solution manages and rotates credentials automatically and logs all sessions. Recently, an auditor discovered that a router's configuration was changed outside of the approved change window. PAM logs show no session during that time. The router supports both local and RADIUS authentication. Which of the following is the MOST likely explanation for the unauthorized change?

Accepted Answer

A local account on the router was used that is not managed by the PAM solution.. The PAM solution logs all sessions, but the logs show no session during the time of the unauthorized change. Since the router supports both local and RADIUS authentication, the most likely explanation is that a local account (e.g., a console or enable password) was used directly on the router, bypassing the PAM-managed RADIUS authentication entirely. Local accounts are not managed or rotated by the PAM solution, so no session would be recorded.

Answer

The PAM solution's database was corrupted and failed to log the session.

Answer

The router's RADIUS configuration pointed to a different, unmonitored authentication server.

Answer

The network administrator used a shared service account not unique to the PAM system.

Question 6

An organization is deploying a VPN solution for remote employees. The security team requires a modern protocol with perfect forward secrecy, uses elliptic curve cryptography, and is known for its efficient, minimal codebase. Which VPN protocol should they choose?

Accepted Answer

WireGuard. WireGuard is the correct choice because it is a modern VPN protocol that uses elliptic curve cryptography (Curve25519) for key exchange, provides perfect forward secrecy by default through its ephemeral session keys, and is designed with a minimal, auditable codebase (around 4,000 lines) for efficiency and security. These features directly match the organization's requirements for a modern protocol with PFS, ECC, and a lean implementation.

Answer

L2TP/IPsec

Answer

PPTP

Answer

IPsec with IKEv2

Question 7

A small company with 50 employees operates a flat network where all workstations, servers, and printers are on a single subnet without segmentation. The company recently suffered a ransomware outbreak that spread rapidly from an infected workstation to the file server and multiple other machines, causing significant downtime. The IT manager wants to redesign the network to contain future outbreaks and limit lateral movement. The budget is limited, and the environment uses a mixture of managed and unmanaged switches. Which course of action would BEST mitigate the risk of lateral spread while minimizing cost and complexity?

Accepted Answer

Implement VLANs with ACLs to separate departments and restrict traffic between them.. Implementing VLANs with ACLs segments the flat network into separate broadcast domains, preventing lateral movement by restricting traffic between departments at Layer 2. This directly contains ransomware propagation without requiring new hardware, as VLANs can be configured on existing managed switches, making it cost-effective. ACLs further enforce least-privilege access between VLANs, blocking unauthorized inter-VLAN communication.

Answer

Enable full-disk encryption on all endpoints and servers.

Answer

Upgrade all endpoint antivirus to the latest version and enable real-time scanning.

Answer

Deploy a network-based intrusion detection system (IDS) to alert on suspicious traffic.

Question 8

A large hospital uses a wireless LAN (WLAN) for mobile medical devices and staff tablets. Recently, nurses reported intermittent connectivity drops and high retransmission rates specifically in the east wing near the elevator banks. The WLAN is based on 802.11ac in the 5 GHz band. The hospital's IT team has already checked for channel overlap, and the APs are configured to use non-overlapping channels with automatic channel selection. Signal strength in the area is adequate (-65 dBm). However, the retransmission rate spikes during peak hours. Which approach should the network team take FIRST to diagnose and resolve the issue?

Accepted Answer

Conduct a spectrum analysis to identify sources of interference and reposition APs away from the elevator shafts.. The symptoms—intermittent connectivity drops and high retransmission rates near elevator banks during peak hours—strongly suggest external RF interference, likely from the elevator motors or other electrical equipment. A spectrum analysis is the correct first step because it can identify non-Wi-Fi interference sources (e.g., microwave ovens, motors, or radar) that cause packet corruption and retransmissions, even when signal strength is adequate and channels are non-overlapping. Repositioning APs away from the elevator shafts after identifying the interference source directly mitigates the physical cause.

Answer

Enable frequency hopping on the APs to avoid interference.

Answer

Increase the transmit power of the APs in the east wing to improve signal-to-noise ratio.

Answer

Deploy additional APs in the elevator area to provide more capacity and redundancy.

Question 9

A security analyst is configuring a firewall to allow HTTP traffic (TCP port 80) from the internet to a web server in the DMZ. The firewall should also allow return traffic from the server back to the internet. Which type of firewall is best suited to handle this traffic while maintaining security?

Accepted Answer

Stateful inspection firewall. A stateful inspection firewall (C) is best suited because it tracks the state of active connections, allowing return traffic for established sessions (e.g., HTTP responses from the server to the internet) while blocking unsolicited inbound packets. It inspects packets at Layers 3 and 4, maintaining a state table that matches return packets to the original outbound request, ensuring only legitimate responses are permitted. This provides better security than a simple packet filter by preventing spoofed or out-of-context packets.

Answer

Application proxy firewall

Answer

Circuit-level gateway

Answer

Packet filter firewall

Question 10

During a penetration test, the tester successfully performs a VLAN hopping attack by sending packets with a specific tag. Which mitigation technique is most effective at preventing double-tagging VLAN hopping?

Accepted Answer

Disable the native VLAN and explicitly tag all VLANs. Double-tagging VLAN hopping exploits the native VLAN (typically VLAN 1) on a trunk link. By disabling the native VLAN and explicitly tagging all VLANs, including the native VLAN, the switch will not forward untagged frames or frames with a single 802.1Q tag that can be misinterpreted by the next switch, thus preventing the attacker from injecting frames into a different VLAN.

Answer

Use VLAN access control lists (VACLs) only

Answer

Implement port security with sticky MAC

Answer

Enable Dynamic Trunking Protocol (DTP) on all ports

Question 11

A financial institution is implementing a data retention policy to comply with regulatory requirements. The policy must ensure that transaction records are retained for 7 years and then securely destroyed. Which of the following is the BEST approach to implement this policy?

Accepted Answer

Automatically purge records using a data management tool that overwrites data after the retention period. Automated purging using a data management tool that overwrites data ensures that the records are securely destroyed at the end of the retention period, meeting both regulatory compliance and data sanitization requirements. Overwriting (e.g., using DoD 5220.22-M or NIST SP 800-88 standards) prevents data recovery by replacing the storage media's bits with patterns, making it a reliable method for secure destruction in a financial institution's automated environment.

Answer

Encrypt all records and destroy the encryption keys after 7 years

Answer

Move records to a separate archive and delete the directory pointers

Answer

Manually review and delete records after 7 years

Question 12

A multinational corporation is evaluating risk treatment options for a identified high-impact, low-probability risk. The risk is below the organization's risk appetite threshold. Which is the most appropriate action?

Accepted Answer

Accept the risk. When a risk is below the organization's risk appetite threshold, it is considered acceptable. Accepting the risk (Option D) is the most appropriate action because the organization has determined that the potential impact is tolerable and does not warrant additional expenditure or operational changes. This aligns with the risk management principle that not all risks must be mitigated, transferred, or avoided—some are simply retained as a cost of doing business.

Answer

Mitigate the risk

Answer

Transfer the risk via insurance

Answer

Avoid the risk by discontinuing the activity

Question 13

A medium-sized financial services company has a flat network topology with no segmentation between the corporate LAN and the server farm. The security team recently deployed a host-based intrusion detection system (HIDS) on all critical servers. Over the past week, the HIDS has generated multiple high-severity alerts indicating outbound connections from a database server to an external IP address in a foreign country, occurring every hour and lasting only a few seconds. The database server contains sensitive customer data. The company's incident response plan (IRP) has not been updated in two years, and the CISO wants to ensure a response that minimizes business disruption while protecting data. The IT team is small, and the security analyst on duty suspects a data exfiltration attempt but is unsure. What should the analyst do FIRST?

Accepted Answer

Disconnect the database server from the network at the switch port and preserve the system state for forensic analysis. The immediate priority is to contain the suspected data exfiltration by isolating the database server from the network, which stops the outbound connections and preserves volatile evidence for forensic analysis. Disconnecting at the switch port (e.g., via `shutdown` interface command) is a rapid, reversible action that minimizes business disruption compared to pulling the power cable, and it aligns with the incident response phase of containment before eradication or recovery. The HIDS alerts indicate a persistent, short-lived outbound connection pattern, which strongly suggests a beaconing or data-stealing malware that must be contained first to prevent further data loss.

Answer

Run a full antivirus scan on the database server and update the HIDS signatures

Answer

Review the firewall logs to identify all external IPs the server has contacted

Answer

Immediately notify the company's legal department and public relations team

Question 14

You are a security analyst at a financial institution. The company has a hybrid infrastructure with on-premises servers and AWS cloud. The on-premises network uses a SIEM that aggregates logs from all sources. Recently, the SIEM has been generating a high volume of alerts for failed SSH login attempts from an internal IP (10.10.50.100) to multiple Linux servers. The IP belongs to a jump box used by system administrators. Upon investigation, you find that the jump box is running a hardened OS, and only authorized admins can access it via SSH key authentication. However, the failed login attempts show usernames like 'root', 'admin', 'test', which are not valid accounts on the target servers. The attempts occur every 5 seconds around the clock. There are no successful logins from that IP. The jump box has the latest patches and antivirus. What should you do FIRST?

Accepted Answer

Isolate the jump box from the network immediately and conduct a forensic analysis. The jump box is exhibiting automated, high-frequency failed login attempts with non-existent usernames, which is a classic indicator of a compromised host being used as an attack launch point—even if the OS appears hardened and AV shows clean. The first priority in incident response is containment; isolating the jump box prevents further potential lateral movement or data exfiltration while preserving forensic evidence. A forensic analysis is then required to determine the root cause (e.g., a hidden backdoor, credential theft, or kernel-level rootkit) before any remediation steps.

Answer

Add the usernames 'root', 'admin', 'test' to the target servers' password blacklist

Answer

Ignore the alerts because the usernames are invalid and the jump box is hardened

Answer

Run a full antivirus scan on the jump box and check for malware

Question 15

A financial services company has a hybrid cloud environment with on-premises servers and a public cloud provider. The security team recently discovered that an attacker exfiltrated sensitive customer data from a cloud storage bucket. The investigation reveals that the bucket was configured with a bucket policy that allowed anonymous read access. The security architect must redesign the architecture to prevent such incidents. The company uses AWS for cloud services. The architect proposes the following: (1) Enable AWS CloudTrail and Amazon GuardDuty for monitoring. (2) Implement AWS Identity and Access Management (IAM) roles for applications instead of long-term access keys. (3) Use AWS Key Management Service (KMS) to encrypt data at rest. (4) Configure a VPC with a NAT gateway and private subnets for all compute resources. (5) Implement S3 bucket policies that deny all access unless explicitly allowed by a specific IAM role. During a review, the chief information security officer (CISO) points out that one of these measures does not directly address the root cause of the incident. Which measure is least effective in preventing unauthorized access to S3 buckets?

Accepted Answer

Enable AWS CloudTrail and Amazon GuardDuty for monitoring. (enabling AWS CloudTrail and Amazon GuardDuty) is a detective control, not a preventive one. The root cause of the incident was a misconfigured bucket policy that allowed anonymous read access. Monitoring tools can detect unauthorized access after it occurs but cannot prevent it. The other options directly address the root cause by enforcing least privilege, encrypting data, or restricting network access.

Answer

Use AWS KMS to encrypt data at rest

Answer

Configure a VPC with private subnets and a NAT gateway

Answer

Implement IAM roles for applications instead of long-term access keys