CISSP Practice Test 14 — 15 Questions

Question 1

A security team is conducting a penetration test on a web application. They identify that the application is vulnerable to reflected cross-site scripting (XSS). Which of the following is the most effective mitigation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Encoding all user-supplied data before reflecting it in the response. Reflecting user-supplied data without proper encoding allows an attacker to inject arbitrary HTML/JavaScript that executes in the victim's browser. Output encoding (e.g., HTML entity encoding for context like

Answer

Using HTTPS to encrypt traffic

Answer

Implementing a Content Security Policy (CSP) with strict directives

Answer

Validating input against a whitelist of allowed characters

Question 2

A SOC analyst receives an alert for a suspicious outbound connection from a server in the DMZ to an external IP on port 443. The server is a web application server that should only communicate internally. The analyst checks the process and finds it is 'svchost.exe' running from a non-standard path. What is the most appropriate immediate action?

Accepted Answer

Isolate the server from the network. Isolating the server immediately contains the threat, preventing potential data exfiltration or lateral movement from a compromised host. The suspicious outbound connection from a DMZ server to an external IP on port 443 (HTTPS) combined with 'svchost.exe' running from a non-standard path strongly indicates malware masquerading as a legitimate Windows process. In security operations, containment is the priority before investigation to minimize damage.

Answer

Initiate a full incident response investigation

Answer

Disregard the alert because svchost.exe is a legitimate Windows process

Answer

Terminate the suspicious process

Question 3

Which of the following is a primary advantage of using a hardware security module (HSM) over software-based key storage?

Accepted Answer

Tamper-resistant physical security. A hardware security module (HSM) provides tamper-resistant physical security by storing cryptographic keys in a dedicated, hardened appliance that resists physical tampering, probing, and extraction. Unlike software-based key storage, which relies on the operating system's file system or memory and is vulnerable to malware or direct memory access attacks, an HSM ensures that keys never leave the secure boundary in plaintext, even if the host system is compromised.

Answer

Easier key backup

Answer

Lower cost

Answer

Faster key generation

Question 4

A financial services firm recently deployed a multi-factor authentication (MFA) solution for remote access to its trading platform. The MFA requires a one-time password (OTP) via a mobile app, in addition to a username and password. Since deployment, remote traders have complained that the authentication process takes too long, especially during market open hours. The help desk reports that many traders are accidentally locking their accounts due to multiple failed OTP attempts. The security team wants to maintain strong security but improve user experience. Which action should the security team take?

Accepted Answer

Implement risk-based adaptive MFA that prompts only when anomalous activity is detected. Risk-based adaptive MFA evaluates the context of each authentication request (e.g., location, device, time, behavior) and only triggers an OTP challenge when the risk score exceeds a threshold. This reduces friction for legitimate traders during peak hours while maintaining strong security against anomalous access attempts, directly addressing the complaint of slow authentication without weakening the overall security posture.

Answer

Reduce MFA to two factors by removing the OTP requirement

Answer

Remove MFA requirements during peak hours to improve performance

Answer

Extend the OTP validity window to 10 minutes to reduce time pressure

Question 5

A security analyst notices repeated failed login attempts from an internal IP address on the domain controller. After enabling account lockout, the lockouts continue but the source IP changes. What is the best next step?

Accepted Answer

Analyze the log events to identify the attack pattern and implement additional controls such as MFA. The changing source IP indicates a distributed attack, likely a password spraying or brute-force attempt from multiple compromised hosts. Analyzing log events helps identify the attack pattern (e.g., timing, targeted accounts, source IP ranges) so you can implement additional controls like MFA, which mitigates credential-based attacks regardless of source IP changes. Account lockout alone is insufficient when attackers rotate IPs, as lockout policies are per-account and per-source, not adaptive to distributed sources.

Answer

Increase the account lockout threshold

Answer

Ignore the event as it is likely a false positive

Answer

Disable the user account being targeted

Question 6

A global technology firm has implemented a continuous integration/continuous deployment (CI/CD) pipeline for its flagship software product. The security testing team is tasked with integrating security testing into the pipeline. The team has decided to use a static application security testing (SAST) tool and a software composition analysis (SCA) tool. They are currently running both tools every night against the entire codebase, but the developers complain that the reports are too long and often contain false positives. The team wants to improve the efficiency without sacrificing security coverage. Which of the following is the BEST strategy?

Accepted Answer

Implement a developers' feedback loop for false positives and tune the tools.. Tuning the SAST and SCA tools based on developer feedback directly addresses the false positive issue while maintaining security coverage. By establishing a feedback loop, the team can adjust rule sets, suppress known false positives, and reduce report noise without reducing scan frequency or scope. This approach aligns with the principle of continuous improvement in DevSecOps, ensuring that security testing remains efficient and actionable.

Answer

Decrease the scan frequency to weekly to reduce noise.

Answer

Replace SAST with dynamic application security testing (DAST) for more accurate results.

Answer

Run SAST and SCA only on new code changes committed to the main branch.

Question 7

An organization is planning a penetration test of its internal network. Which TWO of the following are essential elements to include in the test scope and rules of engagement?

Accepted Answer

Time windows when testing is permitted (e.g., after business hours).. The rules of engagement (ROE) and scope define the boundaries of the penetration test. Essential elements include authorized time windows (option B) to minimize business disruption and ensure testing occurs during agreed-upon periods, and a list of authorized IP addresses and systems (option D) to clearly define the target scope and avoid legal issues. Option A (list of specific tools) is not necessarily required in the scope; tools can be agreed upon but are not essential. Option C (vulnerability scanning schedule) is a separate activity and not part of penetration test scope. Option E (detailed client-side exploitation plan) is too specific and not a required element of the overall scope.

Answer

List of specific exploitation tools to be used.

Answer

Schedule for automated vulnerability scanning of all external systems.

Answer

Detailed plan for exploiting client-side vulnerabilities.

Question 8

A multinational corporation is designing a data retention schedule. Which factor is most critical when determining retention periods for personal data subject to the GDPR?

Accepted Answer

The purpose for which the data was collected. Under the GDPR, Article 5(1)(e) establishes the 'storage limitation' principle, which mandates that personal data must be kept no longer than necessary for the purposes for which it was collected. Therefore, the purpose of collection is the primary driver for determining the retention period, as it defines the lawful basis and necessity for processing. Without a defined purpose, any retention period would be arbitrary and non-compliant with the regulation.

Answer

The length of the third-party data processing agreement

Answer

The cost of storage media

Answer

The duration of any pending legal holds

Question 9

An organization wants to protect sensitive data stored on laptops. Which of the following is the MOST effective control to prevent data loss if a laptop is stolen?

Accepted Answer

Full-disk encryption (FDE). Full-disk encryption (FDE) renders the data on the laptop unreadable without the decryption key, even if the storage drive is removed and analyzed. This is the most effective preventive control against data loss from theft because it protects data at rest regardless of physical access to the device.

Answer

BIOS password

Answer

Asset tracking software

Answer

Remote wipe capability

Question 10

A security architect is designing access controls for a healthcare application where permissions are based on the user's role, the sensitivity of the data, and the context of the access (e.g., time of day). Which access control model best fits this requirement?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) is the correct model because it evaluates access decisions based on multiple attributes: the user's role, the data sensitivity (object attributes), and environmental context such as time of day. Unlike simpler models, ABAC can combine subject, resource, and environment attributes using policy rules (e.g., XACML or ALFA) to enforce fine-grained, context-aware permissions, which is essential for healthcare applications with dynamic compliance requirements like HIPAA.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 11

A multinational corporation is developing a new cloud-based collaboration platform that handles sensitive intellectual property. The platform must ensure end-to-end encryption (E2EE) so that even the cloud provider cannot access the data. Users communicate via chat and file sharing. The architect proposes using a hybrid encryption scheme where each user has a public/private key pair, and for each message, a random symmetric key is used to encrypt the message, which is then encrypted with the recipient's public key. However, there is a requirement for the company to be able to lawfully intercept communications in case of a court order. This conflicts with E2EE. Which design can satisfy both confidentiality and lawful interception?

Accepted Answer

Implement a split-key design where the encryption keys are generated and held by the users, but a separate escrow agent splits the key into two parts: one held by the user and one held by the company. Alternatively, use a 'drop box' approach where communications are recorded in an encrypted format and the company can decrypt only after a court order by using a secondary key that is released upon authorization.. It uses a split-key or drop-box design that preserves end-to-end encryption for regular communications while enabling lawful interception under strict authorization. In this scheme, the user holds one part of the key and the company holds another, or communications are recorded encrypted and a secondary key is released only after a court order, ensuring that neither the cloud provider nor the company can decrypt data without proper legal process. This satisfies both the E2EE requirement and the lawful interception mandate without compromising the core security principle of least privilege.

Answer

Implement key escrow where the company holds a copy of all users' private keys.

Answer

Implement a transparent encryption proxy on the user's device that logs all keys and sends them to the company.

Answer

Use client-side encryption where the encryption key is derived from user password and stored with a backup that can be recovered by the company using a master key.

Question 12

Which security model focuses on preventing unauthorized access by enforcing a 'no read up, no write down' rule?

Accepted Answer

Bell-LaPadula. The Bell-LaPadula model is a formal state machine model for enforcing access control in government and military systems. Its core rule, 'no read up' (simple security property) and 'no write down' (star property), prevents subjects from reading objects at a higher classification level and from writing to objects at a lower classification level, thereby preventing unauthorized disclosure of sensitive information.

Answer

Clark-Wilson

Answer

Biba

Answer

Brewer-Nash

Question 13

A large enterprise uses Active Directory for authentication. Several users report intermittent authentication failures when accessing internal web applications. The help desk confirms that the failures occur at random times and affect both new and existing users. The security team discovers that the system clocks on domain controllers are within acceptable limits, but some client workstations show time drift of up to 10 minutes. The Kerberos protocol is used for authentication. What is the most likely cause of the authentication failures, and what action should be taken?

Accepted Answer

Synchronize all client workstation clocks using a centralized NTP server. Kerberos authentication relies on synchronized clocks between clients and domain controllers, with a default maximum time skew tolerance of 5 minutes (RFC 4120). A client clock drift of up to 10 minutes exceeds this tolerance, causing intermittent authentication failures because Kerberos ticket requests are rejected as invalid or replay attacks. Synchronizing all client workstations to a centralized NTP server resolves the time skew and restores Kerberos authentication reliability.

Answer

Implement password complexity policies to reduce authentication errors

Answer

Enable NTLM fallback authentication for the web applications

Answer

Configure Kerberos ticket lifetimes to 24 hours to reduce sensitivity to time skew

Question 14

A company needs to provide secure remote access to employees using company-issued laptops. The solution must support both web applications and legacy client-server apps without installing client software on the laptops. Which VPN technology is best?

Accepted Answer

SSL VPN with clientless web access and port forwarding. SSL VPN with clientless web access and port forwarding is the best choice because it meets the requirement of supporting both web applications and legacy client-server apps without installing client software. Clientless web access provides secure HTTPS-based access to internal web applications via a browser, while port forwarding allows legacy TCP-based client-server applications to be tunneled through the SSL VPN without requiring a full VPN client on the laptop. This approach leverages the existing browser and OS capabilities, eliminating the need for additional software installation.

Answer

L2TP over IPsec

Answer

MPLS Layer 3 VPN

Answer

IPsec tunnel mode

Question 15

A company is required to retain logs for regulatory compliance. Which factor primarily determines the log retention period?

Accepted Answer

Regulatory requirements. Regulatory compliance frameworks (e.g., PCI DSS, HIPAA, SOX, GDPR) explicitly mandate minimum log retention periods (e.g., PCI DSS Requirement 10.7 requires at least one year of logs, with three months immediately accessible). Storage capacity, incident response needs, and log volume are operational considerations that may influence implementation but do not override the legal or contractual obligation to retain logs for a specified duration. The primary factor is the regulatory requirement itself, as failure to comply can result in fines, legal liability, or loss of certification.

Answer

Storage capacity

Answer

Incident response needs

Answer

Log volume