CISSP Practice Test 14 — 15 Questions

Question 1

Refer to the exhibit. A project team is sending a spreadsheet marked Confidential via email. What control is required?

Accepted Answer

Encrypt the email and attachment. Option B is correct because email transmissions, including attachments, are transmitted in plaintext by default using SMTP (RFC 5321). Encrypting both the email body and the attachment ensures confidentiality, protecting the spreadsheet marked Confidential from unauthorized access during transit. This aligns with the principle of protecting data at rest and in transit as required by asset security policies.

Answer

Both A and B

Answer

No additional controls if sent over internal network

Answer

Use a secure file transfer protocol

Question 2

Refer to the exhibit. A legal hold exception preserves FinancialRecords FIN-001 and FIN-002. What is the correct action for FinancialRecords that are not under legal hold?

Accepted Answer

They should be archived after 2555 days. The exhibit shows a retention policy for FinancialRecords with a retention period of 2555 days (7 years). Legal hold exceptions preserve FIN-001 and FIN-002, but records not under legal hold must follow the standard retention policy. The correct action is to archive them after 2555 days, as archiving retains data for compliance or future reference without indefinite preservation, aligning with the policy's lifecycle.

Answer

They should be audited and then preserved indefinitely

Answer

They should be deleted after 2555 days

Answer

They should be deleted after 365 days

Question 3

A company's data classification policy labels information as 'Internal Use Only' and 'Confidential.' An employee emails a 'Confidential' document to an external partner without authorization. Which type of data security objective has been violated?

Accepted Answer

Confidentiality. Confidentiality ensures that data is not disclosed to unauthorized parties. Option B is wrong because integrity is about accuracy, not disclosure. Option C is wrong because availability is about access when needed. Option D is wrong because non-repudiation is about proof of origin.

Answer

Non-repudiation

Answer

Availability

Answer

Integrity

Question 4

Which TWO of the following are valid types of data classification labels commonly used in commercial organizations?

Accepted Answer

Confidential. Commercial classification often uses labels like Public, Internal, Confidential, and Restricted. A and B are correct. Option C (Top Secret) is government/military classification. Option D (Unclassified) is government. Option E (For Official Use Only) is also government.

Answer

Top Secret

Answer

Unclassified

Answer

For Official Use Only

Question 5

A small business owner stores customer payment card information (PCI) in a legacy database that is not compliant with PCI DSS. The business is migrating to a new cloud-based point-of-sale (POS) system that uses tokenization. The owner wants to ensure that the legacy data is handled securely during the transition. Which of the following is the BEST approach?

Accepted Answer

Tokenize the payment data in the legacy database, then securely purge the original cardholder data and verify the purge. Option C is correct because purging the legacy data after tokenization and confirming no residual sensitive data remains ensures that card data is no longer stored, reducing risk. Option A is wrong because storing legacy data encrypted increases risk of key compromise. Option B is wrong because archiving encrypted data still retains the data. Option D is wrong because merging may complicate tokenization and risk.

Answer

Migrate the legacy data into the new POS system and have the tokenization service replace it

Answer

Encrypt the legacy database using AES-256 and store the encryption key on a separate server

Answer

Archive the legacy database to a tape backup and store it in a secure offsite vault

Question 6

Refer to the exhibit. A security engineer is reviewing the S3 bucket policy. The BackupAdmin role is intended to perform backups and restores of the entire bucket. What is the MOST significant security concern with this policy?

Accepted Answer

The BackupAdmin role has delete access to the entire bucket, which could lead to data loss if misused or compromised. Option D is correct because the BackupAdmin role already has full access to the entire bucket, including deletion. This is dangerous as it allows accidental or malicious destruction of all data without additional controls. Option A is wrong because the public access is restricted to a specific IP range and folder, which is relatively safe. Option B is wrong because while separation of duty is weak, it is not the most significant issue. Option C is wrong because the role can access internal data but the policy does not specify read-only; however, the role needs those permissions to back up.

Answer

The BackupAdmin role has both read and write access to the internal data, which could allow unauthorized modifications

Answer

The public access to the 'public/' folder is not limited to authenticated users

Answer

The DataAnalyst role can see the public folder contents, violating separation of duties

Question 7

A global manufacturing company with headquarters in Europe and factories in Asia and North America has recently experienced a data breach. The breach involved the theft of intellectual property (IP) containing product designs stored on a file server located in the Asian factory. The investigation revealed that the attacker gained access using a compromised administrator account from a contractor's laptop that was connected to the corporate VPN. The company has implemented network segmentation, but the file server resides in the same VLAN as other factory equipment. The company uses Active Directory for identity management, and all employees and contractors use the same domain. The company is now reviewing its data governance policies to prevent future incidents. The security team must recommend a set of controls that address the root cause while maintaining operational efficiency. Which of the following is the BEST course of action?

Accepted Answer

Implement a privileged access management (PAM) solution with just-in-time (JIT) elevation and conditional access policies that require managed, compliant devices for VPN access. Option C is correct because implementing privileged access management (PAM) with just-in-time (JIT) access and conditional access policies (e.g., requiring compliant devices for VPN) directly addresses the use of compromised credentials and contractor access. Option A is wrong because adding more VLANs complicates management but does not prevent credential misuse. Option B is wrong because MFA for all users would help but still allows compromised devices to log in. Option D is wrong because a separate domain for contractors requires significant administrative overhead and may not be feasible.

Answer

Create a separate Active Directory forest for contractors and establish a one-way trust to allow access only to necessary resources

Answer

Require multi-factor authentication (MFA) for all users accessing the VPN, regardless of role

Answer

Isolate the file server into its own VLAN and implement strict firewall rules to limit access to only necessary personnel

Question 8

A system administrator notices that user accounts are often left active after employees leave the company. Which process should be automated to address this?

Accepted Answer

Automated account provisioning and deprovisioning. Automated provisioning and deprovisioning ensures accounts are disabled when employment ends. Password resets and SSO do not solve the issue of stale accounts. MFA adds security but does not remove accounts.

Answer

Single sign-on implementation

Answer

Password reset policy

Answer

Multi-factor authentication

Question 9

An organization's security policy requires that privileged accounts have their passwords changed every 30 days and be monitored. Which solution effectively manages these requirements?

Accepted Answer

Privileged Access Management (PAM) solution. A Privileged Access Management (PAM) solution is specifically designed to manage privileged accounts, enforce password rotation policies (e.g., every 30 days), and provide detailed monitoring and auditing of privileged sessions. It automates password changes, vaults credentials, and logs all access, directly meeting the policy requirements for privileged accounts.

Answer

Role-based access control

Answer

Enterprise password manager

Answer

Single sign-on for administrators

Question 10

A company wants employees to access multiple SaaS applications using a single set of credentials. Which technology should be deployed?

Accepted Answer

Single sign-on (SSO). Single sign-on (SSO) enables users to authenticate once and gain access to multiple SaaS applications without re-entering credentials. It works by establishing a trusted session (often via SAML assertions or OAuth tokens) that is shared across applications, reducing password fatigue and improving user experience. This directly meets the requirement for a single set of credentials across multiple SaaS apps.

Answer

LDAP directory service

Answer

Multi-factor authentication (MFA)

Answer

Federated identity management

Question 11

An organization is implementing biometric authentication. Which factor should be considered to minimize the false rejection rate?

Answer

Lower the sensitivity threshold

Answer

Increase enrollment sample quality

Answer

Use liveness detection

Answer

Store templates securely

Question 12

A company is implementing single sign-on (SSO) for its cloud applications. The security team wants to ensure that user authentication is handled by an on-premises identity provider (IdP) using Security Assertion Markup Language (SAML). Which of the following is a critical configuration step to prevent session hijacking?

Accepted Answer

Validate the Issuer element in the SAML response.. Option D is correct because validating the Issuer element in the SAML response ensures that the response originated from the trusted on-premises identity provider (IdP) and not from an attacker impersonating the IdP. Without this validation, an attacker could forge a SAML response with a manipulated Issuer value, leading to session hijacking or unauthorized access. This is a fundamental SAML security check specified in the SAML 2.0 core specification (section 3.3.4).

Answer

Use HTTP POST binding instead of HTTP Redirect binding.

Answer

Set a short timeout for the SAML authentication request.

Answer

Encrypt the SAML assertions using the service provider's public key.

Question 13

An auditor finds that a system uses the same service account for multiple applications. Which risk does this pose?

Accepted Answer

Inability to rotate passwords without affecting all applications. Option B is correct because changing the password of the shared service account would break all applications that depend on it without coordinated effort. Option A is wrong because there is only one account, not multiple. Option C is wrong because single point of failure is about availability, not credential management. Option D is wrong because it does not increase attack surface directly. Option E is wrong because it simplifies management but introduces risk.

Answer

Increased attack surface due to multiple passwords

Answer

Difficulty in auditing because all applications share one account

Answer

Single point of failure for authentication

Question 14

A system administrator is configuring an LDAP directory for user authentication. The policy requires that account lockout occurs after a specified number of failed attempts. Which attribute should be configured?

Accepted Answer

lockoutThreshold. The `lockoutThreshold` attribute in an LDAP directory specifies the maximum number of consecutive failed authentication attempts allowed before the account is locked. This directly satisfies the policy requirement to lock the account after a specified number of failed attempts, making it the correct attribute to configure.

Answer

failedLoginAttempts

Answer

lockoutDuration

Answer

passwordLockoutTime

Question 15

A security engineer is troubleshooting an issue where users are unable to access a web application after being authenticated via OAuth 2.0. The users receive a 403 Forbidden error. The application logs show that the access token is valid but does not contain the required scope. What is the most likely cause?

Accepted Answer

The authorization server did not grant the requested scope due to user consent settings.. The 403 Forbidden error indicates the resource server received a valid access token but denied access because the token lacks the necessary scope. In OAuth 2.0, the authorization server issues tokens based on the scope granted by the user during consent. If the user did not consent to the required scope (e.g., 'write' instead of 'read'), the token will not include it, causing the resource server to reject the request despite the token being valid.

Answer

The resource server is configured to expect a different token type.

Answer

The client application is not using HTTPS to transmit the token.

Answer

The access token expired before being presented to the resource server.

CISSP Practice Test 14 — 15 Questions

Exhibit

CISSP Practice Test 14 — 15 Questions

Exhibit