CISSP Practice Test 14 — 15 Questions

Question 1

Which THREE of the following are common security design principles? (Select THREE.)

Accepted Answer

Open design. Open design (A) is a fundamental security principle stating that the security of a system should not depend on the secrecy of its implementation; instead, it relies on the strength of its cryptographic keys and algorithms. This principle is embodied in Kerckhoffs's principle, which asserts that a cryptosystem should remain secure even if everything about the system, except the key, is public knowledge. Open design allows for public scrutiny and peer review, which helps identify vulnerabilities and build trust in the system's security.

Answer

Single point of failure

Answer

Security through obscurity

Question 2

A cloud security architect is designing a system that must comply with the principle of data sovereignty. Which three controls should be implemented? (Select THREE.)

Accepted Answer

Enforce contractual clauses with cloud provider regarding data location. Data sovereignty requires that data remains subject to the laws and regulations of the jurisdiction where it is stored, so option B is correct because contractual clauses with the cloud provider legally bind the provider to keep data within specified locations and comply with local regulations. Option C is correct because data classification policies identify which data is subject to sovereignty requirements, enabling proper handling, access control, and residency enforcement based on sensitivity and regulatory scope. Option D is correct because storing data only in approved geographic regions directly enforces residency, ensuring data does not leave the legal jurisdiction whose laws must govern it. Option A is not correct because customer-managed encryption keys address confidentiality and key control, not the physical or legal location of data, and encryption alone does not satisfy sovereignty. Option E is not correct because a VPN protects data in transit from interception but does not control or guarantee where data is stored or which laws apply to it.

Answer

Encrypt data at rest using customer-managed keys

Answer

Use a virtual private network (VPN) for all transfers

Question 3

Which of the following is the correct order of the ISC2 Code of Ethics canons from highest to lowest priority?

Accepted Answer

Protect society, act honorably, provide diligent service, advance the profession. The ISC2 Code of Ethics canons are ordered by priority: (1) Protect society, the common good, necessary public trust and confidence, and the infrastructure; (2) Act honorably, honestly, justly, responsibly, and legally; (3) Provide diligent and competent service to principals; (4) Advance and protect the profession. Option A lists them in this exact order, making it correct. This hierarchy is critical because when canons conflict, the higher one must take precedence.

Answer

Act honorably, protect society, provide diligent service, advance the profession

Answer

Advance the profession, protect society, act honorably, provide diligent service

Answer

Provide diligent service, advance the profession, protect society, act honorably

Question 4

An organization's data retention policy specifies that customer records must be retained for five years after the end of the business relationship. After that period, what should be done with the data according to best practices?

Accepted Answer

Securely destroy the data. Once the retention period expires, data should be securely destroyed to prevent unauthorized access and comply with privacy regulations.

Answer

Continue retaining the data indefinitely for future use

Answer

Archive the data to offline storage

Answer

Anonymize the data and keep it

Question 5

A security analyst is reviewing log data from various sources. Which of the following are essential for effective security logging in accordance with best practices? (Select THREE.)

Accepted Answer

Secure transmission of logs to a central repository. Option B is correct because securely transmitting logs (e.g., via TLS, syslog over TLS, or an encrypted SIEM ingestion channel) to a central repository protects log integrity and confidentiality and enables correlation across sources. Option C is correct because time synchronization (e.g., via NTP) ensures events from different systems share a consistent timeline, which is essential for accurate correlation and forensic reconstruction. Option E is correct because including user identifiers (such as usernames, account IDs, or session identifiers) in log entries ties actions to specific principals, supporting accountability, attribution, and incident investigation. Option A is not correct because storing logs only in plaintext is not a best practice; logs should be protected with access controls and often encryption or hashing to preserve integrity. Option D is not correct because while retention is important, a fixed minimum of at least one year is not a universal best-practice requirement and depends on legal, regulatory, and organizational needs.

Answer

Storage of logs in plaintext format only

Answer

Log retention of at least one year

Question 6

A multinational corporation must comply with GDPR and CCPA. Which data protection strategy should they prioritize?

Accepted Answer

Data minimization. Data minimization is the correct priority because both GDPR (Article 5(1)(c)) and CCPA (Cal. Civ. Code §1798.100) require organizations to limit the collection and processing of personal data to what is directly relevant and necessary for the stated purpose. By minimizing the data held, the corporation reduces its legal exposure, simplifies compliance obligations, and inherently lowers the risk of a data breach impacting sensitive information. This principle is foundational to privacy-by-design and directly addresses the regulatory mandates, whereas the other options are secondary controls that do not address the core requirement of limiting data collection.

Answer

Data masking

Answer

Data retention

Answer

Data encryption

Question 7

A company wants to implement multi-factor authentication (MFA) for remote access. Which combination of factors represents something you have and something you are?

Accepted Answer

Smart card and fingerprint. A smart card is a physical device that you possess (something you have), and a fingerprint is a biometric characteristic unique to you (something you are). This combination satisfies the multi-factor authentication requirement by using two distinct factors from different categories, which is more secure than using two factors from the same category.

Answer

Password and PIN

Answer

Hardware token and mobile phone

Answer

Password and SMS code

Question 8

An organization is implementing a security awareness program. Which topic should be emphasized most?

Accepted Answer

Phishing recognition. Phishing recognition is the most critical topic because phishing attacks are the primary vector for initial access in over 90% of security breaches, according to Verizon's DBIR. Unlike other topics, phishing directly exploits human psychology to bypass technical controls like email filters and MFA, making user detection the last line of defense. Emphasizing this topic reduces the risk of credential theft, malware installation, and ransomware deployment more effectively than any other single awareness area.

Answer

Social media usage

Answer

Password policy

Answer

Clean desk policy

Question 9

Which principle ensures that a user is granted only the permissions necessary to perform their job functions?

Accepted Answer

Least privilege. Least privilege is the principle that users should be granted only the minimum permissions necessary to perform their job functions, reducing the attack surface and limiting potential damage from accidental or malicious actions. The question explicitly describes granting only necessary permissions, which is the definition of least privilege. This principle is a core tenet of access control and is widely tested in security certifications.

Answer

Need-to-know

Answer

Separation of duties

Answer

Zero standing privileges

Question 10

A company uses smart cards for authentication to workstations. A user inserts their smart card but is prompted for a PIN. The user enters the correct PIN but authentication fails. The smart card is not expired. What is the most likely cause?

Accepted Answer

The user's certificate is revoked. When a smart card is used for authentication, the PIN unlocks the private key stored on the card, but the actual authentication typically relies on a certificate chain and the validity of the user's certificate. If the certificate has been revoked (e.g., due to compromise or termination), the Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) check will fail, causing authentication to be denied even though the PIN is correct and the card is not expired.

Answer

The PIN is incorrectly stored on the card

Answer

The smart card driver is outdated

Answer

The workstation's clock is off by more than 5 minutes

Question 11

A security analyst discovers an attack where an attacker sets up a rogue wireless access point with a legitimate SSID to trick users into connecting. Once connected, the attacker captures credentials. This type of attack is known as:

Accepted Answer

Evil twin attack. This is an evil twin attack because the attacker creates a rogue access point that broadcasts the same SSID as a legitimate network, tricking users into connecting to it. Once connected, the attacker can capture credentials or other sensitive data by acting as a man-in-the-middle. The key differentiator is the impersonation of a legitimate SSID to deceive users, not just the presence of an unauthorized AP.

Answer

Deauthentication attack

Answer

Rogue AP attack

Answer

Karma attack

Question 12

Which type of scanning provides the most comprehensive view of an organization's vulnerabilities by allowing the scanner to log into systems and access detailed configuration information?

Accepted Answer

Authenticated scan. An authenticated scan (also called a credentialed scan) provides the scanner with valid credentials to log into target systems, allowing it to read installed software versions, registry keys, configuration files, and patch levels directly. This yields far more accurate and comprehensive vulnerability data than an unauthenticated scan, which can only probe from the outside and often produces false positives or misses local-only vulnerabilities.

Answer

External scan

Answer

Passive scan

Answer

Unauthenticated scan

Question 13

An organization is implementing a BCP. After completing the BIA, which of the following is the next logical step in the planning process?

Accepted Answer

Develop recovery strategies. After the BIA identifies critical processes and recovery requirements, the next step is to develop strategies to meet those requirements, such as selecting recovery sites and technologies.

Answer

Test the plan

Answer

Conduct a risk assessment

Answer

Train personnel

Question 14

A data owner has classified a dataset as 'Confidential' in a commercial organization. Which of the following best describes the primary responsibility of the data owner for this dataset?

Accepted Answer

Determining the data's classification and ensuring it is labeled appropriately. The data owner is accountable for data classification and assigning protection requirements, while the custodian implements controls.

Answer

Ensuring the data is accurate and complete

Answer

Implementing technical controls to protect the data

Answer

Performing daily backups of the data

Question 15

A security administrator needs to ensure that data stored on a server is unrecoverable after decommissioning. The server uses SSDs. Which sanitization method is MOST appropriate?

Accepted Answer

Physical destruction (shredding). SSDs cannot be reliably overwritten due to wear leveling; physical destruction or cryptographic erasure is recommended.

Answer

Quick format

Answer

Standard overwriting with multiple passes

Answer

Degaussing