CISSP Practice Test 15 — 15 Questions

Question 1

During a security assessment, a penetration tester successfully performed a VLAN hopping attack from a host in VLAN 10 to a host in VLAN 20. The switches are configured with IEEE 802.1Q trunking. Which misconfiguration likely allowed this attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dynamic Trunking Protocol (DTP) is enabled on access ports. D is correct because VLAN hopping attacks exploit Dynamic Trunking Protocol (DTP) to negotiate a trunk link between an attacker's host and a switch port. If DTP is enabled on an access port, the attacker can spoof DTP messages to form a trunk, gaining access to traffic from multiple VLANs, including VLAN 20 from VLAN 10.

Answer

The native VLAN is not used on any trunk ports

Answer

Spanning Tree Protocol is disabled

Answer

Port security is disabled on all ports

Question 2

A security analyst is tasked with identifying vulnerabilities in a web application that is still in development. The application code is not yet stable, and frequent changes are expected. Which testing approach would be most appropriate to identify vulnerabilities without hindering the development process?

Accepted Answer

Static application security testing (SAST). Static Application Security Testing (SAST) is the most appropriate approach because it analyzes source code, byte code, or binary code without executing the application, making it ideal for early-stage development where code is unstable and frequently changing. SAST can be integrated into the development pipeline (e.g., as a pre-commit hook or CI/CD step) to identify vulnerabilities like SQL injection, XSS, or buffer overflows without requiring a running application or hindering the iterative development process.

Answer

Fuzz testing

Answer

Manual penetration testing

Answer

Dynamic application security testing (DAST)

Question 3

Which type of SOC report provides a public summary of controls related to security, availability, confidentiality, integrity, and privacy, but does not include detailed testing results?

Accepted Answer

SOC 3. SOC 3 reports are designed for public distribution and provide a high-level summary of an organization's controls related to security, availability, confidentiality, integrity, and privacy (the Trust Services Criteria). Unlike SOC 2 reports, SOC 3 reports do not include detailed testing results, control descriptions, or the auditor's opinion on control effectiveness, making them suitable for marketing or public disclosure.

Answer

SOC 2 Type II

Answer

SOC 1 Type II

Answer

SOC 2 Type I

Question 4

A company requires employees to authenticate using a smart card and PIN to access the corporate network. This is an example of which type of authentication?

Accepted Answer

Two-factor authentication. This scenario requires two distinct authentication factors: something you have (the smart card) and something you know (the PIN). Smart cards store a private key or certificate that must be unlocked by the PIN, and both factors must be presented simultaneously to authenticate. This meets the NIST SP 800-63 definition of multi-factor authentication, specifically two-factor authentication.

Answer

Single-factor authentication

Answer

Biometric authentication

Answer

Single sign-on

Question 5

A security engineer is configuring SNMPv3 on network devices. The policy requires both authentication and encryption of SNMP messages. Which combination of protocols should be used to meet this requirement?

Accepted Answer

authPriv with SHA and AES. SNMPv3's authPriv security level requires both authentication and encryption. SHA (or SHA-2) provides message authentication via HMAC, and AES provides symmetric encryption for the message payload. This combination satisfies the policy requirement for both confidentiality and integrity.

Answer

authPriv with MD5 and DES

Answer

noAuthNoPriv with no security

Answer

authNoPriv with SHA and no encryption

Question 6

A company is deploying a containerized application using Kubernetes. Which practice BEST ensures the security of the container images?

Accepted Answer

Scan images for vulnerabilities and use minimal base images. Scanning container images for known vulnerabilities (e.g., using Trivy, Clair, or Snyk) and using minimal base images (e.g., Alpine or distroless) directly reduces the attack surface and eliminates unnecessary packages that may contain exploitable flaws. This practice is foundational to secure software supply chain management and aligns with the principle of least functionality in containerized environments.

Answer

Restrict containers from running as root

Answer

Use the latest version of the base image without scanning

Answer

Enable container escape protection

Question 7

An organization uses a version control system for all software development. Which practice best ensures that code changes are reviewed for security issues before merging into the main branch?

Accepted Answer

Requiring all pull requests to be approved by at least one peer reviewer.. Requiring pull request approval by at least one peer reviewer ensures that code changes are manually inspected for security flaws before merging into the main branch. This practice leverages human expertise to catch logic errors, insecure patterns, and design weaknesses that automated tools might miss, aligning with the principle of defense in depth in the software development lifecycle.

Answer

Configuring the CI pipeline to run static analysis tools only on the main branch.

Answer

Enforcing that all commits pass automated unit tests before merging.

Answer

Using pre-commit hooks to scan for secrets in code before commit.

Question 8

A financial institution is implementing a data classification policy. Which role is responsible for assigning initial classification labels to data assets?

Accepted Answer

Data owner. The data owner is the senior manager or business stakeholder who has ultimate accountability for a data asset and is responsible for determining its classification level based on business impact and sensitivity. In the CISSP framework, the data owner defines the classification labels (e.g., Public, Internal, Confidential, Restricted) at the time of creation or acquisition, ensuring the asset is tagged according to the organization's data classification policy. This role does not handle the technical implementation but sets the initial classification, which then drives downstream controls like encryption and access control lists (ACLs).

Answer

Data custodian

Answer

Data processor

Answer

Data steward

Question 9

A security engineer is designing an API that handles sensitive customer data. The engineer wants to ensure that only authorized clients can access the API, and that requests are not tampered with in transit. Which approach best addresses both requirements?

Accepted Answer

Implementing OAuth 2.0 with Bearer tokens over HTTPS. OAuth 2.0 with Bearer tokens over HTTPS combines a token-based authorization framework with TLS encryption. HTTPS (TLS) ensures confidentiality and integrity of data in transit, preventing tampering, while OAuth 2.0 provides a standardized mechanism for issuing and validating access tokens, ensuring only authorized clients with valid tokens can access the API. This dual approach directly addresses both authorization and integrity requirements.

Answer

Enforcing TLS for all communications

Answer

Requiring a digital signature using HMAC on each request

Answer

Using API keys transmitted in the request header

Question 10

A security analyst is reviewing logs and notices multiple failed login attempts from a single IP address followed by a successful login. What should the analyst do next?

Accepted Answer

Investigate the successful login. A successful login immediately following multiple failed attempts from the same IP address is a classic indicator of a brute-force or password-spraying attack that succeeded. The analyst must investigate the successful login to determine if it was legitimate or an account compromise, checking for anomalous behavior, time of access, and any subsequent actions. Ignoring or prematurely blocking the IP could destroy forensic evidence or lock out a legitimate user, while disabling the account without investigation may be premature if the login was authorized.

Answer

Disable the account immediately

Answer

Ignore, as failed logins are normal

Answer

Block the IP address

Question 11

A government agency's data retention policy requires that classified documents be destroyed after 10 years. Which method ensures both the information and the media are completely destroyed in a way that is verifiable and auditable?

Accepted Answer

Incineration in a certified facility. Incineration in a certified facility is the only option that completely destroys both the information and the physical media, leaving no residue that could be reconstructed. For classified government documents, the destruction must be verifiable and auditable, which a certified incineration facility provides through documented chain-of-custody and destruction certificates. This method ensures the media is physically reduced to ash, eliminating any possibility of data recovery, unlike logical or magnetic techniques.

Answer

Overwriting the data seven times

Answer

Degaussing the storage media

Answer

Deleting all files and emptying the recycle bin

Question 12

A company's help desk receives many requests from users who have forgotten their passwords. Which solution is MOST effective in reducing these requests while maintaining security?

Accepted Answer

Implement a self-service password reset (SSPR) with identity verification.. Self-service password reset (SSPR) with identity verification directly addresses the root cause of help desk calls—forgotten passwords—by allowing users to reset their own passwords after proving their identity via pre-registered methods (e.g., SMS, security questions, or biometrics). This reduces operational overhead while maintaining security through multi-factor verification and policy enforcement, unlike options that weaken security or fail to address the frequency of resets.

Answer

Increase the password expiration period to 180 days.

Answer

Use single sign-on for all applications.

Answer

Reduce the password complexity requirements.

Question 13

A security analyst detects repeated failed login attempts from a single external IP address targeting a user account. What is the best IMMEDIATE action?

Accepted Answer

Block the IP address at the perimeter firewall. Blocking the IP address at the perimeter firewall is the best immediate action because it stops the ongoing brute-force attack at the network boundary, preventing further authentication attempts without affecting the legitimate user's access. This aligns with the principle of containment in incident response, prioritizing rapid mitigation over investigation or configuration changes that could delay the response.

Answer

Investigate the source IP's history

Answer

Disable the targeted user account

Answer

Enable account lockout after three failures

Question 14

A security manager is evaluating risk treatment options for a high-impact, low-probability risk. Which approach is most appropriate?

Accepted Answer

Transfer. Transfer is the most appropriate approach for a high-impact, low-probability risk because it shifts the financial burden of a rare but severe event to a third party, such as through cyber insurance or outsourcing. This aligns with the risk management principle that low-probability, high-impact risks are often uneconomical to mitigate fully, making transfer a cost-effective strategy. For example, purchasing a cyber liability policy with specific coverage for data breaches ensures the organization does not bear the full recovery cost.

Answer

Accept

Answer

Avoid

Answer

Mitigate

Question 15

A financial institution is conducting a vulnerability assessment of its internal network. The assessor runs a comprehensive scan and discovers that several Windows servers have missing security patches. The organization has a patch management policy that requires all critical patches to be applied within 30 days. The scan results show that some patches have been pending for 45 days. The assessor also finds that the servers are isolated in a separate VLAN with strict firewall rules limiting inbound traffic to only necessary ports. The business owner argues that because the servers are isolated, the risk is low and the patches can be delayed. As the security assessor, what should be the BEST course of action?

Accepted Answer

Escalate the finding to the risk management team for formal risk acceptance.. The organization's patch management policy has been violated (patches overdue by 45 days vs. 30-day requirement), and the business owner's informal risk acceptance is insufficient. Formal risk acceptance requires documented approval from the risk management team, ensuring accountability and alignment with the organization's risk appetite. The VLAN isolation and firewall rules are compensating controls, but they do not negate the need for proper risk treatment per policy.

Answer

Recommend additional compensating controls such as intrusion prevention.

Answer

Accept the risk and close the finding.

Answer

Immediately apply the patches without further approval.