CISSP Practice Test 15 — 15 Questions

Question 1

A company implements a centralized authentication system using RADIUS for network devices. The security team notices that after a user's password is changed in Active Directory, the user can still authenticate to network devices using the old password for up to 30 minutes. What is the most likely cause?

Accepted Answer

Network devices caching authentication responses. Option C is correct because network devices often cache successful authentication responses, so they accept the old password until the cache expires. Option A is wrong because RADIUS servers typically forward authentication to the directory and do not cache credentials. Option B is wrong because it is not the primary cause in this scenario. Option D is wrong because Kerberos ticket lifetimes are unrelated to password changes in this context.

Answer

Kerberos ticket lifetime

Answer

Active Directory replication delay

Answer

RADIUS server caching credentials

Question 2

An organization plans to allow employees to access third-party SaaS applications using their corporate credentials. Which THREE are necessary components for implementing SAML-based identity federation?

Accepted Answer

Service Provider (SP). Option A is correct because the Service Provider (SP) is the entity that hosts the SaaS application and relies on the Identity Provider (IdP) to authenticate users. In SAML-based identity federation, the SP receives a SAML assertion from the IdP and uses it to grant access, making it a necessary component of the trust relationship.

Answer

Bcrypt password hashing

Answer

RADIUS server

Question 3

A user reports that they cannot access a file share after being moved to a different department. The file share is secured with NTFS permissions and share permissions. The user is a member of the 'Marketing' group, but the file share is only accessible by 'Sales' group. What is the most likely reason?

Accepted Answer

The user is not a member of the Sales group. Option A is correct because the user is not a member of the Sales group, which is required for access. Option B is wrong because there is no indication the account is disabled. Option C is wrong because share permissions are not the primary issue. Option D is wrong because NTFS permissions are not the direct cause.

Answer

The share permissions deny access to Marketing

Answer

The user's account is disabled

Answer

The NTFS permissions deny access

Question 4

During a security assessment, it is found that service accounts have interactive logon rights. What is the BEST remediation?

Accepted Answer

Use managed service accounts instead.. Managed Service Accounts (MSAs) are the best remediation because they are designed specifically for service accounts, automatically manage password changes, and by default have no interactive logon rights. This eliminates the security risk of interactive logon while also addressing password management and reducing administrative overhead. Group Policy changes or manual password policies do not address the underlying architectural issue of using a standard user account for a service.

Answer

Implement Group Policy to deny interactive logon for service accounts.

Answer

Ensure service accounts use strong passwords.

Answer

Remove service accounts from the local Administrators group.

Question 5

A security administrator is configuring role-based access control (RBAC) for a cloud storage system. Which of the following is the best practice for assigning permissions?

Accepted Answer

Create roles based on job functions and assign users to roles. Option C is correct because RBAC assigns permissions to roles, then users are assigned to roles, ensuring scalability and manageability. Option A is wrong because direct permissions are difficult to manage. Option B is wrong after all, user-based permissions are not RBAC. Option D is wrong because MAC is a different model. Option E is wrong because ABAC is attribute-based, not RBAC.

Answer

Use access control lists on each object

Answer

Implement mandatory access control

Answer

Assign permissions directly to users for flexibility

Question 6

Refer to the exhibit. The PAM configuration shows pam_tally2.so with deny=5 and unlock_time=300. What is the effect of this configuration?

Accepted Answer

Users are locked out after 5 failed login attempts, and automatically unlocked after 5 minutes. Option C is correct because pam_tally2.so with deny=5 locks the user account after 5 failed authentication attempts, and unlock_time=300 sets the automatic unlock period to 300 seconds (5 minutes). This is a standard PAM (Pluggable Authentication Modules) configuration for account lockout policies, commonly used on Linux systems to mitigate brute-force attacks.

Answer

The account is disabled after 5 successful logins

Answer

Passwords must be changed every 5 days

Answer

Users are locked out after 5 failed attempts until manually unlocked

Question 7

A multinational corporation has experienced several security incidents where terminated employees retained access to internal systems for weeks after their departure. The HR department manually terminates accounts by sending notifications to IT, but the process is often delayed or missed. The company uses an identity management system (IDM) that supports automated provisioning and deprovisioning. The security team is tasked with reducing the risk of unauthorized access by former employees. Which of the following is the most effective course of action?

Accepted Answer

Integrate the HR system with the identity management system for automated deprovisioning. Integrating HR systems with the IDM enables automated deprovisioning immediately upon termination. Increasing audits (B) only detects problems after the fact. Implementing user self-service (C) does not address timely deprovisioning. Requiring strong passwords (D) is irrelevant to the issue of account removal.

Answer

Require terminated employees to change their passwords upon exit

Answer

Increase frequency of access reviews and audits to identify stale accounts

Answer

Implement a user self-service portal for managers to disable accounts

Question 8

A user calls the help desk because they cannot log in. The help desk technician confirms the user's identity by asking for their employee ID and mother's maiden name. Which of the following is the MOST significant security issue with this practice?

Accepted Answer

The technician is using shared secrets that are not effective for strong authentication.. Option A is correct because relying on shared secrets like mother's maiden name is weak authentication. Option B is incorrect because the information may be unique but is not secret. Option C is incorrect, while MFA is better, the most significant issue is the use of weak shared secrets. Option D is incorrect; the information may still be stored.

Answer

The user's mother's maiden name is not stored in the HR system.

Answer

The help desk should be using multi-factor authentication.

Answer

The user's identity is being verified using information that is not unique to the user.

Question 9

Which TWO are security benefits of using a federated identity model?

Accepted Answer

Simplified user management across organizations. Option A is correct because federated identity models allow organizations to trust identities issued by other members of the federation, eliminating the need for separate user accounts and enabling simplified user management across organizational boundaries. This is achieved through standards like SAML 2.0 or OpenID Connect, where identity assertions are exchanged between identity providers (IdPs) and service providers (SPs) without duplicating user directories.

Answer

Elimination of password policies

Answer

Reduced risk of credential theft

Answer

Single point of failure for authentication

Question 10

An organization is implementing a privileged access management (PAM) solution for managing administrative credentials. Which of the following is the most critical control to prevent credential theft?

Accepted Answer

Just-in-time (JIT) privilege elevation. Option A is correct because just-in-time privilege elevation minimizes the window of exposure and reduces standing privileges, which is the most effective against credential theft. Option B is wrong because multi-factor authentication is important but does not prevent theft of cached credentials. Option C is wrong because password rotation is reactive. Option D is wrong because session recording is detective. Option E is wrong because encryption protects at rest but does not prevent theft in use.

Answer

Enforcing periodic password changes

Answer

Encrypting stored passwords

Answer

Multi-factor authentication on admin accounts

Answer

Session recording and monitoring

Question 11

A system is designed to meet the Common Criteria EAL4 evaluation. Which of the following is a required component for this level?

Accepted Answer

Semiformal design and test. EAL4 (Evaluation Assurance Level 4) under the Common Criteria requires 'semiformal design and test' as part of its assurance requirements. This level mandates that the security functional specification and the high-level design be expressed in a semiformal style, and that testing be based on this semiformal design. It does not require formal methods, which are reserved for higher EALs (EAL5–EAL7).

Answer

Formal model of security policy

Answer

Formal specifications and verification

Answer

Informal security policy model

Question 12

A company is deploying a wireless network for guests. The security requirement is to provide internet access only, with no access to the internal corporate network. Which technology should be used?

Accepted Answer

A separate guest VLAN with ACLs restricting access to internal networks. A separate guest VLAN with ACLs restricting access to internal networks is the correct choice because it provides network segmentation at Layer 2 (VLAN) and Layer 3/4 (ACLs), ensuring guest traffic is isolated from the corporate network while allowing internet access. This approach aligns with the principle of least privilege and is a standard best practice for guest wireless deployments, as it does not rely on authentication or encryption alone to enforce access control.

Answer

WPA3-SAE

Answer

MAC address filtering

Answer

WPA2-Enterprise with 802.1X

Question 13

A security architect is designing a network for a high-security data center. The requirement is to ensure that even if an attacker compromises one server, they cannot easily move laterally to other servers in the same data center. Which network design principle should be applied?

Accepted Answer

Microsegmentation (e.g., using virtual firewalls on each hypervisor). Microsegmentation (D) is the correct network design principle because it enforces granular, per-workload firewall rules—often implemented via virtual firewalls on each hypervisor or using VXLAN/ACL policies—that restrict east-west traffic between servers. Even if an attacker compromises one server, microsegmentation prevents lateral movement by allowing only explicitly permitted inter-server communication, effectively isolating the breach to the compromised host.

Answer

Principle of least privilege

Answer

Defense in depth

Answer

Single point of failure elimination

Question 14

A network architect is designing a network to comply with PCI DSS requirements that cardholder data must be encrypted during transmission over open networks. Which protocol should be used for encrypting traffic between a point-of-sale (POS) terminal and the payment gateway?

Accepted Answer

TLS 1.2. TLS 1.2 is the correct choice because it is a widely accepted, secure protocol for encrypting data in transit, and it meets PCI DSS requirements for strong cryptography. PCI DSS explicitly prohibits the use of SSL and early TLS versions (1.0) due to known vulnerabilities, and TLS 1.2 provides robust cipher suites and forward secrecy.

Answer

TLS 1.0

Answer

SSH

Answer

SSL 3.0

Question 15

A company wants to implement 802.1X authentication on their wired network. Which components are required?

Accepted Answer

Supplicant, authenticator, and authentication server. 802.1X requires three distinct roles to function: the supplicant (client software requesting access), the authenticator (network device like a switch that enforces port-based access control), and the authentication server (typically a RADIUS server that validates credentials). Without all three, the EAP (Extensible Authentication Protocol) exchange cannot complete, as the authenticator acts as a proxy between the supplicant and the authentication server. Option C is correct because it lists all three mandatory components.

Answer

Supplicant and authenticator

Answer

Authenticator and authentication server

Answer

Supplicant and authentication server