CISSP Practice Test 15 — 15 Questions

Question 1

An organization is implementing a new access control system. Which of the following represents the correct order of the AAA framework components?

Accepted Answer

Authentication, Authorization, Accounting. The AAA framework defines a sequential process: Authentication verifies the identity of a subject (e.g., via password, token, or biometrics), Authorization determines what resources that authenticated subject may access, and Accounting logs the subject's activities for auditing and billing. This order is logical because you cannot authorize an unauthenticated user, and accounting requires both identity and access decisions to be meaningful. Thus, Authentication → Authorization → Accounting is correct.

Answer

Authorization, Authentication, Accounting

Answer

Authentication, Accounting, Authorization

Answer

Accounting, Authentication, Authorization

Question 2

Which type of firewall operates at Layer 7 and can inspect application payloads, such as blocking specific SQL commands or HTTP methods?

Accepted Answer

Application proxy. An application proxy firewall (also known as an application-level gateway) operates at Layer 7 (Application Layer) of the OSI model. It can inspect the full application payload, allowing it to block specific SQL commands, HTTP methods (e.g., PUT, DELETE), or other application-layer content by terminating the connection and re-establishing it after deep inspection.

Answer

Stateful inspection

Answer

Packet filter

Answer

Circuit-level gateway

Question 3

A security team is reviewing application security and needs to analyze source code without executing the application. Which technique should they use?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) analyzes source code, bytecode, or binaries without executing the application, looking for vulnerabilities such as injection flaws, hardcoded secrets, and insecure patterns. Because it operates on the code itself, it can be run early in the SDLC and integrated into CI/CD pipelines. This matches the requirement to analyze source code without executing the application.

Answer

Dynamic Application Security Testing (DAST)

Answer

Interactive Application Security Testing (IAST)

Answer

Runtime Application Self-Protection (RASP)

Question 4

A SOC has three tiers: Tier 1 triages alerts, Tier 2 investigates, and Tier 3 performs advanced analysis. An alert about a potential data exfiltration using DNS tunneling is escalated from Tier 1. Which tier is BEST suited to perform deep packet inspection and memory forensics to confirm the exfiltration?

Accepted Answer

Tier 3. Tier 3 performs advanced analysis, which explicitly includes deep packet inspection (DPI) and memory forensics. Confirming DNS tunneling exfiltration requires inspecting DNS query payloads for encoded data and analyzing process memory for injected malware — skills and tooling reserved for Tier 3. Tier 1 and Tier 2 handle triage and investigation but not advanced forensic analysis.

Answer

Incident manager

Answer

Tier 2

Answer

Tier 1

Question 5

An auditor finds that a system uses the same service account for multiple applications. Which risk does this pose?

Accepted Answer

Difficulty in auditing because all applications share one account. Sharing a service account across multiple applications destroys accountability. When an action is logged under a shared service account, it is impossible to determine which specific application initiated the action, severely hindering auditing and incident response. While password rotation (Option C) is an operational challenge, the loss of accountability and auditability is a much more critical security risk.

Answer

Increased attack surface due to multiple passwords

Answer

Inability to rotate passwords without affecting all applications

Answer

Single point of failure for authentication

Question 6

Match each threat type to its description.

Accepted Answer

Phishing: Mass email sent to many users to trick them into revealing personal information.. The correct matches are: Phishing with mass email (A), Spear Phishing with targeted attacks (C), and Whaling with executive targets (D). Option B is incorrect because it describes spear phishing, not phishing. Option E is also incorrect as it misassigns whaling as mass email.

Answer

Phishing: Targeted attack on a specific individual

Answer

Whaling: Mass email sent to many users

Question 7

A risk assessment identifies several threats. Which THREE are considered external threats?

Accepted Answer

Hacktivist. Option B (Hacktivist) is correct because a hacktivist is an outside actor who attacks systems to advance a political or social agenda, making it an external threat. Option D (Natural disaster) is correct because events such as floods, fires, and earthquakes originate from the environment outside the organization and are classified as external threats. Option E (Competitor) is correct because a rival organization operating outside the company can conduct espionage, sabotage, or other hostile actions, which is an external threat source. Options A (Insider error) and C (Disgruntled employee) are not external threats because both involve individuals within the organization who already have authorized access, making them internal threats.

Answer

Insider error

Answer

Disgruntled employee

Question 8

Under GDPR, which TWO of the following are valid lawful bases for processing personal data?

Accepted Answer

Consent. Under GDPR Article 6(1), the six lawful bases for processing personal data include consent (option C), where the data subject has given clear, specific, informed, and unambiguous agreement, and legitimate interest (option D), where processing is necessary for the legitimate interests pursued by the controller or a third party unless overridden by the data subject's rights and interests. These are both explicitly enumerated lawful bases, making C and D correct. Option A (data subject's employment) is not a lawful basis under Article 6; employment status is not one of the six grounds, though employment context may affect consent validity or other bases. Option B (data processor's request) is invalid because a processor acts only on the controller's documented instructions and cannot itself create a lawful basis for processing. Option E (data controller's profit) is not a recognized lawful basis; profit alone does not satisfy any Article 6 condition, though it might be considered under legitimate interest only if the balancing test is met.

Answer

Data subject's employment

Answer

Data processor's request

Answer

Data controller's profit

Question 9

Match each security assessment type to its description.

Accepted Answer

Vulnerability Assessment: Automated scan to identify known vulnerabilities. Correct matches: Vulnerability Assessment uses automated scans; Penetration Test involves exploitation; Security Audit reviews policies; Risk Assessment evaluates risks. Common confusions mix vulnerability assessments with penetration tests.

Answer

Vulnerability Assessment: Simulated attack to exploit vulnerabilities and assess impact

Answer

Penetration Test: Automated scan to identify known vulnerabilities

Question 10

Drag and drop the steps for a secure password change procedure in the correct order.

Accepted Answer

Verify identity → Enter new password → Enforce password history → Hash storage → Log. Password change: verify identity, enter new password, enforce history, hash storage, log.

Answer

Verify identity → Enforce password history → Enter new password → Hash storage → Log

Answer

Enter new password → Verify identity → Hash storage → Enforce password history → Log

Answer

Verify identity → Enter new password → Hash storage → Log → Enforce password history

Question 11

A security engineer is hardening a system against side-channel attacks that exploit variations in execution time or power consumption. Which TWO mitigations are specifically designed to counter such attacks? Select two.

Accepted Answer

Constant-time algorithms. Constant-time programming ensures operations take the same time regardless of inputs, and noise injection obscures power consumption patterns.

Answer

Data Execution Prevention (DEP)

Answer

Address Space Layout Randomization (ASLR)

Answer

Input validation

Question 12

A company uses VLANs to separate traffic between the IT, HR, and Finance departments. A user in the HR VLAN reports that she cannot access a file server located in the IT VLAN. The file server's default gateway is correctly set to the IT VLAN interface. All workstations have correct IP addresses and subnet masks. What is the most likely cause of this issue?

Accepted Answer

No routing is configured between the HR and IT VLANs.. VLANs create separate broadcast domains, so traffic between different VLANs must be routed. Since the HR workstation is in a different VLAN than the file server, and no routing is configured between the HR and IT VLANs, the HR workstation cannot reach the file server even though the server's default gateway is correctly set. This is the most likely cause because all other network settings (IP addresses, subnet masks, switch port configurations) are described as correct.

Answer

Spanning Tree Protocol (STP) is blocking the link between the HR and IT switches.

Answer

The HR workstation has an incorrect subnet mask.

Answer

The HR VLAN switch port is incorrectly configured with the wrong VLAN ID.

Question 13

A multinational corporation maintains site-to-site IPsec VPN tunnels between its headquarters and three regional branch offices. Over the past week, the tunnels have been dropping intermittently, causing disruption to real-time applications. The network team checked logs and found frequent 'Phase 2 rekey failure' messages. The tunnels are configured with IKEv1 and preshared keys. The headquarters uses a Cisco ASA, and the branches use various vendors' firewalls. The team verified that firewall policies allow IPsec traffic, and there is no packet loss on the WAN links. Which action should the team take to resolve the issue most effectively?

Accepted Answer

Adjust the Dead Peer Detection (DPD) intervals and Phase 2 lifetime settings to be consistent across all sites.. The frequent 'Phase 2 rekey failure' messages indicate a mismatch in IPsec security association (SA) parameters between the Cisco ASA and the branch firewalls. IKEv1 Phase 2 lifetimes and Dead Peer Detection (DPD) intervals must be consistent across all peers; otherwise, one side may attempt to rekey or declare the peer dead while the other expects a different timing, causing intermittent tunnel drops. Adjusting these values to match across all sites resolves the rekey failures without compromising security or requiring a protocol migration.

Answer

Increase the MTU on the WAN interfaces to 1500 bytes on all firewalls.

Answer

Change the encryption algorithm from AES-256 to 3DES on all peers.

Answer

Migrate all VPN connections from IPsec to SSL VPN using clientless access.

Question 14

A company is selecting a disaster recovery site for critical applications that must be restored within 4 hours with minimal data loss. Which site type best meets these requirements?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, network connectivity, and real-time data replication, enabling recovery within minutes to hours and minimal data loss. This matches the requirement of restoring critical applications within 4 hours with minimal data loss, as hot sites maintain near-synchronous or synchronous replication (e.g., using synchronous replication over Fibre Channel or iSCSI with RPOs in seconds).

Answer

Cold site

Answer

Reciprocal agreement

Answer

Warm site

Question 15

You are the security architect for a multinational corporation that handles highly sensitive intellectual property (IP) and personally identifiable information (PII) for clients in multiple jurisdictions, including GDPR and CCPA regions. The company recently experienced a data breach where an attacker exfiltrated 50 GB of data from a file server by exploiting a vulnerability in the backup software. The backup software had been configured with default credentials and was accessible from the internet. The security team has implemented compensating controls, but management wants to prevent such incidents in the future. You have been asked to recommend a long-term strategy to protect sensitive data assets. The budget is limited, and the solution must minimize user friction. Current environment: On-premises Active Directory with Windows file servers, some data in AWS S3, and a mix of laptops and mobile devices. The organization uses Microsoft 365 for email and collaboration. Which of the following is the BEST course of action?

Accepted Answer

Deploy a data classification and labeling solution integrated with endpoint and network DLP to automatically detect and protect sensitive data. Data classification and labeling, integrated with endpoint and network DLP, directly addresses the root cause: the inability to distinguish sensitive data from non-sensitive data. By automatically classifying and labeling IP and PII, the organization can enforce policy-based protections (e.g., blocking exfiltration, applying encryption) without relying solely on perimeter controls. This minimizes user friction by automating detection and response, and it scales across on-premises, cloud (AWS S3), and Microsoft 365 environments, aligning with GDPR and CCPA requirements for data protection.

Answer

Implement multi-factor authentication (MFA) for all administrative accounts and backup interfaces

Answer

Encrypt all data at rest using AES-256 and implement strict key management policies

Answer

Segment the backup network from the production network and enforce strict firewall rules