CISSP Practice Test 16 — 15 Questions

Question 1

During an audit, it is discovered that several users have inherited permissions through nested group memberships that violate least privilege. What is the best approach to correct this?

Accepted Answer

Implement periodic access reviews and attestation. Periodic access reviews and attestation (Option A) are the best approach because they establish a continuous governance process where data owners or managers formally confirm that inherited permissions from nested group memberships remain appropriate. This directly addresses the root cause—unchecked group nesting—by enforcing regular validation of access rights against the principle of least privilege, rather than relying on a one-time fix or training.

Answer

Re-certify group memberships quarterly

Answer

Provide training on least privilege

Answer

Revoke all group memberships and assign individually

Question 2

A government agency requires a new secure document management system that enforces mandatory access control with the properties that users cannot read documents at a higher classification and cannot write documents to a lower classification (to prevent data leaking). The system must also support different categories (compartments) within the same classification level, and a user with access to one compartment should not be able to access another compartment unless explicitly allowed. The architect is considering the Bell-LaPadula model. However, the Bell-LaPadula model's *-property (no write-down) addresses the write issue, but there is also a need to handle compartment isolation. Which additional model or mechanism should be incorporated to ensure compartment isolation?

Accepted Answer

Use a lattice-based access control (LBAC) that extends Bell-LaPadula by defining a security lattice that includes compartments and categories, ensuring that a subject's clearance must dominate the object's classification, including compartments.. Lattice-based access control (LBAC) extends the Bell-LaPadula model by defining a security lattice that includes both hierarchical classifications (e.g., Top Secret, Secret) and non-hierarchical categories (compartments). In this lattice, a subject's clearance must dominate an object's classification across both dimensions, ensuring that a user with access to one compartment cannot access another unless their clearance includes that specific category. This directly enforces the required compartment isolation while maintaining the *-property (no write-down) for data leakage prevention.

Answer

Apply the Brewer-Nash (Chinese Wall) model which enforces conflict of interest by preventing access to multiple compartments that conflict.

Answer

Implement Biba's integrity model which prevents write-up, thus complementing Bell-LaPadula.

Answer

Use role-based access control (RBAC) to define compartments.

Question 3

A multinational corporation operates a private MPLS VPN network connecting 50 branch offices to a central data center. The network uses BGP as the routing protocol within the VPN, with each branch announcing its internal prefixes to the data center routers. Over the past week, several branch offices have reported intermittent connectivity issues, with traffic being routed to incorrect destinations before recovering. Network logs show that during these incidents, the data center router receives unexpected BGP updates from one of the branch routers, advertising prefixes that belong to other branches. BGP sessions remain established without flaps. The security team is concerned that this could be a route leak or intentional hijack. The network engineer has verified that all BGP sessions are authenticated with MD5 and that RPKI validation is not currently deployed. Which course of action should the engineer take first to mitigate the issue?

Accepted Answer

Configure inbound BGP prefix filtering on the data center routers.. The intermittent connectivity issues are caused by a branch router advertising prefixes that belong to other branches, which is a classic route leak or hijack scenario. Configuring inbound BGP prefix filtering on the data center routers is the immediate and most effective mitigation because it allows the engineer to explicitly define which prefixes are accepted from each BGP neighbor, preventing unauthorized or incorrect routes from being installed in the routing table. This approach does not require additional infrastructure or protocol changes and directly addresses the root cause of the traffic misdirection.

Answer

Implement BGP Flowspec to rate-limit traffic to the affected prefixes.

Answer

Deploy RPKI validation across all routers.

Answer

Increase the BGP hold timer on data center routers.

Question 4

During a business impact analysis (BIA), a department manager states that a critical process cannot be interrupted for more than 2 hours. However, the current backup system requires 8 hours to restore. What is the most appropriate risk management action?

Accepted Answer

Mitigate the risk by implementing faster backup and restoration procedures.. The BIA identifies a maximum tolerable downtime (MTD) of 2 hours, but the current recovery time objective (RTO) is 8 hours, creating a gap. Mitigating the risk by implementing faster backup and restoration procedures directly reduces the RTO to meet the MTD, aligning recovery capability with business requirements. This is the most appropriate action because it addresses the root cause—insufficient recovery speed—without unnecessarily discarding or transferring the process.

Answer

Avoid the risk by discontinuing the process.

Answer

Accept the risk and document the decision.

Answer

Transfer the risk to a third-party service provider.

Question 5

A hospital is implementing an access control system for its electronic health record (EHR) application. The system must ensure that only authorized healthcare providers can access patient records based on their role (doctor, nurse, administrator), department (cardiology, oncology, etc.), and patient consent status. The hospital also needs to support break-the-glass access for emergencies. The current solution uses static role-based access control (RBAC) but fails to enforce department-level restrictions and consent checks. What is the most appropriate access control model to address these requirements?

Accepted Answer

Implement an attribute-based access control (ABAC) system. Attribute-based access control (ABAC) is the correct choice because it can dynamically evaluate multiple attributes—such as user role, department, patient consent status, and emergency context—to grant or deny access. Unlike static RBAC, ABAC supports fine-grained, context-aware policies that can enforce department-level restrictions and consent checks, and it can incorporate break-the-glass rules by evaluating an emergency attribute or time-based condition.

Answer

Enhance the existing RBAC model with more granular roles for each department

Answer

Use mandatory access control (MAC) with security labels per patient record

Answer

Apply discretionary access control (DAC) allowing providers to set access permissions

Question 6

A security analyst notices that an attacker is sending forged ARP messages onto a local area network, linking the attacker's MAC address with the IP address of the default gateway. This allows the attacker to intercept traffic destined for the gateway. Which OSI layer is directly targeted by this attack?

Accepted Answer

Layer 2 – Data Link. ARP spoofing (or ARP poisoning) operates at Layer 2 (Data Link) because ARP messages are encapsulated directly within Ethernet frames and rely on MAC addresses, not IP routing. By forging ARP replies, the attacker corrupts the IP-to-MAC mapping in the victim's ARP cache, causing frames destined for the default gateway to be sent to the attacker's MAC address instead. This attack exploits the lack of authentication in the ARP protocol (RFC 826) and directly targets the Data Link layer's addressing and frame delivery mechanism.

Answer

Layer 4 – Transport

Answer

Layer 3 – Network

Answer

Layer 1 – Physical

Question 7

During a vulnerability scan, a security analyst discovers that a web server is running an outdated version of Apache with known remote code execution vulnerabilities. The server is in production and cannot be patched immediately due to dependency conflicts. What is the best compensating control to reduce risk while a permanent fix is developed?

Accepted Answer

Implement a web application firewall (WAF) to block known attack patterns. A Web Application Firewall (WAF) is the best compensating control because it can inspect HTTP/HTTPS traffic at the application layer (Layer 7) and block known attack patterns targeting the outdated Apache version, such as specific payloads for CVE-2017-9798 or CVE-2021-41773. Unlike other options, a WAF provides virtual patching without modifying the vulnerable server, directly mitigating the remote code execution risk while a permanent fix is developed.

Answer

Disable all unnecessary modules and services on the server

Answer

Enable detailed logging and alerting for the server

Answer

Isolate the server in a separate VLAN with strict ACLs

Question 8

A company is implementing a secure multi-tenant cloud environment. The primary security requirement is that tenants cannot access each other's data even if the hypervisor is compromised. Which architecture best meets this requirement?

Accepted Answer

Use a Trusted Execution Environment (TEE) such as Intel SGX to isolate tenant processes and memory.. A Trusted Execution Environment (TEE) like Intel SGX creates hardware-enforced enclaves that isolate tenant processes and memory at the CPU level. Even if the hypervisor is compromised, the enclave's memory is encrypted and inaccessible to the host OS or hypervisor, ensuring tenant data remains confidential. This directly meets the requirement that tenants cannot access each other's data despite a hypervisor breach.

Answer

Encrypt each tenant's data with a single master key stored in the hypervisor.

Answer

Implement Mandatory Access Control (MAC) on the hypervisor.

Answer

Use VLANs to isolate tenant traffic at the network layer.

Question 9

An organization implements a data loss prevention (DLP) solution. Which action is most effective for protecting data at rest on endpoint devices?

Accepted Answer

Encryption of files. Encryption of files directly protects data at rest on endpoint devices by rendering the data unreadable without the appropriate decryption key. This ensures that even if an endpoint is lost, stolen, or accessed by an unauthorized user, the data remains confidential. DLP solutions often integrate with file-level encryption (e.g., BitLocker, FileVault, or EFS) to enforce policy-based encryption on sensitive files at rest.

Answer

User awareness training

Answer

USB port blocking

Answer

Network DLP monitoring

Question 10

An organization is implementing IPsec VPN tunnels between multiple branch offices and the main office. The security team notices that the VPN tunnels are established successfully but no traffic passes through. Which of the following is the most likely cause?

Accepted Answer

Incorrect routing entries in the VPN routing table. When IPsec VPN tunnels are established (IKE Phase 1 and Phase 2 complete) but no traffic passes, the most common cause is incorrect routing entries in the VPN routing table. The tunnel may be up, but if the branch office does not have a route pointing the destination subnet to the tunnel interface (e.g., a static route or policy-based route), packets will be sent out the physical interface unencrypted or dropped. This is distinct from authentication or encryption mismatches, which would prevent tunnel establishment entirely.

Answer

Certificates expired

Answer

Mismatched encryption algorithm

Answer

Mismatched IKE version

Question 11

A medium-sized financial services company recently deployed a new identity governance and administration (IGA) solution to manage user access across on-premises Active Directory and cloud-based SaaS applications. The IGA system uses a role-based access control (RBAC) model with hundreds of roles defined. The company has a policy that all access certifications must be completed quarterly. During the first quarterly certification, the access reviewers complain that they are overwhelmed by the number of entitlements they need to review, and many certifications are not completed on time. The security team also notices that some users have accumulated excessive privileges because role assignments were not properly reviewed. The company wants to streamline the certification process without sacrificing security. Which of the following is the BEST course of action?

Accepted Answer

Implement a risk-based certification approach that focuses on high-risk access and uses automated certification for low-risk access. A risk-based certification approach prioritizes high-risk entitlements for manual review while automating the certification of low-risk access, reducing reviewer fatigue and ensuring critical privileges are scrutinized. This aligns with the principle of 'defense in depth' and addresses the core issue of overwhelming certification volume without compromising security, as low-risk access can be certified based on predefined policies and automated workflows.

Answer

Increase the certification frequency to monthly and assign more reviewers

Answer

Eliminate role-based access and assign permissions directly to users

Answer

Automate all certifications by using scripts that approve access if no violations are detected

Question 12

Which of the following is the primary purpose of a security assessment?

Accepted Answer

To identify weaknesses and measure control effectiveness. The primary purpose of a security assessment is to systematically identify vulnerabilities, threats, and weaknesses in an organization's information systems, and to evaluate the effectiveness of existing security controls. This aligns with the CISSP domain of Security Assessment and Testing, where the goal is to measure control performance against a baseline, not to immediately remediate or enforce compliance.

Answer

To fix all vulnerabilities immediately

Answer

To ensure compliance with regulations

Answer

To punish non-compliant employees

Question 13

A security team is reviewing a web application that allows users to search for products. The application uses a SQL database and constructs queries by concatenating user input directly into the SQL statement. Which of the following is the most effective mitigation against SQL injection attacks?

Accepted Answer

Using parameterized queries with prepared statements. Parameterized queries with prepared statements separate SQL logic from user input by sending the query structure to the database first, then binding input values as data parameters. This prevents the database from interpreting user input as executable SQL code, even if the input contains malicious characters. It is the only defense that completely eliminates the injection vector at the database interaction layer.

Answer

Escaping all user input before concatenation

Answer

Input validation using a blacklist of known malicious patterns

Answer

Implementing a Web Application Firewall (WAF)

Question 14

A company is implementing a secure software development lifecycle (SSDLC). Which of the following is a key activity during the design phase?

Accepted Answer

Threat modeling. Threat modeling is a key activity during the design phase of the SSDLC because it proactively identifies potential security threats, vulnerabilities, and attack vectors before any code is written. By analyzing the system's architecture, data flows, and trust boundaries (e.g., using STRIDE or PASTA methodologies), teams can design security controls directly into the system, reducing the cost and impact of fixes later. This aligns with the NIST SP 800-64 and Microsoft SDL frameworks, which mandate threat modeling as a core design-phase activity.

Answer

Static code analysis

Answer

Code signing

Answer

Penetration testing

Question 15

A company is conducting a risk assessment and needs to prioritize risks based on both likelihood and impact. The risk management team decides to use a quantitative approach. Which of the following is a key advantage of using quantitative risk analysis over qualitative risk analysis?

Accepted Answer

It provides monetary values for risks, facilitating cost-benefit analysis.. Quantitative risk analysis assigns monetary values to assets, threats, and vulnerabilities, enabling precise cost-benefit calculations for risk mitigation options. This allows organizations to compare the cost of controls directly against the expected loss, a key advantage over qualitative methods that rely on subjective rankings.

Answer

It relies on expert opinions and does not require historical data.

Answer

It is easier to communicate to non-technical stakeholders.

Answer

It requires less data and is faster to perform.