CISSP Practice Test 17 — 15 Questions

Question 1

A security analyst notices repeated failed login attempts from an internal IP address on the domain controller. After enabling account lockout, the lockouts continue but the source IP changes. What is the best next step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyze the log events to identify the attack pattern and implement additional controls such as MFA. The changing source IP indicates a distributed attack, likely a password spraying or brute-force attempt from multiple compromised hosts. Analyzing log events helps identify the attack pattern (e.g., timing, targeted accounts, source IP ranges) so you can implement additional controls like MFA, which mitigates credential-based attacks regardless of source IP changes. Account lockout alone is insufficient when attackers rotate IPs, as lockout policies are per-account and per-source, not adaptive to distributed sources.

Answer

Increase the account lockout threshold

Answer

Ignore the event as it is likely a false positive

Answer

Disable the user account being targeted

Question 2

A global technology firm has implemented a continuous integration/continuous deployment (CI/CD) pipeline for its flagship software product. The security testing team is tasked with integrating security testing into the pipeline. The team has decided to use a static application security testing (SAST) tool and a software composition analysis (SCA) tool. They are currently running both tools every night against the entire codebase, but the developers complain that the reports are too long and often contain false positives. The team wants to improve the efficiency without sacrificing security coverage. Which of the following is the BEST strategy?

Accepted Answer

Implement a developers' feedback loop for false positives and tune the tools.. Tuning the SAST and SCA tools based on developer feedback directly addresses the false positive issue while maintaining security coverage. By establishing a feedback loop, the team can adjust rule sets, suppress known false positives, and reduce report noise without reducing scan frequency or scope. This approach aligns with the principle of continuous improvement in DevSecOps, ensuring that security testing remains efficient and actionable.

Answer

Decrease the scan frequency to weekly to reduce noise.

Answer

Replace SAST with dynamic application security testing (DAST) for more accurate results.

Answer

Run SAST and SCA only on new code changes committed to the main branch.

Question 3

An organization is planning a penetration test of its internal network. Which TWO of the following are essential elements to include in the test scope and rules of engagement?

Accepted Answer

Time windows when testing is permitted (e.g., after business hours).. The rules of engagement (ROE) and scope define the boundaries of the penetration test. Essential elements include authorized time windows (option B) to minimize business disruption and ensure testing occurs during agreed-upon periods, and a list of authorized IP addresses and systems (option D) to clearly define the target scope and avoid legal issues. Option A (list of specific tools) is not necessarily required in the scope; tools can be agreed upon but are not essential. Option C (vulnerability scanning schedule) is a separate activity and not part of penetration test scope. Option E (detailed client-side exploitation plan) is too specific and not a required element of the overall scope.

Answer

List of specific exploitation tools to be used.

Answer

Schedule for automated vulnerability scanning of all external systems.

Answer

Detailed plan for exploiting client-side vulnerabilities.

Question 4

A multinational corporation is designing a data retention schedule. Which factor is most critical when determining retention periods for personal data subject to the GDPR?

Accepted Answer

The purpose for which the data was collected. Under the GDPR, Article 5(1)(e) establishes the 'storage limitation' principle, which mandates that personal data must be kept no longer than necessary for the purposes for which it was collected. Therefore, the purpose of collection is the primary driver for determining the retention period, as it defines the lawful basis and necessity for processing. Without a defined purpose, any retention period would be arbitrary and non-compliant with the regulation.

Answer

The length of the third-party data processing agreement

Answer

The cost of storage media

Answer

The duration of any pending legal holds

Question 5

An organization wants to protect sensitive data stored on laptops. Which of the following is the MOST effective control to prevent data loss if a laptop is stolen?

Accepted Answer

Full-disk encryption (FDE). Full-disk encryption (FDE) renders the data on the laptop unreadable without the decryption key, even if the storage drive is removed and analyzed. This is the most effective preventive control against data loss from theft because it protects data at rest regardless of physical access to the device.

Answer

BIOS password

Answer

Asset tracking software

Answer

Remote wipe capability

Question 6

A security architect is designing access controls for a healthcare application where permissions are based on the user's role, the sensitivity of the data, and the context of the access (e.g., time of day). Which access control model best fits this requirement?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) is the correct model because it evaluates access decisions based on multiple attributes: the user's role, the data sensitivity (object attributes), and environmental context such as time of day. Unlike simpler models, ABAC can combine subject, resource, and environment attributes using policy rules (e.g., XACML or ALFA) to enforce fine-grained, context-aware permissions, which is essential for healthcare applications with dynamic compliance requirements like HIPAA.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 7

A multinational corporation is developing a new cloud-based collaboration platform that handles sensitive intellectual property. The platform must ensure end-to-end encryption (E2EE) so that even the cloud provider cannot access the data. Users communicate via chat and file sharing. The architect proposes using a hybrid encryption scheme where each user has a public/private key pair, and for each message, a random symmetric key is used to encrypt the message, which is then encrypted with the recipient's public key. However, there is a requirement for the company to be able to lawfully intercept communications in case of a court order. This conflicts with E2EE. Which design can satisfy both confidentiality and lawful interception?

Accepted Answer

Implement a split-key design where the encryption keys are generated and held by the users, but a separate escrow agent splits the key into two parts: one held by the user and one held by the company. Alternatively, use a 'drop box' approach where communications are recorded in an encrypted format and the company can decrypt only after a court order by using a secondary key that is released upon authorization.. It uses a split-key or drop-box design that preserves end-to-end encryption for regular communications while enabling lawful interception under strict authorization. In this scheme, the user holds one part of the key and the company holds another, or communications are recorded encrypted and a secondary key is released only after a court order, ensuring that neither the cloud provider nor the company can decrypt data without proper legal process. This satisfies both the E2EE requirement and the lawful interception mandate without compromising the core security principle of least privilege.

Answer

Implement key escrow where the company holds a copy of all users' private keys.

Answer

Implement a transparent encryption proxy on the user's device that logs all keys and sends them to the company.

Answer

Use client-side encryption where the encryption key is derived from user password and stored with a backup that can be recovered by the company using a master key.

Question 8

Which security model focuses on preventing unauthorized access by enforcing a 'no read up, no write down' rule?

Accepted Answer

Bell-LaPadula. The Bell-LaPadula model is a formal state machine model for enforcing access control in government and military systems. Its core rule, 'no read up' (simple security property) and 'no write down' (star property), prevents subjects from reading objects at a higher classification level and from writing to objects at a lower classification level, thereby preventing unauthorized disclosure of sensitive information.

Answer

Clark-Wilson

Answer

Biba

Answer

Brewer-Nash

Question 9

A large enterprise uses Active Directory for authentication. Several users report intermittent authentication failures when accessing internal web applications. The help desk confirms that the failures occur at random times and affect both new and existing users. The security team discovers that the system clocks on domain controllers are within acceptable limits, but some client workstations show time drift of up to 10 minutes. The Kerberos protocol is used for authentication. What is the most likely cause of the authentication failures, and what action should be taken?

Accepted Answer

Synchronize all client workstation clocks using a centralized NTP server. Kerberos authentication relies on synchronized clocks between clients and domain controllers, with a default maximum time skew tolerance of 5 minutes (RFC 4120). A client clock drift of up to 10 minutes exceeds this tolerance, causing intermittent authentication failures because Kerberos ticket requests are rejected as invalid or replay attacks. Synchronizing all client workstations to a centralized NTP server resolves the time skew and restores Kerberos authentication reliability.

Answer

Implement password complexity policies to reduce authentication errors

Answer

Enable NTLM fallback authentication for the web applications

Answer

Configure Kerberos ticket lifetimes to 24 hours to reduce sensitivity to time skew

Question 10

A company needs to provide secure remote access to employees using company-issued laptops. The solution must support both web applications and legacy client-server apps without installing client software on the laptops. Which VPN technology is best?

Accepted Answer

SSL VPN with clientless web access and port forwarding. SSL VPN with clientless web access and port forwarding is the best choice because it meets the requirement of supporting both web applications and legacy client-server apps without installing client software. Clientless web access provides secure HTTPS-based access to internal web applications via a browser, while port forwarding allows legacy TCP-based client-server applications to be tunneled through the SSL VPN without requiring a full VPN client on the laptop. This approach leverages the existing browser and OS capabilities, eliminating the need for additional software installation.

Answer

L2TP over IPsec

Answer

MPLS Layer 3 VPN

Answer

IPsec tunnel mode

Question 11

A company is required to retain logs for regulatory compliance. Which factor primarily determines the log retention period?

Accepted Answer

Regulatory requirements. Regulatory compliance frameworks (e.g., PCI DSS, HIPAA, SOX, GDPR) explicitly mandate minimum log retention periods (e.g., PCI DSS Requirement 10.7 requires at least one year of logs, with three months immediately accessible). Storage capacity, incident response needs, and log volume are operational considerations that may influence implementation but do not override the legal or contractual obligation to retain logs for a specified duration. The primary factor is the regulatory requirement itself, as failure to comply can result in fines, legal liability, or loss of certification.

Answer

Storage capacity

Answer

Incident response needs

Answer

Log volume

Question 12

During a security assessment, a penetration tester successfully performed a VLAN hopping attack from a host in VLAN 10 to a host in VLAN 20. The switches are configured with IEEE 802.1Q trunking. Which misconfiguration likely allowed this attack?

Accepted Answer

Dynamic Trunking Protocol (DTP) is enabled on access ports. D is correct because VLAN hopping attacks exploit Dynamic Trunking Protocol (DTP) to negotiate a trunk link between an attacker's host and a switch port. If DTP is enabled on an access port, the attacker can spoof DTP messages to form a trunk, gaining access to traffic from multiple VLANs, including VLAN 20 from VLAN 10.

Answer

The native VLAN is not used on any trunk ports

Answer

Spanning Tree Protocol is disabled

Answer

Port security is disabled on all ports

Question 13

A security analyst is tasked with identifying vulnerabilities in a web application that is still in development. The application code is not yet stable, and frequent changes are expected. Which testing approach would be most appropriate to identify vulnerabilities without hindering the development process?

Accepted Answer

Static application security testing (SAST). Static Application Security Testing (SAST) is the most appropriate approach because it analyzes source code, byte code, or binary code without executing the application, making it ideal for early-stage development where code is unstable and frequently changing. SAST can be integrated into the development pipeline (e.g., as a pre-commit hook or CI/CD step) to identify vulnerabilities like SQL injection, XSS, or buffer overflows without requiring a running application or hindering the iterative development process.

Answer

Fuzz testing

Answer

Manual penetration testing

Answer

Dynamic application security testing (DAST)

Question 14

Which type of SOC report provides a public summary of controls related to security, availability, confidentiality, integrity, and privacy, but does not include detailed testing results?

Accepted Answer

SOC 3. SOC 3 reports are designed for public distribution and provide a high-level summary of an organization's controls related to security, availability, confidentiality, integrity, and privacy (the Trust Services Criteria). Unlike SOC 2 reports, SOC 3 reports do not include detailed testing results, control descriptions, or the auditor's opinion on control effectiveness, making them suitable for marketing or public disclosure.

Answer

SOC 2 Type II

Answer

SOC 1 Type II

Answer

SOC 2 Type I

Question 15

A company requires employees to authenticate using a smart card and PIN to access the corporate network. This is an example of which type of authentication?

Accepted Answer

Two-factor authentication. This scenario requires two distinct authentication factors: something you have (the smart card) and something you know (the PIN). Smart cards store a private key or certificate that must be unlocked by the PIN, and both factors must be presented simultaneously to authenticate. This meets the NIST SP 800-63 definition of multi-factor authentication, specifically two-factor authentication.

Answer

Single-factor authentication

Answer

Biometric authentication

Answer

Single sign-on