CISSP Practice Test 17 — 15 Questions

Question 1

A security engineer is troubleshooting an issue where users are unable to access a web application after being authenticated via OAuth 2.0. The users receive a 403 Forbidden error. The application logs show that the access token is valid but does not contain the required scope. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The authorization server did not grant the requested scope due to user consent settings.. The 403 Forbidden error indicates the resource server received a valid access token but denied access because the token lacks the necessary scope. In OAuth 2.0, the authorization server issues tokens based on the scope granted by the user during consent. If the user did not consent to the required scope (e.g., 'write' instead of 'read'), the token will not include it, causing the resource server to reject the request despite the token being valid.

Answer

The resource server is configured to expect a different token type.

Answer

The client application is not using HTTPS to transmit the token.

Answer

The access token expired before being presented to the resource server.

Question 2

A system administrator is configuring an LDAP directory for user authentication. The policy requires that account lockout occurs after a specified number of failed attempts. Which attribute should be configured?

Accepted Answer

lockoutThreshold. The `lockoutThreshold` attribute in an LDAP directory specifies the maximum number of consecutive failed authentication attempts allowed before the account is locked. This directly satisfies the policy requirement to lock the account after a specified number of failed attempts, making it the correct attribute to configure.

Answer

failedLoginAttempts

Answer

lockoutDuration

Answer

passwordLockoutTime

Question 3

A security analyst receives an alert that a host in the internal network is sending abnormal amounts of traffic to an external IP. The traffic uses destination port 53. What is the most likely attack?

Accepted Answer

DNS tunneling. The alert describes a host sending abnormal traffic to an external IP on destination port 53, which is the default port for DNS. DNS tunneling exploits the DNS protocol to encapsulate non-DNS data (e.g., commands or exfiltrated files) within DNS queries and responses, allowing covert communication through firewalls that typically allow DNS traffic. The abnormal volume of traffic to a single external IP is a classic indicator of a DNS tunnel, as the compromised host continuously sends encoded data to an external command-and-control server.

Answer

DNS cache poisoning

Answer

DNS amplification

Answer

DNS zone transfer

Question 4

An organization is implementing a new backup strategy for its critical servers. The backup must support rapid restoration of individual files and allow for a recovery point objective (RPO) of no more than 15 minutes. Which backup method should be used for daily operations?

Accepted Answer

Continuous data protection (CDP). Continuous data protection (CDP) is the only backup method that can guarantee a recovery point objective (RPO) of 15 minutes or less because it captures every write to disk in real time or near-real time, enabling restoration to any point within the protection window. Full, differential, and incremental backups all rely on periodic snapshots, which inherently introduce gaps that exceed a 15-minute RPO unless the interval is shorter than 15 minutes, which is impractical for daily operations.

Answer

Full backup every 24 hours

Answer

Differential backup every 6 hours

Answer

Incremental backup every 4 hours

Question 5

A company is implementing a continuous monitoring program for its cloud infrastructure. Which of the following metrics would be MOST useful for detecting unauthorized changes to production systems?

Accepted Answer

Configuration drift from a known good baseline.. Configuration drift from a known good baseline is the most effective metric for detecting unauthorized changes because it directly compares the current state of production systems against a secure, approved baseline (e.g., using tools like AWS Config, Azure Policy, or Chef InSpec). Any deviation—such as altered file permissions, unexpected services, or modified registry keys—triggers an alert, enabling rapid detection of unauthorized modifications. This aligns with continuous monitoring principles in cloud security, focusing on integrity rather than performance or access patterns.

Answer

Network throughput between application tiers.

Answer

Average CPU load across all systems.

Answer

Number of failed login attempts per hour.

Question 6

A small business wants to implement multifactor authentication (MFA) for remote access to its internal network. The solution must be cost-effective and easy to deploy. Which combination is most appropriate?

Accepted Answer

Password and one-time passcode sent via SMS. It combines a password (something you know) with a one-time passcode sent via SMS (something you have), satisfying the definition of multifactor authentication. SMS-based OTP is cost-effective and easy to deploy for a small business, as it requires no additional hardware or complex infrastructure, leveraging existing mobile networks.

Answer

Fingerprint scanner and password

Answer

Smart card and PIN

Answer

Password and security questions

Question 7

An organization is implementing a defense-in-depth strategy for its web application. Which of the following is an example of a compensating control?

Accepted Answer

A web application firewall (WAF) blocking SQL injection. A compensating control is an alternative security measure implemented when a primary control cannot be applied due to technical or business constraints. In this context, a Web Application Firewall (WAF) blocking SQL injection serves as a compensating control when, for example, source code fixes for input validation are not immediately feasible. The WAF inspects HTTP/HTTPS traffic at the application layer (Layer 7) and uses signature-based or behavioral analysis to detect and block malicious SQL patterns, thereby mitigating the vulnerability without modifying the application code.

Answer

A firewall blocking port 80

Answer

Regular vulnerability scanning

Answer

Two-factor authentication for administrative access

Question 8

A multinational corporation is establishing a security governance framework. The board of directors wants to ensure that information security strategy aligns with business objectives. Which role is primarily responsible for integrating security into the organization's strategic decision-making?

Accepted Answer

Senior management. Senior management (C) is primarily responsible for integrating security into strategic decision-making because they hold the authority to allocate resources, define risk appetite, and ensure that security initiatives directly support business objectives. In a governance framework, only senior management can bridge the gap between operational security and enterprise strategy, as they are accountable for the organization's overall risk posture and compliance mandates.

Answer

IT security team

Answer

Internal audit team

Answer

Data owner

Question 9

A system administrator notices that user accounts are often left active after employees leave the company. Which process should be automated to address this?

Accepted Answer

Automated account provisioning and deprovisioning. Automated account provisioning and deprovisioning ensures that when an employee leaves the company, their access rights are automatically revoked in a timely manner. This process directly addresses the issue of orphaned accounts by integrating with HR systems to trigger account disablement or deletion upon termination, reducing the risk of unauthorized access.

Answer

Single sign-on implementation

Answer

Password reset policy

Answer

Multi-factor authentication

Question 10

A company has implemented data classification labels such as 'Public', 'Internal', 'Confidential', and 'Restricted'. Which control is most appropriate for protecting 'Confidential' data?

Accepted Answer

Encryption at rest and in transit. Encryption at rest and in transit is the most appropriate control for protecting 'Confidential' data because it renders the data unreadable to unauthorized parties both when stored on disk (e.g., AES-256) and when transmitted over networks (e.g., TLS 1.3). This directly enforces confidentiality by ensuring that even if an attacker gains access to the storage medium or intercepts network traffic, the data remains protected. Data classification labels like 'Confidential' require strong cryptographic controls to meet the principle of least privilege and compliance mandates such as GDPR or HIPAA.

Answer

Data masking for all users

Answer

Removing all access controls to streamline sharing

Answer

Public posting on the company website

Question 11

A security team is analyzing logs from multiple sources and notices anomalous outbound traffic to a known command-and-control server. What is the most likely conclusion?

Accepted Answer

A host is compromised and is beaconing. Anomalous outbound traffic to a known command-and-control (C2) server is a classic indicator of compromise (IoC). Compromised hosts often beacon outbound to C2 infrastructure using HTTP, HTTPS, or DNS tunnels to receive instructions or exfiltrate data. This pattern is distinct from normal traffic and is a primary focus of network security monitoring and intrusion detection systems (IDS).

Answer

A misconfigured firewall is causing traffic

Answer

An employee is streaming video to a personal server

Answer

The network is under a DDoS attack

Question 12

A company uses Role-Based Access Control (RBAC) for its ERP system. A user in the 'Accounts Payable' role needs to temporarily approve purchase orders up to $10,000 while the 'Purchasing Manager' is on leave. What is the BEST way to grant this access?

Accepted Answer

Temporarily assign the 'Purchasing Approver' role to the user with an expiration date. It follows the principle of least privilege by temporarily assigning the 'Purchasing Approver' role to the user with an expiration date, ensuring that the elevated permissions are automatically revoked after the leave period. This approach maintains RBAC integrity without permanently altering role definitions or sharing credentials.

Answer

Share the Purchasing Manager's account credentials with the user

Answer

Modify the 'Accounts Payable' role to include purchase order approval permissions

Answer

Create a new role with the exact permissions needed and assign it to the user

Question 13

A healthcare organization implements a policy requiring all employees to use biometric fingerprint scanners to access patient records. Which of the following is the MOST significant risk associated with this authentication method?

Accepted Answer

Biometric data cannot be revoked or changed if compromised. Biometric data, such as fingerprint templates, is immutable and permanently tied to the individual. Once compromised, the user cannot simply 'reset' their fingerprint like a password, rendering the authentication factor permanently insecure for that user across all systems where it is used. This non-repudiation and revocation failure represents the most significant long-term risk to the organization's identity management infrastructure.

Answer

High false acceptance rate leading to unauthorized access

Answer

Low user acceptance due to privacy concerns

Answer

Increased login time compared to password authentication

Question 14

An organization is decommissioning a data center. Which of the following is the most secure method for sanitizing hard drives that will be reused?

Accepted Answer

Overwriting with random data multiple times. Overwriting with random data multiple times (option C) is the most secure method for sanitizing hard drives that will be reused because it ensures that the original data is irrecoverable through any known forensic technique. Unlike physical destruction, which renders the drive unusable, or file deletion and quick format, which only remove file system pointers and leave data intact, multiple-pass overwriting (e.g., using the DoD 5220.22-M standard) writes patterns over every sector, including remapped sectors, making the original data unrecoverable even with advanced magnetic force microscopy.

Answer

Physical destruction

Answer

Deleting all files

Answer

Quick format

Question 15

A financial institution is required to retain customer transaction records for seven years under regulatory mandates. The institution is facing a lawsuit and must preserve all relevant data. What legal concept applies?

Accepted Answer

Legal hold. When a lawsuit is reasonably anticipated or has been filed, the duty to preserve relevant evidence arises. A legal hold (also known as a litigation hold) is the formal process that suspends normal data retention and destruction policies to ensure that all potentially relevant electronically stored information (ESI) is preserved. This overrides the standard seven-year retention schedule because the legal obligation to preserve supersedes the regulatory retention mandate.

Answer

E-discovery

Answer

Data retention policy

Answer

Chain of custody