CISSP Practice Test 17 — 15 Questions

Question 1

Refer to the exhibit. What is a potential security weakness in this policy?

Accepted Answer

It grants access to a private IP range which is not routable over the internet. Option C is correct because the policy grants access to a private IP range (e.g., 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) which is not routable over the internet. This means the condition is ineffective for controlling access from external sources, as private IP addresses are only meaningful within a local network and cannot be used to authenticate or authorize remote users. An attacker could spoof such an IP address from within the same network or bypass the restriction entirely if the policy is intended to restrict internet-based access.

Answer

It does not specify a principal

Answer

It allows all actions on the bucket

Answer

It uses a condition that can be bypassed

Question 2

A company's vulnerability management program requires that all critical vulnerabilities be remediated within 30 days. A critical vulnerability is discovered in a legacy system that cannot be patched because the vendor no longer supports it. Which of the following is the best compensating control?

Accepted Answer

Segment the system from the rest of the network. Network segmentation isolates the legacy system, reducing the attack surface. HIDS only detects, not prevents. Logging and monitoring are detective controls. Encryption does not prevent exploitation of the vulnerability.

Answer

Deploy a host-based intrusion detection system (HIDS)

Answer

Increase logging and monitoring

Answer

Encrypt all data at rest on the system

Question 3

A security analyst is reviewing log data from various sources. Which of the following are essential for effective security logging in accordance with best practices? (Select THREE.)

Accepted Answer

Secure transmission of logs to a central repository. Option B is correct because logs must be transmitted securely to a central repository to prevent tampering, interception, or unauthorized disclosure during transit. Best practices require the use of encrypted channels such as TLS (e.g., syslog over TLS per RFC 5425) or IPsec to ensure confidentiality and integrity of log data while in motion.

Answer

Storage of logs in plaintext format only

Answer

Log retention of at least one year

Question 4

An organization has implemented a new SIEM system. What is the most critical factor for its effectiveness?

Accepted Answer

The ability to correlate events. The most critical factor for a SIEM's effectiveness is its ability to correlate events across diverse log sources to detect complex attack patterns, such as a lateral movement chain or a multi-stage exploit. Without correlation, a SIEM is merely a log aggregator, unable to distinguish a true security incident from isolated benign events. Correlation engines apply rule-based or statistical analysis (e.g., using Sigma rules or machine learning) to identify relationships between seemingly unrelated log entries, which is the core value proposition of a SIEM.

Answer

The cost of the solution

Answer

The speed of data ingestion

Answer

The number of log sources integrated

Question 5

During a penetration test, the tester gains access to a server and finds sensitive customer data. What should the tester do next?

Accepted Answer

Report the finding immediately and secure the data. Option D is correct because the tester's primary responsibility is to protect sensitive data and minimize risk. Upon discovering PII or other regulated data, the tester must immediately report the finding to the client and secure the data (e.g., by isolating the server or encrypting the data in place) to prevent unauthorized access or exposure. This aligns with the ethical hacking code of conduct and the CISSP principle of 'do no harm'.

Answer

Exfiltrate the data to demonstrate the risk

Answer

Delete the data to prevent exposure

Answer

Continue testing to find more vulnerabilities

Question 6

A security analyst reviews the syslog configuration exhibit. What is the primary security concern with this configuration?

Accepted Answer

Logs are sent in clear text to the remote syslog server. The configuration shows syslog messages being sent to a remote server using UDP port 514 without any encryption or authentication mechanism. By default, syslog over UDP transmits all log data in clear text, meaning any attacker with network access can intercept and read sensitive information such as failed login attempts, user names, or system events. This violates the confidentiality principle and is the primary security concern because it exposes potentially sensitive audit data in transit.

Answer

The remote syslog server is not configured to receive logs

Answer

The logging level for authentication is set to 'none'

Answer

Local7 and mail logs are being sent to different destinations

Question 7

An organization wants to verify that its security policies are being followed by employees. Which testing method is most appropriate?

Accepted Answer

Compliance audit. A compliance audit is the most appropriate method to verify that security policies are being followed because it systematically compares actual practices, configurations, and controls against documented policy requirements. Unlike technical scans that identify vulnerabilities, a compliance audit focuses on adherence to rules, standards, and procedures, often using checklists derived from frameworks like ISO 27001 or NIST SP 800-53.

Answer

Vulnerability scan

Answer

Risk assessment

Answer

Penetration test

Question 8

Which TWO of the following are best practices for conducting a penetration test?

Accepted Answer

Define scope and rules of engagement. Obtaining written authorization and defining scope and rules of engagement are fundamental to ethical and legal testing. Using only automated tools is not best; manual techniques are also needed. Installing backdoors is unethical. Notifying law enforcement is not a standard practice and could compromise the test.

Answer

Install backdoors for future access

Answer

Notify law enforcement before testing

Answer

Use only automated tools

Question 9

A security team is planning to conduct a social engineering test as part of an organization's security assessment. Which THREE of the following should be included in the test plan to ensure ethical and legal compliance?

Accepted Answer

Obtain explicit written consent from management. Option A is correct because explicit written consent from management is a foundational ethical and legal requirement for social engineering tests. Without documented authorization, the test could be construed as unauthorized access or harassment, violating laws such as the Computer Fraud and Abuse Act (CFAA) or GDPR. This consent ensures the test is conducted under the organization's official risk management framework and provides legal protection for the testers.

Answer

Use real personal information of targets

Answer

Include all employees without exceptions

Question 10

A financial institution is conducting a vulnerability assessment of its internal network. The assessor runs a comprehensive scan and discovers that several Windows servers have missing security patches. The organization has a patch management policy that requires all critical patches to be applied within 30 days. The scan results show that some patches have been pending for 45 days. The assessor also finds that the servers are isolated in a separate VLAN with strict firewall rules limiting inbound traffic to only necessary ports. The business owner argues that because the servers are isolated, the risk is low and the patches can be delayed. As the security assessor, what should be the BEST course of action?

Accepted Answer

Escalate the finding to the risk management team for formal risk acceptance.. Option B is correct because the finding should be formally documented and accepted by the risk management team to ensure accountability and alignment with the organization's risk appetite. Option A is wrong because simply accepting risk without formal documentation is not proper risk management. Option C is wrong because patches should not be applied without proper change management due to potential operational impact. Option D is wrong because while compensating controls may be considered, the best first step is to escalate for formal risk acceptance.

Answer

Recommend additional compensating controls such as intrusion prevention.

Answer

Accept the risk and close the finding.

Answer

Immediately apply the patches without further approval.

Question 11

Which THREE of the following are key activities in the recovery phase of incident response?

Accepted Answer

Notifying law enforcement. Notifying law enforcement is a key activity in the recovery phase because it involves external coordination after the immediate threat is contained, ensuring legal and regulatory compliance. Recovery focuses on restoring normal operations and preserving evidence for potential prosecution, which includes contacting authorities if the incident involves criminal activity. This step is distinct from containment or eradication, as it occurs after systems are stabilized and the organization begins returning to business as usual.

Answer

Identifying the root cause

Answer

Implementing containment measures

Question 12

Which TWO of the following are key elements of a disaster recovery plan (DRP)?

Accepted Answer

Communication and notification procedures. A and D are correct. A is correct because a DRP must include communication procedures to notify stakeholders. D is correct because the DRP should outline the order in which systems are restored (recovery priorities). B is incorrect because the BIA itself is separate, though its outputs inform the DRP. C is incorrect because the DRP is not focused on daily operations but on recovery. E is incorrect because patch management is part of ongoing maintenance.

Answer

Standard operating procedures for daily tasks

Answer

Patch management schedules

Answer

Business impact analysis (BIA) results

Question 13

A SOC analyst receives an alert for a high number of outbound connections to a known malicious IP. Which action should be taken first?

Accepted Answer

Isolate the affected host. Option A is correct because isolating the host prevents further data exfiltration and allows for safe investigation. Blocking the IP may stop the traffic but the host remains compromised. Antivirus and notification are secondary steps.

Answer

Notify management

Answer

Block the IP at the firewall

Answer

Run an antivirus scan

Question 14

An organization's backup strategy includes daily full backups and hourly incremental backups. The system suffers a ransomware attack that encrypts all data. Which backup set is essential to restore the most recent clean state?

Accepted Answer

The last full backup plus all incremental backups after that. To restore the most recent clean state after a ransomware attack, you need the last full backup as the base and all subsequent incremental backups to apply every change made up to the moment before the attack. Incremental backups capture only data changed since the last backup (full or incremental), so skipping any breaks the chain and results in data loss. Option A correctly includes the full backup and every incremental backup after it, ensuring a complete restoration to the latest point before encryption.

Answer

The last full backup plus the last incremental backup

Answer

The last full backup only

Answer

The last incremental backup only

Question 15

During a security incident, the incident response team identifies that an attacker exfiltrated data via a compromised service account. Which of the following is the BEST immediate step to contain the incident?

Accepted Answer

Revoke the service account's privileges. Option C is correct because revoking the compromised account's privileges stops further access. Option A is wrong because changing the password may not be effective if the attacker has established persistence. Option B is wrong while important, auditing alone doesn't stop ongoing exfiltration. Option D is wrong because notifying law enforcement is a later step, not immediate containment.

Answer

Notify law enforcement

Answer

Enable detailed auditing on the account

Answer

Change the password of the service account

CISSP Practice Test 17 — 15 Questions

Exhibit

CISSP Practice Test 17 — 15 Questions

Exhibit