CISSP Practice Test 18 — 15 Questions

Question 1

A company's security policy requires that all removable media be encrypted. An employee plugs in a USB drive and is prompted to format it before use. After formatting, the drive is not encrypted. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The employee did not enable encryption (e.g., BitLocker To Go) after formatting. BitLocker To Go, the native encryption feature for removable drives in Windows, is not automatically enabled when a USB drive is formatted. The employee must explicitly enable encryption (e.g., via BitLocker To Go in Control Panel or by right-clicking the drive and selecting 'Turn on BitLocker') after formatting. Without this step, the drive remains unencrypted, violating the security policy.

Answer

The USB drive hardware does not support encryption

Answer

The operating system does not support encryption of removable media

Answer

The employee used the wrong file system (FAT32 vs NTFS)

Question 2

During a code review, a developer notices that an application directly concatenates user input into SQL queries. Which type of vulnerability does this represent?

Accepted Answer

SQL injection. Directly concatenating user input into SQL queries allows an attacker to inject arbitrary SQL commands, altering the query's intended behavior. This is the classic definition of SQL injection, which can lead to unauthorized data access, modification, or deletion. The vulnerability arises because the input is treated as executable code rather than data, bypassing parameterized query protections.

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Answer

Buffer overflow

Question 3

A financial application requires two employees to authorize a wire transfer. Which principle does this implement?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the principle that requires two or more individuals to complete a sensitive transaction, such as a wire transfer, to prevent fraud or error. By mandating two employees to authorize the transfer, the application ensures no single person has unchecked control over the entire process, enforcing a dual-control mechanism. This directly implements the SoD principle, which is a core access control concept in identity and access management.

Answer

Least privilege

Answer

Need-to-know

Answer

Zero standing privileges

Question 4

An organization wants to test its security controls by simulating an attack where the tester has no prior knowledge of the internal network. This is known as a:

Accepted Answer

Black box test. A black box test (D) is correct because the tester has no prior knowledge of the internal network, simulating an external attacker with zero inside information. This approach evaluates the security controls from an unprivileged, external perspective, relying solely on publicly available information and active reconnaissance. It is the purest form of adversarial simulation for testing perimeter defenses and detection capabilities.

Answer

Grey box test

Answer

White box test

Answer

Red team exercise

Question 5

During a security audit, an organization discovers that several employees are sharing a single generic account to access a critical database. Which principle of security operations is being violated?

Accepted Answer

Accountability. Accountability requires that each individual user be uniquely identified and their actions traceable. Sharing a generic account breaks this chain because the audit logs cannot attribute specific database operations (e.g., SELECT, UPDATE, DELETE) to a particular employee, making it impossible to hold anyone responsible for misuse or errors.

Answer

Separation of duties

Answer

Defense in depth

Answer

Least privilege

Question 6

A development team is implementing a web application that allows users to search for products. To prevent SQL injection attacks, which secure coding practice should be applied?

Accepted Answer

Parameterized queries with prepared statements. Parameterized queries with prepared statements (Option B) are the definitive defense against SQL injection because they separate SQL logic from user-supplied data. The database engine compiles the query structure first, then binds input values as parameters, ensuring that malicious input cannot alter the intended SQL command. This approach is language-agnostic and works across all modern database interfaces (e.g., JDBC, PDO, ADO.NET).

Answer

Input validation using a blacklist of SQL keywords

Answer

Output encoding of user input

Answer

Using stored procedures exclusively

Question 7

A DevOps team is implementing a DevSecOps pipeline. Which of the following should be introduced first in the pipeline to catch security issues early and reduce remediation cost?

Accepted Answer

Pre-commit hooks that run linters and secret scanners. Pre-commit hooks run linters and secret scanners before code is even committed to the repository, catching issues like hardcoded credentials, insecure patterns, or syntax errors at the earliest possible point in the development lifecycle. This aligns with the DevSecOps principle of 'shift left'—finding defects earlier dramatically reduces remediation cost compared to post-build or post-deployment testing. Unlike later stages, pre-commit hooks prevent vulnerable code from entering the shared codebase, stopping issues before they propagate.

Answer

Container vulnerability scanning after image build

Answer

Static application security testing (SAST) during the build stage

Answer

Dynamic application security testing (DAST) in staging environment

Question 8

During a security audit, it is discovered that a company's data classification labels are inconsistently applied across different departments. Which of the following is the BEST long-term solution to ensure consistent data classification?

Accepted Answer

Implement automated data classification tools that apply labels based on content and context. Automated data classification tools use content inspection (e.g., regex patterns, keyword matching) and contextual analysis (e.g., file location, creator, metadata) to consistently apply labels across the enterprise. This eliminates human error and variability between departments, ensuring uniform enforcement of the classification policy without relying on manual interpretation or periodic training.

Answer

Conduct annual retraining on data classification policies

Answer

Adopt a single classification level for all data to eliminate confusion

Answer

Assign a data owner in each department to manually review and classify data

Question 9

During a penetration test, the tester successfully exploits a vulnerability in a web server and gains initial access. The next step in the penetration testing process is to:

Accepted Answer

Conduct post-exploitation and lateral movement. After gaining initial access during a penetration test, the standard methodology (e.g., PTES, OWASP) requires conducting post-exploitation and lateral movement to assess the full impact of the compromise. This involves enumerating the compromised host, escalating privileges, and pivoting to other systems using techniques like pass-the-hash or SSH tunneling. Reporting findings immediately or disconnecting would violate the test scope and fail to demonstrate the real risk of the vulnerability.

Answer

Disconnect from the network

Answer

Report the findings immediately

Answer

Perform reconnaissance

Question 10

A security architect is designing controls for a cloud-based file storage service that stores personally identifiable information (PII). Which control best ensures that data remains encrypted at rest without involving the cloud provider's key management?

Accepted Answer

Client-side encryption. Client-side encryption ensures data is encrypted before it leaves the client device, so the cloud provider never has access to the plaintext or the encryption keys. This guarantees that the data remains encrypted at rest in the cloud storage without relying on the provider's key management infrastructure, meeting the requirement of keeping the provider out of the key management loop.

Answer

Tokenization of PII fields

Answer

Transport Layer Security (TLS) for data in transit

Answer

Server-side encryption with customer-managed keys

Question 11

A security administrator is configuring role-based access control (RBAC) for a cloud storage system. Which of the following is the best practice for assigning permissions?

Accepted Answer

Create roles based on job functions and assign users to roles. Role-based access control (RBAC) is the recommended approach for managing permissions in cloud storage systems because it aligns with the principle of least privilege and simplifies administration. By creating roles based on job functions and assigning users to those roles, permissions are granted consistently and can be easily audited or modified without touching individual user accounts. This reduces the risk of excessive permissions and makes compliance with policies like separation of duties more manageable.

Answer

Use access control lists on each object

Answer

Implement mandatory access control

Answer

Assign permissions directly to users for flexibility

Question 12

An organization's disaster recovery plan specifies a Recovery Time Objective (RTO) of 4 hours for its critical financial application. Which disaster recovery site would be MOST appropriate to meet this RTO?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and real-time data replication, enabling the critical financial application to be operational within minutes to a few hours. With an RTO of 4 hours, a hot site provides the necessary infrastructure and up-to-date data to meet this stringent recovery timeline, as cold and warm sites require significant setup and data restoration time.

Answer

Reciprocal agreement

Answer

Warm site

Answer

Cold site

Question 13

Which TWO protocols are commonly used for identity federation?

Accepted Answer

OpenID Connect. OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that enables clients to verify the identity of an end-user based on the authentication performed by an authorization server. It provides a standardized way to obtain identity claims via an ID token (JWT) and is widely used for federated identity scenarios, such as single sign-on (SSO) across domains. SAML 2.0 is an XML-based protocol for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP), making it a cornerstone of enterprise identity federation.

Answer

LDAP

Answer

OAuth 2.0

Answer

RADIUS

Question 14

OpenID Connect (OIDC) extends OAuth 2.0 primarily by adding which capability?

Accepted Answer

User authentication. OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that primarily adds user authentication. While OAuth 2.0 provides authorization delegation (access tokens for resources), OIDC introduces an ID token (a JSON Web Token, JWT) that contains claims about the authenticated user, enabling the client to verify the user's identity. This is defined in the OIDC specification (OpenID Foundation) and is the key differentiator from plain OAuth 2.0.

Answer

Client credential management

Answer

Authorization delegation

Answer

Token introspection

Question 15

Which type of firewall operates at Layer 7 and can inspect application payloads, such as blocking specific SQL commands or HTTP methods?

Accepted Answer

Application proxy. An application proxy firewall (also known as an application-level gateway) operates at Layer 7 (Application Layer) of the OSI model. It can inspect the full application payload, allowing it to block specific SQL commands, HTTP methods (e.g., PUT, DELETE), or other application-layer content by terminating the connection and re-establishing it after deep inspection.

Answer

Stateful inspection

Answer

Packet filter

Answer

Circuit-level gateway