CISSP Practice Test 18 — 15 Questions

Question 1

A security analyst notices that the SIEM is generating an overwhelming number of low-priority alerts from a single application server. The server is critical to operations. What is the BEST approach to reduce noise without compromising security?

Accepted Answer

Create a suppression rule for known benign patterns.. Option C is correct because suppression rules allow the SIEM to filter out known benign patterns (e.g., routine service checks or scheduled scans) while still capturing genuine threats. This reduces alert fatigue without disabling monitoring for the critical server, preserving visibility into anomalous or malicious activity.

Answer

Increase the severity threshold for that server's alerts.

Answer

Disable all alerts from that server.

Answer

Exclude the server from SIEM monitoring.

Question 2

Which of the following is a key requirement for an effective backup strategy to ensure data can be recovered after a ransomware attack?

Accepted Answer

Backups are encrypted and stored offline or air-gapped.. Option B is correct because backups that are encrypted and stored offline or air-gapped are protected from encryption by ransomware. Other options would leave backups vulnerable.

Answer

Incremental backups are performed monthly.

Answer

Backups use the same credentials as the production environment.

Answer

Backups are stored on the same network as production.

Question 3

During an incident response, the team identifies that the attacker gained access through a compromised service account with domain admin privileges. Which of the following steps should be taken FIRST to contain the incident?

Accepted Answer

Disable the compromised account and revoke its tokens.. Disabling the compromised account and revoking its tokens (e.g., Kerberos TGTs via `Set-ADAccountControl -Disable` and clearing cached tickets) immediately stops the attacker's current authentication and lateral movement capabilities. This is the fastest containment step because the service account with Domain Admin privileges is the direct vector; isolating systems or resetting all passwords is slower and may not address active token reuse.

Answer

Isolate all affected systems from the network.

Answer

Reset all user passwords.

Answer

Perform a full forensic analysis before any action.

Question 4

Which TWO of the following are examples of detective controls?

Accepted Answer

CCTV surveillance. CCTV surveillance is a detective control because it records events for later review, enabling the detection of unauthorized activities after they occur. It does not prevent or deter access in real-time, but instead provides evidence for incident investigation and forensic analysis. This aligns with the detective control category in security operations, which focuses on identifying and logging violations post-facto.

Answer

Access control list

Answer

Firewall

Answer

Security awareness training

Question 5

An organization implements a data loss prevention (DLP) solution. Which action is most effective for protecting data at rest on endpoint devices?

Accepted Answer

Encryption of files. Encryption of files directly protects data at rest on endpoint devices by rendering the data unreadable without the appropriate decryption key. This ensures that even if an endpoint is lost, stolen, or accessed by an unauthorized user, the data remains confidential. DLP solutions often integrate with file-level encryption (e.g., BitLocker, FileVault, or EFS) to enforce policy-based encryption on sensitive files at rest.

Answer

User awareness training

Answer

USB port blocking

Answer

Network DLP monitoring

Question 6

A security team is evaluating a new endpoint detection and response (EDR) solution. Which of the following capabilities is MOST important for detecting fileless malware?

Accepted Answer

Behavioral analysis and process monitoring.. Option B is correct because behavioral analysis and process monitoring detect anomalous behavior typical of fileless malware. Signature-based detection is ineffective against fileless variants.

Answer

Static malware analysis.

Answer

Signature-based detection.

Answer

Network traffic inspection.

Question 7

Your organization is forming an incident response team (IRT). According to NIST SP 800-61, which TWO roles are considered core to the incident response team?

Accepted Answer

Technical Lead. NIST SP 800-61 Rev. 2 identifies the Team Manager and the Technical Lead as core roles within an incident response team. The Manager oversees the response process, allocates resources, and coordinates communication, while the Technical Lead drives the technical analysis, containment, and eradication efforts. These two roles are essential for both strategic direction and hands-on technical execution during an incident.

Answer

Public Relations

Answer

Legal Counsel

Answer

Human Resources

Question 8

During a forensic investigation, the team needs to preserve evidence from a running server. What is the FIRST step the team should take?

Accepted Answer

Capture a memory dump.. The first step in a forensic investigation of a running server is to capture a memory dump because volatile data (RAM) contains critical evidence such as running processes, network connections, encryption keys, and malware that would be lost if the system is powered off or altered. Preserving this volatile state before any other action ensures that the most transient evidence is secured, following the order of volatility principle. Capturing memory first prevents irreversible loss of data that cannot be recovered from disk or network captures.

Answer

Create a disk image.

Answer

Shut down the server normally.

Answer

Unplug the network cable.

Question 9

A multinational corporation is establishing a security governance framework. The board of directors wants to ensure that information security strategy aligns with business objectives. Which role is primarily responsible for integrating security into the organization's strategic decision-making?

Accepted Answer

Senior management. Senior management (C) is primarily responsible for integrating security into strategic decision-making because they hold the authority to allocate resources, define risk appetite, and ensure that security initiatives directly support business objectives. In a governance framework, only senior management can bridge the gap between operational security and enterprise strategy, as they are accountable for the organization's overall risk posture and compliance mandates.

Answer

IT security team

Answer

Internal audit team

Answer

Data owner

Question 10

Based on the exhibit, which security objective is this policy primarily designed to protect?

Accepted Answer

Confidentiality. The policy explicitly states that data must be encrypted both at rest (using AES-256) and in transit (using TLS 1.2+). Encryption is a primary mechanism for ensuring confidentiality by preventing unauthorized access to data. The requirement to protect data from disclosure directly aligns with the confidentiality objective of the CIA triad.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 11

A company's risk assessment identifies a high likelihood of a data breach due to outdated encryption standards. The cost to upgrade encryption is $50,000, and the estimated loss from a breach is $2,000,000. The risk manager decides to implement the upgrade. Which risk treatment option is being applied?

Accepted Answer

Risk mitigation. The risk manager is applying risk mitigation by implementing the encryption upgrade to reduce the likelihood or impact of a data breach. This directly addresses the identified risk by deploying a stronger cryptographic control, such as moving from AES-128 to AES-256 or replacing deprecated TLS 1.0/1.1 with TLS 1.3, thereby lowering the residual risk to an acceptable level.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk enhancement

Answer

Risk transfer

Question 12

An information security manager is implementing an asset classification policy. Which of the following is the primary purpose of classifying information assets?

Accepted Answer

To apply appropriate security controls based on asset sensitivity. The primary purpose of classifying information assets is to assign a level of sensitivity (e.g., confidential, internal, public) so that appropriate security controls—such as encryption, access control lists, and data loss prevention rules—can be applied proportionally. This ensures that resources are focused on protecting the most critical data, aligning with the principle of cost-effective risk management.

Answer

To track the physical location of all assets

Answer

To determine the monetary value of each asset

Answer

To identify the legal owner of each asset

Question 13

During a business impact analysis (BIA), the team identifies that the customer service application must be restored within 4 hours of a disruption. What is the term for this metric?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable time that a business process or application can be unavailable after a disruption. In this scenario, the 4-hour restoration requirement for the customer service application directly matches the RTO metric, which drives the design of recovery strategies and resource allocation.

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Point Objective (RPO)

Answer

Service Level Agreement (SLA)

Question 14

Which security control is most effective for preventing unauthorized access to a data center?

Accepted Answer

Mantrap. A mantrap provides a physical barrier that prevents tailgating and ensures one person enters at a time. Biometrics and video surveillance are controls but less direct prevention. Access logs are detective.

Answer

Biometric authentication

Answer

Access logs

Answer

Video surveillance

Question 15

An organization is implementing a security awareness program. Which topic should be emphasized most?

Accepted Answer

Phishing recognition. Phishing is one of the most common attack vectors and requires user vigilance. Password policies are important but phishing directly exploits human error. Clean desk and social media are relevant but less critical.

Answer

Social media usage

Answer

Password policy

Answer

Clean desk policy