CISSP Practice Test 19 — 15 Questions

Question 1

A security engineer is designing a cryptographic solution to ensure data integrity and non-repudiation. Which combination should be used?

Accepted Answer

Digital signature with hashing. Digital signature with hashing is the correct combination because hashing ensures data integrity by producing a fixed-size digest, and the digital signature encrypts that hash with the sender's private key, providing non-repudiation by proving the sender's identity and preventing denial of message origin. This satisfies both requirements without relying on a shared secret.

Answer

HMAC with a shared key

Answer

Asymmetric encryption with digital signature

Answer

Symmetric encryption with HMAC

Question 2

An organization needs to ensure that backup tapes containing sensitive data are protected during transportation between sites. What is the most effective control?

Accepted Answer

Encrypting the backup tapes. Encrypting the backup tapes ensures that even if the physical media is lost, stolen, or intercepted during transit, the sensitive data remains unreadable without the decryption key. This provides a strong, data-centric security control that protects confidentiality regardless of the physical security measures in place. Encryption is the most effective control because it directly addresses the risk of unauthorized access to the data itself.

Answer

Applying tamper-evident seals

Answer

Using a chain of custody log

Answer

Using a bonded courier service

Question 3

During a security assessment, it is found that service accounts have interactive logon rights. What is the BEST remediation?

Accepted Answer

Use managed service accounts instead.. Managed Service Accounts (MSAs) are the best remediation because they are designed specifically for service accounts, automatically manage password changes, and by default have no interactive logon rights. This eliminates the security risk of interactive logon while also addressing password management and reducing administrative overhead. Group Policy changes or manual password policies do not address the underlying architectural issue of using a standard user account for a service.

Answer

Implement Group Policy to deny interactive logon for service accounts.

Answer

Ensure service accounts use strong passwords.

Answer

Remove service accounts from the local Administrators group.

Question 4

Which of the following is a secure coding practice to prevent SQL injection attacks?

Accepted Answer

Using parameterized queries. Parameterized queries (also known as prepared statements) separate SQL code from data by using placeholders (e.g., '?' in ODBC/JDBC or ':param' in Oracle) that are bound to user-supplied values at execution time. This ensures that input is always treated as data, never as executable SQL syntax, effectively neutralizing SQL injection regardless of the input content.

Answer

Escaping all user input

Answer

Using stored procedures exclusively

Answer

Validating input length

Question 5

During a security audit of a web application, the following issues are found: (1) Session tokens are included in URLs, (2) The application does not invalidate session tokens after logout, and (3) Session tokens are predictable. Which THREE of the following controls are most appropriate to address these issues?

Accepted Answer

Store session tokens in cookies with Secure and HttpOnly flags. Option B is correct because storing session tokens in cookies with Secure and HttpOnly flags addresses the issue of tokens being included in URLs by keeping them out of URLs and providing additional protections. Option C is correct because invalidating session tokens on logout and setting short expiration times directly addresses the lack of invalidation. Option D is correct because using a cryptographically secure random number generator directly addresses the predictability of session tokens. Option A is incorrect because regenerating session tokens after login is primarily a control against session fixation, not directly addressing predictability, exposure in URLs, or lack of invalidation. Option E is incorrect because IP address binding is fragile and does not protect against token exposure or poor invalidation.

Answer

Regenerate session tokens after login

Answer

Implement IP address binding for session tokens

Question 6

A security architect is reviewing the access control model for a microservices architecture. Which approach minimizes the risk of privilege escalation from a compromised service?

Accepted Answer

Use attribute-based access control (ABAC) with service-specific policies.. ABAC with service-specific policies minimizes privilege escalation because it enforces fine-grained, context-aware permissions (e.g., user attributes, resource type, action) per microservice. If a service is compromised, its policies are scoped only to that service’s required operations, preventing lateral movement or elevation to other services. This aligns with the principle of least privilege and defense in depth in a distributed architecture.

Answer

Implement role-based access control (RBAC) with global roles.

Answer

Use API keys for all service-to-service communication.

Answer

Deploy a single sign-on solution.

Question 7

A security architect is designing an authentication system. To prevent session fixation attacks, which secure design principle should be implemented?

Accepted Answer

Regenerating session IDs after successful login. Session fixation attacks occur when an attacker forces a user to use a known session ID. Regenerating the session ID after successful login (e.g., via `session_regenerate_id()` in PHP or `HttpServletRequest.changeSessionId()` in Java) ensures that the pre-authentication session ID is discarded and a new, unpredictable one is issued, breaking the attacker's control.

Answer

Using HTTPS for all communications

Answer

Setting session timeout to 30 minutes

Answer

Implementing multi-factor authentication

Question 8

An organization wants to ensure that employees can securely access internal applications from home. They deploy a VPN solution. Which VPN type provides the strongest encryption and is most commonly used for remote access?

Accepted Answer

IPsec with IKEv2 and AES-256. IPsec with IKEv2 and AES-256 provides the strongest encryption for remote access VPNs. IKEv2 offers improved security features like mobility and multi-homing support, while AES-256 is a symmetric cipher with a 256-bit key that is currently considered unbreakable by brute force. This combination is widely deployed for secure client-to-site connections.

Answer

MPLS Layer 3 VPN

Answer

L2TP without encryption

Answer

PPTP

Question 9

A security engineer is troubleshooting a site-to-site IPsec VPN between two firewalls. The tunnel status shows Phase 1 is up but Phase 2 is not. Which of the following is the most likely cause?

Accepted Answer

Mismatched proxy IDs (traffic selectors). Phase 1 (IKE SA) establishes a secure channel for key exchange, while Phase 2 (IPsec SA) negotiates the specific traffic to be encrypted. If Phase 1 is up but Phase 2 fails, the most common cause is a mismatch in proxy IDs (traffic selectors), such as local/remote subnets or ports, which prevents the two peers from agreeing on which traffic to protect. This is distinct from authentication or encryption mismatches, which would typically cause Phase 1 to fail.

Answer

Incorrect pre-shared key

Answer

Mismatched authentication algorithm

Answer

Firewall rule blocking IKE traffic

Question 10

Which type of firewall is capable of inspecting application-layer data, performing SSL decryption, and integrating intrusion prevention capabilities?

Accepted Answer

Next-generation firewall. A next-generation firewall (NGFW) goes beyond traditional stateful inspection by incorporating deep packet inspection (DPI) of application-layer data, the ability to decrypt and inspect SSL/TLS traffic, and integrated intrusion prevention system (IPS) capabilities. This convergence allows NGFWs to identify and block threats within encrypted sessions and enforce policies based on application identity rather than just ports and protocols.

Answer

Packet filter firewall

Answer

Application proxy firewall

Answer

Stateful firewall

Question 11

A company wants to secure email communications for its employees. They need to ensure message confidentiality and integrity, and also verify the sender's identity. Which protocol uses a hierarchical public key infrastructure (PKI) for email encryption and signing?

Accepted Answer

S/MIME. S/MIME (Secure/Multipurpose Internet Mail Extensions) is the correct answer because it is specifically designed to provide email encryption and digital signing using a hierarchical public key infrastructure (PKI) based on X.509 certificates. This allows the company to ensure message confidentiality (via encryption), integrity (via hashing and signing), and sender authentication (via certificate validation against a trusted root CA).

Answer

PGP

Answer

TLS

Answer

SSH

Question 12

A financial institution requires that no single employee can approve a transaction and also reconcile the account. This is an example of which security principle?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the security principle that prevents a single individual from having conflicting responsibilities, such as both approving a transaction and reconciling the account. This reduces the risk of fraud or error by requiring collusion between two or more people to subvert a process. In a financial system, SoD is enforced through access control mechanisms that assign distinct roles (e.g., 'Transaction Approver' and 'Account Reconciler') with mutually exclusive permissions, often implemented via Role-Based Access Control (RBAC) or attribute-based policies.

Answer

Least privilege

Answer

Defense in depth

Answer

Need to know

Question 13

To enforce separation of duties in a CI/CD pipeline, what architectural principle should be implemented?

Accepted Answer

Require different permissions for committing code vs. deploying to production. Separation of duties in a CI/CD pipeline requires distinct permissions for code commits and production deployments. This ensures that no single individual can introduce and deploy malicious code without oversight, aligning with the principle of least privilege and auditability. By enforcing role-based access control (RBAC) with separate pipelines for build and release, organizations mitigate the risk of unauthorized changes reaching production.

Answer

Allow all developers to deploy their own code to production

Answer

Use a single approval gate without role distinction

Answer

Grant a single DevOps team full access to both source code and deployment

Question 14

A development team is integrating a third-party library for encryption. The security team insists on using only the latest version of the library. What is the primary security benefit of this requirement?

Accepted Answer

Reduces the attack surface by patching known vulnerabilities.. Using the latest version of a third-party encryption library ensures that known vulnerabilities (CVEs) are patched, directly reducing the attack surface. Encryption libraries are frequent targets for exploits, and vendors release updates specifically to address security flaws. This aligns with the principle of secure software development, where outdated dependencies are a primary vector for compromise.

Answer

Improves performance due to optimized code.

Answer

Ensures the library has more features than older versions.

Answer

Guarantees backward compatibility with existing code.

Question 15

A vulnerability scanner reports a medium-severity finding on a web server. After investigating, the system administrator claims the finding is a false positive because the service in question is not actually running. Which step should the security analyst take next?

Accepted Answer

Verify the service status using system commands or network scans. The security analyst must independently verify the administrator's claim before taking any action. The vulnerability scanner may have detected a service on a different port or the service may be bound to a non-standard interface; using system commands (e.g., `netstat -tulpn` or `ss -tulpn`) or a targeted network scan (e.g., `nmap -sV -p `) provides objective evidence of whether the service is actually listening. Relying solely on the administrator's assertion without verification could lead to a missed true positive, especially if the service is hidden or misconfigured.

Answer

Remove the finding from the report since the administrator confirmed it

Answer

Close the finding as accepted risk

Answer

Escalate the issue to management for risk acceptance