CISSP Practice Test 2 — 10 Questions

Question 1

Which THREE of the following are valid risk response strategies?

Accepted Answer

Transfer. Common risk responses include Avoid, Transfer, Mitigate, and Accept.

Answer

Eliminate

Answer

Ignore

Question 2

A multinational company must comply with the EU General Data Protection Regulation (GDPR) for processing personal data of EU citizens. The company's data protection officer (DPO) has been appointed but reports to the Chief Marketing Officer (CMO). Which compliance issue is most critical?

Accepted Answer

The DPO must report directly to the board of directors or CEO. Under the GDPR, the Data Protection Officer (DPO) must report directly to the highest level of management, typically the board of directors or CEO, to ensure independence and authority. Reporting to the Chief Marketing Officer (CMO) creates a conflict of interest because the CMO oversees marketing activities that often involve extensive personal data processing, compromising the DPO's ability to provide unbiased oversight. This structural subordination is the most critical compliance issue as it directly undermines the DPO's statutory role under Article 38(3) of the GDPR.

Answer

The DPO should not hold any other role within the organization

Answer

The DPO must be a lawyer certified in data protection

Answer

The DPO must be located in the EU

Question 3

A security analyst is reviewing SIEM logs and notices multiple failed login attempts from a single IP address followed by a successful login. The account belongs to a user in finance. Which incident category is most appropriate?

Accepted Answer

Unauthorized access. The sequence of multiple failed login attempts followed by a successful login from the same external IP address indicates a brute-force or password-spraying attack that succeeded. This constitutes unauthorized access because the attacker gained entry to an account without legitimate authorization, violating the confidentiality and integrity of the finance user's account.

Answer

DoS

Answer

Insider threat

Answer

Social engineering

Question 4

A company implements a centralized authentication system using RADIUS for network devices. The security team notices that after a user's password is changed in Active Directory, the user can still authenticate to network devices using the old password for up to 30 minutes. What is the most likely cause?

Accepted Answer

Active Directory replication delay. When a password is changed in Active Directory, the change is processed by a specific Domain Controller (DC) and urgently replicated to the PDC Emulator. However, if the RADIUS server queries a different DC (such as one in a different AD site), that DC will not know about the password change until normal replication occurs. Inter-site replication typically occurs on a schedule (often 15 to 30 minutes). During this replication window, the DC queried by the RADIUS server still holds the old password hash as valid, allowing the user to successfully authenticate with their old password.

Answer

Kerberos ticket lifetime

Answer

Network devices caching authentication responses

Answer

RADIUS server caching credentials

Question 5

A security architect is reviewing a web application's design and identifies several potential vulnerabilities. Which TWO of the following are effective mitigations for cross-site scripting (XSS) attacks?

Accepted Answer

Enabling Content Security Policy (CSP). Option A, enabling Content Security Policy (CSP), is correct because CSP is a browser-enforced response header (e.g., Content-Security-Policy: default-src 'self') that restricts which scripts may execute, blocking inline scripts and untrusted external sources, which directly mitigates XSS. Option E, using output encoding, is correct because encoding untrusted data for the correct context (HTML entity, JavaScript, URL, or CSS encoding) ensures injected markup is rendered as inert text rather than executable script, which is the primary defense against XSS. Option B, using CSRF tokens, does not belong because anti-CSRF tokens defend against cross-site request forgery, a different attack that abuses a victim's authenticated session, not script injection. Option C, disabling client-side scripts entirely, does not belong because it is an impractical, functionality-breaking measure rather than a targeted XSS mitigation and is not a standard remediation. Option D, implementing parameterized queries, does not belong because prepared statements with bound parameters mitigate SQL injection, not XSS.

Answer

Using CSRF tokens

Answer

Disabling client-side scripts entirely

Answer

Implementing parameterized queries

Question 6

A security analyst discovers that an employee shared confidential customer data with an unauthorized third party. The analyst reports this to the CISO, who decides to terminate the employee. Which ethical principle from the (ISC)² Code of Ethics is most directly violated by the employee?

Accepted Answer

Provide diligent and competent service to principals. Disclosing confidential customer or corporate data that an employee has access to via their employer violates the trust and privileges granted by the employer (the principal). According to the (ISC)² Code of Ethics, the canon 'Provide diligent and competent service to principals' requires members to respect the trust and privileges granted to them and to preserve the value of the principal's systems, applications, and information. Therefore, leaking confidential data directly violates this canon.

Answer

Protect society, the common good, necessary public trust and confidence, and the infrastructure

Answer

Advance and protect the profession

Answer

Act honorably, honestly, justly, responsibly, and legally

Question 7

After a recent security audit, a network administrator discovers that an attacker has been intercepting traffic by associating with a legitimate access point's MAC address and broadcasting a stronger signal. Which type of attack has occurred?

Accepted Answer

Evil twin attack. Evil twin attack. This attack involves an attacker setting up a rogue access point that mimics a legitimate access point by spoofing its MAC address (BSSID) and broadcasting a stronger signal, causing clients to associate with the attacker's device instead of the legitimate AP. The key distinction is the active impersonation of a specific legitimate AP, not just the presence of an unauthorized AP.

Answer

Rogue access point

Answer

Karma attack

Answer

ARP spoofing

Question 8

Which access control model allows the owner of a resource to determine who can access it and what permissions they have?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) allows the resource owner to control access at their discretion.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Question 9

A company recently suffered a data breach where an attacker was able to intercept network traffic and read sensitive data. Which network security control should be implemented to prevent this type of attack?

Accepted Answer

Encryption at the network layer (e.g., IPsec). IPsec operates at the network layer (Layer 3) and provides encryption of the entire IP packet, including the payload, ensuring that even if an attacker intercepts the traffic, the data remains unreadable. This directly addresses the scenario where an attacker reads sensitive data from intercepted network traffic, as IPsec can be configured in transport mode for end-to-end encryption or tunnel mode for VPNs.

Answer

Network segmentation

Answer

Intrusion prevention system (IPS)

Answer

Strong password policies

Question 10

A large financial institution is migrating its core banking system to a private cloud. The architecture must protect against data leakage between different business units sharing the same physical infrastructure. The system uses a hypervisor and virtual machines. Each business unit has its own security classification. The security requirement is that no VM belonging to a lower classification should be able to read data from a higher classification VM, even if the hypervisor is compromised. The architect proposes using mandatory access control at the hypervisor level. However, the IT team notes that a hypervisor compromise could bypass MAC. Additionally, they need to ensure that data at rest is encrypted and keys are stored securely. Which of the following would BEST meet the requirement?

Accepted Answer

Use a hardware security module (HSM) to manage keys and implement full memory encryption using AES-256 with integrity protection, and use a trusted execution environment (TEE) for each VM, ensuring that even the hypervisor cannot access VM memory.. It addresses the core requirement: preventing data leakage even if the hypervisor is compromised. By using a hardware security module (HSM) for key management, full memory encryption with AES-256 and integrity protection, and a trusted execution environment (TEE) for each VM, the solution ensures that VM memory is encrypted and isolated at the hardware level. The hypervisor, even if compromised, cannot access the decrypted memory of a VM, thus enforcing the security classification separation regardless of hypervisor integrity.

Answer

Implement network segmentation with VLANs and IPsec encryption between VMs.

Answer

Deploy a data loss prevention (DLP) system to monitor data transfers between VMs.

Answer

Use a public key infrastructure (PKI) to issue certificates for each VM and enforce mutual TLS for all inter-VM communication.