CISSP Practice Test 20 — 15 Questions

Question 1

An organization has a maximum tolerable downtime (MTD) of 8 hours for its critical e-commerce platform. The recovery time objective (RTO) is set to 4 hours, and the recovery point objective (RPO) is 30 minutes. Which disaster recovery strategy is most cost-effective while meeting these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud DR with continuous replication. Cloud DR with continuous replication meets the RPO of 30 minutes because data is replicated in near real-time, resulting in minimal data loss. It can also meet the RTO of 4 hours if automated failover and resource provisioning are configured. This approach is more cost-effective than a hot site because it avoids maintaining idle infrastructure and only incurs costs during actual disaster recovery operations. Hot site with real-time replication (option B) also meets the requirements but is more expensive. Cold site with daily backups (option C) fails both RTO and RPO. Warm site with hourly backups (option D) fails RPO because it can result in up to 1 hour of data loss, exceeding the 30-minute limit.

Answer

Hot site with real-time replication

Answer

Cold site with daily backups

Answer

Warm site with hourly backups

Question 2

An information security manager is implementing an asset classification policy. Which of the following is the primary purpose of classifying information assets?

Accepted Answer

To apply appropriate security controls based on asset sensitivity. The primary purpose of classifying information assets is to assign a level of sensitivity (e.g., confidential, internal, public) so that appropriate security controls—such as encryption, access control lists, and data loss prevention rules—can be applied proportionally. This ensures that resources are focused on protecting the most critical data, aligning with the principle of cost-effective risk management.

Answer

To track the physical location of all assets

Answer

To determine the monetary value of each asset

Answer

To identify the legal owner of each asset

Question 3

An organization develops a SaaS platform that integrates with multiple third-party services via APIs. The platform handles authentication tokens and user data. A security review reveals that the platform uses hardcoded API keys in the source code. What is the most secure way to manage these secrets in a cloud-native environment?

Accepted Answer

Store secrets in a dedicated secrets management service like AWS Secrets Manager or Azure Key Vault.. Dedicated secrets management services like AWS Secrets Manager or Azure Key Vault provide secure storage, automatic rotation, and fine-grained access control for API keys and tokens. They eliminate the risk of hardcoded secrets in source code or configuration files, which is critical in a cloud-native SaaS platform that integrates with multiple third-party services.

Answer

Use environment variables in the deployment configuration.

Answer

Use .gitignore to prevent them from being committed.

Answer

Encrypt the secrets and store them in the database.

Question 4

An organization is migrating from WPA2 to WPA3 for its wireless network. Which improvement does WPA3 provide over WPA2?

Accepted Answer

Simultaneous Authentication of Equals (SAE) providing forward secrecy. WPA3 replaces WPA2's Pre-Shared Key (PSK) handshake with Simultaneous Authentication of Equals (SAE), defined in IEEE 802.11-2016 and RFC 7664. SAE uses a Dragonfly key exchange based on discrete logarithm cryptography, which provides forward secrecy: even if an attacker captures the handshake and later obtains the pre-shared key, they cannot decrypt past session traffic. This eliminates the vulnerability to offline dictionary attacks that plagued WPA2-PSK.

Answer

Use of TKIP for backward compatibility

Answer

Mandatory use of WPS for easy setup

Answer

Support for 802.1X only, no personal mode

Question 5

Which of the following is a key feature of TLS 1.3 that enhances security compared to earlier versions?

Accepted Answer

Mandatory forward secrecy via ephemeral Diffie-Hellman. TLS 1.3 mandates forward secrecy by requiring ephemeral Diffie-Hellman (DHE or ECDHE) key exchange for all sessions. This ensures that even if a server's long-term private key is compromised, past session keys cannot be derived, protecting historical communications. In contrast, earlier TLS versions allowed static RSA key exchange, which does not provide forward secrecy.

Answer

Backward compatibility with SSL 3.0

Answer

Use of RSA key exchange for authentication

Answer

Support for RC4 stream cipher

Question 6

A security architect is considering secure design principles. Which two principles are essential for a defense-in-depth strategy? (Select TWO.)

Accepted Answer

Layered security. Layered security (defense in depth) is essential because it implements multiple, overlapping security controls so that if one layer fails, another layer continues to provide protection. This principle ensures that no single vulnerability can compromise the entire system, which is the core of a defense-in-depth strategy. Least privilege is equally essential because it restricts users and processes to only the minimum permissions necessary, limiting the blast radius of any breach and preventing lateral movement across layers.

Answer

Single point of failure

Answer

Open design

Answer

Fail safe

Question 7

A multinational corporation deploys a single sign-on (SSO) solution using SAML 2.0 across all subsidiaries. Recently, users in one subsidiary report being unable to access an internal application. The identity provider (IdP) logs show successful authentication, but the service provider (SP) logs indicate assertion validation failures. Which of the following is the MOST likely cause?

Accepted Answer

The system clocks on the IdP and SP are significantly out of sync. SAML 2.0 relies on timestamps (NotBefore and NotOnOrAfter) within the assertion for validity. If the system clocks on the identity provider (IdP) and service provider (SP) are significantly out of sync, the SP will reject the assertion as expired or not yet valid, even though the IdP logs show successful authentication. This is the most common cause of assertion validation failures in cross-domain SSO deployments.

Answer

The SP is configured to require a specific SAML attribute not present in the assertion

Answer

The IdP server for the subsidiary is temporarily unreachable

Answer

The SAML certificate used by the SP has expired

Question 8

A company uses a SIEM to correlate logs from multiple sources. Which log source is most critical for detecting privilege escalation attacks?

Accepted Answer

Authentication logs. Authentication logs are most critical for detecting privilege escalation attacks because they record user identity changes, such as the use of 'su' or 'sudo' commands, and account modifications like group membership changes. A SIEM can correlate these events with other logs to identify anomalous privilege transitions, such as a standard user suddenly acquiring administrative rights, which is a hallmark of privilege escalation.

Answer

DNS logs

Answer

Firewall logs

Answer

Web server logs

Question 9

A security administrator is configuring SNMPv3 for network device monitoring. The requirement is to provide both authentication and encryption of SNMP traffic. Which combination of options should be used?

Accepted Answer

AuthPriv with SHA and AES. SNMPv3 defines three security levels: NoAuthNoPriv, AuthNoPriv, and AuthPriv. The requirement for both authentication and encryption corresponds to the AuthPriv level. The recommended modern cryptographic algorithms for AuthPriv are SHA (for authentication) and AES (for encryption), as specified in RFC 3826 and RFC 3414. Option C correctly pairs SHA and AES to meet the requirement.

Answer

AuthNoPriv

Answer

AuthPriv with MD5 and DES

Answer

NoAuthNoPriv

Question 10

Which TWO features are true of IPsec tunnel mode compared to transport mode? (Select two.)

Accepted Answer

A new IP header is added to the packet. In IPsec tunnel mode, the entire original IP packet (including the original IP header) is encapsulated within a new IP packet. A new outer IP header is added, and the entire inner packet is encrypted and optionally authenticated. This is why option B is correct: a new IP header is added to the packet.

Answer

It provides better performance than transport mode

Answer

It is used for end-to-end communication between hosts

Answer

Only the payload of the packet is encrypted

Question 11

A security architect is designing a system that must continue to function even when a component fails. The architect implements multiple layers of security controls so that if one fails, others still provide protection. Which principle is being applied?

Accepted Answer

Defense in depth. Defense in depth (B) is the correct principle because it involves implementing multiple layers of security controls (e.g., firewalls, intrusion detection systems, encryption, access controls) so that if one layer fails or is bypassed, other layers continue to provide protection, ensuring the system remains functional. This directly matches the scenario where the architect designs for continued operation despite component failure by layering controls.

Answer

Separation of duties

Answer

Fail-secure

Answer

Least privilege

Question 12

Drag and drop the steps for implementing mandatory access control (MAC) in a secure system in the correct order.

Accepted Answer

Step 1: Define labels, Step 2: Assign clearances, Step 3: Assign classifications, Step 4: Configure monitor, Step 5: Test.. MAC implementation: define labels, assign clearances, assign classifications, configure monitor, test.

Answer

Step 1: Assign clearances, Step 2: Define labels, Step 3: Assign classifications, Step 4: Configure monitor, Step 5: Test.

Answer

Step 1: Define labels, Step 2: Assign classifications, Step 3: Assign clearances, Step 4: Configure monitor, Step 5: Test.

Answer

Step 1: Define labels, Step 2: Assign clearances, Step 3: Assign classifications, Step 4: Test, Step 5: Configure monitor.

Question 13

A business is evaluating risk treatment options for a high-likelihood, low-impact risk. The cost of mitigation exceeds the potential loss. Which risk treatment strategy is most appropriate?

Accepted Answer

Risk acceptance with documented decision. When the cost of mitigation exceeds the potential loss, risk acceptance is the most cost-effective strategy. The business formally acknowledges the risk and documents the decision to accept it, often because the residual risk is within the organization's risk appetite. This aligns with the principle that not all risks must be mitigated or transferred if the economic justification is absent.

Answer

Risk transfer by purchasing insurance

Answer

Risk mitigation by implementing additional controls

Answer

Risk avoidance by discontinuing the activity

Question 14

A security engineer notices that the IKE phase 1 lifetime is set to 3600 seconds. What is a potential security implication?

Accepted Answer

Short lifetimes may cause frequent reauthentication and potential disruption. IKE phase 1 establishes a secure authenticated channel for subsequent IKE phase 2 negotiations. A lifetime of 3600 seconds (1 hour) is relatively short, causing frequent reauthentication. This can lead to service disruption if the rekeying process fails or if the VPN peers experience transient network issues, potentially dropping active tunnels and impacting production traffic.

Answer

Longer lifetimes reduce rekeying overhead

Answer

Shorter lifetimes increase performance

Answer

The lifetime should be at least 86400 seconds

Question 15

Which of the following is the primary purpose of output encoding in web application security?

Accepted Answer

Preventing cross-site scripting (XSS) attacks. Output encoding is the practice of converting special characters (e.g., <, >, &, ") into their corresponding HTML entities (e.g., < > & ") before sending data to the browser. This ensures that any user-supplied data is treated as text, not executable code, thereby neutralizing injected scripts. It is the primary defense against stored, reflected, and DOM-based cross-site scripting (XSS) attacks because it breaks the parser's ability to interpret the data as active content.

Answer

Preventing buffer overflow attacks

Answer

Preventing cross-site request forgery (CSRF)

Answer

Preventing SQL injection attacks