CISSP Practice Exam 2 — 20 Questions

Question 1

A network administrator has configured private VLANs on a switch. The host in this port is part of PVLAN 100, and its associated secondary PVLAN is 200. What is the expected behavior for traffic from this host to other hosts in the same primary VLAN 100?

Accepted Answer

It can communicate with the promiscuous port only. In a private VLAN (PVLAN) configuration, a host in a community or isolated secondary VLAN cannot communicate with other hosts in the same primary VLAN unless they share the same secondary VLAN. However, the question specifies that the host is in PVLAN 100 and its associated secondary PVLAN is 200, but does not state that the host is in a community VLAN; the only way a host in a secondary VLAN can communicate with any other host is via the promiscuous port (typically connected to a router or firewall). Since the host is in an isolated secondary VLAN (or community without a matching community), it can only send traffic to the promiscuous port, which then forwards it as needed.

Answer

It cannot communicate with any other host

Answer

It can communicate only with other hosts in the same secondary VLAN 200

Answer

It can communicate with all hosts in primary VLAN 100

Question 2

Which three BGP security mechanisms help protect against route hijacking? (Choose THREE.)

Accepted Answer

Resource Public Key Infrastructure (RPKI). RPKI is correct because it uses cryptographically signed Route Origin Authorizations (ROAs) to validate that an AS is authorized to originate specific IP prefixes. This prevents route hijacking by allowing routers to reject BGP announcements that do not match the registered origin AS.

Answer

BGP Flowspec

Answer

BGP MED attribute

Question 3

Refer to the exhibit. Which security model does this policy enforce?

Accepted Answer

Bell-LaPadula. The Bell-LaPadula model enforces a mandatory access control policy based on the 'no read up, no write down' principle, which directly corresponds to the exhibit's rule that a subject at a given security level cannot read objects at a higher level (Simple Security Property) and cannot write to objects at a lower level (Star Property). This is the only model among the options that specifically addresses confidentiality through hierarchical classification levels and the prevention of information flow from higher to lower security levels.

Answer

Biba

Answer

Brewer-Nash

Answer

Clark-Wilson

Question 4

Refer to the exhibit. A security analyst finds these logs on a Linux server. What is the most likely cause of these events?

Accepted Answer

A brute-force attack is in progress. The logs show repeated SSH authentication failures from the same source IP address with different usernames, including root, admin, and user. This pattern of multiple failed login attempts in rapid succession is characteristic of a brute-force attack against the SSH service. The fact that attempts continue across different usernames indicates an automated tool is systematically trying credentials, not a single misconfiguration or network issue.

Answer

The root account is disabled

Answer

The firewall is blocking port 22

Answer

The SSH service is not running

Question 5

During a security assessment, an organization wants to ensure that its web application is resistant to common attacks. Which THREE testing types should be included?

Accepted Answer

Input validation testing. Input validation testing (A) is correct because it directly addresses common web application attacks such as SQL injection, cross-site scripting (XSS), and command injection by ensuring that all user-supplied data is properly sanitized, validated, and encoded before processing. Without rigorous input validation, an attacker can manipulate input fields to execute arbitrary code or access unauthorized data, making this a foundational security control in the OWASP Top 10.

Answer

Network segmentation testing

Answer

Load testing

Question 6

An auditor is reviewing the JSON policy exhibit. What is the most likely security issue with this policy?

Accepted Answer

The 'Allow' rule for customers does not restrict based on user identity, only IP. Option C is correct because the policy's 'Allow' rule for customers only restricts access based on source IP address, not on authenticated user identity. This means any user or system within the allowed IP range can access the resource, regardless of whether they are a legitimate customer. In a JSON-based policy (e.g., AWS IAM or Azure RBAC), failing to include a condition that checks user identity (such as a JWT claim or IAM user ARN) creates a significant authorization gap, allowing potential impersonation or lateral movement within the trusted network.

Answer

The policy allows all actions on public_data, which could be exploited

Answer

The policy uses JSON syntax, which is not secure

Answer

The 'Deny' rule uses a wildcard resource, which is too restrictive

Question 7

Which TWO of the following are common techniques used in dynamic application security testing (DAST)?

Accepted Answer

Fuzzing. Fuzzing is a DAST technique that involves sending malformed or unexpected input to an application to trigger unhandled exceptions, crashes, or security vulnerabilities. It tests the runtime behavior of the application, making it a dynamic testing method.

Answer

Static analysis

Answer

String search

Answer

Code review

Question 8

Refer to the exhibit. Based on the exhibit, what is the most urgent remediation?

Accepted Answer

Upgrade to Apache 2.4.50. The exhibit shows Apache 2.4.49 is in use, which is vulnerable to CVE-2021-41773 — a path traversal and remote code execution flaw in the `mod_cgi` module. Upgrading to Apache 2.4.50 is the most urgent remediation because it directly patches this critical vulnerability, preventing attackers from reading arbitrary files or executing commands via crafted URL paths like `/cgi-bin/.%2e/%2e%2e/bin/sh`.

Answer

Disable directory listing

Answer

Recompile Apache with security flags

Answer

Apply a WAF rule to block path traversal attempts

Question 9

Which THREE are key components of a business continuity plan (BCP)?

Accepted Answer

Backup strategies. Backup strategies are a core component of a BCP because they ensure that critical data and systems can be restored after a disruption. Without defined backup procedures (e.g., frequency, media rotation, off-site storage), the organization cannot recover its operational state, making this a fundamental technical requirement for continuity.

Answer

Vendor risk assessments

Answer

System hardening standards

Question 10

Refer to the exhibit. The network administrator applies this access control list to the inbound interface of a router connecting to the internet. Which type of access control model is being implemented?

Accepted Answer

Rule-Based Access Control. The access control list (ACL) applied to the inbound interface of a router connecting to the internet enforces traffic filtering based on a set of predefined rules (e.g., permit or deny statements based on source IP, destination IP, port numbers). This is the essence of Rule-Based Access Control (RBAC), where access decisions are governed by a global set of rules applied uniformly to all subjects, independent of user identity or roles. The ACL does not allow individual users to change permissions (eliminating DAC), does not use security labels or clearances (eliminating MAC), and does not map permissions to job roles (eliminating Role-Based Access Control).

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 11

A software development company uses a continuous integration/continuous deployment (CI/CD) pipeline that automatically builds and deploys code to production after passing automated tests. The code repository contains proprietary algorithms and customer data. A recent incident was traced to an attacker who injected malicious code into a library that was pulled from a public package repository during the build process. The company wants to prevent similar supply chain attacks without significantly slowing development. Which of the following is the BEST course of action?

Accepted Answer

Implement a private repository that mirrors approved open-source libraries and enforces signature verification and hash checks before allowing use. Option D is correct because implementing a private repository that mirrors only approved, vetted open-source libraries with enforced signature verification and hash checks directly addresses supply chain attacks by ensuring that only trusted, integrity-verified code enters the build pipeline. This approach prevents malicious code from public repositories from being pulled automatically, without requiring manual review of every library (which would slow development) or relying on post-build scanning that cannot prevent the initial injection. It aligns with the principle of secure software supply chain management by establishing a trusted source of components.

Answer

Require all developers to perform manual code review of every third-party library before inclusion

Answer

Perform static application security testing (SAST) on the entire codebase including libraries

Answer

Increase the frequency of vulnerability scanning on the production environment and delay deployment of any library that has a deprecation notice

Question 12

A multinational corporation maintains site-to-site IPsec VPN tunnels between its headquarters and three regional branch offices. Over the past week, the tunnels have been dropping intermittently, causing disruption to real-time applications. The network team checked logs and found frequent 'Phase 2 rekey failure' messages. The tunnels are configured with IKEv1 and preshared keys. The headquarters uses a Cisco ASA, and the branches use various vendors' firewalls. The team verified that firewall policies allow IPsec traffic, and there is no packet loss on the WAN links. Which action should the team take to resolve the issue most effectively?

Accepted Answer

Adjust the Dead Peer Detection (DPD) intervals and Phase 2 lifetime settings to be consistent across all sites.. The frequent 'Phase 2 rekey failure' messages indicate a mismatch in IPsec security association (SA) parameters between the Cisco ASA and the branch firewalls. IKEv1 Phase 2 lifetimes and Dead Peer Detection (DPD) intervals must be consistent across all peers; otherwise, one side may attempt to rekey or declare the peer dead while the other expects a different timing, causing intermittent tunnel drops. Adjusting these values to match across all sites resolves the rekey failures without compromising security or requiring a protocol migration.

Answer

Increase the MTU on the WAN interfaces to 1500 bytes on all firewalls.

Answer

Change the encryption algorithm from AES-256 to 3DES on all peers.

Answer

Migrate all VPN connections from IPsec to SSL VPN using clientless access.

Question 13

Drag and drop the steps for a secure software development lifecycle (SDLC) in the correct order.

Question 14

Drag and drop the steps for implementing a digital signature using asymmetric cryptography in the correct order.

Question 15

Drag and drop the steps for conducting a risk assessment in the correct order.

Question 16

An organization wants to protect sensitive data stored on laptops. Which of the following is the MOST effective control to prevent data loss if a laptop is stolen?

Accepted Answer

Full-disk encryption (FDE). Full-disk encryption (FDE) renders the data on the laptop unreadable without the decryption key, even if the storage drive is removed and analyzed. This is the most effective preventive control against data loss from theft because it protects data at rest regardless of physical access to the device.

Answer

BIOS password

Answer

Asset tracking software

Answer

Remote wipe capability

Question 17

Which TWO of the following are essential components of a data classification policy? (Select two.)

Accepted Answer

Roles and responsibilities for data classification. Roles and responsibilities are essential because a data classification policy must clearly define who is accountable for classifying data, who can assign classification levels, and who is responsible for maintaining the labels. Without this, classification efforts become inconsistent and unenforceable, leading to security gaps. The CISSP emphasizes that governance requires clear assignment of ownership and decision-making authority for data assets.

Answer

Data retention periods for each classification level

Answer

Methods for secure data destruction

Answer

Encryption standards for each classification level

Question 18

A security architect is designing a secure enclave for processing highly sensitive data. The architecture must ensure that even if the operating system is compromised, the enclave's memory contents remain confidential and integrity-protected. Which technology should be used?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel Software Guard Extensions (SGX) is the correct choice because it provides hardware-enforced isolation of memory regions (enclaves) that remain confidential and integrity-protected even if the operating system or hypervisor is compromised. SGX encrypts enclave memory on-die and decrypts it only within the CPU, preventing any privileged software from reading or tampering with the data.

Answer

Full disk encryption (FDE) with a strong passphrase

Answer

Trusted Platform Module (TPM)

Answer

Hypervisor-based isolation

Question 19

A small business wants to implement multifactor authentication (MFA) for remote access to its internal network. The solution must be cost-effective and easy to deploy. Which combination is most appropriate?

Accepted Answer

Password and one-time passcode sent via SMS. Option B is correct because it combines a password (something you know) with a one-time passcode sent via SMS (something you have), satisfying the definition of multifactor authentication. SMS-based OTP is cost-effective and easy to deploy for a small business, as it requires no additional hardware or complex infrastructure, leveraging existing mobile networks.

Answer

Fingerprint scanner and password

Answer

Smart card and PIN

Answer

Password and security questions

Question 20

A company deploys a web application that uses TLS to protect data in transit. The security team discovers that the server supports TLS 1.0 and uses a 1024-bit RSA certificate. What is the most significant security concern?

Accepted Answer

The server supports TLS 1.0. TLS 1.0 is a deprecated protocol with known vulnerabilities, including susceptibility to BEAST and POODLE attacks, which can allow an attacker to decrypt intercepted traffic. While a 1024-bit RSA key is weak, the most immediate and significant risk is the use of an outdated protocol that is actively exploited in the field. Disabling TLS 1.0 and enforcing TLS 1.2 or higher is the critical first step to secure data in transit.

Answer

The certificate uses RSA 1024-bit key

Answer

The server does not support HTTP/2

Answer

The server enables TLS session tickets

CISSP Practice Exam 2 — 20 Questions

Exhibit

CISSP Practice Exam 2 — 20 Questions

Exhibit