CISSP Practice Exam 2 — 20 Questions

Question 1

A network security analyst receives an alert from the intrusion detection system (IDS) indicating a high volume of TCP SYN packets to a single external IP address from a compromised internal host. This is characteristic of which type of attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target, exhausting its connection table and preventing legitimate connections. The IDS alert specifically describes a compromised internal host generating many SYN packets to a single external IP, which matches the classic behavior of a SYN flood where the attacker spoofs the source IP or uses a bot to saturate the target's resources.

Answer

Man-in-the-middle

Answer

ARP spoofing

Answer

DNS amplification

Question 2

A development team is adopting a secure SDLC. Which phase should include threat modeling to identify potential security vulnerabilities early?

Accepted Answer

Design. Threat modeling is a structured activity that identifies potential threats, vulnerabilities, and attack vectors against a system. It is most effective during the Design phase because architectural decisions, data flow diagrams, trust boundaries, and component interactions are being defined, allowing security controls to be built in rather than bolted on later. Performing threat modeling here aligns with the 'shift left' principle of secure SDLC, reducing cost and effort compared to retrofitting security after implementation.

Answer

Implementation

Answer

Testing

Answer

Requirements gathering

Question 3

A penetration tester is planning an engagement. Which of the following rules of engagement should be defined before testing begins? (Select TWO.)

Accepted Answer

Emergency contact procedures. Option B (Emergency contact procedures) is correct because rules of engagement must establish who to contact and how to halt testing immediately if a critical system outage or unintended impact occurs, ensuring safety and rapid escalation. Option C (The scope of systems to be tested) is correct because ROE must explicitly define in-scope and out-of-scope IP ranges, domains, and assets to prevent unauthorized testing and legal exposure. Option A is not required in the ROE because specific exploits are chosen during execution based on findings, not pre-defined in the engagement contract. Option D is irrelevant to ROE since compensation is a business/contractual matter, not a testing boundary or safety control. Option E is inappropriate because naming specific employees to target is not a standard ROE element and could raise ethical or legal concerns; targeting is defined by scope, not individuals.

Answer

The exact exploits to be used

Answer

The tester's personal compensation

Answer

The names of employees to be targeted

Question 4

A financial institution is implementing a data loss prevention (DLP) solution to protect customer financial information. The DLP system must detect and block the transmission of credit card numbers via email. Which of the following is the BEST approach to ensure accurate detection while minimizing false positives?

Accepted Answer

Apply a regular expression that validates the Luhn algorithm in addition to pattern matching. Combining a regular expression for credit card number patterns with Luhn algorithm validation significantly reduces false positives. The regular expression identifies potential matches (e.g., 16-digit patterns), and the Luhn algorithm checks the mathematical validity of the checksum. This dual-layer approach is a standard DLP best practice for accurately detecting sensitive data like credit card numbers.

Answer

Hash all outbound emails and compare against a database of known credit card hashes

Answer

Use a simple regular expression matching patterns like '\d{4}-\d{4}-\d{4}-\d{4}'

Answer

Rely on machine learning classifiers trained on past credit card data

Question 5

A software company uses a third-party library that has a known critical vulnerability. The library is used extensively and rewriting the code would take months. What is the BEST immediate action to reduce risk?

Accepted Answer

Implement a Web Application Firewall (WAF) rule to block exploitation. Implementing a Web Application Firewall (WAF) rule to block exploitation provides an immediate, compensating control that mitigates the known vulnerability without requiring code changes. This is the best immediate action because it buys time for a permanent fix while reducing risk, aligning with the principle of defense in depth. The WAF can inspect HTTP/HTTPS traffic for attack patterns (e.g., SQL injection, path traversal) specific to the vulnerable library and block malicious requests at the application layer.

Answer

Remove the library from the codebase immediately

Answer

Disable the vulnerable feature in the library

Answer

Increase logging and monitoring to detect exploitation attempts

Question 6

A company has implemented a new web application firewall (WAF) and wants to test its effectiveness. Which of the following testing methods would provide the MOST accurate assessment?

Accepted Answer

Conduct a penetration test that includes attempts to bypass the WAF.. A penetration test that actively attempts to bypass the WAF provides the most accurate assessment because it simulates a real attacker's behavior, testing the WAF's ability to detect and block evasion techniques such as HTTP parameter pollution, encoding obfuscation, and SQL injection payload splitting. This method validates the WAF's effectiveness under realistic adversarial conditions, revealing gaps that passive or disabled-state testing cannot uncover.

Answer

Perform a vulnerability scan on the web application with the WAF disabled.

Answer

Review the WAF logs for any blocked attacks.

Answer

Run an automated web application scanner against the application with the WAF enabled.

Question 7

A security architect is designing a network for a high-security data center. The requirement is to ensure that even if an attacker compromises one server, they cannot easily move laterally to other servers in the same data center. Which network design principle should be applied?

Accepted Answer

Microsegmentation (e.g., using virtual firewalls on each hypervisor). Microsegmentation (D) is the correct network design principle because it enforces granular, per-workload firewall rules—often implemented via virtual firewalls on each hypervisor or using VXLAN/ACL policies—that restrict east-west traffic between servers. Even if an attacker compromises one server, microsegmentation prevents lateral movement by allowing only explicitly permitted inter-server communication, effectively isolating the breach to the compromised host.

Answer

Principle of least privilege

Answer

Defense in depth

Answer

Single point of failure elimination

Question 8

A company deploys DNSSEC to protect its DNS infrastructure. Which cryptographic operation does DNSSEC primarily use to ensure the authenticity and integrity of DNS data?

Accepted Answer

Digital signatures of DNS records. DNSSEC primarily uses digital signatures to ensure the authenticity and integrity of DNS data. Each DNS zone is signed with a private key, and resolvers verify the signatures using the corresponding public key, which is published as a DNSKEY record. This process allows the resolver to cryptographically confirm that the data has not been modified in transit and originates from the authoritative source.

Answer

Hashing of DNS responses without keys

Answer

Transport Layer Security for DNS

Answer

Symmetric encryption of DNS queries

Question 9

Drag and drop the steps for a disaster recovery (DR) plan activation in the correct order.

Accepted Answer

1. Declare disaster, 2. Notify stakeholders, 3. Failover to alternate site, 4. Restore operations, 5. Test and resume normal operations. The correct order for DR plan activation is: declare disaster first to initiate the plan, then notify all stakeholders, perform failover to the alternate site, restore operations from backups or other means, and finally test and resume normal operations. This sequence ensures that activation is acknowledged, resources are aware, critical systems are recovered, and operations can safely return to normal after validation.

Answer

1. Notify stakeholders, 2. Declare disaster, 3. Failover to alternate site, 4. Test and resume normal operations, 5. Restore operations

Answer

1. Declare disaster, 2. Failover to alternate site, 3. Notify stakeholders, 4. Restore operations, 5. Test and resume normal operations

Answer

1. Declare disaster, 2. Notify stakeholders, 3. Restore operations, 4. Failover to alternate site, 5. Test and resume normal operations

Question 10

A company wants to securely transfer files between systems over SSH. Which protocol should they use to leverage the existing SSH infrastructure and provide both authentication and encryption?

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol) is the correct choice because it operates over the SSH protocol (typically port 22), leveraging its existing authentication and encryption mechanisms. Unlike FTPS, which adds SSL/TLS to FTP, SFTP is designed as a secure file transfer subsystem of SSH, providing both confidentiality and integrity without requiring additional infrastructure.

Answer

FTPS

Answer

TFTP

Answer

SCP

Question 11

A multinational corporation is expanding its operations into a new country with strict data protection laws. The company needs to ensure compliance while maintaining operational efficiency. Which of the following is the BEST approach to manage this risk?

Accepted Answer

Adopt a privacy-by-design framework and conduct a Data Protection Impact Assessment (DPIA) before launching operations.. A privacy-by-design framework ensures data protection is embedded into systems and processes from the outset, while a Data Protection Impact Assessment (DPIA) systematically identifies and mitigates privacy risks specific to the new jurisdiction. This proactive, risk-based approach aligns with regulatory requirements like the GDPR and demonstrates due diligence, reducing the likelihood of non-compliance and operational disruption.

Answer

Accept the risk of non-compliance as a cost of doing business and set aside a contingency fund for fines.

Answer

Assign legal counsel to review local laws and implement a one-time compliance checklist.

Answer

Create a uniform global privacy policy that satisfies all jurisdictions with minimal adjustments.

Question 12

A security engineer is troubleshooting a network where internal users can access internet websites but cannot reach the company's external VPN server (IP 203.0.113.50, UDP port 500). The firewall rule for VPN traffic is correctly configured. What is the most likely cause?

Accepted Answer

The VPN server is not listening on UDP port 500.. The symptom—internal users can reach internet websites but cannot reach the external VPN server—indicates a host-level issue rather than a network or firewall problem. Since the firewall rule for VPN traffic is correctly configured and other traffic flows normally, the most likely cause is that the VPN server itself is not listening on UDP port 500, which is the standard port for IPsec IKE (Internet Key Exchange) traffic. This could be due to a misconfiguration, service failure, or the server being configured to use a different port or protocol.

Answer

The VPN server is using TCP port 443 instead of UDP 500.

Answer

The firewall rule is applied to the wrong interface.

Answer

The firewall is stateful and blocking the return traffic.

Question 13

A security analyst is reviewing logs from a web application firewall (WAF) and notices multiple requests containing the payload "1=1--" in the query string. The analyst suspects a SQL injection attack. Which of the following is the BEST immediate action to validate the suspicion?

Accepted Answer

Check the application logs for database error messages.. Checking the application logs for database error messages is the best immediate action because SQL injection attempts often trigger verbose database errors (e.g., MySQL syntax errors, ODBC error codes) that confirm the injection point. This passive validation requires no additional tools and directly correlates the WAF alert with backend behavior, avoiding the risk of actively exploiting a live system.

Answer

Use a manual SQL injection tool like sqlmap to test the application.

Answer

Implement prepared statements in the application code.

Answer

Run a vulnerability scan with a SQL injection detection module.

Question 14

A business continuity coordinator is planning a test of the disaster recovery plan. Which type of test involves a walk-through of the plan with key stakeholders without actually invoking the technical recovery?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based session where key stakeholders walk through the disaster recovery plan step-by-step without invoking any technical recovery procedures. This validates roles, responsibilities, and decision-making processes in a low-risk environment, ensuring the plan's logic is sound before any actual failover or system restoration is attempted.

Answer

Full interruption test

Answer

Checklist review

Answer

Parallel test

Question 15

A company uses BGP to exchange routes with its ISP. To prevent prefix hijacking, which mechanism should be implemented?

Accepted Answer

RPKI. RPKI (Resource Public Key Infrastructure) is the correct mechanism because it cryptographically validates the origin AS of a BGP route announcement, preventing prefix hijacking by ensuring that only the legitimate owner of an IP prefix can announce it. Unlike other options, RPKI provides a trust anchor based on the IP address allocation hierarchy, making it the only solution that directly addresses the root cause of hijacking—unauthorized origin AS claims.

Answer

BGP MD5 authentication

Answer

BGP community values

Answer

AS-path filtering

Question 16

During a security assessment, a consultant discovers that a legacy VPN solution uses MS-CHAPv2 for authentication and does not support IKE. The protocol is known to be vulnerable to dictionary attacks. Which VPN protocol is most likely being used?

Accepted Answer

PPTP. MS-CHAPv2 is a Microsoft proprietary authentication protocol used by PPTP (Point-to-Point Tunneling Protocol). PPTP does not support IKE (Internet Key Exchange) and relies on MS-CHAPv2, which is vulnerable to dictionary attacks due to its weak hashing and lack of mutual authentication. The combination of MS-CHAPv2 authentication and the absence of IKE support directly points to PPTP as the VPN protocol in use.

Answer

IPsec with IKEv2

Answer

SSL/TLS VPN

Answer

L2TP/IPsec

Question 17

An organization is implementing a bring-your-own-device (BYOD) policy. The security architect must ensure that corporate data on the device is protected from unauthorized access if the device is lost or stolen, while minimizing impact on user privacy. Which solution is most appropriate?

Accepted Answer

Use mobile device management (MDM) to create a secure container for corporate apps and data. A secure container (often implemented via MDM with app wrapping or per-app VPN) creates an encrypted, isolated partition on the device for corporate apps and data. This ensures that if the device is lost or stolen, the corporate data remains encrypted and inaccessible without the container's authentication, while personal apps and data outside the container remain untouched, thus minimizing privacy impact.

Answer

Require employees to use company-issued devices only

Answer

Disable camera and microphone on the device

Answer

Full device encryption with remote wipe capability

Question 18

An organization is adopting a microservices architecture. Which security control is most effective for ensuring that inter-service communication is authenticated and authorized?

Accepted Answer

Implementing mutual TLS (mTLS) between services. Mutual TLS (mTLS) is the most effective control because it provides both authentication and encryption for inter-service communication. In a microservices architecture, mTLS ensures that each service presents a valid X.509 certificate, and both sides verify each other's identity before any data exchange, preventing unauthorized or spoofed services from communicating. This aligns with the principle of zero trust, where no implicit trust is granted based on network location.

Answer

Relying on network segmentation and IP allowlisting

Answer

Using JSON Web Tokens (JWT) in the HTTP header

Answer

Using pre-shared API keys for each service pair

Question 19

Which type of security testing involves analyzing source code for vulnerabilities without executing the code?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It operates by scanning the codebase for patterns known to be insecure (e.g., SQL injection via string concatenation) using techniques like data flow analysis, taint tracking, and pattern matching, all performed at rest.

Answer

Penetration testing

Answer

IAST

Answer

DAST

Question 20

During a penetration test, an ethical hacker sets up a rogue access point with the same SSID as the corporate network and broadcasts a stronger signal. Users inadvertently connect to the rogue AP, allowing the hacker to capture credentials. What is this attack called?

Accepted Answer

Evil twin attack. Evil twin attack. This attack involves setting up a rogue access point that broadcasts the same SSID as a legitimate corporate network but with a stronger signal, causing users to connect to it instead. Once connected, the attacker can capture credentials or other sensitive data through man-in-the-middle techniques, exploiting the lack of mutual authentication in many Wi-Fi implementations.

Answer

Deauthentication attack

Answer

ARP spoofing

Answer

Karma attack