CISSP Practice Exam 3 — 20 Questions

Question 1

A company uses Role-Based Access Control (RBAC) for its ERP system. A user in the 'Accounts Payable' role needs to temporarily approve purchase orders up to $10,000 while the 'Purchasing Manager' is on leave. What is the BEST way to grant this access?

Accepted Answer

Temporarily assign the 'Purchasing Approver' role to the user with an expiration date. Option B is correct because it follows the principle of least privilege by temporarily assigning the 'Purchasing Approver' role to the user with an expiration date, ensuring that the elevated permissions are automatically revoked after the leave period. This approach maintains RBAC integrity without permanently altering role definitions or sharing credentials.

Answer

Share the Purchasing Manager's account credentials with the user

Answer

Modify the 'Accounts Payable' role to include purchase order approval permissions

Answer

Create a new role with the exact permissions needed and assign it to the user

Question 2

Refer to the exhibit. A user 'jdoe' is a member of the Domain Users group but not of the Administrators or Remote Desktop Users groups. The user reports they cannot log on locally to a domain-joined Windows server, but they can log on via RDP. Based on the GPO results, what is the MOST likely reason?

Accepted Answer

The user is not a member of the local Users group or Administrators group. The user 'jdoe' can log on via RDP but not locally because the default security policy on a domain-joined Windows server grants the 'Allow log on locally' right only to the local Administrators group and the local Users group. Since 'jdoe' is a member of Domain Users, which is mapped to the local Users group on a domain-joined server, the user should normally have local logon rights. However, the exhibit shows GPO results that likely indicate the local Users group has been removed from the 'Allow log on locally' policy, or the user is not actually a member of the local Users group (e.g., the server is configured to not map Domain Users to the local Users group). The most direct reason is that the user is not a member of either the local Users group or the local Administrators group, which are the only groups granted local logon by default.

Answer

The user is a member of the Remote Desktop Users group

Answer

The user is a member of a group that is denied local logon

Answer

The user is denied logon through Remote Desktop Services

Question 3

A security analyst discovers that a service account in Active Directory has not had its password changed in 5 years and has domain admin privileges. The account is used by a legacy application that does not support modern authentication protocols. Which of the following is the MOST secure approach to manage this account?

Accepted Answer

Decommission the legacy application and migrate to a modern alternative that supports secure authentication. Option D is correct because the best security is to decommission the account and modernize the application. Option A is wrong because group Managed Service Accounts (gMSAs) require Windows Server 2012 or later and application support. Option B is wrong because a long, complex password still has risk of theft and is not automatically rotated. Option C is wrong because disabling the account would break the application.

Answer

Convert the account to a group Managed Service Account (gMSA)

Answer

Set a very long, complex password and store it in a password manager

Answer

Disable the account and create a new service account with limited privileges

Question 4

Which THREE of the following are common methods used in security assessment and testing? (Select exactly 3.)

Accepted Answer

Penetration testing. Penetration testing is a common method in security assessment and testing that simulates real-world attacks to identify exploitable vulnerabilities. Unlike vulnerability scanning, which only identifies potential weaknesses, penetration testing actively exploits them to validate security controls and measure the impact of a breach.

Answer

Risk analysis

Answer

Forensic analysis

Question 5

An AWS security engineer is reviewing the above S3 bucket policy. What is the net effect of this policy on requests to read objects in the 'confidential' folder?

Accepted Answer

Only IPs in 10.100.0.0/16 can read confidential objects. The S3 bucket policy grants read access to the 'confidential' folder for all principals within the 10.0.0.0/8 IP range, but then explicitly denies access to IPs within the 10.100.0.0/16 subnet. Because explicit Deny overrides any Allow, the net effect is that only IPs in 10.0.0.0/8 that are NOT in 10.100.0.0/16 can read objects. This matches option D.

Answer

Only IPs in 10.0.0.0/8 but outside 10.100.0.0/16 can read confidential objects

Answer

No IPs can read confidential objects because the Deny applies to all

Answer

All IPs in the 10.0.0.0/8 range can read confidential objects

Question 6

A security engineer is designing a new SIEM correlation rule to detect potential data exfiltration. The rule should trigger when a single internal host sends more than 10 MB of data to an external IP address within a 5-minute window, but only if the external IP is not on a whitelist of known business partners. Which approach best minimizes false positives while ensuring effective detection?

Accepted Answer

Use a baseline of normal traffic per host and trigger only when the volume exceeds the baseline by a significant margin. Option C is correct because using a baseline of normal traffic per host adapts to different users' behaviors, reducing false positives from legitimate large transfers. Option A is wrong because applying the rule to all internal hosts would generate many false positives from servers that routinely transfer large files. Option B is wrong because a static threshold does not account for varying normal usage. Option D is wrong because excluding only known partner IPs may miss exfiltration to unknown but legitimate external services.

Answer

Apply the rule to all internal hosts with the same threshold

Answer

Trigger only when the destination IP is in a threat intelligence feed of known malicious IPs

Answer

Set a static threshold of 10 MB for all hosts, but exclude traffic to common cloud storage providers

Question 7

An organization is migrating from a waterfall to an Agile development methodology. Which of the following is a key security advantage of Agile?

Accepted Answer

Security issues can be addressed incrementally throughout development. In Agile development, security testing and remediation are integrated into each iteration (sprint), allowing teams to identify and fix vulnerabilities incrementally rather than waiting until the end. This continuous feedback loop reduces the risk of late-stage security surprises and aligns with the principle of 'shifting left' on security.

Answer

Security testing is performed only at the end of the project

Answer

Security requirements are finalized upfront

Answer

Security documentation is minimized to reduce overhead

Question 8

Based on the exhibit, what security control is being demonstrated?

Accepted Answer

Account lockout threshold. The exhibit shows a login attempt counter that increments with each failed authentication, and after a specific number of failures (e.g., 5), the account is locked for a defined period. This is the classic behavior of an account lockout threshold, which is a preventive security control that mitigates brute-force password guessing attacks by temporarily disabling the account after exceeding the allowed number of failed attempts.

Answer

Session timeout

Answer

CAPTCHA implementation

Answer

Input validation

Question 9

An organization needs to ensure that its employees understand their responsibilities regarding information security. Which of the following is the MOST effective way to achieve this?

Accepted Answer

Implement a security awareness program with regular training and assessments.. A security awareness program with regular training and assessments is the most effective way to ensure employees understand their responsibilities because it establishes a continuous learning cycle. Unlike one-time events, it reinforces secure behaviors through repetition, real-world scenarios, and measurable assessments, aligning with the NIST SP 800-50 framework for building a security-conscious culture.

Answer

Distribute a security policy document and require a signature.

Answer

Conduct a one-time annual security briefing.

Answer

Display security posters in common areas.

Question 10

A multinational corporation is expanding its operations into a new country with strict data protection laws. The company needs to ensure compliance while maintaining operational efficiency. Which of the following is the BEST approach to manage this risk?

Accepted Answer

Adopt a privacy-by-design framework and conduct a Data Protection Impact Assessment (DPIA) before launching operations.. Option D is correct because a privacy-by-design framework ensures data protection is embedded into systems and processes from the outset, while a Data Protection Impact Assessment (DPIA) systematically identifies and mitigates privacy risks specific to the new jurisdiction. This proactive, risk-based approach aligns with regulatory requirements like the GDPR and demonstrates due diligence, reducing the likelihood of non-compliance and operational disruption.

Answer

Accept the risk of non-compliance as a cost of doing business and set aside a contingency fund for fines.

Answer

Assign legal counsel to review local laws and implement a one-time compliance checklist.

Answer

Create a uniform global privacy policy that satisfies all jurisdictions with minimal adjustments.

Question 11

A company's security team discovers that an employee inadvertently shared sensitive customer data via a public cloud storage link. The incident response team contains the breach and notifies affected customers. Which of the following risk management strategies would BEST prevent recurrence?

Accepted Answer

Deploy a Data Loss Prevention (DLP) solution that monitors and controls sharing of sensitive data.. Option C is correct because a Data Loss Prevention (DLP) solution provides automated, policy-based monitoring and control of sensitive data being shared via public cloud storage links. Unlike awareness training (which relies on human behavior) or blanket blocking (which hinders productivity), DLP can inspect content in real time using pattern matching, fingerprinting, or exact data matching to prevent unauthorized sharing before it occurs, directly addressing the root cause of inadvertent exposure.

Answer

Block all access to public cloud storage services from corporate devices.

Answer

Implement mandatory security awareness training focusing on data handling procedures.

Answer

Encrypt all sensitive data at rest and in transit to render shared data useless.

Question 12

An organization is developing a business continuity plan (BCP) for its critical IT systems. Which of the following is the FIRST step in the BCP process?

Accepted Answer

Conduct a business impact analysis (BIA) to prioritize critical business functions.. The first step in the BCP process is to conduct a Business Impact Analysis (BIA) to identify and prioritize critical business functions and their dependencies. Without the BIA, you cannot determine which systems require recovery strategies or what recovery time objectives (RTOs) and recovery point objectives (RPOs) are needed. The BIA provides the quantitative and qualitative basis for all subsequent BCP decisions.

Answer

Identify recovery strategies for critical systems.

Answer

Develop a testing schedule for the BCP.

Answer

Perform a risk assessment to identify potential threats.

Question 13

A company is decommissioning a data center and needs to dispose of hard drives that contained highly confidential financial data. Which of the following methods provides the HIGHEST assurance that data cannot be recovered?

Accepted Answer

Shredding the drives into small pieces. Shredding the drives into small pieces physically destroys the platters, making data recovery impossible regardless of the storage technology (e.g., HDD vs. SSD). This method provides the highest assurance because it eliminates any possibility of reading residual magnetic or solid-state data, even with advanced forensic tools like electron microscopy.

Answer

Overwriting the drives with multiple passes of random data

Answer

Degaussing the drives

Answer

Overwriting the drives with a single pass of zeros

Question 14

Which TWO of the following are key components of an Information Security Governance framework? (Select exactly 2)

Accepted Answer

Risk management processes. Risk management processes are a core component of an Information Security Governance framework because they provide the structured methodology for identifying, assessing, and mitigating risks to the organization's information assets. This aligns with the ISO/IEC 27001 standard, which mandates a risk-based approach to establishing, implementing, and maintaining an information security management system (ISMS). Without formal risk management, governance lacks the data-driven foundation to prioritize security investments and controls.

Answer

Incident response team structure

Answer

Penetration testing schedule

Answer

Vendor contract negotiation

Question 15

A company is considering outsourcing its customer support operations to a third-party vendor. Which of the following should be the PRIMARY risk management activity before finalizing the contract?

Accepted Answer

Conduct a thorough vendor risk assessment including security audits.. Before outsourcing critical operations, the primary risk management activity is to conduct a thorough vendor risk assessment, including security audits. This evaluates the vendor's security posture, compliance with standards (e.g., ISO 27001), and ability to protect sensitive customer data, directly addressing risks like data breaches or service disruptions before contractual obligations are locked in.

Answer

Negotiate a lower price to offset potential security investments.

Answer

Purchase cyber liability insurance to cover potential breaches.

Answer

Require the vendor to sign a non-disclosure agreement (NDA).

Question 16

During a risk assessment, a company identifies that its primary data center is located in a flood-prone area. The estimated annual loss expectancy (ALE) for a flood event is $500,000. Installing flood barriers costs $200,000 and reduces the ALE to $50,000. What is the net benefit of implementing the flood barriers?

Accepted Answer

$250,000. The net benefit is calculated as the reduction in ALE minus the cost of the control. The original ALE is $500,000, and after implementing flood barriers the ALE drops to $50,000, a reduction of $450,000. Subtracting the $200,000 cost of the barriers yields a net benefit of $250,000. This aligns with the CISSP risk management formula: Net Benefit = (ALE_old - ALE_new) - Cost_of_control.

Answer

$300,000

Answer

$450,000

Answer

$200,000

Question 17

A small business wants to implement a security policy that balances protection with usability. Which of the following is the MOST important factor when developing the policy?

Accepted Answer

Aligning the policy with business objectives and risk appetite.. Option B is correct because a security policy must be aligned with the organization's business objectives and risk appetite to ensure it supports operations without imposing unnecessary restrictions. For a small business, this balance is critical—overly strict controls can hinder productivity, while weak controls increase risk. The policy should reflect the specific threats and tolerances of the business, not generic templates or compliance-only checklists.

Answer

Adopting a template from a similar organization to save time.

Answer

Ensuring the policy is enforceable with technical controls.

Answer

Basing the policy solely on regulatory compliance requirements.

Question 18

During a security audit, it is discovered that a company's data classification labels are inconsistently applied across different departments. Which of the following is the BEST long-term solution to ensure consistent data classification?

Accepted Answer

Implement automated data classification tools that apply labels based on content and context. Automated data classification tools use content inspection (e.g., regex patterns, keyword matching) and contextual analysis (e.g., file location, creator, metadata) to consistently apply labels across the enterprise. This eliminates human error and variability between departments, ensuring uniform enforcement of the classification policy without relying on manual interpretation or periodic training.

Answer

Conduct annual retraining on data classification policies

Answer

Adopt a single classification level for all data to eliminate confusion

Answer

Assign a data owner in each department to manually review and classify data

Question 19

A security engineer reviews the S3 bucket policy in the exhibit. What is the most significant security issue with this configuration?

Accepted Answer

The bucket allows public read access to all objects. The S3 bucket policy in the exhibit grants "Effect": "Allow" with "Principal": "*" and "Action": "s3:GetObject" on the bucket ARN. This configuration effectively makes all objects in the bucket publicly readable over the internet, which is a severe data exposure risk. Option C correctly identifies this as the most significant security issue because it violates the principle of least privilege and can lead to unauthorized access to sensitive data.

Answer

The resource ARN does not specify a version ID

Answer

The policy does not enforce encryption in transit

Answer

The policy lacks an explicit deny statement

Question 20

A data classification policy is shown. A database contains a field labeled 'SSN' that matches the pattern for 'employee_id'. What action should be applied to the SSN field?

Accepted Answer

Mask. The SSN field matches the pattern for 'employee_id', indicating it contains sensitive personally identifiable information (PII). Masking is the appropriate action because it preserves the data format for operational use (e.g., testing, analytics) while irreversibly obscuring the actual values, reducing exposure risk without breaking referential integrity. Encryption would still allow authorized decryption, which is unnecessary for fields that only need pattern matching, and blocking would prevent legitimate access to the field entirely.

Answer

None

Answer

Encrypt

Answer

Block