CISSP Practice Exam 3 — 20 Questions

Question 1

Which type of security testing involves analyzing source code for vulnerabilities without executing the code?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It operates by scanning the codebase for patterns known to be insecure (e.g., SQL injection via string concatenation) using techniques like data flow analysis, taint tracking, and pattern matching, all performed at rest.

Answer

Penetration testing

Answer

IAST

Answer

DAST

Question 2

During a penetration test, an ethical hacker sets up a rogue access point with the same SSID as the corporate network and broadcasts a stronger signal. Users inadvertently connect to the rogue AP, allowing the hacker to capture credentials. What is this attack called?

Accepted Answer

Evil twin attack. Evil twin attack. This attack involves setting up a rogue access point that broadcasts the same SSID as a legitimate corporate network but with a stronger signal, causing users to connect to it instead. Once connected, the attacker can capture credentials or other sensitive data through man-in-the-middle techniques, exploiting the lack of mutual authentication in many Wi-Fi implementations.

Answer

Deauthentication attack

Answer

ARP spoofing

Answer

Karma attack

Question 3

A company's security team discovers that an employee inadvertently shared sensitive customer data via a public cloud storage link. The incident response team contains the breach and notifies affected customers. Which of the following risk management strategies would BEST prevent recurrence?

Accepted Answer

Deploy a Data Loss Prevention (DLP) solution that monitors and controls sharing of sensitive data.. A Data Loss Prevention (DLP) solution provides automated, policy-based monitoring and control of sensitive data being shared via public cloud storage links. Unlike awareness training (which relies on human behavior) or blanket blocking (which hinders productivity), DLP can inspect content in real time using pattern matching, fingerprinting, or exact data matching to prevent unauthorized sharing before it occurs, directly addressing the root cause of inadvertent exposure.

Answer

Block all access to public cloud storage services from corporate devices.

Answer

Implement mandatory security awareness training focusing on data handling procedures.

Answer

Encrypt all sensitive data at rest and in transit to render shared data useless.

Question 4

A multinational corporation with a hybrid cloud infrastructure has recently experienced a series of security incidents involving unauthorized access to sensitive customer data. The incidents were traced to compromised credentials of privileged users. The company has implemented multi-factor authentication (MFA) for all privileged accounts, but the attacks persisted. A security assessment team is brought in to evaluate the environment. During the assessment, they discover that some privileged accounts do not require MFA when accessing systems via API calls, and that session tokens for these APIs have a long expiration time of 24 hours. Additionally, the team finds that the logging and monitoring system does not capture API calls from privileged accounts, making it difficult to detect anomalous behavior. The company wants to remediate these issues effectively. Which of the following is the BEST course of action to address the root cause of the incidents?

Accepted Answer

Require MFA for all privileged access methods, including APIs, and reduce session token expiration to 15 minutes.. The root cause is that privileged accounts can bypass MFA when accessing systems via API calls, and long-lived session tokens (24 hours) provide a wide window for attackers to reuse stolen tokens. Requiring MFA for all privileged access methods, including APIs, closes the authentication gap, and reducing session token expiration to 15 minutes minimizes the impact of token theft by limiting the reuse window. This directly addresses the two key vulnerabilities identified in the assessment.

Answer

Implement a SIEM system to analyze logs from all sources and create alerts for anomalous API activity.

Answer

Conduct a full audit of privileged account usage and revoke access for any accounts with suspicious activity.

Answer

Replace API tokens with certificate-based authentication for all privileged accounts.

Question 5

In a microservices architecture with a service mesh, what is the most effective approach to secure inter-service communication?

Accepted Answer

Implement mutual TLS (mTLS) and identity-based access policies. In a service mesh, mutual TLS (mTLS) provides both encryption and identity verification for every inter-service call, ensuring that only authenticated services with the correct identity can communicate. Identity-based access policies (e.g., using SPIFFE IDs) then enforce fine-grained authorization, which is essential in dynamic microservices environments where IP addresses are ephemeral. This combination directly addresses the core security requirements of confidentiality, integrity, and authentication in zero-trust architectures.

Answer

Segment services into separate VLANs without encryption

Answer

Use TLS only for all communication

Answer

Rely on API keys in the request headers

Question 6

A security architect is designing a secure enclave for processing highly sensitive data. The architecture must ensure that even if the operating system is compromised, the enclave's memory contents remain confidential and integrity-protected. Which technology should be used?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel Software Guard Extensions (SGX) is the correct choice because it provides hardware-enforced isolation of memory regions (enclaves) that remain confidential and integrity-protected even if the operating system or hypervisor is compromised. SGX encrypts enclave memory on-die and decrypts it only within the CPU, preventing any privileged software from reading or tampering with the data.

Answer

Full disk encryption (FDE) with a strong passphrase

Answer

Trusted Platform Module (TPM)

Answer

Hypervisor-based isolation

Question 7

A security engineer is reviewing the architecture of a system that uses the Bell-LaPadula model. The system has subjects with security clearances and objects with classifications. To prevent covert timing channels, which additional control should be implemented?

Accepted Answer

Disable concurrent access to shared resources. Covert timing channels exploit the ability of a subject to modulate the timing of its access to a shared resource, thereby leaking information to another subject at a different security level. The Bell-LaPadula model enforces mandatory access control (MAC) but does not inherently prevent these channels. Disabling concurrent access to shared resources (option C) eliminates the ability to use timing variations as a signaling mechanism, directly addressing the covert channel at the resource scheduling level.

Answer

Enforce strict data labeling

Answer

Implement audit logging

Answer

Use encryption for data at rest

Question 8

A multinational corporation must comply with GDPR and CCPA. Which data protection strategy should they prioritize?

Accepted Answer

Data minimization. Data minimization is the correct priority because both GDPR (Article 5(1)(c)) and CCPA (Cal. Civ. Code §1798.100) require organizations to limit the collection and processing of personal data to what is directly relevant and necessary for the stated purpose. By minimizing the data held, the corporation reduces its legal exposure, simplifies compliance obligations, and inherently lowers the risk of a data breach impacting sensitive information. This principle is foundational to privacy-by-design and directly addresses the regulatory mandates, whereas the other options are secondary controls that do not address the core requirement of limiting data collection.

Answer

Data masking

Answer

Data retention

Answer

Data encryption

Question 9

A company uses SSH for remote administration. To enhance security, they want to implement public-key authentication. Which statement about SSH public-key authentication is true?

Accepted Answer

The private key must be kept secret by the user. In SSH public-key authentication, the private key is the secret half of the asymmetric key pair and must be kept confidential by the user. The server stores only the public key, and authentication is proven by the client signing a challenge with the private key, which the server verifies using the stored public key. This ensures that even if the server is compromised, the private key remains safe on the client side.

Answer

The public key is used to decrypt the session

Answer

Public-key authentication does not require a passphrase

Answer

The private key is stored on the server

Question 10

A security tester needs to test a new application for vulnerabilities but is concerned about contaminating the production database with test data. What is the best practice for conducting such tests?

Accepted Answer

Create a separate test environment with anonymized production data. Creating a separate test environment with anonymized production data ensures that testing does not affect the integrity or availability of the production database while still using realistic data to uncover vulnerabilities. Anonymization techniques, such as data masking or tokenization, remove personally identifiable information (PII) while preserving referential integrity and data distribution, allowing for accurate security testing without contaminating production systems.

Answer

Perform the test on the production environment during off-hours

Answer

Test only from the network perimeter to avoid data exposure

Answer

Use synthetic data that mimics production but is not real

Question 11

A company is considering outsourcing its customer support operations to a third-party vendor. Which of the following should be the PRIMARY risk management activity before finalizing the contract?

Accepted Answer

Conduct a thorough vendor risk assessment including security audits.. Before outsourcing critical operations, the primary risk management activity is to conduct a thorough vendor risk assessment, including security audits. This evaluates the vendor's security posture, compliance with standards (e.g., ISO 27001), and ability to protect sensitive customer data, directly addressing risks like data breaches or service disruptions before contractual obligations are locked in.

Answer

Negotiate a lower price to offset potential security investments.

Answer

Purchase cyber liability insurance to cover potential breaches.

Answer

Require the vendor to sign a non-disclosure agreement (NDA).

Question 12

A multinational corporation must ensure that data leaving the organization's network is classified and labeled appropriately. Which of the following is the MOST effective method to enforce consistent labeling across all data types?

Accepted Answer

Implement automated data classification tools that scan for sensitive content and apply labels. Automated data classification tools (e.g., Microsoft Purview, Symantec DLP) use content inspection, pattern matching, and machine learning to scan data at rest, in use, and in transit. They apply consistent labels based on predefined policies (e.g., regex for PII, fingerprinting for IP), ensuring uniform labeling across all data types without relying on human consistency or manual effort.

Answer

Appoint data stewards in each department to manually review and label data

Answer

Require all employees to complete annual training on data classification

Answer

Encrypt all data in transit and at rest to prevent unauthorized access

Question 13

A security manager is conducting a risk assessment for a new cloud application. The manager needs to estimate the potential financial loss from a data breach. Which approach should be used?

Accepted Answer

Quantitative risk analysis using annualized loss expectancy (ALE). Quantitative risk analysis using Annualized Loss Expectancy (ALE) provides a specific monetary estimate of potential financial loss, which is exactly what the security manager needs for a data breach scenario. ALE is calculated as Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO), enabling data-driven budgeting and cost-benefit analysis for cloud application security controls.

Answer

Scenario-based risk analysis with ordinal scales

Answer

Qualitative risk analysis using high/medium/low ratings

Answer

Benchmarking against industry standards

Question 14

During a forensic investigation, the team needs to preserve evidence from a running server. What is the FIRST step the team should take?

Accepted Answer

Capture a memory dump.. The first step in a forensic investigation of a running server is to capture a memory dump because volatile data (RAM) contains critical evidence such as running processes, network connections, encryption keys, and malware that would be lost if the system is powered off or altered. Preserving this volatile state before any other action ensures that the most transient evidence is secured, following the order of volatility principle. Capturing memory first prevents irreversible loss of data that cannot be recovered from disk or network captures.

Answer

Create a disk image.

Answer

Shut down the server normally.

Answer

Unplug the network cable.

Question 15

An organization wants to identify vulnerabilities in their network without attempting to exploit them. Which type of security assessment should they perform?

Accepted Answer

Vulnerability assessment. A vulnerability assessment is the correct choice because it is a systematic review of security weaknesses in a network or system that identifies vulnerabilities without actively exploiting them. This assessment typically uses automated scanning tools (e.g., Nessus, OpenVAS) to compare system configurations against known vulnerability databases (e.g., CVE, NVD) and reports potential issues, but does not attempt to gain unauthorized access or cause disruption.

Answer

Penetration test

Answer

Security audit

Answer

Security review

Question 16

A healthcare organization must decommission an old server containing patient health information (PHI) stored on solid-state drives (SSDs). Standard overwriting techniques are ineffective for SSDs due to wear-leveling and bad block mapping. Which sanitization method is most appropriate for these drives?

Accepted Answer

Physical destruction such as shredding or pulverizing. Physical destruction (e.g., shredding or pulverizing) is recommended for SSDs because overwriting may not reach all cells, and degaussing does not affect flash memory.

Answer

Cryptographic erasure by deleting the encryption key

Answer

Degaussing with a high-coercivity degausser

Answer

Overwriting with the DoD 5220.22-M 7-pass standard

Question 17

A company is migrating its critical application to a cloud provider. Which disaster recovery strategy provides the shortest recovery time objective (RTO) and recovery point objective (RPO)?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and real-time data synchronization, minimizing RTO and RPO.

Answer

Warm site

Answer

Cold site

Answer

Reciprocal agreement

Question 18

Which of the following is an example of a security policy?

Accepted Answer

All employees must use multi-factor authentication. A policy is a high-level mandatory statement that reflects management's intent. 'All employees must use multi-factor authentication' is a mandatory directive.

Answer

Step 1: Log in, Step 2: Enter code, Step 3: Access system

Answer

It is recommended to change passwords every 90 days

Answer

Use passwords of at least 12 characters with mixed case and numbers

Question 19

A company is recovering from a ransomware attack. Which THREE of the following are key considerations when restoring data from backups to ensure integrity and minimal downtime?

Accepted Answer

Isolate the restored data from the production network until verified. Isolating the restored data from production prevents reinfection. Validating backup integrity ensures clean data. Testing the restoration process ensures the backups work. Encrypted backups require decryption keys.

Answer

Ensure encryption keys for backups are available

Answer

Restore data directly to production servers to save time

Question 20

Which of the following is a key objective of a business impact analysis (BIA)?

Accepted Answer

Determine the maximum tolerable downtime for critical processes. BIA identifies critical business processes and their recovery requirements such as RTO, RPO, and maximum tolerable downtime.

Answer

Implement security controls

Answer

Identify vulnerabilities in the network

Answer

Test the disaster recovery plan