CISSP Practice Exam 4 — 20 Questions

Question 1

Which component of a trusted computing base (TCB) implements the reference monitor concept by enforcing access control decisions for all subjects and objects in the system?

Accepted Answer

Security kernel. The security kernel is the part of the TCB that implements the reference monitor, mediating all access requests.

Answer

Trusted platform module

Answer

Trusted computing base

Answer

Reference monitor

Question 2

A financial institution must ensure that transactions are well-formed and enforce separation of duties to prevent fraud. Which security model best addresses these requirements?

Accepted Answer

Clark-Wilson. Clark-Wilson model defines well-formed transactions and separation of duties to maintain commercial integrity.

Answer

Biba

Answer

Brewer-Nash

Answer

Bell-LaPadula

Question 3

A security auditor is reviewing the results of a recently completed internal vulnerability scan. The scan report shows several hosts with the same vulnerability. Which of the following actions should the auditor take FIRST?

Accepted Answer

Manually verify the vulnerability on a sample of affected hosts.. The auditor must first manually verify the vulnerability on a sample of affected hosts because automated vulnerability scans can produce false positives due to factors like incomplete banner grabbing, outdated plugin signatures, or network-level interference. Confirming the finding ensures that subsequent remediation efforts are based on accurate, validated data, preventing wasted resources on non-existent issues.

Answer

Immediately apply patches to all affected hosts.

Answer

Remove the hosts from the network until the vulnerability is resolved.

Answer

Re-run the scan with a different scanner.

Question 4

A security engineer is investigating a covert channel in a system. Which TWO types of covert channels could be used to leak information from a high-security to a low-security process?

Accepted Answer

Covert timing channel. Covert timing channels modulate the timing of events to signal information. Covert storage channels write data to a shared resource that the other process can read.

Answer

TOCTOU

Answer

Emanations

Answer

Side-channel

Question 5

A company collects PII from European customers for order processing. Under GDPR, they engage a third-party logistics provider to handle shipping. Which role does the logistics provider typically assume in this scenario?

Accepted Answer

Data processor. A data processor processes personal data on behalf of the data controller (the company). The logistics provider handles data for shipping but does not determine purposes or means.

Answer

Data controller

Answer

Data custodian

Answer

Data subject

Question 6

During a security audit, a vulnerability scanner reports a buffer overflow vulnerability in a legacy application. The application runs on a system with Data Execution Prevention (DEP/NX) enabled and Address Space Layout Randomization (ASLR) active. Which of the following is the most likely impact of these mitigations on a typical stack-based buffer overflow exploit?

Accepted Answer

They make it harder to execute arbitrary code via injected shellcode. DEP prevents code execution in data segments like the stack. ASLR randomizes memory addresses, making it harder for an attacker to redirect execution to injected code. Combined, they significantly raise the bar.

Answer

They only protect heap-based overflows, not stack-based

Answer

They completely prevent any exploitation of buffer overflows

Answer

They have no effect on buffer overflow exploits

Question 7

Which of the following is the primary purpose of a configuration management database (CMDB) in asset management?

Accepted Answer

Store information about hardware and software components and their relationships. A CMDB stores information about configuration items (CIs) and their relationships, aiding in change and incident management.

Answer

Track software licenses and compliance

Answer

Perform vulnerability scanning

Answer

Monitor network performance

Question 8

An organization is implementing privacy by design for a new application that processes PII. Which practice BEST aligns with the data minimization principle?

Accepted Answer

Collecting only the PII required for the stated function.. Data minimization means collecting only the personal data that is directly necessary for the specified purpose.

Answer

Anonymizing data after collection.

Answer

Obtaining explicit consent from users.

Answer

Collecting all possible PII in case it is needed later.

Question 9

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. A Type 2 factor is something you have, such as a smart card or OTP token.

Answer

Security question

Answer

Password

Answer

Fingerprint

Question 10

A security analyst discovers that an attacker has gained domain admin privileges by forging a Kerberos TGT using the KRBTGT account hash. Which attack has occurred?

Accepted Answer

Golden ticket attack. A Golden Ticket attack involves forging a TGT with the KRBTGT hash, granting unrestricted access.

Answer

Pass-the-ticket attack

Answer

Silver ticket attack

Answer

Kerberos brute force attack

Question 11

During a security audit, it is discovered that a network firewall is allowing traffic based on source IP address only, without inspecting application-layer data. Which type of firewall is this?

Accepted Answer

Packet filter. A packet filter firewall operates at Layer 3 (Network) and Layer 4 (Transport) of the OSI model, making decisions solely based on source and destination IP addresses, ports, and protocols. It does not inspect application-layer data (Layer 7), which matches the scenario where traffic is allowed based on source IP address only. This is the simplest and fastest type of firewall, but it lacks the ability to block attacks embedded in application payloads.

Answer

Circuit-level gateway

Answer

Application gateway

Answer

Stateful inspection

Question 12

A security administrator is reviewing potential risks associated with orphaned accounts. Which TWO of the following are risks of orphaned accounts?

Accepted Answer

Attackers can use orphaned accounts to gain unauthorized access. Orphaned accounts are active accounts of former employees or unused accounts, which can be exploited to gain unauthorized access or persist undetected.

Answer

Compliance with password policies is weakened

Answer

Performance degradation of authentication servers

Answer

Increased logging overhead

Question 13

In Kerberos, which component issues ticket-granting tickets (TGTs) after verifying the user's credentials?

Accepted Answer

Authentication Server (AS). The Authentication Server (AS) is responsible for issuing TGTs after verifying the user's password or other credentials.

Answer

Domain Controller

Answer

Ticket Granting Server (TGS)

Answer

Key Distribution Center (KDC)

Question 14

Which type of scanning provides the most comprehensive view of an organization's vulnerabilities by allowing the scanner to log into systems and access detailed configuration information?

Accepted Answer

Authenticated scan. Authenticated scans use credentials to access system internals, providing deeper insight than unauthenticated scans.

Answer

External scan

Answer

Passive scan

Answer

Unauthenticated scan

Question 15

In a software-defined network (SDN) architecture, the control plane is separated from the data plane. A network administrator is troubleshooting packet forwarding delays. Which plane is directly responsible for forwarding packets?

Accepted Answer

Data plane. In SDN, the data plane (also called the forwarding plane) is directly responsible for forwarding packets based on flow table entries installed by the controller. It handles per-packet operations like looking up destination addresses, applying actions (e.g., output to port, drop, modify header), and forwarding at line rate. Packet forwarding delays are typically caused by data plane issues such as flow table misses, hardware forwarding pipeline congestion, or inefficient TCAM lookups.

Answer

Application plane

Answer

Control plane

Answer

Management plane

Question 16

A SOC has three tiers: Tier 1 triages alerts, Tier 2 investigates, and Tier 3 performs advanced analysis. An alert about a potential data exfiltration using DNS tunneling is escalated from Tier 1. Which tier is BEST suited to perform deep packet inspection and memory forensics to confirm the exfiltration?

Accepted Answer

Tier 3. Tier 3 handles advanced analysis including memory forensics.

Answer

Incident manager

Answer

Tier 2

Answer

Tier 1

Question 17

A security architect is designing a Single Sign-On (SSO) solution for a web application that needs to support authentication and authorization. Which TWO of the following protocols are best suited for this purpose? (Select TWO)

Accepted Answer

OpenID Connect (OIDC). SAML 2.0 and OpenID Connect (OIDC) are both SSO protocols that provide authentication and authorization. OAuth 2.0 alone provides only authorization.

Answer

Kerberos

Answer

LDAP

Answer

OAuth 2.0

Question 18

A company wants to measure the effectiveness of its vulnerability management program. Which metric would best indicate the organization's ability to respond quickly to critical vulnerabilities?

Accepted Answer

Mean time to remediate critical vulnerabilities. Mean time to remediate (MTTR) for critical vulnerabilities directly measures the speed of response, which is a key indicator of program effectiveness.

Answer

Patch compliance percentage

Answer

ROI of security controls

Answer

Number of open vulnerabilities by severity

Question 19

During an incident response, the team identifies that the attacker gained access through a compromised service account with domain admin privileges. Which of the following steps should be taken FIRST to contain the incident?

Accepted Answer

Disable the compromised account and revoke its tokens.. Disabling the compromised account and revoking its tokens (e.g., Kerberos TGTs via `Set-ADAccountControl -Disable` and clearing cached tickets) immediately stops the attacker's current authentication and lateral movement capabilities. This is the fastest containment step because the service account with Domain Admin privileges is the direct vector; isolating systems or resetting all passwords is slower and may not address active token reuse.

Answer

Isolate all affected systems from the network.

Answer

Reset all user passwords.

Answer

Perform a full forensic analysis before any action.

Question 20

A security analyst notices that the SIEM is generating an overwhelming number of low-priority alerts from a single application server. The server is critical to operations. What is the BEST approach to reduce noise without compromising security?

Accepted Answer

Create a suppression rule for known benign patterns.. Suppression rules allow the SIEM to filter out known benign patterns (e.g., routine service checks or scheduled scans) while still capturing genuine threats. This reduces alert fatigue without disabling monitoring for the critical server, preserving visibility into anomalous or malicious activity.

Answer

Increase the severity threshold for that server's alerts.

Answer

Disable all alerts from that server.

Answer

Exclude the server from SIEM monitoring.