CISSP Practice Test 21 — 15 Questions

Question 1

Refer to the exhibit. A security analyst reviews this syslog entry from a firewall. The firewall's ACL is configured to deny all traffic by default except what is explicitly permitted. This is an example of which security principle?

Accepted Answer

Least privilege. The principle of least privilege grants only necessary access; default-deny (deny all by default) is an implementation of this principle.

Answer

Separation of duties

Answer

Need to know

Answer

Defense in depth

Question 2

A security manager is selecting controls to protect sensitive data. Which TWO are examples of administrative controls?

Accepted Answer

Security awareness training. Administrative controls are policies, procedures, and training. Security awareness training (B) and background checks (D) are administrative. Firewalls (A) and encryption (C) are technical. Access control lists (E) are technical.

Answer

Firewalls

Answer

Access control lists

Answer

Encryption

Question 3

Which THREE of the following are primary objectives of a risk management program?

Accepted Answer

Identify assets. The primary objectives include identifying assets, protecting critical assets, and achieving risk appetite. Eliminating all risks is impossible, and compliance is a secondary benefit, not a primary objective.

Answer

Eliminate all risks

Answer

Ensure compliance

Question 4

A company wants to ensure that its security policy is effectively enforced across all departments. Currently, the policy is published on the intranet and included in the employee handbook. However, the security team notices that many employees are not following the policy, leading to security incidents. Which of the following would be the most effective way to improve policy enforcement?

Accepted Answer

Require annual signed acknowledgment of the policy. Requiring annual signed acknowledgment ensures that employees are aware of and agree to comply with the policy. This creates a record of acceptance and can be used in disciplinary actions. Publishing on intranet or handbook alone does not guarantee reading or acceptance. Random audits with penalties may enforce compliance but without awareness, employees may not know what is expected.

Answer

Include the policy in the employee handbook

Answer

Conduct random audits and penalize non-compliance

Answer

Publish the policy on the intranet only

Question 5

A large healthcare organization is subject to both HIPAA and GDPR. They are creating a data retention policy for electronic protected health information (ePHI) concerning European patients. HIPAA requires retention for 6 years from creation or last effective date, while GDPR requires that personal data not be kept longer than necessary for the purpose, with a general guideline of retaining for the duration of the relationship plus a reasonable period. The organization wants to minimize storage costs while ensuring compliance. Which approach should they take?

Accepted Answer

Implement a tiered retention policy based on data classification. A tiered retention policy based on data classification allows the organization to apply different retention periods to different types of data, balancing regulatory requirements and cost. Retaining for the longer of the two requirements may over-retain data that is not subject to both laws. Retaining for the shorter may violate HIPAA. Retaining all data indefinitely is costly and may violate GDPR's storage limitation principle.

Answer

Retain data for the longer of the two regulatory requirements (HIPAA 6 years)

Answer

Retain all data indefinitely

Answer

Retain data for the shorter requirement (GDPR-defined necessity period)

Question 6

An organization's risk assessment identified a vulnerability in a legacy system that cannot be patched because the vendor no longer supports it. The system processes sensitive customer data and is critical for daily operations. The risk is rated as high likelihood and high impact. The organization has a moderate risk appetite. Which risk treatment is most appropriate?

Accepted Answer

Mitigate by implementing compensating controls. Since the system cannot be replaced immediately, implementing compensating controls (e.g., network segmentation, strict access controls, monitoring) reduces the risk to an acceptable level. Accepting a high risk is not advisable when it exceeds appetite. Cyber insurance does not protect against data breach consequences adequately. Decommissioning would disrupt critical operations.

Answer

Transfer the risk through cyber insurance

Answer

Avoid the risk by decommissioning the system

Answer

Accept the risk

Question 7

Which TWO of the following are mandatory secure coding practices to prevent injection attacks? (Select exactly two.)

Accepted Answer

Use parameterized queries or prepared statements. Options A and D are correct. Input validation ensures data conforms to expected patterns; parameterized queries separate code from data. Option B is wrong because encoding outputs is for XSS, not injection. Option C is wrong because error messages should not reveal internal details. Option E is wrong because encryption does not prevent injection.

Answer

Encode output to the browser

Answer

Encrypt sensitive input data

Answer

Use custom error messages that detail the failure

Question 8

A company uses Docker containers for microservices. What is the most important security measure for container images?

Accepted Answer

Use minimal base images and scan them for vulnerabilities. Option A is correct because minimal base images reduce attack surface, and vulnerability scanning detects known issues. Option B is wrong because using 'latest' tags can cause inconsistent builds. Option C is wrong because running as root is insecure. Option D is wrong because hardcoding secrets is never recommended.

Answer

Use the latest version of base image to ensure patches

Answer

Hardcode secrets into the image

Answer

Run containers as root for easier privilege management

Question 9

A security assessment reveals that a web application uses client-side input validation exclusively. What is the most likely security risk?

Accepted Answer

An attacker can submit malicious data directly to the server without client-side constraints.. Option A is correct because client-side validation is easily bypassed by an attacker who sends requests directly to the server. Option B is wrong because usability is not a security risk. Option C is wrong while client-side can be tampered; the core risk is missing server-side validation. Option D is wrong because XSS is typically mitigated by output encoding, not input validation.

Answer

Attacker can inject malicious scripts that execute on the client side.

Answer

The application will have poor user experience due to slow responses.

Answer

The client-side code can be obfuscated but not decrypted.

Question 10

A company is developing a mobile payment application. To comply with PCI DSS, what should be implemented to protect cardholder data during transmission?

Accepted Answer

Implement TLS 1.2 or higher with strong ciphers.. TLS 1.2 or higher with strong ciphers is the current standard for secure transmission. RC4 and SSL 3.0 are deprecated. Base64 is encoding, not encryption.

Answer

Apply base64 encoding.

Answer

Use RC4 encryption.

Answer

Use SSL 3.0.

Question 11

A DevOps team implements a CI/CD pipeline that runs security scans automatically. The pipeline fails often due to false positives, causing delays. Which approach balances security and efficiency?

Accepted Answer

Tune scan rules to reduce false positives while retaining critical checks.. Tuning scan rules reduces false positives while maintaining critical security checks, thus minimizing delays without disabling security. Turning off scans removes security. Manual review of every false positive is inefficient. Running scans only on production bypasses early detection.

Answer

Turn off all security scans.

Answer

Manually review every false positive.

Answer

Only run scans on code that is deployed to production.

Question 12

Which THREE of the following are essential components of a software supply chain security program? (Select exactly three.)

Accepted Answer

Using signed and verified software artifacts. Options B, C, and E are correct. SBOMs provide transparency; vendor assessments ensure third-party security; signed artifacts verify integrity. Option A is wrong because static analysis is internal, not supply chain. Option D is wrong because penetration tests are broader, not specifically supply chain.

Answer

Running penetration tests on the production environment

Answer

Conducting static analysis on all in-house code

Question 13

A DevSecOps team wants to integrate security into the CI/CD pipeline without slowing down development. Which approach best achieves this?

Accepted Answer

Implement automated security scanning with gating (pass/fail) in the pipeline. Option D is correct because automated security gates with pass/fail criteria provide fast feedback without manual delays. Option A is wrong because manual reviews are slow. Option B is wrong because skipping testing increases risk. Option C is wrong because after-the-fact reviews do not prevent flawed releases.

Answer

Perform comprehensive security tests only on major releases

Answer

Conduct a security review after each release and fix issues retrospectively

Answer

Require manual security sign-off before each production deployment

Question 14

An organization is adopting a microservices architecture. Which security control is most effective for ensuring that inter-service communication is authenticated and authorized?

Accepted Answer

Implementing mutual TLS (mTLS) between services. Option C is correct because mutual TLS (mTLS) ensures that both parties in communication are authenticated, providing strong identity verification and encryption. Option A is wrong because API keys alone do not provide mutual authentication. Option B is wrong while JWT can carry claims, it does not inherently encrypt the channel. Option D is wrong because IP allowlisting is prone to spoofing within cloud environments.

Answer

Relying on network segmentation and IP allowlisting

Answer

Using JSON Web Tokens (JWT) in the HTTP header

Answer

Using pre-shared API keys for each service pair

Question 15

A security architect is reviewing the access control model for a microservices architecture. Which approach minimizes the risk of privilege escalation from a compromised service?

Accepted Answer

Use attribute-based access control (ABAC) with service-specific policies.. ABAC uses attributes (user, resource, environment) to grant fine-grained permissions, reducing the blast radius if a service is compromised. RBAC with global roles is too coarse. SSO does not address service-to-service. API keys are weak for authentication.

Answer

Implement role-based access control (RBAC) with global roles.

Answer

Use API keys for all service-to-service communication.

Answer

Deploy a single sign-on solution.

CISSP Practice Test 21 — 15 Questions

Exhibit

CISSP Practice Test 21 — 15 Questions

Exhibit