CISSP Practice Test 21 — 15 Questions

Question 1

A financial services company is migrating its customer relationship management (CRM) system to a public cloud provider. The CRM contains personally identifiable information (PII) and financial transaction records. The security architect must design a solution that ensures data confidentiality and integrity both at rest and in transit, while complying with PCI DSS requirements. The cloud provider offers a key management service (KMS) that can generate and store encryption keys, a hardware security module (HSM) in the cloud, and a certificate authority for TLS certificates. The architect needs to select the appropriate encryption methods and access controls. The company's security policy requires encryption keys to be rotated every 90 days and stored separately from the data. The cloud provider's KMS supports automatic key rotation, but the HSM requires manual intervention. The CRM application uses a database that supports transparent data encryption (TDE) with keys stored in the KMS, and the application also requires TLS for all network connections. Which course of action best meets all requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the cloud provider's KMS to generate and store the database encryption key with automatic rotation, and use a certificate from a third-party CA for TLS. Store the KMS key in a separate account and region from the database.. It uses the KMS with automatic key rotation (meeting the 90-day rotation requirement without manual intervention), stores the key in a separate account and region from the database (satisfying the separation requirement), and uses a certificate from a third-party CA for TLS (providing strong trust and compliance with PCI DSS). Option A uses self-signed certificates (not trusted for external connections) and manual rotation (error-prone). Option C uses manual rotation and does not leverage automatic rotation. Option D stores all keys in the same region as the database, violating the separation requirement, and uses a KMS-managed key for TLS which may not be necessary.

Answer

Use the cloud provider's KMS to generate and store the database encryption key, disable automatic rotation, and manually rotate it every 90 days. Use a self-signed certificate for TLS to save costs.

Answer

Use the cloud HSM to generate and store the database encryption key, manually rotate it every 90 days, and use a certificate from the cloud provider's CA for TLS. Store the HSM key in a different region from the database.

Answer

Use the cloud provider's KMS to generate and store the database encryption key, enable automatic key rotation, and use a separate KMS-managed key for TLS certificates. Store all keys in the same KMS region as the database.

Question 2

An organization implements a data masking policy for production databases. Which of the following best describes the primary goal?

Accepted Answer

Reduce the risk of data exposure during testing. Data masking irreversibly replaces sensitive data with realistic but fictitious values, ensuring that production data is not exposed in non-production environments like testing or development. This directly reduces the risk of data exposure during testing, which is the primary goal of a data masking policy. Unlike encryption, masking does not preserve the ability to reverse the transformation, making it ideal for scenarios where the original data is not needed.

Answer

Ensure data availability

Answer

Encrypt data at rest

Answer

Simplify access controls

Question 3

An organization wants to implement a password policy that balances security and usability. Which of the following is the BEST practice according to current NIST guidelines?

Accepted Answer

Compare new passwords against a list of known compromised passwords. NIST SP 800-63B explicitly recommends checking passwords against a list of known compromised passwords (e.g., from previous breaches) rather than enforcing arbitrary complexity rules. This approach directly mitigates credential stuffing and dictionary attacks by rejecting passwords that have already been exposed, while avoiding user frustration from frequent changes or complex composition requirements.

Answer

Set maximum password length to 8 characters

Answer

Require password changes every 30 days

Answer

Enforce a minimum of one uppercase, one lowercase, one digit, and one special character

Question 4

During a business impact analysis (BIA), the team identifies that the customer service application must be restored within 4 hours of a disruption. What is the term for this metric?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable time that a business process or application can be unavailable after a disruption. In this scenario, the 4-hour restoration requirement for the customer service application directly matches the RTO metric, which drives the design of recovery strategies and resource allocation.

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Point Objective (RPO)

Answer

Service Level Agreement (SLA)

Question 5

An organization is implementing identity management and wants to ensure that when an employee leaves, all access is promptly revoked. Which process is most directly responsible for removing accounts and access rights for a leaver?

Accepted Answer

Deprovisioning. Deprovisioning is the process of removing user accounts and access rights when an employee leaves the organization. It directly addresses the requirement to promptly revoke all access, ensuring that the former employee cannot authenticate or authorize any actions within the system. This process typically involves disabling or deleting the user object in the directory service (e.g., Active Directory) and removing associated permissions from all resources.

Answer

Privileged access management

Answer

Access recertification

Answer

Separation of duties

Question 6

A security analyst is asked to identify vulnerabilities in a web application without attempting to exploit them. Which type of assessment is being performed?

Accepted Answer

Vulnerability assessment. A vulnerability assessment is a systematic review of security weaknesses in a system or application, but it does not involve actively exploiting those weaknesses. The question specifies that the analyst is asked to identify vulnerabilities without attempting to exploit them, which directly matches the definition of a vulnerability assessment. This type of assessment typically uses automated scanners (e.g., Nessus, OpenVAS) and manual checks to enumerate potential vulnerabilities, such as missing patches or misconfigurations, without moving to the exploitation phase.

Answer

Security review

Answer

Security audit

Answer

Penetration test

Question 7

An organization uses a siem to collect logs from multiple sources. The security team notices that some events are missing during peak traffic hours. Analysis shows that the log sources are sending data via UDP. What is the most likely cause?

Accepted Answer

UDP packet loss. UDP is a connectionless, best-effort transport protocol that does not guarantee delivery. During peak traffic hours, network congestion can cause UDP datagrams to be dropped without any retransmission mechanism, leading to missing events in the SIEM. This is the most direct and likely cause given the scenario.

Answer

Clock skew between sources and SIEM

Answer

Insufficient SIEM storage capacity

Answer

Network bandwidth saturation

Question 8

A global manufacturing company with headquarters in Europe and factories in Asia and North America has recently experienced a data breach. The breach involved the theft of intellectual property (IP) containing product designs stored on a file server located in the Asian factory. The investigation revealed that the attacker gained access using a compromised administrator account from a contractor's laptop that was connected to the corporate VPN. The company has implemented network segmentation, but the file server resides in the same VLAN as other factory equipment. The company uses Active Directory for identity management, and all employees and contractors use the same domain. The company is now reviewing its data governance policies to prevent future incidents. The security team must recommend a set of controls that address the root cause while maintaining operational efficiency. Which of the following is the BEST course of action?

Accepted Answer

Implement a privileged access management (PAM) solution with just-in-time (JIT) elevation and conditional access policies that require managed, compliant devices for VPN access. The best course of action because implementing a privileged access management (PAM) solution with just-in-time (JIT) elevation and conditional access policies (e.g., requiring managed, compliant devices for VPN access) directly addresses the root cause: the use of compromised administrator credentials from an unmanaged contractor device. This control ensures that privileged access is granted only when needed, for a limited time, and only from devices that meet security baselines. Option A (separate Active Directory forest with one-way trust) adds significant administrative overhead and complexity without preventing credential misuse. Option C (MFA for all users) improves authentication security but does not require device compliance, so a compromised but MFA-enabled device could still be used for lateral movement. Option D (isolating the file server in its own VLAN with strict firewall rules) is a good network control but does not address the credential theft or the unmanaged device vector; the attacker could still access the server remotely through VPN if credentials are valid.

Answer

Create a separate Active Directory forest for contractors and establish a one-way trust to allow access only to necessary resources

Answer

Require multi-factor authentication (MFA) for all users accessing the VPN, regardless of role

Answer

Isolate the file server into its own VLAN and implement strict firewall rules to limit access to only necessary personnel

Question 9

A security architect is reviewing a system that uses a microkernel operating system. The architect is concerned about potential side-channel attacks between processes. Which mitigation is most effective at the architecture level?

Accepted Answer

Use cache partitioning or cache coloring to isolate process caches. D is correct because cache partitioning or cache coloring directly addresses the root cause of side-channel attacks in a microkernel environment: shared CPU caches. By isolating each process's cache footprint, an attacker cannot infer sensitive data (e.g., cryptographic keys) through timing variations or cache occupancy measurements, which is a fundamental architectural mitigation.

Answer

Randomize the address space layout (ASLR)

Answer

Implement stack canaries in all user-space applications

Answer

Reduce the number of system calls and IPC mechanisms

Question 10

A data classification scheme includes Public, Internal, Confidential, and Restricted. Which classification requires the highest level of protection?

Accepted Answer

Restricted. Restricted is the highest classification level in this scheme, indicating data that would cause severe damage to the organization if disclosed. It requires the strongest access controls, encryption (e.g., AES-256 for data at rest, TLS 1.3 for data in transit), and strict need-to-know policies. This aligns with the principle of protecting data based on its sensitivity and the potential impact of unauthorized disclosure.

Answer

Internal

Answer

Public

Answer

Confidential

Question 11

Which of the following is a primary purpose of conducting a tabletop exercise for incident response?

Accepted Answer

Validate communication and decision-making processes.. A tabletop exercise is a discussion-based session where participants walk through a simulated incident scenario to evaluate the effectiveness of communication channels, decision-making hierarchies, and coordination among stakeholders. It does not involve live systems or technical testing, so its primary purpose is to validate the procedural and human elements of the incident response plan, such as who notifies whom and how escalation decisions are made.

Answer

Measure the effectiveness of backup restoration.

Answer

Test technical capabilities of security tools.

Answer

Identify unpatched vulnerabilities in systems.

Question 12

An organization is developing a business continuity plan (BCP) for its critical IT systems. Which of the following is the FIRST step in the BCP process?

Accepted Answer

Conduct a business impact analysis (BIA) to prioritize critical business functions.. The first step in the BCP process is to conduct a Business Impact Analysis (BIA) to identify and prioritize critical business functions and their dependencies. Without the BIA, you cannot determine which systems require recovery strategies or what recovery time objectives (RTOs) and recovery point objectives (RPOs) are needed. The BIA provides the quantitative and qualitative basis for all subsequent BCP decisions.

Answer

Identify recovery strategies for critical systems.

Answer

Develop a testing schedule for the BCP.

Answer

Perform a risk assessment to identify potential threats.

Question 13

Which of the following is a key feature of TLS 1.3 that enhances security compared to earlier versions?

Accepted Answer

Mandatory forward secrecy. TLS 1.3 mandates forward secrecy by requiring ephemeral Diffie-Hellman (DHE or ECDHE) key exchange for all sessions, eliminating static RSA and static DH key exchanges. This ensures that even if the server's long-term private key is compromised, past session keys cannot be derived, protecting historical traffic. Earlier TLS versions allowed static key exchanges, making them vulnerable to retrospective decryption.

Answer

Support for RC4 encryption

Answer

Support for DES and 3DES

Answer

Use of static RSA key exchange

Question 14

A company must comply with a regulation requiring a formal, independent assessment of its security controls against a standard. Which type of assessment is MOST appropriate?

Accepted Answer

Security audit. A security audit is the most appropriate assessment because it is a formal, independent evaluation of an organization's security controls against a predefined standard (e.g., ISO 27001, NIST SP 800-53). Unlike other assessments, an audit is conducted by an independent third party or internal audit function, providing objective evidence of compliance with regulatory requirements.

Answer

Penetration test

Answer

Security review

Answer

Vulnerability assessment

Question 15

Drag and drop the steps for implementing a digital signature using asymmetric cryptography in the correct order.

Accepted Answer

Hash the message, then encrypt the hash with the sender's private key, then attach the encrypted hash to the message, then verify by decrypting with the public key and comparing hashes.. Digital signatures involve hashing the message, encrypting the hash with the private key, attaching, then verifying with the public key.

Answer

Encrypt the hash with the sender's private key, then hash the message, then attach the encrypted hash to the message, then verify by decrypting with the public key and comparing hashes.

Answer

Hash the message, then attach the encrypted hash to the message, then encrypt the hash with the sender's private key, then verify by decrypting with the public key and comparing hashes.

Answer

Hash the message, then encrypt the hash with the sender's private key, then verify by decrypting with the public key and comparing hashes, then attach the encrypted hash to the message.