CISSP Practice Test 22 — 15 Questions

Question 1

A security professional is tasked with testing the effectiveness of security controls in a production environment without causing disruption. Which type of assessment should be performed?

Accepted Answer

Vulnerability scan. A vulnerability scan is the correct choice because it is a non-intrusive, automated assessment that identifies known vulnerabilities (e.g., missing patches, misconfigurations) by comparing system states against a database of CVEs and configuration benchmarks (e.g., CIS benchmarks). It does not exploit vulnerabilities or generate attack traffic, making it safe for production environments. In contrast, penetration tests and red team exercises involve active exploitation and simulated attacks that risk service disruption.

Answer

Penetration test

Answer

Red team exercise

Answer

Social engineering test

Question 2

An organization is migrating from a waterfall to an Agile development methodology. Which of the following is a key security advantage of Agile?

Accepted Answer

Security issues can be addressed incrementally throughout development. In Agile development, security testing and remediation are integrated into each iteration (sprint), allowing teams to identify and fix vulnerabilities incrementally rather than waiting until the end. This continuous feedback loop reduces the risk of late-stage security surprises and aligns with the principle of 'shifting left' on security.

Answer

Security testing is performed only at the end of the project

Answer

Security requirements are finalized upfront

Answer

Security documentation is minimized to reduce overhead

Question 3

A vulnerability scan report shows that a web server has a critical vulnerability with a CVSS score of 9.8. However, the server is behind a WAF that blocks the attack vector, and the vulnerability is in a deprecated feature that cannot be removed until the next major release. What should the security manager do first?

Accepted Answer

Document the compensating control and accept the residual risk. The WAF serves as a compensating control that effectively mitigates the attack vector for this vulnerability, and the residual risk has been formally documented and accepted by management. In the absence of an immediate patch or removal of the deprecated feature, documenting the compensating control and accepting the residual risk is the appropriate risk management decision per the organization's risk appetite and the NIST SP 800-30 risk assessment framework.

Answer

Remove the server from production

Answer

Ignore the finding because the WAF blocks it

Answer

Immediately patch the vulnerability

Question 4

A development team is using a third-party library that is known to have a critical vulnerability. The team decides to continue using the library because it is widely used and the vulnerability has not been exploited. Which security risk is the team ignoring?

Accepted Answer

Using components with known vulnerabilities. The team is ignoring the risk of using components with known vulnerabilities, which is explicitly listed in the OWASP Top 10 (A06:2021). Even if a vulnerability has not been exploited yet, continuing to use a library with a known CVE (e.g., a remote code execution flaw in an older version of Log4j) exposes the application to potential attacks once exploit code becomes public. The decision based on 'wide usage' and 'no exploitation so far' is a fallacy, as threat actors often target widely deployed libraries precisely because of their large attack surface.

Answer

Insecure deserialization

Answer

Insufficient logging and monitoring

Answer

Security misconfiguration

Question 5

A network engineer is configuring a firewall to allow HTTP traffic from the internet to a web server (10.0.0.10). The firewall has three interfaces: outside (ISP), DMZ (10.0.0.0/24), and inside (192.168.1.0/24). The web server is in the DMZ. Which rule is correct?

Accepted Answer

Rule: Source interface Outside, Source any, Destination 10.0.0.10, Port 80, Action allow. HTTP traffic from the internet arrives on the outside interface, and the firewall rule must match the source interface (Outside), allow any source IP, and specify the destination IP (10.0.0.10) and port 80. This permits inbound web traffic to the DMZ web server while maintaining security boundaries.

Answer

Rule: Source interface Inside, Source any, Destination 10.0.0.10, Port 80, Action allow

Answer

Rule: Source interface Outside, Source 192.168.1.0/24, Destination 10.0.0.10, Port 80, Action allow

Answer

Rule: Source interface DMZ, Source any, Destination 10.0.0.10, Port 80, Action allow

Question 6

An organization discovers that an employee has been using a personal cloud storage account to share confidential files. After revoking access, what is the NEXT best step to prevent recurrence?

Accepted Answer

Deploy a data loss prevention (DLP) solution. Deploying a Data Loss Prevention (DLP) solution is the next best step because it provides automated, policy-based monitoring and control of data in motion, at rest, and in use. DLP can inspect content for sensitive patterns (e.g., credit card numbers, proprietary file headers) and block unauthorized transfers to personal cloud storage, addressing the root cause of the incident rather than relying on manual enforcement.

Answer

Block access to all cloud storage sites

Answer

Discipline the employee

Answer

Retrain all employees on data handling policy

Question 7

An organization is adopting DevOps. Which of the following is a primary security concern when integrating security into CI/CD pipelines?

Accepted Answer

Credential management for automated tools.. Credential management for automated tools is a primary security concern because CI/CD pipelines require automated access to repositories, artifact registries, and deployment environments. Hardcoding secrets or using weak storage (e.g., plaintext in scripts) exposes credentials to compromise via pipeline logs, version control history, or insider threats. Proper management using vaults (e.g., HashiCorp Vault) or secret injection (e.g., Kubernetes Secrets) is critical to prevent unauthorized access.

Answer

Increased number of releases.

Answer

Automated testing slows down deployment.

Answer

Resistance from development teams.

Question 8

An organization wants to secure email communications by providing encryption and digital signatures. They require a solution that uses a web of trust model rather than a hierarchical PKI. Which protocol should they implement?

Accepted Answer

PGP/GPG. PGP/GPG implements a web of trust model where users sign each other's keys to establish trust, rather than relying on a centralized Certificate Authority (CA). It provides both encryption and digital signatures for email, making it the correct choice for an organization that explicitly wants to avoid hierarchical PKI.

Answer

S/MIME

Answer

TLS

Answer

SSH

Question 9

A company hires a third party to perform an assessment where the testers are given no prior knowledge of the internal network. This type of penetration test is known as:

Accepted Answer

Black box. A black box penetration test simulates an external attacker with no prior knowledge of the target environment. The testers are given no credentials, network diagrams, or internal details, forcing them to perform reconnaissance and exploitation from an outsider's perspective. This aligns directly with the scenario where the third party has 'no prior knowledge of the internal network.'

Answer

White box

Answer

Grey box

Answer

Internal test

Question 10

A large organization needs to deploy a Public Key Infrastructure (PKI) for thousands of devices and users. A key requirement is the ability to revoke certificates in real time when a device is lost or compromised. Which solution is most appropriate?

Accepted Answer

Implement Online Certificate Status Protocol (OCSP) responders.. OCSP provides real-time certificate status checking by querying an OCSP responder directly, eliminating the delays inherent in CRL distribution. This meets the requirement for immediate revocation verification when a device is lost or compromised, as the responder can return a 'revoked' status instantly without waiting for a CRL refresh cycle.

Answer

Deploy multiple hierarchical CAs and distribute CRLs periodically.

Answer

Rely on certificate expiration only and do not implement revocation.

Answer

Use a single Certificate Authority (CA) with a large Certificate Revocation List (CRL).

Question 11

A network administrator is deploying a wireless network for a small business and wants to ensure strong security. Which of the following is the best choice for authentication in a WPA3 Personal network?

Accepted Answer

Simultaneous Authentication of Equals (SAE). Simultaneous Authentication of Equals (SAE) is the correct choice because WPA3 Personal replaces the vulnerable Pre-Shared Key (PSK) handshake with SAE, which provides a secure key exchange resistant to offline dictionary attacks. SAE uses a Dragonfly handshake based on a zero-knowledge proof, ensuring that even if an attacker captures the handshake, they cannot brute-force the password without being present for each guess.

Answer

EAP-TLS

Answer

TKIP

Answer

Pre-shared key (PSK)

Question 12

A security architect is designing a zero trust network. Which principle is fundamental to a zero trust architecture?

Accepted Answer

Never trust, always verify. Zero trust architecture (ZTA) fundamentally rejects implicit trust based on network location. The principle 'never trust, always verify' mandates continuous authentication and authorization for every access request, regardless of whether it originates from inside or outside the network perimeter. This is enforced through micro-segmentation, least-privilege access, and per-session verification, often using technologies like identity-aware proxies and software-defined perimeters (SDP).

Answer

Trust but verify

Answer

Rely on perimeter defenses

Answer

Trust internal traffic implicitly

Question 13

An organization implements a data loss prevention (DLP) solution to monitor data in motion. Which type of data is typically most challenging to detect?

Accepted Answer

Encrypted traffic. Encrypted traffic is the most challenging data in motion for DLP to inspect because the payload is obfuscated by encryption protocols such as TLS 1.3 or IPsec. Without decryption (e.g., via a proxy with TLS interception), the DLP sensor cannot read the content to match patterns or keywords, rendering traditional deep packet inspection ineffective.

Answer

Data in images

Answer

Structured data in CSV files

Answer

Unstructured data in email attachments

Question 14

An organization is implementing a bring-your-own-device (BYOD) policy. Which security control should be enforced to ensure that only compliant devices can access corporate resources?

Accepted Answer

Implementing network access control (NAC). Network access control (NAC) is the correct control because it evaluates device posture (e.g., OS patch level, antivirus status, disk encryption) against a compliance policy before granting network access. NAC can quarantine non-compliant devices to a remediation VLAN or deny access entirely, ensuring only trusted endpoints reach corporate resources. This is distinct from generic encryption or authentication controls, as NAC enforces a dynamic, policy-based admission decision at the network layer.

Answer

Using a VPN concentrator

Answer

Requiring strong passwords

Answer

Enabling full disk encryption

Question 15

An organization is developing a security governance framework to align with business objectives. Which group should have ultimate authority and responsibility for the cybersecurity program?

Accepted Answer

Board of directors. The board of directors holds ultimate fiduciary duty for the organization, including oversight of risk management and cybersecurity. They approve the security governance framework and ensure it aligns with business objectives, as they are legally accountable for the entire enterprise. The CISO and CEO implement the program, but the board retains final authority.

Answer

IT steering committee

Answer

Chief Information Security Officer (CISO)

Answer

Chief Executive Officer (CEO)