CISSP Practice Test 22 — 15 Questions

Question 1

During a security assessment, it is found that service accounts have interactive logon rights. What is the BEST remediation?

Accepted Answer

Use managed service accounts instead.. Managed Service Accounts (MSAs) are the best remediation because they are designed specifically for service accounts, automatically manage password changes, and by default have no interactive logon rights. This eliminates the security risk of interactive logon while also addressing password management and reducing administrative overhead. Group Policy changes or manual password policies do not address the underlying architectural issue of using a standard user account for a service.

Answer

Implement Group Policy to deny interactive logon for service accounts.

Answer

Ensure service accounts use strong passwords.

Answer

Remove service accounts from the local Administrators group.

Question 2

Which of the following is a secure coding practice to prevent SQL injection attacks?

Accepted Answer

Using parameterized queries. Parameterized queries (also known as prepared statements) separate SQL code from data by using placeholders (e.g., '?' in ODBC/JDBC or ':param' in Oracle) that are bound to user-supplied values at execution time. This ensures that input is always treated as data, never as executable SQL syntax, effectively neutralizing SQL injection regardless of the input content.

Answer

Escaping all user input

Answer

Using stored procedures exclusively

Answer

Validating input length

Question 3

During a security audit of a web application, the following issues are found: (1) Session tokens are included in URLs, (2) The application does not invalidate session tokens after logout, and (3) Session tokens are predictable. Which THREE of the following controls are most appropriate to address these issues?

Accepted Answer

Store session tokens in cookies with Secure and HttpOnly flags. Option B is correct because storing session tokens in cookies with Secure and HttpOnly flags addresses the issue of tokens being included in URLs by keeping them out of URLs and providing additional protections. Option C is correct because invalidating session tokens on logout and setting short expiration times directly addresses the lack of invalidation. Option D is correct because using a cryptographically secure random number generator directly addresses the predictability of session tokens. Option A is incorrect because regenerating session tokens after login is primarily a control against session fixation, not directly addressing predictability, exposure in URLs, or lack of invalidation. Option E is incorrect because IP address binding is fragile and does not protect against token exposure or poor invalidation.

Answer

Regenerate session tokens after login

Answer

Implement IP address binding for session tokens

Question 4

A security architect is reviewing the access control model for a microservices architecture. Which approach minimizes the risk of privilege escalation from a compromised service?

Accepted Answer

Use attribute-based access control (ABAC) with service-specific policies.. ABAC with service-specific policies minimizes privilege escalation because it enforces fine-grained, context-aware permissions (e.g., user attributes, resource type, action) per microservice. If a service is compromised, its policies are scoped only to that service’s required operations, preventing lateral movement or elevation to other services. This aligns with the principle of least privilege and defense in depth in a distributed architecture.

Answer

Implement role-based access control (RBAC) with global roles.

Answer

Use API keys for all service-to-service communication.

Answer

Deploy a single sign-on solution.

Question 5

Which of the following is an example of a Type 1 authentication factor?

Accepted Answer

Password. A Type 1 authentication factor is something you know, such as a password, PIN, or passphrase. The password is knowledge held in the user's memory, making it the classic example of a Type 1 factor. The other options represent possession (something you have) or inherence (something you are).

Answer

OTP token

Answer

Fingerprint

Answer

Smart card

Question 6

A security architect is designing an authentication system. To prevent session fixation attacks, which secure design principle should be implemented?

Accepted Answer

Regenerating session IDs after successful login. Session fixation attacks occur when an attacker forces a user to use a known session ID. Regenerating the session ID after successful login (e.g., via `session_regenerate_id()` in PHP or `HttpServletRequest.changeSessionId()` in Java) ensures that the pre-authentication session ID is discarded and a new, unpredictable one is issued, breaking the attacker's control.

Answer

Using HTTPS for all communications

Answer

Setting session timeout to 30 minutes

Answer

Implementing multi-factor authentication

Question 7

An organization wants to ensure that employees can securely access internal applications from home. They deploy a VPN solution. Which VPN type provides the strongest encryption and is most commonly used for remote access?

Accepted Answer

IPsec with IKEv2 and AES-256. IPsec with IKEv2 and AES-256 provides the strongest encryption for remote access VPNs. IKEv2 offers improved security features like mobility and multi-homing support, while AES-256 is a symmetric cipher with a 256-bit key that is currently considered unbreakable by brute force. This combination is widely deployed for secure client-to-site connections.

Answer

MPLS Layer 3 VPN

Answer

L2TP without encryption

Answer

PPTP

Question 8

A security engineer is troubleshooting a site-to-site IPsec VPN between two firewalls. The tunnel status shows Phase 1 is up but Phase 2 is not. Which of the following is the most likely cause?

Accepted Answer

Mismatched proxy IDs (traffic selectors). Phase 1 (IKE SA) establishes a secure channel for key exchange, while Phase 2 (IPsec SA) negotiates the specific traffic to be encrypted. If Phase 1 is up but Phase 2 fails, the most common cause is a mismatch in proxy IDs (traffic selectors), such as local/remote subnets or ports, which prevents the two peers from agreeing on which traffic to protect. This is distinct from authentication or encryption mismatches, which would typically cause Phase 1 to fail.

Answer

Incorrect pre-shared key

Answer

Mismatched authentication algorithm

Answer

Firewall rule blocking IKE traffic

Question 9

What is the PRIMARY purpose of a chain of custody in digital forensics?

Accepted Answer

To maintain evidence integrity and admissibility in court. A chain of custody is a chronological record documenting who collected, handled, transferred, and analyzed evidence, along with when and why each action occurred. Its primary purpose is to preserve evidence integrity and prove in court that the evidence was not tampered with, making it admissible under rules such as the Federal Rules of Evidence (FRE 901). Without an unbroken chain, opposing counsel can challenge authenticity and the evidence may be excluded.

Answer

To document the tools used during investigation

Answer

To identify the perpetrator of a cybercrime

Answer

To speed up the forensic analysis process

Question 10

A security team is performing a quantitative risk analysis for a server valued at $100,000. The exposure factor is 0.4 and the annual rate of occurrence is 2. What is the annualized loss expectancy (ALE)?

Accepted Answer

$80,000. The ALE is calculated as SLE × ARO, where SLE = Asset Value × Exposure Factor. Here, SLE = $100,000 × 0.4 = $40,000, and ARO = 2, so ALE = $40,000 × 2 = $80,000. This represents the expected annual monetary loss from the risk event.

Answer

$40,000

Answer

$200,000

Answer

$160,000

Question 11

Which type of firewall is capable of inspecting application-layer data, performing SSL decryption, and integrating intrusion prevention capabilities?

Accepted Answer

Next-generation firewall. A next-generation firewall (NGFW) goes beyond traditional stateful inspection by incorporating deep packet inspection (DPI) of application-layer data, the ability to decrypt and inspect SSL/TLS traffic, and integrated intrusion prevention system (IPS) capabilities. This convergence allows NGFWs to identify and block threats within encrypted sessions and enforce policies based on application identity rather than just ports and protocols.

Answer

Packet filter firewall

Answer

Application proxy firewall

Answer

Stateful firewall

Question 12

A company wants to secure email communications for its employees. They need to ensure message confidentiality and integrity, and also verify the sender's identity. Which protocol uses a hierarchical public key infrastructure (PKI) for email encryption and signing?

Accepted Answer

S/MIME. S/MIME (Secure/Multipurpose Internet Mail Extensions) is the correct answer because it is specifically designed to provide email encryption and digital signing using a hierarchical public key infrastructure (PKI) based on X.509 certificates. This allows the company to ensure message confidentiality (via encryption), integrity (via hashing and signing), and sender authentication (via certificate validation against a trusted root CA).

Answer

PGP

Answer

TLS

Answer

SSH

Question 13

A financial institution requires that no single employee can approve a transaction and also reconcile the account. This is an example of which security principle?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the security principle that prevents a single individual from having conflicting responsibilities, such as both approving a transaction and reconciling the account. This reduces the risk of fraud or error by requiring collusion between two or more people to subvert a process. In a financial system, SoD is enforced through access control mechanisms that assign distinct roles (e.g., 'Transaction Approver' and 'Account Reconciler') with mutually exclusive permissions, often implemented via Role-Based Access Control (RBAC) or attribute-based policies.

Answer

Least privilege

Answer

Defense in depth

Answer

Need to know

Question 14

To enforce separation of duties in a CI/CD pipeline, what architectural principle should be implemented?

Accepted Answer

Require different permissions for committing code vs. deploying to production. Separation of duties in a CI/CD pipeline requires distinct permissions for code commits and production deployments. This ensures that no single individual can introduce and deploy malicious code without oversight, aligning with the principle of least privilege and auditability. By enforcing role-based access control (RBAC) with separate pipelines for build and release, organizations mitigate the risk of unauthorized changes reaching production.

Answer

Allow all developers to deploy their own code to production

Answer

Use a single approval gate without role distinction

Answer

Grant a single DevOps team full access to both source code and deployment

Question 15

A remote user at 203.0.113.5 cannot access the internal web server at 10.0.0.10 over HTTPS. What is the most likely cause of the denial?

Accepted Answer

The ACL is missing a permit rule for the user's IP. The user at 203.0.113.5 is attempting to reach the internal web server over HTTPS (TCP/443). If a firewall with an ACL is implemented to control this traffic, the most direct cause of a silent denial for a specific user is the absence of an explicit permit rule for that user's source IP. Because ACLs process rules sequentially and end with an implicit deny, any traffic not explicitly permitted will be dropped.

Answer

The ACL is applied in the wrong direction

Answer

The firewall is not performing stateful inspection

Answer

The web server is not listening on port 443