CISSP Practice Test 24 — 15 Questions

Question 1

A company is planning to conduct a penetration test. Which THREE of the following should be included in the rules of engagement?

Accepted Answer

Emergency stop criteria. Emergency stop criteria define the conditions under which the penetration test must be immediately halted, such as causing a production system outage or detecting unauthorized data access. This is a critical component of the rules of engagement (RoE) to ensure the test does not cause unacceptable business impact, aligning with the principle of minimizing risk during security assessments.

Answer

The tester's personal contact information

Answer

Specific vulnerabilities to be exploited

Question 2

Which of the following is a primary benefit of using an application programming interface (API) gateway in a microservices architecture from a security perspective?

Accepted Answer

It provides a centralized point for authentication and rate limiting. An API gateway acts as a single entry point for all client requests in a microservices architecture. It centralizes cross-cutting security concerns such as authentication (e.g., validating OAuth 2.0 tokens or JWT) and rate limiting (e.g., enforcing requests per second per client), offloading these tasks from individual microservices. This reduces attack surface and ensures consistent enforcement of security policies across the entire system.

Answer

It eliminates the need for encryption

Answer

It replaces the need for a web application firewall

Answer

It allows direct database access to services

Question 3

An organization wants to verify that its security policies are being followed by employees. Which testing method is most appropriate?

Accepted Answer

Compliance audit. A compliance audit is the most appropriate method to verify that security policies are being followed because it systematically compares actual practices, configurations, and controls against documented policy requirements. Unlike technical scans that identify vulnerabilities, a compliance audit focuses on adherence to rules, standards, and procedures, often using checklists derived from frameworks like ISO 27001 or NIST SP 800-53.

Answer

Vulnerability scan

Answer

Risk assessment

Answer

Penetration test

Question 4

Which of the following describes the concept of 'least privilege' in the context of access control?

Accepted Answer

Users are granted only the permissions necessary to perform their job functions. Least privilege is a fundamental access control principle that mandates users be granted only the permissions necessary to perform their specific job functions. This minimizes the attack surface by reducing unnecessary access to sensitive resources, limiting potential damage from accidental or malicious actions. In practice, this is enforced through mechanisms like discretionary access control (DAC) or role-based access control (RBAC) with granular permission sets, ensuring no user has more rights than required.

Answer

Access is granted on a need-to-know basis but with maximum permissions

Answer

Access is based on roles and seniority

Answer

Users have access to all resources unless explicitly denied

Question 5

A development team is fixing a stored cross-site scripting (XSS) vulnerability in a web application that displays user comments. The application stores comments in a database and renders them in HTML. Which of the following is the most secure approach to prevent XSS?

Accepted Answer

Apply output encoding based on the context (e.g., HTML entity encoding). Output encoding (C) is the most secure approach because it neutralizes malicious scripts at the point of rendering, ensuring that user-controlled data is treated as text rather than executable code. For HTML contexts, HTML entity encoding (e.g., `<script>`) prevents the browser from interpreting injected tags, regardless of how the data was stored. This aligns with the defense-in-depth principle and is the primary mitigation for stored XSS as recommended by OWASP.

Answer

Use Content Security Policy (CSP) headers to restrict script execution

Answer

Sanitize input by removing all HTML tags before storing

Answer

Store comments in a separate domain to isolate them

Question 6

In the context of physical security, which of the following is an example of a preventive control?

Accepted Answer

Mantrap door. A mantrap door is a preventive physical security control because it actively prevents unauthorized entry by requiring authentication and verification before allowing passage through a series of interlocking doors. Unlike monitoring or detection systems, a mantrap physically blocks access until the user is validated, thereby stopping a breach before it occurs.

Answer

Security guards monitoring

Answer

CCTV cameras

Answer

Intrusion detection system

Question 7

Which THREE of the following are control families defined in NIST SP 800-53? (Choose three.)

Accepted Answer

Access Control (AC). Access Control (AC) is a control family in NIST SP 800-53 that encompasses policies, procedures, and mechanisms for managing user permissions, authentication, and authorization. It includes controls like AC-2 (Account Management) and AC-3 (Access Enforcement), which are fundamental to enforcing least privilege and separation of duties.

Answer

Data Encryption (DE)

Answer

Business Continuity (BC)

Question 8

A network administrator is reviewing the security of the company's VPN solution. They discover that the current VPN uses PPTP. Which TWO of the following are significant security weaknesses associated with PPTP?

Accepted Answer

It uses MS-CHAPv2 authentication which is susceptible to brute-force attacks. PPTP uses Microsoft Point-to-Point Encryption (MPPE), which relies on the RC4 stream cipher. RC4 has known weaknesses, including statistical biases and the ability to recover plaintext after encrypting a large volume of traffic, making it considered weak for modern security requirements. Additionally, PPTP's default authentication protocol is MS-CHAPv2, which is vulnerable to offline brute-force attacks because its challenge-response mechanism uses a weak DES-based hash that can be cracked with tools like Asleap or ChapCrack.

Answer

It relies on IKE for key exchange

Answer

It supports strong authentication with digital certificates

Answer

It provides perfect forward secrecy

Question 9

A healthcare organization is moving patient records to a cloud storage service. Which of the following is the MOST important requirement to ensure data security and compliance with HIPAA?

Accepted Answer

A signed Business Associate Agreement (BAA) with the cloud provider. Under HIPAA, a covered entity must have a signed Business Associate Agreement (BAA) with any cloud service provider that creates, receives, maintains, or transmits protected health information (PHI). Without a BAA, the provider is not contractually bound to safeguard PHI, making the organization non-compliant regardless of technical controls. While encryption and MFA are important security measures, they cannot substitute for the legal and regulatory requirement of a BAA.

Answer

Multi-factor authentication for all cloud access

Answer

Encryption of data in transit using TLS 1.2

Answer

Encryption of data at rest using AES-256

Question 10

Which TWO are common techniques to defend against VLAN hopping attacks? (Choose two.)

Accepted Answer

Disable DTP. Disabling Dynamic Trunking Protocol (DTP) on all switch ports prevents interfaces from automatically negotiating trunk links, which is the primary vector for VLAN hopping attacks. By setting ports to 'switchport mode access' and disabling DTP with 'switchport nonegotiate', an attacker cannot trick the switch into forming a trunk and gain access to traffic from multiple VLANs.

Answer

Enable BPDU Guard

Answer

Use Private VLANs

Answer

Enable Port Security

Question 11

A security architect is designing a system that must enforce the principle of least privilege at the operating system level. Which mechanism should be implemented to grant processes only the minimal permissions required for their tasks?

Accepted Answer

Mandatory Access Control (MAC) using SELinux policies. SELinux implements Mandatory Access Control (MAC) by enforcing a system-wide security policy that overrides user and process permissions. This allows the security architect to define precise rules (e.g., via Type Enforcement) that grant each process only the minimal set of resources it needs, effectively enforcing least privilege at the OS level regardless of user identity.

Answer

Role-Based Access Control (RBAC) with fine-grained roles

Answer

Discretionary Access Control (DAC) with user permissions

Answer

Mandatory Integrity Control (Biba)

Question 12

A security assessor is conducting a penetration test and needs to identify live hosts on a network without causing disruption. Which of the following techniques should the assessor use FIRST?

Accepted Answer

Ping sweep using ICMP echo requests.. A ping sweep using ICMP echo requests (ICMP Type 8) is the most appropriate first step for identifying live hosts on a network because it is a standard, low-disruption method that quickly determines host availability. ICMP echo requests are typically allowed by default on many networks and do not initiate full protocol handshakes or service interactions, minimizing the risk of triggering alarms or causing instability. This aligns with the penetration testing methodology of starting with passive or low-impact reconnaissance before escalating to more intrusive techniques.

Answer

ARP scan to discover hosts on the local subnet.

Answer

Vulnerability scan of all IP addresses in the target range.

Answer

Full TCP port scan on common ports.

Question 13

A red team exercise is planned to simulate a sophisticated adversary. The blue team is aware of the exercise but not the exact methods. The red team is given a budget to acquire attack tools. What is the primary advantage of this approach over a traditional penetration test?

Accepted Answer

It evaluates the organization's detection and response capabilities. A red team exercise with a known-but-not-detailed blue team specifically tests the organization's detection and response capabilities under realistic adversarial conditions. Unlike a traditional penetration test, which focuses on identifying vulnerabilities, this approach evaluates how well the blue team can detect, analyze, and respond to stealthy, multi-stage attacks that mimic a sophisticated adversary. The red team's budget for attack tools allows them to simulate advanced persistent threats (APTs) that challenge the blue team's security operations center (SOC) processes and incident response procedures.

Answer

It ensures that the blue team is not alerted to the test

Answer

It provides comprehensive vulnerability coverage

Answer

It is more cost-effective than a penetration test

Question 14

A security team is reviewing network segmentation strategies. Which TWO of the following are benefits of using VLANs? (Select TWO.)

Accepted Answer

They allow logical grouping of devices regardless of physical location. VLANs operate at Layer 2 (Data Link Layer) and allow network administrators to segment devices into distinct broadcast domains based on logical criteria such as department or function, regardless of their physical location on the network. This logical grouping reduces the scope of broadcast traffic because broadcasts are confined to the VLAN, not the entire physical network. By containing broadcasts, VLANs improve network performance and security by limiting unnecessary traffic and isolating potential threats.

Answer

They provide encryption of network traffic

Answer

They eliminate the need for firewalls

Answer

They provide inherent protection against ARP spoofing

Question 15

A security team is selecting tools for code review. Which THREE of the following are characteristics of Static Application Security Testing (SAST) tools?

Accepted Answer

They require access to the source code. SAST tools analyze source code, bytecode, or binary code without executing the application. They require access to the source code to perform static analysis, scanning for security flaws such as injection vulnerabilities, buffer overflows, and insecure cryptographic implementations. This allows developers to identify and fix vulnerabilities early in the development lifecycle, before the code is compiled or deployed.

Answer

They are typically used after deployment

Answer

They analyze the application while it is running