CISSP Practice Test 25 — 15 Questions

Question 1

A company has a headquarters and three branch offices connected via MPLS VPN. Recently, they deployed a new VoIP system across all sites. Users report intermittent call drops and poor voice quality during peak business hours. The network team suspects packet loss and jitter are the cause. The IT manager wants to verify the issue without affecting production traffic. Which of the following is the best course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use IP SLA to generate test traffic and measure jitter and packet loss.. IP SLA can generate synthetic traffic to measure network performance metrics like jitter, latency, and packet loss without impacting production traffic. Creating a full packet capture is resource-intensive and may affect performance. Duplicating traffic requires additional configuration and may not reflect real-time issues. Increasing bandwidth is a solution, not a diagnostic step.

Answer

Deploy a full packet capture on all branch routers.

Answer

Conduct a network assessment by duplicating traffic to a monitoring tool.

Answer

Increase the MPLS bandwidth immediately.

Question 2

A security manager is planning a penetration test and needs to ensure proper rules of engagement are established. Which TWO of the following are essential components of the rules of engagement?

Accepted Answer

Scope definition including in-scope systems. Scope definition (B) is essential because it explicitly lists in-scope systems, IP ranges, and exclusions, preventing unauthorized access and legal liability. Written authorization from management (C) provides the legal and contractual basis for the test, ensuring the penetration test is conducted with informed consent and documented approval.

Answer

Vulnerability scoring methodology

Answer

Previous test results

Answer

List of tools to be used

Question 3

A company is designing an access control system for a highly sensitive database. They want to ensure that only authorized users can access data, and that access is automatically revoked when the user's context changes (e.g., job role change). Which model BEST meets these requirements?

Accepted Answer

Attribute-based access control (ABAC) with dynamic policy evaluation.. ABAC with dynamic policy evaluation is the best fit because it uses attributes (user, resource, environment) to make real-time access decisions. This allows access to be automatically revoked when context changes, such as a job role update, without manual intervention or periodic reviews.

Answer

Discretionary access control (DAC) with access control lists.

Answer

Role-based access control (RBAC) with periodic reviews.

Answer

Mandatory access control (MAC) with security labels.

Question 4

A network administrator notices that users in the accounting department can access the internet but are unable to access the internal payroll server (10.10.10.50). The firewall rule allows traffic from the accounting subnet (10.10.20.0/24) to the payroll server. What is the most likely issue?

Accepted Answer

The payroll server's default gateway does not have a route back to 10.10.20.0/24.. The most likely issue is that the payroll server's default gateway does not have a route back to the accounting subnet (10.10.20.0/24). Even if the firewall permits outbound traffic from the accounting subnet to the payroll server, the return traffic from the server must be routed back through the firewall or a router that knows how to reach 10.10.20.0/24. Without a return route, the server's response packets are dropped, causing a one-way communication failure.

Answer

DNS is not resolving the payroll server's IP address.

Answer

The firewall rule is applied to the outbound interface only.

Answer

The accounting subnet is blocked by an implicit deny rule.

Question 5

During a penetration test, the tester successfully gains access to a server and then attempts to move laterally to other systems. This phase is known as:

Accepted Answer

Post-exploitation and lateral movement. After initial access is gained, the phase where the tester moves from the compromised host to other systems within the network is specifically called post-exploitation and lateral movement. This involves using the foothold to pivot, escalate privileges, and access additional resources, which is distinct from the initial exploitation step.

Answer

Scanning and enumeration

Answer

Exploitation

Answer

Reconnaissance

Question 6

A network architect is designing a network to comply with PCI DSS requirements that cardholder data must be encrypted during transmission over open networks. Which protocol should be used for encrypting traffic between a point-of-sale (POS) terminal and the payment gateway?

Accepted Answer

TLS 1.2. TLS 1.2 is the correct choice because it is a widely accepted, secure protocol for encrypting data in transit, and it meets PCI DSS requirements for strong cryptography. PCI DSS explicitly prohibits the use of SSL and early TLS versions (1.0) due to known vulnerabilities, and TLS 1.2 provides robust cipher suites and forward secrecy.

Answer

TLS 1.0

Answer

SSH

Answer

SSL 3.0

Question 7

A security analyst detects an attack where the attacker sends forged ARP messages to associate the attacker's MAC address with the IP address of the default gateway. Which OSI layer is primarily targeted by this attack?

Accepted Answer

Layer 2 – Data Link. ARP operates at Layer 2 (Data Link) because it maps IP addresses (Layer 3) to MAC addresses (Layer 2) within a single broadcast domain. By forging ARP replies, the attacker poisons the ARP cache of hosts, causing frames destined for the default gateway to be sent to the attacker's MAC address. This directly targets the address resolution process that bridges Layer 2 and Layer 3, but the attack itself is executed at the Data Link layer.

Answer

Layer 4 – Transport

Answer

Layer 3 – Network

Answer

Layer 1 – Physical

Question 8

An organization is implementing a security information and event management (SIEM) system. Which THREE factors are most critical for the SIEM to provide actionable security insights?

Accepted Answer

Real-time alerting capabilities. Real-time alerting is critical because SIEM must detect and notify security teams of ongoing threats within seconds to minutes, enabling timely incident response. Without near-instantaneous correlation and alerting, attackers can achieve their objectives (e.g., lateral movement, data exfiltration) before the organization even knows an incident occurred. This aligns with the NIST SP 800-61 incident response lifecycle, where detection and analysis must be rapid to contain damage.

Answer

Ability to store raw logs for one year

Answer

Low false-positive rate

Question 9

Which TWO of the following are key objectives of a security assessment? (Select exactly 2.)

Accepted Answer

Identify vulnerabilities in systems and applications.. A is correct because identifying vulnerabilities is a primary objective of a security assessment, such as a vulnerability scan or penetration test, which systematically discovers weaknesses in systems and applications (e.g., missing patches, misconfigurations, or insecure code). B is correct because assessing the effectiveness of existing security controls (e.g., firewalls, IDS/IPS, access controls) is a core goal, often achieved through control testing or validation to determine if controls are properly implemented and functioning as intended.

Answer

Exploit vulnerabilities to gain unauthorized access.

Answer

Prioritize threats based on business impact.

Answer

Implement new security controls to address findings.

Question 10

Which THREE of the following are valid countermeasures against buffer overflow attacks?

Accepted Answer

Stack canaries. Stack canaries are correct because they place a known value (canary) between the buffer and control data on the stack. Before a function returns, the canary is checked; if it has been overwritten (indicating a buffer overflow), the program terminates, preventing code execution. This directly detects stack-based buffer overflows before they can hijack the return address.

Answer

Full disk encryption

Answer

Input validation using allowlists

Question 11

Which wireless security protocol replaces the pre-shared key (PSK) authentication with Simultaneous Authentication of Equals (SAE) to provide stronger security and forward secrecy?

Accepted Answer

WPA3. WPA3 replaces the Pre-Shared Key (PSK) authentication used in WPA2 with Simultaneous Authentication of Equals (SAE), defined in IEEE 802.11-2016 and specified in RFC 7664. SAE provides forward secrecy by using a Diffie-Hellman key exchange that ensures even if the long-term password is compromised, past session keys remain secure. This eliminates vulnerabilities to offline dictionary attacks that plague WPA2-PSK.

Answer

WEP

Answer

WPA2 with TKIP

Answer

WPA2 with CCMP

Question 12

A company wants to test the effectiveness of its security controls without causing disruption. Which type of assessment is most appropriate?

Accepted Answer

Vulnerability scan. A vulnerability scan is the most appropriate assessment because it passively identifies known vulnerabilities (e.g., missing patches, misconfigurations) without exploiting them, ensuring no disruption to production systems. Unlike active exploitation tests, vulnerability scanners use non-intrusive probes (e.g., banner grabbing, version fingerprinting) that do not trigger denial-of-service or system crashes. This aligns with the requirement to test control effectiveness while maintaining operational stability.

Answer

Penetration test

Answer

Security audit

Answer

Red team exercise

Question 13

A security analyst runs a vulnerability scan and sees the output shown in the exhibit. The analyst wants to remediate the most critical issue first. Which action should the analyst take to address the SQL injection vulnerability?

Accepted Answer

Rewrite the database query to use parameterized statements.. The correct action to remediate SQL injection is to use parameterized statements (prepared statements), which separate SQL code from data and prevent injection entirely. Option A (WAF) is a compensating control but does not fix the root cause. Option C (input validation) can be bypassed and is not a definitive solution. Option D (output encoding) addresses XSS, not SQL injection.

Answer

Deploy a web application firewall (WAF) with SQL injection signatures.

Answer

Implement strict input validation on the 'id' parameter.

Answer

Encode all output from the 'id' parameter using HTML entity encoding.

Question 14

A security analyst is conducting a review of aggregated logs from firewalls, IDS, and servers to detect anomalous behavior. This activity is best described as:

Accepted Answer

Security log analysis. Security log analysis involves the systematic review of logs from firewalls, IDS, and servers to identify patterns, anomalies, or indicators of compromise. This activity directly matches the scenario of detecting anomalous behavior through aggregated log review, which is a core practice in security monitoring and incident detection.

Answer

Risk assessment

Answer

Vulnerability scanning

Answer

Penetration testing

Question 15

A multinational corporation has experienced several security incidents where terminated employees retained access to internal systems for weeks after their departure. The HR department manually terminates accounts by sending notifications to IT, but the process is often delayed or missed. The company uses an identity management system (IDM) that supports automated provisioning and deprovisioning. The security team is tasked with reducing the risk of unauthorized access by former employees. Which of the following is the most effective course of action?

Accepted Answer

Integrate the HR system with the identity management system for automated deprovisioning. Integrating the HR system with the identity management (IDM) system enables automated deprovisioning, ensuring that when an employee is terminated in HR records, the IDM immediately triggers account disablement across all connected systems. This eliminates the manual delay and human error inherent in the current notification-based process, directly addressing the root cause of the risk.

Answer

Require terminated employees to change their passwords upon exit

Answer

Increase frequency of access reviews and audits to identify stale accounts

Answer

Implement a user self-service portal for managers to disable accounts