CISSP Practice Test 1 — 25 Questions

Question 1

Which of the following is the primary purpose of the CIA triad in information security?

Accepted Answer

To define the core objectives of information security. The CIA triad—Confidentiality, Integrity, and Availability—provides a foundational model for developing security policies and ensuring that data is protected from unauthorized access, tampering, and downtime.

Answer

To establish a framework for risk management

Answer

To ensure compliance with regulatory requirements

Answer

To balance security controls with usability

Question 2

An organization is implementing role-based access control (RBAC). Which two components are fundamental to the RBAC model? (Select TWO.)

Accepted Answer

Constraints such as separation of duties. Constraints such as separation of duties are fundamental to RBAC because they enforce organizational policies by preventing conflicts of interest (e.g., a user cannot both create and approve a purchase order). This is a core component of the RBAC model as defined in the NIST RBAC standard (ANSI INCITS 359-2004), which includes core RBAC, hierarchical RBAC, and constrained RBAC. Constraints ensure that role assignments and permissions adhere to security rules beyond simple role-user mapping.

Answer

Access control lists (ACLs)

Answer

Subjects, objects, and operations

Answer

Security labels and clearances

Question 3

A security analyst discovers that an attacker has gained domain admin privileges by forging a Kerberos TGT using the KRBTGT account hash. Which attack has occurred?

Accepted Answer

Golden ticket attack. A Golden Ticket attack occurs when an attacker compromises the KRBTGT account's password hash and uses it to forge a legitimate-looking Kerberos Ticket Granting Ticket (TGT). Because the KRBTGT account signs all TGTs in the domain, a forged TGT is trusted by every Kerberos-enabled service, granting the attacker persistent domain-wide access — often as domain admin — without needing to authenticate normally.

Answer

Pass-the-ticket attack

Answer

Silver ticket attack

Answer

Kerberos brute force attack

Question 4

A hospital chain collects and stores electronic health records (EHR) for millions of patients. The EHR system is hosted in a private cloud and accessed by doctors, nurses, and administrative staff from various locations. Recently, an internal audit found that several employees shared their login credentials with colleagues to expedite workflows. The hospital must comply with HIPAA and state privacy laws. The security officer wants to implement a solution that minimizes the risk of unauthorized access due to shared credentials while still allowing efficient access for patient care. Which of the following is the BEST approach?

Accepted Answer

Implement single sign-on (SSO) integrated with role-based access control (RBAC) and enforce audit logging of all access. SSO integrated with RBAC reduces the attack surface of shared credentials by centralizing authentication and enforcing least-privilege access based on job roles. Audit logging provides non-repudiation and traceability, which deters credential sharing and satisfies HIPAA's requirement to track access to ePHI. This combination directly addresses the root cause (shared credentials) while maintaining workflow efficiency through seamless authentication.

Answer

Enforce a policy requiring password changes every 30 days and complexity requirements

Answer

Replace passwords with biometric authentication (fingerprint and iris scans) for all users

Answer

Disable remote access to the EHR system and require all access to occur only from within the hospital's LAN

Question 5

An organization's security policy requires that privileged accounts have their passwords changed every 30 days and be monitored. Which solution effectively manages these requirements?

Accepted Answer

Privileged Access Management (PAM) solution. A Privileged Access Management (PAM) solution is specifically designed to manage privileged accounts, enforce password rotation policies (e.g., every 30 days), and provide detailed monitoring and auditing of privileged sessions. It automates password changes, vaults credentials, and logs all access, directly meeting the policy requirements for privileged accounts.

Answer

Role-based access control

Answer

Enterprise password manager

Answer

Single sign-on for administrators

Question 6

An organization is developing a business continuity plan (BCP). The IT department has identified a critical application that must be restored within 4 hours of a disruption. Which metric defines the maximum acceptable time that the application can be unavailable?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable downtime for a critical application after a disruption. In this scenario, the IT department has specified that the application must be restored within 4 hours, which directly aligns with the RTO metric. RTO is a key BCP parameter that drives resource allocation and recovery strategy design.

Answer

Recovery Point Objective (RPO)

Answer

Mean Time to Repair (MTTR)

Answer

Mean Time Between Failures (MTBF)

Answer

Service Level Agreement (SLA)

Question 7

A company wants to ensure that its security policy is effectively enforced across all departments. Currently, the policy is published on the intranet and included in the employee handbook. However, the security team notices that many employees are not following the policy, leading to security incidents. Which of the following would be the most effective way to improve policy enforcement?

Accepted Answer

Require annual signed acknowledgment of the policy. Requiring annual signed acknowledgment ensures that employees are aware of and agree to comply with the policy. This creates a record of acceptance and can be used in disciplinary actions. Publishing on intranet or handbook alone does not guarantee reading or acceptance. Random audits with penalties may enforce compliance but without awareness, employees may not know what is expected.

Answer

Include the policy in the employee handbook

Answer

Conduct random audits and penalize non-compliance

Answer

Publish the policy on the intranet only

Question 8

A network analyst suspects a host on the internal network is sending abnormal amounts of traffic. Which tool should be used to capture and analyze the packets?

Accepted Answer

Wireshark. Wireshark is the correct tool because it is a packet analyzer that captures live network traffic and provides deep inspection of individual packets, including headers and payloads. This allows the analyst to examine the abnormal traffic patterns, identify source/destination IPs, protocols, and payload content to diagnose the issue.

Answer

Nmap

Answer

Netstat

Answer

Traceroute

Question 9

In the context of physical security, which of the following is an example of a preventive control?

Accepted Answer

Mantrap door. A mantrap door is a preventive physical security control because it actively prevents unauthorized entry by requiring authentication and verification before allowing passage through a series of interlocking doors. Unlike monitoring or detection systems, a mantrap physically blocks access until the user is validated, thereby stopping a breach before it occurs.

Answer

Security guards monitoring

Answer

CCTV cameras

Answer

Intrusion detection system

Question 10

Which THREE of the following are valid considerations when implementing data loss prevention (DLP) controls to protect sensitive data? (Select three.)

Accepted Answer

User training to reduce false positives and increase acceptance. User training is a critical component of a successful DLP implementation. Without proper training, users may inadvertently trigger false positives by mishandling data or may attempt to bypass controls they perceive as overly restrictive. Training helps users understand classification labels and proper data handling procedures, reducing the operational burden on security teams and increasing overall acceptance of DLP policies.

Answer

Integration with all third-party applications

Answer

Blocking all data transfers to external devices

Question 11

Which THREE of the following are valid risk response strategies?

Accepted Answer

Transfer. Common risk responses include Avoid, Transfer, Mitigate, and Accept.

Answer

Eliminate

Answer

Ignore

Question 12

A multinational company must comply with the EU General Data Protection Regulation (GDPR) for processing personal data of EU citizens. The company's data protection officer (DPO) has been appointed but reports to the Chief Marketing Officer (CMO). Which compliance issue is most critical?

Accepted Answer

The DPO must report directly to the board of directors or CEO. Under the GDPR, the Data Protection Officer (DPO) must report directly to the highest level of management, typically the board of directors or CEO, to ensure independence and authority. Reporting to the Chief Marketing Officer (CMO) creates a conflict of interest because the CMO oversees marketing activities that often involve extensive personal data processing, compromising the DPO's ability to provide unbiased oversight. This structural subordination is the most critical compliance issue as it directly undermines the DPO's statutory role under Article 38(3) of the GDPR.

Answer

The DPO should not hold any other role within the organization

Answer

The DPO must be a lawyer certified in data protection

Answer

The DPO must be located in the EU

Question 13

A security analyst is reviewing SIEM logs and notices multiple failed login attempts from a single IP address followed by a successful login. The account belongs to a user in finance. Which incident category is most appropriate?

Accepted Answer

Unauthorized access. The sequence of multiple failed login attempts followed by a successful login from the same external IP address indicates a brute-force or password-spraying attack that succeeded. This constitutes unauthorized access because the attacker gained entry to an account without legitimate authorization, violating the confidentiality and integrity of the finance user's account.

Answer

DoS

Answer

Insider threat

Answer

Social engineering

Question 14

A company implements a centralized authentication system using RADIUS for network devices. The security team notices that after a user's password is changed in Active Directory, the user can still authenticate to network devices using the old password for up to 30 minutes. What is the most likely cause?

Accepted Answer

Active Directory replication delay. When a password is changed in Active Directory, the change is processed by a specific Domain Controller (DC) and urgently replicated to the PDC Emulator. However, if the RADIUS server queries a different DC (such as one in a different AD site), that DC will not know about the password change until normal replication occurs. Inter-site replication typically occurs on a schedule (often 15 to 30 minutes). During this replication window, the DC queried by the RADIUS server still holds the old password hash as valid, allowing the user to successfully authenticate with their old password.

Answer

Kerberos ticket lifetime

Answer

Network devices caching authentication responses

Answer

RADIUS server caching credentials

Question 15

A security architect is reviewing a web application's design and identifies several potential vulnerabilities. Which TWO of the following are effective mitigations for cross-site scripting (XSS) attacks?

Accepted Answer

Enabling Content Security Policy (CSP). Option A, enabling Content Security Policy (CSP), is correct because CSP is a browser-enforced response header (e.g., Content-Security-Policy: default-src 'self') that restricts which scripts may execute, blocking inline scripts and untrusted external sources, which directly mitigates XSS. Option E, using output encoding, is correct because encoding untrusted data for the correct context (HTML entity, JavaScript, URL, or CSS encoding) ensures injected markup is rendered as inert text rather than executable script, which is the primary defense against XSS. Option B, using CSRF tokens, does not belong because anti-CSRF tokens defend against cross-site request forgery, a different attack that abuses a victim's authenticated session, not script injection. Option C, disabling client-side scripts entirely, does not belong because it is an impractical, functionality-breaking measure rather than a targeted XSS mitigation and is not a standard remediation. Option D, implementing parameterized queries, does not belong because prepared statements with bound parameters mitigate SQL injection, not XSS.

Answer

Using CSRF tokens

Answer

Disabling client-side scripts entirely

Answer

Implementing parameterized queries

Question 16

A security analyst discovers that an employee shared confidential customer data with an unauthorized third party. The analyst reports this to the CISO, who decides to terminate the employee. Which ethical principle from the (ISC)² Code of Ethics is most directly violated by the employee?

Accepted Answer

Provide diligent and competent service to principals. Disclosing confidential customer or corporate data that an employee has access to via their employer violates the trust and privileges granted by the employer (the principal). According to the (ISC)² Code of Ethics, the canon 'Provide diligent and competent service to principals' requires members to respect the trust and privileges granted to them and to preserve the value of the principal's systems, applications, and information. Therefore, leaking confidential data directly violates this canon.

Answer

Protect society, the common good, necessary public trust and confidence, and the infrastructure

Answer

Advance and protect the profession

Answer

Act honorably, honestly, justly, responsibly, and legally

Question 17

After a recent security audit, a network administrator discovers that an attacker has been intercepting traffic by associating with a legitimate access point's MAC address and broadcasting a stronger signal. Which type of attack has occurred?

Accepted Answer

Evil twin attack. Evil twin attack. This attack involves an attacker setting up a rogue access point that mimics a legitimate access point by spoofing its MAC address (BSSID) and broadcasting a stronger signal, causing clients to associate with the attacker's device instead of the legitimate AP. The key distinction is the active impersonation of a specific legitimate AP, not just the presence of an unauthorized AP.

Answer

Rogue access point

Answer

Karma attack

Answer

ARP spoofing

Question 18

Which access control model allows the owner of a resource to determine who can access it and what permissions they have?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) allows the resource owner to control access at their discretion.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Question 19

A company recently suffered a data breach where an attacker was able to intercept network traffic and read sensitive data. Which network security control should be implemented to prevent this type of attack?

Accepted Answer

Encryption at the network layer (e.g., IPsec). IPsec operates at the network layer (Layer 3) and provides encryption of the entire IP packet, including the payload, ensuring that even if an attacker intercepts the traffic, the data remains unreadable. This directly addresses the scenario where an attacker reads sensitive data from intercepted network traffic, as IPsec can be configured in transport mode for end-to-end encryption or tunnel mode for VPNs.

Answer

Network segmentation

Answer

Intrusion prevention system (IPS)

Answer

Strong password policies

Question 20

A large financial institution is migrating its core banking system to a private cloud. The architecture must protect against data leakage between different business units sharing the same physical infrastructure. The system uses a hypervisor and virtual machines. Each business unit has its own security classification. The security requirement is that no VM belonging to a lower classification should be able to read data from a higher classification VM, even if the hypervisor is compromised. The architect proposes using mandatory access control at the hypervisor level. However, the IT team notes that a hypervisor compromise could bypass MAC. Additionally, they need to ensure that data at rest is encrypted and keys are stored securely. Which of the following would BEST meet the requirement?

Accepted Answer

Use a hardware security module (HSM) to manage keys and implement full memory encryption using AES-256 with integrity protection, and use a trusted execution environment (TEE) for each VM, ensuring that even the hypervisor cannot access VM memory.. It addresses the core requirement: preventing data leakage even if the hypervisor is compromised. By using a hardware security module (HSM) for key management, full memory encryption with AES-256 and integrity protection, and a trusted execution environment (TEE) for each VM, the solution ensures that VM memory is encrypted and isolated at the hardware level. The hypervisor, even if compromised, cannot access the decrypted memory of a VM, thus enforcing the security classification separation regardless of hypervisor integrity.

Answer

Implement network segmentation with VLANs and IPsec encryption between VMs.

Answer

Deploy a data loss prevention (DLP) system to monitor data transfers between VMs.

Answer

Use a public key infrastructure (PKI) to issue certificates for each VM and enforce mutual TLS for all inter-VM communication.