CISSP Practice Test 2 — 25 Questions

Question 1

A software company uses a third-party library that has a known critical vulnerability. The library is used extensively and rewriting the code would take months. What is the BEST immediate action to reduce risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a Web Application Firewall (WAF) rule to block exploitation. Implementing a Web Application Firewall (WAF) rule to block exploitation provides an immediate, compensating control that mitigates the known vulnerability without requiring code changes. This is the best immediate action because it buys time for a permanent fix while reducing risk, aligning with the principle of defense in depth. The WAF can inspect HTTP/HTTPS traffic for attack patterns (e.g., SQL injection, path traversal) specific to the vulnerable library and block malicious requests at the application layer.

Answer

Remove the library from the codebase immediately

Answer

Disable the vulnerable feature in the library

Answer

Increase logging and monitoring to detect exploitation attempts

Question 2

A company has implemented a new web application firewall (WAF) and wants to test its effectiveness. Which of the following testing methods would provide the MOST accurate assessment?

Accepted Answer

Conduct a penetration test that includes attempts to bypass the WAF.. A penetration test that actively attempts to bypass the WAF provides the most accurate assessment because it simulates a real attacker's behavior, testing the WAF's ability to detect and block evasion techniques such as HTTP parameter pollution, encoding obfuscation, and SQL injection payload splitting. This method validates the WAF's effectiveness under realistic adversarial conditions, revealing gaps that passive or disabled-state testing cannot uncover.

Answer

Perform a vulnerability scan on the web application with the WAF disabled.

Answer

Review the WAF logs for any blocked attacks.

Answer

Run an automated web application scanner against the application with the WAF enabled.

Question 3

A security architect is designing a network for a high-security data center. The requirement is to ensure that even if an attacker compromises one server, they cannot easily move laterally to other servers in the same data center. Which network design principle should be applied?

Accepted Answer

Microsegmentation (e.g., using virtual firewalls on each hypervisor). Microsegmentation (D) is the correct network design principle because it enforces granular, per-workload firewall rules—often implemented via virtual firewalls on each hypervisor or using VXLAN/ACL policies—that restrict east-west traffic between servers. Even if an attacker compromises one server, microsegmentation prevents lateral movement by allowing only explicitly permitted inter-server communication, effectively isolating the breach to the compromised host.

Answer

Principle of least privilege

Answer

Defense in depth

Answer

Single point of failure elimination

Question 4

A company deploys DNSSEC to protect its DNS infrastructure. Which cryptographic operation does DNSSEC primarily use to ensure the authenticity and integrity of DNS data?

Accepted Answer

Digital signatures of DNS records. DNSSEC primarily uses digital signatures to ensure the authenticity and integrity of DNS data. Each DNS zone is signed with a private key, and resolvers verify the signatures using the corresponding public key, which is published as a DNSKEY record. This process allows the resolver to cryptographically confirm that the data has not been modified in transit and originates from the authoritative source.

Answer

Hashing of DNS responses without keys

Answer

Transport Layer Security for DNS

Answer

Symmetric encryption of DNS queries

Question 5

Drag and drop the steps for a disaster recovery (DR) plan activation in the correct order.

Accepted Answer

1. Declare disaster, 2. Notify stakeholders, 3. Failover to alternate site, 4. Restore operations, 5. Test and resume normal operations. The correct order for DR plan activation is: declare disaster first to initiate the plan, then notify all stakeholders, perform failover to the alternate site, restore operations from backups or other means, and finally test and resume normal operations. This sequence ensures that activation is acknowledged, resources are aware, critical systems are recovered, and operations can safely return to normal after validation.

Answer

1. Notify stakeholders, 2. Declare disaster, 3. Failover to alternate site, 4. Test and resume normal operations, 5. Restore operations

Answer

1. Declare disaster, 2. Failover to alternate site, 3. Notify stakeholders, 4. Restore operations, 5. Test and resume normal operations

Answer

1. Declare disaster, 2. Notify stakeholders, 3. Restore operations, 4. Failover to alternate site, 5. Test and resume normal operations

Question 6

A company wants to securely transfer files between systems over SSH. Which protocol should they use to leverage the existing SSH infrastructure and provide both authentication and encryption?

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol) is the correct choice because it operates over the SSH protocol (typically port 22), leveraging its existing authentication and encryption mechanisms. Unlike FTPS, which adds SSL/TLS to FTP, SFTP is designed as a secure file transfer subsystem of SSH, providing both confidentiality and integrity without requiring additional infrastructure.

Answer

FTPS

Answer

TFTP

Answer

SCP

Question 7

A data custodian is responsible for implementing controls to protect data. Which TWO of the following are typical responsibilities of a data custodian? (Select 2)

Accepted Answer

Performing regular backups of data. Data custodians handle day-to-day management, implement security controls, and perform backups and restoration.

Answer

Classifying data according to sensitivity

Answer

Defining data usage policies

Answer

Determining data retention periods

Question 8

A multinational corporation is expanding its operations into a new country with strict data protection laws. The company needs to ensure compliance while maintaining operational efficiency. Which of the following is the BEST approach to manage this risk?

Accepted Answer

Adopt a privacy-by-design framework and conduct a Data Protection Impact Assessment (DPIA) before launching operations.. A privacy-by-design framework ensures data protection is embedded into systems and processes from the outset, while a Data Protection Impact Assessment (DPIA) systematically identifies and mitigates privacy risks specific to the new jurisdiction. This proactive, risk-based approach aligns with regulatory requirements like the GDPR and demonstrates due diligence, reducing the likelihood of non-compliance and operational disruption.

Answer

Accept the risk of non-compliance as a cost of doing business and set aside a contingency fund for fines.

Answer

Assign legal counsel to review local laws and implement a one-time compliance checklist.

Answer

Create a uniform global privacy policy that satisfies all jurisdictions with minimal adjustments.

Question 9

A security engineer is troubleshooting a network where internal users can access internet websites but cannot reach the company's external VPN server (IP 203.0.113.50, UDP port 500). The firewall rule for VPN traffic is correctly configured. What is the most likely cause?

Accepted Answer

The VPN server is not listening on UDP port 500.. The symptom—internal users can reach internet websites but cannot reach the external VPN server—indicates a host-level issue rather than a network or firewall problem. Since the firewall rule for VPN traffic is correctly configured and other traffic flows normally, the most likely cause is that the VPN server itself is not listening on UDP port 500, which is the standard port for IPsec IKE (Internet Key Exchange) traffic. This could be due to a misconfiguration, service failure, or the server being configured to use a different port or protocol.

Answer

The VPN server is using TCP port 443 instead of UDP 500.

Answer

The firewall rule is applied to the wrong interface.

Answer

The firewall is stateful and blocking the return traffic.

Question 10

A security analyst is reviewing logs from a web application firewall (WAF) and notices multiple requests containing the payload "1=1--" in the query string. The analyst suspects a SQL injection attack. Which of the following is the BEST immediate action to validate the suspicion?

Accepted Answer

Check the application logs for database error messages.. Checking the application logs for database error messages is the best immediate action because SQL injection attempts often trigger verbose database errors (e.g., MySQL syntax errors, ODBC error codes) that confirm the injection point. This passive validation requires no additional tools and directly correlates the WAF alert with backend behavior, avoiding the risk of actively exploiting a live system.

Answer

Use a manual SQL injection tool like sqlmap to test the application.

Answer

Implement prepared statements in the application code.

Answer

Run a vulnerability scan with a SQL injection detection module.

Question 11

A business continuity coordinator is planning a test of the disaster recovery plan. Which type of test involves a walk-through of the plan with key stakeholders without actually invoking the technical recovery?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based session where key stakeholders walk through the disaster recovery plan step-by-step without invoking any technical recovery procedures. This validates roles, responsibilities, and decision-making processes in a low-risk environment, ensuring the plan's logic is sound before any actual failover or system restoration is attempted.

Answer

Full interruption test

Answer

Checklist review

Answer

Parallel test

Question 12

A company uses BGP to exchange routes with its ISP. To prevent prefix hijacking, which mechanism should be implemented?

Accepted Answer

RPKI. RPKI (Resource Public Key Infrastructure) is the correct mechanism because it cryptographically validates the origin AS of a BGP route announcement, preventing prefix hijacking by ensuring that only the legitimate owner of an IP prefix can announce it. Unlike other options, RPKI provides a trust anchor based on the IP address allocation hierarchy, making it the only solution that directly addresses the root cause of hijacking—unauthorized origin AS claims.

Answer

BGP MD5 authentication

Answer

BGP community values

Answer

AS-path filtering

Question 13

During a security assessment, a consultant discovers that a legacy VPN solution uses MS-CHAPv2 for authentication and does not support IKE. The protocol is known to be vulnerable to dictionary attacks. Which VPN protocol is most likely being used?

Accepted Answer

PPTP. MS-CHAPv2 is a Microsoft proprietary authentication protocol used by PPTP (Point-to-Point Tunneling Protocol). PPTP does not support IKE (Internet Key Exchange) and relies on MS-CHAPv2, which is vulnerable to dictionary attacks due to its weak hashing and lack of mutual authentication. The combination of MS-CHAPv2 authentication and the absence of IKE support directly points to PPTP as the VPN protocol in use.

Answer

IPsec with IKEv2

Answer

SSL/TLS VPN

Answer

L2TP/IPsec

Question 14

An organization is implementing a bring-your-own-device (BYOD) policy. The security architect must ensure that corporate data on the device is protected from unauthorized access if the device is lost or stolen, while minimizing impact on user privacy. Which solution is most appropriate?

Accepted Answer

Use mobile device management (MDM) to create a secure container for corporate apps and data. A secure container (often implemented via MDM with app wrapping or per-app VPN) creates an encrypted, isolated partition on the device for corporate apps and data. This ensures that if the device is lost or stolen, the corporate data remains encrypted and inaccessible without the container's authentication, while personal apps and data outside the container remain untouched, thus minimizing privacy impact.

Answer

Require employees to use company-issued devices only

Answer

Disable camera and microphone on the device

Answer

Full device encryption with remote wipe capability

Question 15

An organization is adopting a microservices architecture. Which security control is most effective for ensuring that inter-service communication is authenticated and authorized?

Accepted Answer

Implementing mutual TLS (mTLS) between services. Mutual TLS (mTLS) is the most effective control because it provides both authentication and encryption for inter-service communication. In a microservices architecture, mTLS ensures that each service presents a valid X.509 certificate, and both sides verify each other's identity before any data exchange, preventing unauthorized or spoofed services from communicating. This aligns with the principle of zero trust, where no implicit trust is granted based on network location.

Answer

Relying on network segmentation and IP allowlisting

Answer

Using JSON Web Tokens (JWT) in the HTTP header

Answer

Using pre-shared API keys for each service pair

Question 16

Which type of security testing involves analyzing source code for vulnerabilities without executing the code?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It operates by scanning the codebase for patterns known to be insecure (e.g., SQL injection via string concatenation) using techniques like data flow analysis, taint tracking, and pattern matching, all performed at rest.

Answer

Penetration testing

Answer

IAST

Answer

DAST

Question 17

During a penetration test, an ethical hacker sets up a rogue access point with the same SSID as the corporate network and broadcasts a stronger signal. Users inadvertently connect to the rogue AP, allowing the hacker to capture credentials. What is this attack called?

Accepted Answer

Evil twin attack. Evil twin attack. This attack involves setting up a rogue access point that broadcasts the same SSID as a legitimate corporate network but with a stronger signal, causing users to connect to it instead. Once connected, the attacker can capture credentials or other sensitive data through man-in-the-middle techniques, exploiting the lack of mutual authentication in many Wi-Fi implementations.

Answer

Deauthentication attack

Answer

ARP spoofing

Answer

Karma attack

Question 18

A company's security team discovers that an employee inadvertently shared sensitive customer data via a public cloud storage link. The incident response team contains the breach and notifies affected customers. Which of the following risk management strategies would BEST prevent recurrence?

Accepted Answer

Deploy a Data Loss Prevention (DLP) solution that monitors and controls sharing of sensitive data.. A Data Loss Prevention (DLP) solution provides automated, policy-based monitoring and control of sensitive data being shared via public cloud storage links. Unlike awareness training (which relies on human behavior) or blanket blocking (which hinders productivity), DLP can inspect content in real time using pattern matching, fingerprinting, or exact data matching to prevent unauthorized sharing before it occurs, directly addressing the root cause of inadvertent exposure.

Answer

Block all access to public cloud storage services from corporate devices.

Answer

Implement mandatory security awareness training focusing on data handling procedures.

Answer

Encrypt all sensitive data at rest and in transit to render shared data useless.

Question 19

A multinational corporation with a hybrid cloud infrastructure has recently experienced a series of security incidents involving unauthorized access to sensitive customer data. The incidents were traced to compromised credentials of privileged users. The company has implemented multi-factor authentication (MFA) for all privileged accounts, but the attacks persisted. A security assessment team is brought in to evaluate the environment. During the assessment, they discover that some privileged accounts do not require MFA when accessing systems via API calls, and that session tokens for these APIs have a long expiration time of 24 hours. Additionally, the team finds that the logging and monitoring system does not capture API calls from privileged accounts, making it difficult to detect anomalous behavior. The company wants to remediate these issues effectively. Which of the following is the BEST course of action to address the root cause of the incidents?

Accepted Answer

Require MFA for all privileged access methods, including APIs, and reduce session token expiration to 15 minutes.. The root cause is that privileged accounts can bypass MFA when accessing systems via API calls, and long-lived session tokens (24 hours) provide a wide window for attackers to reuse stolen tokens. Requiring MFA for all privileged access methods, including APIs, closes the authentication gap, and reducing session token expiration to 15 minutes minimizes the impact of token theft by limiting the reuse window. This directly addresses the two key vulnerabilities identified in the assessment.

Answer

Implement a SIEM system to analyze logs from all sources and create alerts for anomalous API activity.

Answer

Conduct a full audit of privileged account usage and revoke access for any accounts with suspicious activity.

Answer

Replace API tokens with certificate-based authentication for all privileged accounts.

Question 20

In a microservices architecture with a service mesh, what is the most effective approach to secure inter-service communication?

Accepted Answer

Implement mutual TLS (mTLS) and identity-based access policies. In a service mesh, mutual TLS (mTLS) provides both encryption and identity verification for every inter-service call, ensuring that only authenticated services with the correct identity can communicate. Identity-based access policies (e.g., using SPIFFE IDs) then enforce fine-grained authorization, which is essential in dynamic microservices environments where IP addresses are ephemeral. This combination directly addresses the core security requirements of confidentiality, integrity, and authentication in zero-trust architectures.

Answer

Segment services into separate VLANs without encryption

Answer

Use TLS only for all communication

Answer

Rely on API keys in the request headers