CISSP Practice Test 2 — 25 Questions

Question 1

A development team is fixing a stored cross-site scripting (XSS) vulnerability in a web application that displays user comments. The application stores comments in a database and renders them in HTML. Which of the following is the most secure approach to prevent XSS?

Accepted Answer

Apply output encoding based on the context (e.g., HTML entity encoding). Output encoding (C) is the most secure approach because it neutralizes malicious scripts at the point of rendering, ensuring that user-controlled data is treated as text rather than executable code. For HTML contexts, HTML entity encoding (e.g., `<script>`) prevents the browser from interpreting injected tags, regardless of how the data was stored. This aligns with the defense-in-depth principle and is the primary mitigation for stored XSS as recommended by OWASP.

Answer

Use Content Security Policy (CSP) headers to restrict script execution

Answer

Sanitize input by removing all HTML tags before storing

Answer

Store comments in a separate domain to isolate them

Question 2

A security architect is designing a system that must continue to function even when a component fails. The architect implements multiple layers of security controls so that if one fails, others still provide protection. Which principle is being applied?

Accepted Answer

Defense in depth. Defense in depth (B) is the correct principle because it involves implementing multiple layers of security controls (e.g., firewalls, intrusion detection systems, encryption, access controls) so that if one layer fails or is bypassed, other layers continue to provide protection, ensuring the system remains functional. This directly matches the scenario where the architect designs for continued operation despite component failure by layering controls.

Answer

Separation of duties

Answer

Fail-secure

Answer

Least privilege

Question 3

A security team is conducting a penetration test on a web application. They identify that the application is vulnerable to reflected cross-site scripting (XSS). Which of the following is the most effective mitigation?

Accepted Answer

Encoding all user-supplied data before reflecting it in the response. Option D is correct because reflecting user-supplied data without proper encoding allows an attacker to inject arbitrary HTML/JavaScript that executes in the victim's browser. Output encoding (e.g., HTML entity encoding for context like

Answer

Using HTTPS to encrypt traffic

Answer

Implementing a Content Security Policy (CSP) with strict directives

Answer

Validating input against a whitelist of allowed characters

Question 4

Which type of testing analyzes source code for security vulnerabilities without executing the program?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It operates by scanning the codebase for known patterns, such as SQL injection or buffer overflow, using techniques like data flow analysis and taint tracking. This white-box approach identifies issues early in the Software Development Life Cycle (SDLC), making it the correct answer for testing that does not require runtime execution.

Answer

Interactive Application Security Testing (IAST)

Answer

Penetration testing

Answer

Dynamic Application Security Testing (DAST)

Question 5

During the requirements gathering phase of a software development project, which threat modeling methodology is most commonly used to identify threats such as spoofing, tampering, and elevation of privilege?

Accepted Answer

STRIDE. STRIDE is a threat modeling methodology developed by Microsoft that categorizes threats into six types: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. During the requirements gathering phase, STRIDE is commonly used to systematically identify and classify potential security threats against each system component, making it the correct choice for identifying threats like spoofing, tampering, and elevation of privilege.

Answer

CVSS

Answer

OCTAVE

Answer

PASTA

Question 6

A company recently suffered a data breach where an attacker was able to intercept network traffic and read sensitive data. Which network security control should be implemented to prevent this type of attack?

Accepted Answer

Encryption at the network layer (e.g., IPsec). IPsec operates at the network layer (Layer 3) and provides encryption of the entire IP packet, including the payload, ensuring that even if an attacker intercepts the traffic, the data remains unreadable. This directly addresses the scenario where an attacker reads sensitive data from intercepted network traffic, as IPsec can be configured in transport mode for end-to-end encryption or tunnel mode for VPNs.

Answer

Network segmentation

Answer

Intrusion prevention system (IPS)

Answer

Strong password policies

Question 7

Which TWO options are valid methods for providing confidentiality in network communications? (Choose two.)

Accepted Answer

ESP in transport mode. ESP (Encapsulating Security Payload) in transport mode provides confidentiality by encrypting the payload of an IP packet while leaving the original IP header intact. This is a core function of IPsec, where ESP can optionally include authentication but its primary role is encryption, making it a valid method for ensuring data confidentiality in network communications.

Answer

SSH

Answer

HMAC

Answer

AH in tunnel mode

Question 8

A network administrator is configuring switches to prevent VLAN hopping attacks. Which TWO of the following measures should be implemented?

Accepted Answer

Set the native VLAN to an unused VLAN.. Setting the native VLAN to an unused VLAN prevents VLAN hopping via double-tagging attacks. In a double-tagging attack, an attacker sends frames with two 802.1Q tags; the first tag is stripped by the trunk's native VLAN, and the second tag allows the frame to hop to a different VLAN. By using an unused VLAN as the native VLAN, there are no hosts on that VLAN to receive or exploit the double-tagged traffic.

Answer

Use private VLANs on all trunk ports.

Answer

Enable BPDU guard on all access ports.

Answer

Implement port security on all access ports.

Question 9

Which THREE of the following are common indicators of a privilege escalation attack? (Choose three.)

Accepted Answer

Creation of new user accounts with administrative privileges. Option A is correct because the creation of new user accounts with administrative privileges is a classic post-exploitation technique used by attackers to establish persistent elevated access. After successfully exploiting a vulnerability to gain initial elevated privileges, an attacker often creates a backdoor account (e.g., via `net user /add` and `net localgroup Administrators /add` on Windows, or `useradd -G wheel` on Linux) to maintain control even if the original exploit vector is patched. This indicator is directly tied to privilege escalation as it demonstrates an unauthorized elevation from a lower-privileged context to full administrative control.

Answer

Higher-than-normal network traffic

Answer

System performance degradation

Question 10

Which of the following is the primary purpose of output encoding in web application security?

Accepted Answer

Preventing cross-site scripting (XSS) attacks. Output encoding is the practice of converting special characters (e.g., <, >, &, ") into their corresponding HTML entities (e.g., < > & ") before sending data to the browser. This ensures that any user-supplied data is treated as text, not executable code, thereby neutralizing injected scripts. It is the primary defense against stored, reflected, and DOM-based cross-site scripting (XSS) attacks because it breaks the parser's ability to interpret the data as active content.

Answer

Preventing buffer overflow attacks

Answer

Preventing cross-site request forgery (CSRF)

Answer

Preventing SQL injection attacks

Question 11

A company uses a cloud storage service. Which asset security control is most important to prevent unauthorized access to data?

Accepted Answer

Encryption in transit and at rest. Encryption in transit (e.g., TLS 1.3) and at rest (e.g., AES-256) is the most important asset security control because it renders data unreadable even if the cloud storage service is compromised or an attacker gains access to the underlying infrastructure. Without encryption, all other controls (logging, reviews, scanning) are reactive and cannot prevent a direct breach of the stored data. This aligns with the CISSP principle of defense in depth, where encryption provides a strong preventive layer for data confidentiality.

Answer

Logging and monitoring

Answer

Periodic access reviews

Answer

Regular vulnerability scanning

Question 12

A security architect is designing an authentication system. To prevent session fixation attacks, which secure design principle should be implemented?

Accepted Answer

Regenerating session IDs after successful login. Session fixation attacks occur when an attacker forces a user to use a known session ID. Regenerating the session ID after successful login (e.g., via `session_regenerate_id()` in PHP or `HttpServletRequest.changeSessionId()` in Java) ensures that the pre-authentication session ID is discarded and a new, unpredictable one is issued, breaking the attacker's control.

Answer

Using HTTPS for all communications

Answer

Setting session timeout to 30 minutes

Answer

Implementing multi-factor authentication

Question 13

A development team is using a third-party library that is known to have a critical vulnerability. The team decides to continue using the library because it is widely used and the vulnerability has not been exploited. Which security risk is the team ignoring?

Accepted Answer

Using components with known vulnerabilities. The team is ignoring the risk of using components with known vulnerabilities, which is explicitly listed in the OWASP Top 10 (A06:2021). Even if a vulnerability has not been exploited yet, continuing to use a library with a known CVE (e.g., a remote code execution flaw in an older version of Log4j) exposes the application to potential attacks once exploit code becomes public. The decision based on 'wide usage' and 'no exploitation so far' is a fallacy, as threat actors often target widely deployed libraries precisely because of their large attack surface.

Answer

Insecure deserialization

Answer

Insufficient logging and monitoring

Answer

Security misconfiguration

Question 14

Which of the following is a secure coding practice to prevent SQL injection attacks?

Accepted Answer

Using parameterized queries. Parameterized queries (also known as prepared statements) separate SQL code from data by using placeholders (e.g., '?' in ODBC/JDBC or ':param' in Oracle) that are bound to user-supplied values at execution time. This ensures that input is always treated as data, never as executable SQL syntax, effectively neutralizing SQL injection regardless of the input content.

Answer

Escaping all user input

Answer

Using stored procedures exclusively

Answer

Validating input length

Question 15

A multinational corporation is designing a data retention schedule. Which factor is most critical when determining retention periods for personal data subject to the GDPR?

Accepted Answer

The purpose for which the data was collected. Under the GDPR, Article 5(1)(e) establishes the 'storage limitation' principle, which mandates that personal data must be kept no longer than necessary for the purposes for which it was collected. Therefore, the purpose of collection is the primary driver for determining the retention period, as it defines the lawful basis and necessity for processing. Without a defined purpose, any retention period would be arbitrary and non-compliant with the regulation.

Answer

The length of the third-party data processing agreement

Answer

The cost of storage media

Answer

The duration of any pending legal holds

Question 16

During a code review, a developer identifies that the application uses a custom encryption algorithm for storing sensitive data. Which THREE of the following are secure cryptographic practices that should be recommended instead?

Accepted Answer

Using industry-standard algorithms (e.g., AES-256). Option A is correct because using industry-standard algorithms like AES-256 ensures the encryption is based on publicly vetted, mathematically robust ciphers that have undergone extensive cryptanalysis. Custom encryption algorithms are highly risky as they lack peer review and often contain subtle flaws that can be exploited, whereas AES-256 is a NIST-approved symmetric block cipher with a 256-bit key size that provides strong confidentiality for sensitive data.

Answer

Hashing the data with MD5 for faster performance

Answer

Using a static IV for simplicity

Question 17

Refer to the exhibit. An organization uses this ACL on the external interface of a border router to control access to internal services. A security analyst discovered that an attacker from the Internet was able to SSH into the internal server at 192.168.1.100. Which of the following is the MOST likely reason for this security gap?

Accepted Answer

The ACL permits SSH from any source in 10.0.0.0/8 to the internal host, allowing an external attacker to spoof an internal IP. Option C is correct because the ACL permits SSH (TCP port 22) from any source within the 10.0.0.0/8 range to the internal host 192.168.1.100. Since 10.0.0.0/8 is a private RFC 1918 address space, an external attacker can spoof a source IP in that range, bypassing the intended restriction that only internal hosts should use those addresses. The ACL does not validate the source IP's legitimacy, so a spoofed packet from the Internet matching the permit rule will be allowed through.

Answer

The final permit ip any any rule allows all traffic, bypassing the other rules

Answer

The ACL permits HTTP traffic to host 10.0.0.1 which could be used as a pivot

Answer

The ACL is applied inbound on the external interface, so it should block all external traffic, but the permit rules override

Question 18

A medium-sized financial services company has a flat network topology with no segmentation between the corporate LAN and the server farm. The security team recently deployed a host-based intrusion detection system (HIDS) on all critical servers. Over the past week, the HIDS has generated multiple high-severity alerts indicating outbound connections from a database server to an external IP address in a foreign country, occurring every hour and lasting only a few seconds. The database server contains sensitive customer data. The company's incident response plan (IRP) has not been updated in two years, and the CISO wants to ensure a response that minimizes business disruption while protecting data. The IT team is small, and the security analyst on duty suspects a data exfiltration attempt but is unsure. What should the analyst do FIRST?

Accepted Answer

Disconnect the database server from the network at the switch port and preserve the system state for forensic analysis. Option A is correct because the immediate priority is to contain the suspected data exfiltration by isolating the database server from the network, which stops the outbound connections and preserves volatile evidence for forensic analysis. Disconnecting at the switch port (e.g., via `shutdown` interface command) is a rapid, reversible action that minimizes business disruption compared to pulling the power cable, and it aligns with the incident response phase of containment before eradication or recovery. The HIDS alerts indicate a persistent, short-lived outbound connection pattern, which strongly suggests a beaconing or data-stealing malware that must be contained first to prevent further data loss.

Answer

Run a full antivirus scan on the database server and update the HIDS signatures

Answer

Review the firewall logs to identify all external IPs the server has contacted

Answer

Immediately notify the company's legal department and public relations team

Question 19

Refer to the exhibit. An IAM policy is attached to a user. What is the effective permission when the user attempts to read the object 'confidential/report.pdf'?

Accepted Answer

Denied because the Deny statement explicitly denies all actions on that path. The correct answer is A because IAM policies evaluate explicit Deny statements before any Allow statements. Since the Deny statement explicitly denies all actions on the 'confidential/report.pdf' path, the user's GetObject request is denied regardless of any broader Allow statements. This is a fundamental principle of AWS IAM policy evaluation logic: an explicit Deny overrides all Allow permissions.

Answer

Allowed because the resource match is broader in the Allow

Answer

Allowed because the Allow statement grants GetObject

Answer

Denied only if the user has no other Allow policies

Question 20

Which TWO of the following are considered the primary access control models in the context of the CISSP? (Select two.)

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) is a primary access control model where access decisions are based on fixed security labels (e.g., classification levels like Top Secret, Secret, Confidential) assigned to subjects and objects by a central authority. The system enforces these labels, and users cannot override them, making it a core model for high-security environments such as military or government systems. In the CISSP context, MAC and DAC are traditionally considered the two foundational models, with RBAC and ABAC often treated as extensions or implementations of DAC.

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Risk-Based Access Control