CISSP Practice Test 3 — 25 Questions

Question 1

Refer to the exhibit. A security team is reviewing switch configurations and notices that the native VLAN is set to VLAN 10. An attacker on an access port in VLAN 10 sends a frame with a VLAN tag of VLAN 20 inside another frame. Which type of attack does this configuration make possible?

Accepted Answer

VLAN hopping via double tagging. The configuration with native VLAN 10 allows an attacker on an access port in VLAN 10 to craft a frame with an outer 802.1Q tag for VLAN 20 and an inner tag for VLAN 10. When the switch receives this frame on a trunk port, it strips the outer tag (native VLAN) and forwards the inner tag, causing the frame to hop into VLAN 20. This is the classic VLAN hopping via double tagging attack, exploiting the native VLAN behavior.

Answer

DHCP starvation

Answer

ARP spoofing

Answer

MAC flooding

Question 2

A security engineer is troubleshooting a site-to-site IPsec VPN between two firewalls. The tunnel status shows Phase 1 is up but Phase 2 is not. Which of the following is the most likely cause?

Accepted Answer

Mismatched proxy IDs (traffic selectors). Phase 1 (IKE SA) establishes a secure channel for key exchange, while Phase 2 (IPsec SA) negotiates the specific traffic to be encrypted. If Phase 1 is up but Phase 2 fails, the most common cause is a mismatch in proxy IDs (traffic selectors), such as local/remote subnets or ports, which prevents the two peers from agreeing on which traffic to protect. This is distinct from authentication or encryption mismatches, which would typically cause Phase 1 to fail.

Answer

Incorrect pre-shared key

Answer

Mismatched authentication algorithm

Answer

Firewall rule blocking IKE traffic

Question 3

A switch port is configured with port security that allows only one MAC address. The help desk reports that a user's device cannot connect after a laptop is replaced. What should the network administrator do to resolve the issue?

Accepted Answer

Clear the port security counters. When port security is configured to allow only one MAC address and a laptop is replaced, the new MAC address is automatically blocked because the switch has already learned and secured the old MAC address. Clearing the port security counters (e.g., using `clear port-security sticky` or `clear port-security dynamic`) resets the learned MAC address, allowing the switch to learn the new device's MAC address on the next link-up. This is the standard remediation without disabling security or causing unnecessary downtime.

Answer

Disable port security

Answer

Shut down the port and re-enable

Answer

Change the port security to sticky MAC

Question 4

A company has multiple offices connected via a WAN. They want to ensure that all traffic between offices is encrypted and authenticated. Which technology is most appropriate?

Accepted Answer

IPsec VPN. IPsec VPN is the most appropriate technology because it operates at the network layer (Layer 3) and provides both encryption and authentication for all IP traffic between sites over an untrusted WAN. It uses protocols such as ESP (Encapsulating Security Payload) for confidentiality and AH (Authentication Header) or ESP for integrity and authentication, ensuring that all inter-office traffic is protected in transit.

Answer

MPLS

Answer

DMVPN

Answer

SSL VPN

Question 5

In a software-defined network (SDN) architecture, the control plane is separated from the data plane. A network administrator is troubleshooting packet forwarding delays. Which plane is directly responsible for forwarding packets?

Accepted Answer

Data plane. In SDN, the data plane (also called the forwarding plane) is directly responsible for forwarding packets based on flow table entries installed by the controller. It handles per-packet operations like looking up destination addresses, applying actions (e.g., output to port, drop, modify header), and forwarding at line rate. Packet forwarding delays are typically caused by data plane issues such as flow table misses, hardware forwarding pipeline congestion, or inefficient TCAM lookups.

Answer

Application plane

Answer

Control plane

Answer

Management plane

Question 6

A security engineer notices that the IKE phase 1 lifetime is set to 3600 seconds. What is a potential security implication?

Accepted Answer

Short lifetimes may cause frequent reauthentication and potential disruption. IKE phase 1 establishes a secure authenticated channel for subsequent IKE phase 2 negotiations. A lifetime of 3600 seconds (1 hour) is relatively short, causing frequent reauthentication. This can lead to service disruption if the rekeying process fails or if the VPN peers experience transient network issues, potentially dropping active tunnels and impacting production traffic.

Answer

Longer lifetimes reduce rekeying overhead

Answer

Shorter lifetimes increase performance

Answer

The lifetime should be at least 86400 seconds

Question 7

A network administrator has configured private VLANs on a switch. The host in this port is part of PVLAN 100, and its associated secondary PVLAN is 200. What is the expected behavior for traffic from this host to other hosts in the same primary VLAN 100?

Accepted Answer

It can communicate with the promiscuous port only. In a private VLAN (PVLAN) configuration, a host in a community or isolated secondary VLAN cannot communicate with other hosts in the same primary VLAN unless they share the same secondary VLAN. However, the question specifies that the host is in PVLAN 100 and its associated secondary PVLAN is 200, but does not state that the host is in a community VLAN; the only way a host in a secondary VLAN can communicate with any other host is via the promiscuous port (typically connected to a router or firewall). Since the host is in an isolated secondary VLAN (or community without a matching community), it can only send traffic to the promiscuous port, which then forwards it as needed.

Answer

It cannot communicate with any other host

Answer

It can communicate only with other hosts in the same secondary VLAN 200

Answer

It can communicate with all hosts in primary VLAN 100

Question 8

Which three BGP security mechanisms help protect against route hijacking? (Choose THREE.)

Accepted Answer

Resource Public Key Infrastructure (RPKI). RPKI is correct because it uses cryptographically signed Route Origin Authorizations (ROAs) to validate that an AS is authorized to originate specific IP prefixes. This prevents route hijacking by allowing routers to reject BGP announcements that do not match the registered origin AS.

Answer

BGP Flowspec

Answer

BGP MED attribute

Question 9

Refer to the exhibit. Which security model does this policy enforce?

Accepted Answer

Bell-LaPadula. The Bell-LaPadula model enforces a mandatory access control policy based on the 'no read up, no write down' principle, which directly corresponds to the exhibit's rule that a subject at a given security level cannot read objects at a higher level (Simple Security Property) and cannot write to objects at a lower level (Star Property). This is the only model among the options that specifically addresses confidentiality through hierarchical classification levels and the prevention of information flow from higher to lower security levels.

Answer

Biba

Answer

Brewer-Nash

Answer

Clark-Wilson

Question 10

Refer to the exhibit. A security analyst finds these logs on a Linux server. What is the most likely cause of these events?

Accepted Answer

A brute-force attack is in progress. The logs show repeated SSH authentication failures from the same source IP address with different usernames, including root, admin, and user. This pattern of multiple failed login attempts in rapid succession is characteristic of a brute-force attack against the SSH service. The fact that attempts continue across different usernames indicates an automated tool is systematically trying credentials, not a single misconfiguration or network issue.

Answer

The root account is disabled

Answer

The firewall is blocking port 22

Answer

The SSH service is not running

Question 11

During a security assessment, an organization wants to ensure that its web application is resistant to common attacks. Which THREE testing types should be included?

Accepted Answer

Input validation testing. Input validation testing (A) is correct because it directly addresses common web application attacks such as SQL injection, cross-site scripting (XSS), and command injection by ensuring that all user-supplied data is properly sanitized, validated, and encoded before processing. Without rigorous input validation, an attacker can manipulate input fields to execute arbitrary code or access unauthorized data, making this a foundational security control in the OWASP Top 10.

Answer

Network segmentation testing

Answer

Load testing

Question 12

An auditor is reviewing the JSON policy exhibit. What is the most likely security issue with this policy?

Accepted Answer

The 'Allow' rule for customers does not restrict based on user identity, only IP. Option C is correct because the policy's 'Allow' rule for customers only restricts access based on source IP address, not on authenticated user identity. This means any user or system within the allowed IP range can access the resource, regardless of whether they are a legitimate customer. In a JSON-based policy (e.g., AWS IAM or Azure RBAC), failing to include a condition that checks user identity (such as a JWT claim or IAM user ARN) creates a significant authorization gap, allowing potential impersonation or lateral movement within the trusted network.

Answer

The policy allows all actions on public_data, which could be exploited

Answer

The policy uses JSON syntax, which is not secure

Answer

The 'Deny' rule uses a wildcard resource, which is too restrictive

Question 13

Which TWO of the following are common techniques used in dynamic application security testing (DAST)?

Accepted Answer

Fuzzing. Fuzzing is a DAST technique that involves sending malformed or unexpected input to an application to trigger unhandled exceptions, crashes, or security vulnerabilities. It tests the runtime behavior of the application, making it a dynamic testing method.

Answer

Static analysis

Answer

String search

Answer

Code review

Question 14

Refer to the exhibit. Based on the exhibit, what is the most urgent remediation?

Accepted Answer

Upgrade to Apache 2.4.50. The exhibit shows Apache 2.4.49 is in use, which is vulnerable to CVE-2021-41773 — a path traversal and remote code execution flaw in the `mod_cgi` module. Upgrading to Apache 2.4.50 is the most urgent remediation because it directly patches this critical vulnerability, preventing attackers from reading arbitrary files or executing commands via crafted URL paths like `/cgi-bin/.%2e/%2e%2e/bin/sh`.

Answer

Disable directory listing

Answer

Recompile Apache with security flags

Answer

Apply a WAF rule to block path traversal attempts

Question 15

Which THREE are key components of a business continuity plan (BCP)?

Accepted Answer

Backup strategies. Backup strategies are a core component of a BCP because they ensure that critical data and systems can be restored after a disruption. Without defined backup procedures (e.g., frequency, media rotation, off-site storage), the organization cannot recover its operational state, making this a fundamental technical requirement for continuity.

Answer

Vendor risk assessments

Answer

System hardening standards

Question 16

Refer to the exhibit. The network administrator applies this access control list to the inbound interface of a router connecting to the internet. Which type of access control model is being implemented?

Accepted Answer

Rule-Based Access Control. The access control list (ACL) applied to the inbound interface of a router connecting to the internet enforces traffic filtering based on a set of predefined rules (e.g., permit or deny statements based on source IP, destination IP, port numbers). This is the essence of Rule-Based Access Control (RBAC), where access decisions are governed by a global set of rules applied uniformly to all subjects, independent of user identity or roles. The ACL does not allow individual users to change permissions (eliminating DAC), does not use security labels or clearances (eliminating MAC), and does not map permissions to job roles (eliminating Role-Based Access Control).

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 17

A security analyst discovers that a business unit is storing sensitive data on a file share without classification labels. What is the first step to remediate?

Accepted Answer

Notify the data owner to classify the data. The first step in remediating unclassified sensitive data is to notify the data owner, who is responsible for assigning classification labels based on organizational policy. Without classification, subsequent security controls (e.g., encryption, access controls) cannot be correctly applied because the data's sensitivity level is unknown. This aligns with the CISSP principle that data classification must precede protection mechanisms.

Answer

Move the data to a secure server

Answer

Immediately delete the data

Answer

Encrypt the file share

Question 18

A system administrator notices that user accounts are often left active after employees leave the company. Which process should be automated to address this?

Accepted Answer

Automated account provisioning and deprovisioning. Automated account provisioning and deprovisioning ensures that when an employee leaves the company, their access rights are automatically revoked in a timely manner. This process directly addresses the issue of orphaned accounts by integrating with HR systems to trigger account disablement or deletion upon termination, reducing the risk of unauthorized access.

Answer

Single sign-on implementation

Answer

Password reset policy

Answer

Multi-factor authentication

Question 19

An auditor finds that a system uses the same service account for multiple applications. Which risk does this pose?

Accepted Answer

Inability to rotate passwords without affecting all applications. Option C is correct because when multiple applications share a single service account, rotating the password requires coordinated downtime or configuration changes across all dependent applications. This violates the principle of least privilege and creates operational complexity, as a password change for one application will break authentication for others until they are updated.

Answer

Increased attack surface due to multiple passwords

Answer

Difficulty in auditing because all applications share one account

Answer

Single point of failure for authentication

Question 20

A company implements a centralized authentication system using RADIUS for network devices. The security team notices that after a user's password is changed in Active Directory, the user can still authenticate to network devices using the old password for up to 30 minutes. What is the most likely cause?

Accepted Answer

Network devices caching authentication responses. The most likely cause is that network devices (such as switches, routers, or wireless controllers) are caching the RADIUS authentication responses. When a user authenticates, the RADIUS server returns an Access-Accept packet, and the network device may store this result in a local cache for a configurable period (often 30 minutes by default). This allows the device to avoid querying the RADIUS server repeatedly for the same user, but it also means that a password change in Active Directory will not take effect until the cached entry expires.

Answer

Kerberos ticket lifetime

Answer

Active Directory replication delay

Answer

RADIUS server caching credentials

CISSP Practice Test 3 — 25 Questions

Exhibit

CISSP Practice Test 3 — 25 Questions

Exhibit