CISSP Practice Test 4 — 25 Questions

Question 1

A multinational corporation maintains site-to-site IPsec VPN tunnels between its headquarters and three regional branch offices. Over the past week, the tunnels have been dropping intermittently, causing disruption to real-time applications. The network team checked logs and found frequent 'Phase 2 rekey failure' messages. The tunnels are configured with IKEv1 and preshared keys. The headquarters uses a Cisco ASA, and the branches use various vendors' firewalls. The team verified that firewall policies allow IPsec traffic, and there is no packet loss on the WAN links. Which action should the team take to resolve the issue most effectively?

Accepted Answer

Adjust the Dead Peer Detection (DPD) intervals and Phase 2 lifetime settings to be consistent across all sites.. The frequent 'Phase 2 rekey failure' messages indicate a mismatch in IPsec security association (SA) parameters between the Cisco ASA and the branch firewalls. IKEv1 Phase 2 lifetimes and Dead Peer Detection (DPD) intervals must be consistent across all peers; otherwise, one side may attempt to rekey or declare the peer dead while the other expects a different timing, causing intermittent tunnel drops. Adjusting these values to match across all sites resolves the rekey failures without compromising security or requiring a protocol migration.

Answer

Increase the MTU on the WAN interfaces to 1500 bytes on all firewalls.

Answer

Change the encryption algorithm from AES-256 to 3DES on all peers.

Answer

Migrate all VPN connections from IPsec to SSL VPN using clientless access.

Question 2

Which TWO of the following are best practices for conducting a penetration test?

Accepted Answer

Define scope and rules of engagement. Defining the scope and rules of engagement is a foundational best practice for penetration testing because it establishes the boundaries of the test, including target systems, testing methods, and permitted times. This prevents unintended disruption to production systems and ensures the test aligns with organizational risk tolerance. Without a clear scope, the test could violate system availability requirements or legal boundaries, making the results invalid or harmful.

Answer

Install backdoors for future access

Answer

Notify law enforcement before testing

Answer

Use only automated tools

Question 3

A financial institution is conducting a vulnerability assessment of its internal network. The assessor runs a comprehensive scan and discovers that several Windows servers have missing security patches. The organization has a patch management policy that requires all critical patches to be applied within 30 days. The scan results show that some patches have been pending for 45 days. The assessor also finds that the servers are isolated in a separate VLAN with strict firewall rules limiting inbound traffic to only necessary ports. The business owner argues that because the servers are isolated, the risk is low and the patches can be delayed. As the security assessor, what should be the BEST course of action?

Accepted Answer

Escalate the finding to the risk management team for formal risk acceptance.. Option C is correct because the organization's patch management policy has been violated (patches overdue by 45 days vs. 30-day requirement), and the business owner's informal risk acceptance is insufficient. Formal risk acceptance requires documented approval from the risk management team, ensuring accountability and alignment with the organization's risk appetite. The VLAN isolation and firewall rules are compensating controls, but they do not negate the need for proper risk treatment per policy.

Answer

Recommend additional compensating controls such as intrusion prevention.

Answer

Accept the risk and close the finding.

Answer

Immediately apply the patches without further approval.

Question 4

An organization is implementing a security awareness program. Which topic should be emphasized most?

Accepted Answer

Phishing recognition. Phishing recognition is the most critical topic because phishing attacks are the primary vector for initial access in over 90% of security breaches, according to Verizon's DBIR. Unlike other topics, phishing directly exploits human psychology to bypass technical controls like email filters and MFA, making user detection the last line of defense. Emphasizing this topic reduces the risk of credential theft, malware installation, and ransomware deployment more effectively than any other single awareness area.

Answer

Social media usage

Answer

Password policy

Answer

Clean desk policy

Question 5

A multinational corporation is evaluating risk treatment options for a identified high-impact, low-probability risk. The risk is below the organization's risk appetite threshold. Which is the most appropriate action?

Accepted Answer

Accept the risk. When a risk is below the organization's risk appetite threshold, it is considered acceptable. Accepting the risk (Option D) is the most appropriate action because the organization has determined that the potential impact is tolerable and does not warrant additional expenditure or operational changes. This aligns with the risk management principle that not all risks must be mitigated, transferred, or avoided—some are simply retained as a cost of doing business.

Answer

Mitigate the risk

Answer

Transfer the risk via insurance

Answer

Avoid the risk by discontinuing the activity

Question 6

Which THREE of the following are control families defined in NIST SP 800-53? (Choose three.)

Accepted Answer

Access Control (AC). Access Control (AC) is a control family in NIST SP 800-53 that encompasses policies, procedures, and mechanisms for managing user permissions, authentication, and authorization. It includes controls like AC-2 (Account Management) and AC-3 (Access Enforcement), which are fundamental to enforcing least privilege and separation of duties.

Answer

Data Encryption (DE)

Answer

Business Continuity (BC)

Question 7

Which TWO of the following are essential components of a quantitative risk analysis formula? (Choose two.)

Accepted Answer

Annual Rate of Occurrence (ARO). In quantitative risk analysis, the formula for calculating Annualized Loss Expectancy (ALE) is ALE = SLE × ARO. The Single Loss Expectancy (SLE) represents the monetary loss expected from a single occurrence of a risk, calculated as Asset Value × Exposure Factor (EF). The Annual Rate of Occurrence (ARO) is the expected frequency of that risk occurring per year. Both SLE and ARO are direct, essential multipliers in the core ALE formula, making them fundamental components of the quantitative risk analysis equation.

Answer

Exposure Factor (EF)

Answer

Residual Risk

Answer

Control Frequency (CF)

Question 8

A company has implemented data classification labels such as 'Public', 'Internal', 'Confidential', and 'Restricted'. Which control is most appropriate for protecting 'Confidential' data?

Accepted Answer

Encryption at rest and in transit. Encryption at rest and in transit is the most appropriate control for protecting 'Confidential' data because it renders the data unreadable to unauthorized parties both when stored on disk (e.g., AES-256) and when transmitted over networks (e.g., TLS 1.3). This directly enforces confidentiality by ensuring that even if an attacker gains access to the storage medium or intercepts network traffic, the data remains protected. Data classification labels like 'Confidential' require strong cryptographic controls to meet the principle of least privilege and compliance mandates such as GDPR or HIPAA.

Answer

Data masking for all users

Answer

Removing all access controls to streamline sharing

Answer

Public posting on the company website

Question 9

A multinational corporation must comply with GDPR and CCPA. Which data protection strategy should they prioritize?

Accepted Answer

Data minimization. Data minimization is the correct priority because both GDPR (Article 5(1)(c)) and CCPA (Cal. Civ. Code §1798.100) require organizations to limit the collection and processing of personal data to what is directly relevant and necessary for the stated purpose. By minimizing the data held, the corporation reduces its legal exposure, simplifies compliance obligations, and inherently lowers the risk of a data breach impacting sensitive information. This principle is foundational to privacy-by-design and directly addresses the regulatory mandates, whereas the other options are secondary controls that do not address the core requirement of limiting data collection.

Answer

Data masking

Answer

Data retention

Answer

Data encryption

Question 10

A risk assessment identifies several threats. Which THREE are considered external threats?

Accepted Answer

Hacktivist. Hacktivists are external threat actors who launch attacks from outside the organization, often for political or ideological motives. They are not part of the internal workforce and do not have authorized access, making them a classic external threat in risk assessment frameworks.

Answer

Insider error

Answer

Disgruntled employee

Question 11

An organization is implementing a security program and wants to ensure it meets legal and regulatory requirements. The security manager is reviewing the concept of due care. Which best describes due care in the context of information security?

Accepted Answer

The level of prudence expected from a reasonable organization in the same industry. Due care is the legal concept that an organization must act with the level of prudence that a reasonable organization in the same industry would exercise to protect sensitive information. It is not merely compliance with laws (option C), but a broader standard of care that includes implementing reasonable security measures, even where specific regulations do not mandate them. In information security, due care is demonstrated through policies, procedures, and controls that a prudent organization would adopt to avoid negligence liability.

Answer

The process of responding to security incidents after they occur

Answer

The selection of security controls based on cost-benefit analysis

Answer

Compliance with all applicable laws and regulations

Question 12

A financial institution is required to retain customer transaction records for seven years under regulatory mandates. The institution is facing a lawsuit and must preserve all relevant data. What legal concept applies?

Accepted Answer

Legal hold. When a lawsuit is reasonably anticipated or has been filed, the duty to preserve relevant evidence arises. A legal hold (also known as a litigation hold) is the formal process that suspends normal data retention and destruction policies to ensure that all potentially relevant electronically stored information (ESI) is preserved. This overrides the standard seven-year retention schedule because the legal obligation to preserve supersedes the regulatory retention mandate.

Answer

E-discovery

Answer

Data retention policy

Answer

Chain of custody

Question 13

A business continuity coordinator is planning a test of the disaster recovery plan. Which type of test involves a walk-through of the plan with key stakeholders without actually invoking the technical recovery?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based session where key stakeholders walk through the disaster recovery plan step-by-step without invoking any technical recovery procedures. This validates roles, responsibilities, and decision-making processes in a low-risk environment, ensuring the plan's logic is sound before any actual failover or system restoration is attempted.

Answer

Full interruption test

Answer

Checklist review

Answer

Parallel test

Question 14

During a risk assessment, a critical asset has a vulnerability with a CVSS score of 9.0. Which risk treatment strategy is most appropriate if the cost to mitigate exceeds the asset's value?

Accepted Answer

Transfer. A CVSS score of 9.0 indicates a critical vulnerability that could severely impact the asset's confidentiality, integrity, or availability. When the cost to mitigate (e.g., implementing patches, compensating controls, or redesign) exceeds the asset's financial value, the most cost-effective risk treatment is to transfer the risk, typically through cyber insurance or outsourcing to a managed security service provider (MSSP). This shifts the financial burden of a potential exploit to a third party without incurring prohibitive remediation costs.

Answer

Acceptance

Answer

Avoidance

Answer

Mitigation

Question 15

A company experiences a data breach. Which step should be taken first according to best practices?

Accepted Answer

Contain the breach. According to incident response best practices (NIST SP 800-61), the first priority after confirming a breach is to contain it. This prevents further data exfiltration, limits lateral movement by an attacker, and preserves forensic evidence. Containment actions may include isolating affected systems, blocking malicious IPs at the firewall, or revoking compromised credentials.

Answer

Inform affected parties

Answer

Notify law enforcement

Answer

Assess the damage

Question 16

Refer to the exhibit. Which security risk does this policy primarily introduce?

Accepted Answer

Unauthorized write access. The exhibit shows an access control list (ACL) that permits write access (e.g., write or modify permissions) to a resource for a broad set of users or groups without corresponding restrictions. This primarily introduces the risk of unauthorized write access, as users who should not have the ability to alter data or configurations can now modify them, potentially leading to data corruption, unauthorized changes, or system compromise.

Answer

Privilege escalation

Answer

Unauthorized read access

Answer

Denial of service

Question 17

Drag and drop the steps for a secure software development lifecycle (SDLC) in the correct order.

Question 18

Drag and drop the steps for implementing a digital signature using asymmetric cryptography in the correct order.

Question 19

Drag and drop the steps for conducting a risk assessment in the correct order.

Question 20

A security manager is conducting a risk assessment for a new cloud application. The manager needs to estimate the potential financial loss from a data breach. Which approach should be used?

Accepted Answer

Quantitative risk analysis using annualized loss expectancy (ALE). Option D is correct because quantitative risk analysis using Annualized Loss Expectancy (ALE) provides a specific monetary estimate of potential financial loss, which is exactly what the security manager needs for a data breach scenario. ALE is calculated as Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO), enabling data-driven budgeting and cost-benefit analysis for cloud application security controls.

Answer

Scenario-based risk analysis with ordinal scales

Answer

Qualitative risk analysis using high/medium/low ratings

Answer

Benchmarking against industry standards