CISSP Practice Test 4 — 25 Questions

Question 1

A SOC has three tiers: Tier 1 triages alerts, Tier 2 investigates, and Tier 3 performs advanced analysis. An alert about a potential data exfiltration using DNS tunneling is escalated from Tier 1. Which tier is BEST suited to perform deep packet inspection and memory forensics to confirm the exfiltration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Tier 3. Tier 3 handles advanced analysis including memory forensics.

Answer

Incident manager

Answer

Tier 2

Answer

Tier 1

Question 2

A security architect is designing a Single Sign-On (SSO) solution for a web application that needs to support authentication and authorization. Which TWO of the following protocols are best suited for this purpose? (Select TWO)

Accepted Answer

OpenID Connect (OIDC). SAML 2.0 and OpenID Connect (OIDC) are both SSO protocols that provide authentication and authorization. OAuth 2.0 alone provides only authorization.

Answer

Kerberos

Answer

LDAP

Answer

OAuth 2.0

Question 3

A company wants to measure the effectiveness of its vulnerability management program. Which metric would best indicate the organization's ability to respond quickly to critical vulnerabilities?

Accepted Answer

Mean time to remediate critical vulnerabilities. Mean time to remediate (MTTR) for critical vulnerabilities directly measures the speed of response, which is a key indicator of program effectiveness.

Answer

Patch compliance percentage

Answer

ROI of security controls

Answer

Number of open vulnerabilities by severity

Question 4

During an incident response, the team identifies that the attacker gained access through a compromised service account with domain admin privileges. Which of the following steps should be taken FIRST to contain the incident?

Accepted Answer

Disable the compromised account and revoke its tokens.. Disabling the compromised account and revoking its tokens (e.g., Kerberos TGTs via `Set-ADAccountControl -Disable` and clearing cached tickets) immediately stops the attacker's current authentication and lateral movement capabilities. This is the fastest containment step because the service account with Domain Admin privileges is the direct vector; isolating systems or resetting all passwords is slower and may not address active token reuse.

Answer

Isolate all affected systems from the network.

Answer

Reset all user passwords.

Answer

Perform a full forensic analysis before any action.

Question 5

A security analyst notices that the SIEM is generating an overwhelming number of low-priority alerts from a single application server. The server is critical to operations. What is the BEST approach to reduce noise without compromising security?

Accepted Answer

Create a suppression rule for known benign patterns.. Suppression rules allow the SIEM to filter out known benign patterns (e.g., routine service checks or scheduled scans) while still capturing genuine threats. This reduces alert fatigue without disabling monitoring for the critical server, preserving visibility into anomalous or malicious activity.

Answer

Increase the severity threshold for that server's alerts.

Answer

Disable all alerts from that server.

Answer

Exclude the server from SIEM monitoring.

Question 6

You are the security architect for a global financial firm. The organization has recently deployed a new cloud-based application that requires low-latency connections between data centers in New York, London, and Tokyo. The existing WAN uses MPLS L3 VPNs with IPsec encryption. However, the application team reports excessive latency and packet loss during peak hours. The network team confirms that the MPLS links are underutilized, but the IPsec tunnels show high CPU usage on the edge routers. Additionally, the security policy mandates that all inter-data center traffic must be encrypted and authenticated. The firm has a budget for hardware upgrades but wants to minimize operational changes. Which of the following is the BEST course of action?

Accepted Answer

Upgrade the edge routers to models that support hardware-accelerated IPsec encryption.. The high CPU usage on edge routers is a classic symptom of software-based IPsec encryption overwhelming the router's CPU. Hardware-accelerated IPsec offloads the cryptographic operations to dedicated ASICs or crypto engines, reducing CPU load and eliminating the latency and packet loss caused by processing bottlenecks. This directly addresses the root cause without changing the security policy or requiring major operational changes.

Answer

Reduce the IPsec encryption algorithm to AES-128 and the hash to SHA-1 to lower CPU usage.

Answer

Replace MPLS with dedicated point-to-point circuits and remove IPsec encryption.

Answer

Increase the MTU on the WAN interfaces to reduce packet fragmentation.

Question 7

A developer uses a tool that analyzes source code for potential security flaws without executing the program. This is an example of:

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. This matches the description of a tool that inspects code statically, making D the correct answer.

Answer

DAST

Answer

IAST

Answer

RASP

Question 8

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. A smart card is a Type 2 authentication factor because it falls under the category of 'something you have.' Type 2 factors are possession-based, meaning the user must physically possess the token to authenticate. Smart cards store cryptographic keys or certificates and require a card reader to present the credential, making them a classic example of a possession factor.

Answer

Answer

Password

Answer

Fingerprint

Question 9

A company is deploying a new web application and needs to ensure that only HTTPS traffic is allowed. What is the MOST effective way to enforce this at the network perimeter?

Accepted Answer

Allow TCP port 443 only and block port 80.. Blocking TCP port 80 and allowing only TCP port 443 at the network perimeter ensures that only HTTPS traffic can enter or leave the network. This is the most effective method because it directly enforces the protocol restriction at the firewall, preventing any HTTP traffic from bypassing encryption. Allowing both ports would permit unencrypted HTTP, while using a proxy or blocking port 443 would either add unnecessary complexity or deny legitimate HTTPS traffic.

Answer

Configure the firewall to allow TCP port 80 and 443.

Answer

Use a proxy server to decrypt all traffic.

Answer

Block TCP port 443.

Question 10

Which of the following is the primary purpose of a hardware security module (HSM)?

Accepted Answer

Generating and storing cryptographic keys securely. A hardware security module (HSM) is a dedicated, tamper-resistant hardware appliance designed to securely generate, store, and manage cryptographic keys throughout their lifecycle. Its primary purpose is to protect the root of trust for encryption operations, ensuring that private keys never leave the secure boundary of the module. This is critical for high-assurance environments such as certificate authorities (CAs) and payment processing systems.

Answer

Filtering malicious traffic

Answer

Encrypting hard drives at rest

Answer

Accelerating network traffic

Question 11

During a risk assessment, a company identifies that its primary data center is located in a flood-prone area. The estimated annual loss expectancy (ALE) for a flood event is $500,000. Installing flood barriers costs $200,000 and reduces the ALE to $50,000. What is the net benefit of implementing the flood barriers?

Accepted Answer

$250,000. The net benefit is calculated as the reduction in ALE minus the cost of the control. The original ALE is $500,000, and after implementing flood barriers the ALE drops to $50,000, a reduction of $450,000. Subtracting the $200,000 cost of the barriers yields a net benefit of $250,000. This aligns with the CISSP risk management formula: Net Benefit = (ALE_old - ALE_new) - Cost_of_control.

Answer

$300,000

Answer

$450,000

Answer

$200,000

Question 12

An organization uses a custom application that stores user passwords using salted SHA-256 hashes. During a security audit, the auditor recommends migrating to a more secure password storage mechanism. Which of the following is the best recommendation?

Accepted Answer

Use bcrypt with a cost factor of 12. bcrypt is a deliberately slow, adaptive password hashing function that includes a built-in salt and a configurable cost factor. A cost factor of 12 makes each hash computation computationally expensive, effectively thwarting brute-force and GPU-based attacks. Unlike SHA-256, which is designed for speed and can be cracked rapidly with modern hardware, bcrypt's design inherently resists parallelization and ASIC/GPU acceleration.

Answer

Use plaintext with database encryption

Answer

Use AES-256 encryption for passwords

Answer

Use MD5 with a salt

Answer

Use PBKDF2 with 10,000 iterations

Question 13

A DevOps team implements a CI/CD pipeline that runs security scans automatically. The pipeline fails often due to false positives, causing delays. Which approach balances security and efficiency?

Accepted Answer

Tune scan rules to reduce false positives while retaining critical checks.. Tuning scan rules reduces false positives by adjusting thresholds or disabling low-severity checks while preserving critical security controls (e.g., SAST rules for OWASP Top 10). This maintains automated security validation in the CI/CD pipeline without blocking development velocity, aligning with the principle of 'secure enough' rather than 'perfect security'.

Answer

Turn off all security scans.

Answer

Manually review every false positive.

Answer

Only run scans on code that is deployed to production.

Question 14

Which THREE of the following are common security design principles? (Select THREE.)

Accepted Answer

Open design. Open design (A) is a fundamental security principle stating that the security of a system should not depend on the secrecy of its implementation; instead, it relies on the strength of its cryptographic keys and algorithms. This principle is embodied in Kerckhoffs's principle, which asserts that a cryptosystem should remain secure even if everything about the system, except the key, is public knowledge. Open design allows for public scrutiny and peer review, which helps identify vulnerabilities and build trust in the system's security.

Answer

Single point of failure

Answer

Security through obscurity

Question 15

An organization's data retention policy specifies that customer records must be retained for five years after the end of the business relationship. After that period, what should be done with the data according to best practices?

Accepted Answer

Securely destroy the data. Once the retention period expires, data should be securely destroyed to prevent unauthorized access and comply with privacy regulations.

Answer

Continue retaining the data indefinitely for future use

Answer

Archive the data to offline storage

Answer

Anonymize the data and keep it

Question 16

A company is conducting a security assessment of its network infrastructure. Which of the following activities are typically performed during a vulnerability assessment? (Select TWO.)

Accepted Answer

Identification of missing security patches. A is correct because vulnerability assessments focus on identifying and cataloging weaknesses without exploitation. Missing security patches are a common finding from automated scanning tools like Nessus or OpenVAS, which compare system configurations against known vulnerability databases (e.g., CVE). This aligns with the assessment's goal of discovering vulnerabilities, not exploiting them.

Answer

Attempting to crack password hashes

Answer

Social engineering attacks against employees

Answer

Exploiting identified vulnerabilities to gain unauthorized access

Question 17

Which of the following is a key component of the rules of engagement for a penetration test?

Accepted Answer

Written authorization from management. Rules of engagement must include written authorization, scope, and emergency stop criteria.

Answer

Use of only automated tools

Answer

Guarantee of no system disruption

Answer

Identification of all vulnerabilities

Question 18

During an audit, it is discovered that a database containing personally identifiable information (PII) has been retained for 10 years beyond the regulatory requirement. The data owner has not approved the retention extension. Which data lifecycle principle is primarily being violated?

Accepted Answer

Storage limitation. Storage limitation requires that data be retained only as long as necessary; exceeding the retention period violates this principle.

Answer

Data minimization

Answer

Purpose limitation

Answer

Integrity

Question 19

A healthcare organization uses a custom application to manage patient records. The application uses a database with encrypted columns for sensitive data. The security team discovers that an insider has been copying encrypted data to an external drive. While the data is encrypted, the encryption key is stored in a configuration file accessible to the application. Which additional control would best mitigate this risk?

Accepted Answer

Store the encryption key in a hardware security module (HSM) with access policies.. Storing the encryption key in an HSM with access policies ensures the key is never in cleartext accessible to the application or user; it also enforces access controls and auditing. Role-based access on the config file is insufficient because the application still needs to read the key. TDE protects data at rest but does not protect the key. Auditing is detective, not preventive.

Answer

Enable audit logging on the application.

Answer

Implement role-based access control on the configuration file.

Answer

Use transparent data encryption (TDE) at the database level.

Question 20

In an OAuth 2.0 authorization code flow with PKCE, what is the primary purpose of the code verifier and code challenge?

Accepted Answer

To ensure the client that requested the code is the same one redeeming it. PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks, especially for public clients like mobile apps.

Answer

To encrypt the authorization code

Answer

To authenticate the end user

Answer

To generate the ID token