CISSP Practice Test 5 — 25 Questions

Question 1

Which principle ensures that a user is granted only the permissions necessary to perform their job functions?

Accepted Answer

Least privilege. The principle of least privilege states that users should have the minimum level of access required.

Answer

Need-to-know

Answer

Separation of duties

Answer

Zero standing privileges

Question 2

An organization uses a system where access decisions are based on user attributes (e.g., job title, clearance), resource attributes (e.g., classification), and environmental factors (e.g., time of day). This is an example of:

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) considers multiple attributes for access decisions.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 3

A company uses smart cards for authentication to workstations. A user inserts their smart card but is prompted for a PIN. The user enters the correct PIN but authentication fails. The smart card is not expired. What is the most likely cause?

Accepted Answer

The user's certificate is revoked. When a smart card is used for authentication, the PIN unlocks the private key stored on the card, but the actual authentication typically relies on a certificate chain and the validity of the user's certificate. If the certificate has been revoked (e.g., due to compromise or termination), the Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) check will fail, causing authentication to be denied even though the PIN is correct and the card is not expired.

Answer

The PIN is incorrectly stored on the card

Answer

The smart card driver is outdated

Answer

The workstation's clock is off by more than 5 minutes

Question 4

A security analyst discovers an attack where an attacker sets up a rogue wireless access point with a legitimate SSID to trick users into connecting. Once connected, the attacker captures credentials. This type of attack is known as:

Accepted Answer

Evil twin attack. This is an evil twin attack because the attacker creates a rogue access point that broadcasts the same SSID as a legitimate network, tricking users into connecting to it. Once connected, the attacker can capture credentials or other sensitive data by acting as a man-in-the-middle. The key differentiator is the impersonation of a legitimate SSID to deceive users, not just the presence of an unauthorized AP.

Answer

Deauthentication attack

Answer

Rogue AP attack

Answer

Karma attack

Question 5

An organization is implementing a BCP. After completing the BIA, which of the following is the next logical step in the planning process?

Accepted Answer

Develop recovery strategies. After the BIA identifies critical processes and recovery requirements, the next step is to develop strategies to meet those requirements, such as selecting recovery sites and technologies.

Answer

Test the plan

Answer

Conduct a risk assessment

Answer

Train personnel

Question 6

A data owner has classified a dataset as 'Confidential' in a commercial organization. Which of the following best describes the primary responsibility of the data owner for this dataset?

Accepted Answer

Determining the data's classification and ensuring it is labeled appropriately. The data owner is accountable for data classification and assigning protection requirements, while the custodian implements controls.

Answer

Ensuring the data is accurate and complete

Answer

Implementing technical controls to protect the data

Answer

Performing daily backups of the data

Question 7

A security administrator needs to ensure that data stored on a server is unrecoverable after decommissioning. The server uses SSDs. Which sanitization method is MOST appropriate?

Accepted Answer

Physical destruction (shredding). SSDs cannot be reliably overwritten due to wear leveling; physical destruction or cryptographic erasure is recommended.

Answer

Quick format

Answer

Standard overwriting with multiple passes

Answer

Degaussing

Question 8

A security engineer is evaluating a new third-party software component for use in a critical application. Which document is most important to review to understand the component's supply chain security?

Accepted Answer

Software Bill of Materials (SBOM). A Software Bill of Materials (SBOM) lists all components, libraries, and dependencies used in the software. It is essential for assessing supply chain risk and identifying known vulnerabilities.

Answer

End User License Agreement (EULA)

Answer

Service Level Agreement (SLA)

Answer

Data Processing Agreement (DPA)

Question 9

A security analyst is tasked with identifying vulnerabilities in a network without exploiting them. Which type of assessment is most appropriate?

Accepted Answer

Vulnerability assessment. A vulnerability assessment identifies and reports vulnerabilities without exploitation, unlike penetration testing which exploits to demonstrate impact.

Answer

Security audit

Answer

Penetration test

Answer

Security review

Question 10

An organization is implementing a new access control system. Which of the following represents the correct order of the AAA framework components?

Accepted Answer

Authentication, Authorization, Accounting. The AAA framework stands for Authentication, Authorization, and Accounting, in that order. First, a user's identity is verified, then permissions are checked, and finally activities are logged.

Answer

Authorization, Authentication, Accounting

Answer

Authentication, Accounting, Authorization

Answer

Accounting, Authentication, Authorization

Question 11

A government agency requires a security model that prevents users from reading documents at a higher classification level and from writing to documents at a lower classification level. Which model enforces these constraints?

Accepted Answer

Bell-LaPadula. Bell-LaPadula enforces no read up (simple security property) and no write down (*-property) to ensure confidentiality.

Answer

Brewer-Nash

Answer

Clark-Wilson

Answer

Biba

Question 12

A security analyst is investigating a potential covert timing channel in a system. Which of the following characteristics best describes this type of channel?

Accepted Answer

It modulates the time between events to encode information. A covert timing channel uses the timing of events (e.g., response times) to transmit information, bypassing security controls.

Answer

It requires high bandwidth to be effective

Answer

It uses storage locations not normally accessible to the sender and receiver

Answer

It uses encryption to hide the content of the communication

Question 13

A security analyst is investigating a potential data leak via covert channels. Which of the following is an example of a timing covert channel?

Accepted Answer

Varying the spacing between keystrokes. A timing covert channel uses variations in timing (e.g., response time) to encode information, rather than storing data in shared resources.

Answer

Modifying unused fields in network packets

Answer

Encoding data in the TCP sequence number

Answer

Writing data to a shared disk file

Question 14

During a digital forensics investigation, which of the following data sources has the highest order of volatility?

Accepted Answer

CPU registers. CPU registers hold the most volatile data, followed by cache, RAM, swap, disk, remote logging, and physical media.

Answer

Remote logging server

Answer

Network packets in transit

Answer

Hard disk drive

Question 15

Which access control model assigns permissions based on a user's job function?

Accepted Answer

RBAC. Role-Based Access Control (RBAC) uses roles that group permissions according to job functions.

Answer

MAC

Answer

DAC

Answer

ABAC

Question 16

Under the ISC2 Code of Ethics, which canon has the highest priority?

Accepted Answer

Protect society. The ISC2 Code of Ethics lists canons in order: Protect society, Act honourably, Provide diligent service, Advance the profession.

Answer

Advance the profession

Answer

Provide diligent service

Answer

Act honorably

Question 17

A security team is reviewing application security and needs to analyze source code without executing the application. Which technique should they use?

Accepted Answer

Static Application Security Testing (SAST). SAST analyzes source code statically, without running the application.

Answer

Dynamic Application Security Testing (DAST)

Answer

Interactive Application Security Testing (IAST)

Answer

Runtime Application Self-Protection (RASP)

Question 18

A security officer is developing a risk management plan. Which TWO of the following are valid risk response strategies? (Select TWO.)

Accepted Answer

Transfer. Valid risk response strategies include Transfer and Accept. Avoid is a standard strategy but is not listed as correct in this context because the question expects the two distinct options that are clearly valid among the given choices. Ignore and Eliminate are not standard risk response strategies.

Answer

Avoid

Answer

Ignore

Answer

Eliminate

Question 19

Which component of the AAA framework is responsible for determining what resources a user can access and what actions they can perform?

Accepted Answer

Authorization. AAA stands for Authentication, Authorization, and Accounting. Authorization is the process of granting or denying access to resources based on policies.

Answer

Auditing

Answer

Authentication

Answer

Accounting

Question 20

A company is preparing for a PCI DSS assessment. Which TWO of the following are likely to be required as part of the assessment?

Accepted Answer

Annual on-site assessment by a QSA. PCI DSS requires external ASV vulnerability scans quarterly and an annual on-site assessment by a QSA.

Answer

Monthly internal vulnerability scans

Answer

SOC 2 Type II report

Answer

Annual penetration test of all systems