CISSP Practice Test 5 — 25 Questions

Question 1

Which document is mandatory, high-level, and sets the direction for security within an organization?

Accepted Answer

Policy. A security policy is a mandatory, high-level document that defines an organization's security objectives, principles, and management intent. It sets direction and assigns responsibility without prescribing specific technical implementations. Standards, procedures, and baselines all derive from and must comply with the policy, making policy the authoritative top-level document.

Answer

Standard

Answer

Procedure

Answer

Baseline

Question 2

A company has a data retention policy requiring customer transaction records to be kept for 7 years. After 7 years, the data should be destroyed. Which phase of the data lifecycle governs this action?

Accepted Answer

Destroy. The destroy phase of the data lifecycle explicitly governs the secure disposal of data once its retention period ends. In this scenario, after 7 years, the policy mandates destruction, so the action falls under the Destroy phase. This phase ensures data is irrecoverable and compliant with legal and regulatory requirements.

Answer

Use

Answer

Share

Answer

Archive

Question 3

A business continuity plan (BCP) differs from a disaster recovery plan (DRP) in that the BCP primarily focuses on:

Accepted Answer

Maintaining critical business processes during a disruption. A Business Continuity Plan (BCP) is broader in scope and focuses on maintaining critical business processes — people, facilities, suppliers, and operations — during and after a disruption. The Disaster Recovery Plan (DRP) is a subset focused specifically on restoring IT systems and infrastructure. Thus, maintaining critical business processes is the BCP's primary focus.

Answer

Securing physical facilities

Answer

Restoring IT systems and infrastructure

Answer

Replacing hardware and software

Question 4

A government contractor handles data classified as 'Secret'. According to government data classification levels, which of the following is the correct order from most restrictive to least restrictive?

Accepted Answer

Top Secret, Secret, Confidential, Unclassified. The U.S. government classification hierarchy, defined by Executive Order 13526, ranks information from most to least restrictive as Top Secret, Secret, Confidential, and Unclassified. Top Secret covers information whose unauthorized disclosure could cause 'exceptionally grave damage' to national security, while Secret and Confidential correspond to 'serious' and 'damage' respectively. Unclassified sits at the bottom with no restriction. Option B is the only choice that lists this order correctly.

Answer

Confidential, Secret, Top Secret, Unclassified

Answer

Unclassified, Confidential, Secret, Top Secret

Answer

Secret, Top Secret, Confidential, Unclassified

Question 5

A security architect is designing a physical security perimeter for a data center. Which of the following is an example of Crime Prevention Through Environmental Design (CPTED) principle?

Accepted Answer

Designing the landscape to provide clear sightlines from the guard post. CPTED focuses on designing the physical environment to reduce crime and fear of crime by influencing human behavior. Clear sightlines from a guard post are a classic CPTED principle—natural surveillance—which allows guards to observe the area without obstruction, deterring potential intruders. This is a design-based approach, not just adding security hardware.

Answer

Using high fences with barbed wire around the facility

Answer

Deploying motion sensors and CCTV cameras

Answer

Installing biometric locks on all server room doors

Question 6

A company wants to ensure its internal web application is free from security flaws during development. Which testing approach analyzes source code without executing the program?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code, bytecode, or binaries without executing the program, which is exactly what the question describes. It is integrated into the IDE or CI/CD pipeline to catch flaws like SQL injection, XSS, and hardcoded secrets early in the SDLC, shifting security left.

Answer

IAST

Answer

RASP

Answer

DAST

Question 7

A security auditor is reviewing the results of a recently completed internal vulnerability scan. The scan report shows several hosts with the same vulnerability. Which of the following actions should the auditor take FIRST?

Accepted Answer

Manually verify the vulnerability on a sample of affected hosts.. The auditor must first manually verify the vulnerability on a sample of affected hosts because automated vulnerability scans can produce false positives due to factors like incomplete banner grabbing, outdated plugin signatures, or network-level interference. Confirming the finding ensures that subsequent remediation efforts are based on accurate, validated data, preventing wasted resources on non-existent issues.

Answer

Immediately apply patches to all affected hosts.

Answer

Remove the hosts from the network until the vulnerability is resolved.

Answer

Re-run the scan with a different scanner.

Question 8

A company uses a qualitative risk analysis matrix where likelihood ranges from 1 to 5 and impact ranges from 1 to 5. A risk with a likelihood of 4 and an impact of 5 would fall into which risk level if the matrix defines high risk as scores above 15, medium as 10-15, and low as below 10?

Accepted Answer

High. The risk score is calculated as likelihood × impact = 4 × 5 = 20. The matrix defines high risk as scores above 15, and 20 exceeds 15, so the risk falls into the High category. This is a straightforward application of the qualitative risk scoring formula used in the scenario.

Answer

Medium

Answer

Critical

Answer

Low

Question 9

Which physical security design principle emphasizes that the physical environment should be designed to discourage criminal activity by using natural surveillance, access control, and territorial reinforcement?

Accepted Answer

CPTED. CPTED (Crime Prevention Through Environmental Design) is the discipline that uses natural surveillance (sightlines that make intruders visible), natural access control (directing flow through defined entry points), and territorial reinforcement (fences, signage, landscaping that signal private space) to deter criminal activity. It is a design philosophy applied to the physical environment itself, not a technology or a layered-defense strategy.

Answer

TEMPEST

Answer

Fail-safe

Answer

Layered defense

Question 10

Which of the following is the correct order of priority for the ISC2 Code of Ethics Canons?

Accepted Answer

Protect society, act honorably, provide diligent service, advance the profession. The ISC2 Code of Ethics Canons are ordered by priority: Protect society, the common good, necessary public trust and confidence, and the infrastructure; Act honorably, honestly, justly, responsibly, and legally; Provide diligent and competent service to principals; and Advance and protect the profession. Option B correctly lists this order.

Answer

Advance the profession, protect society, act honorably, provide diligent service

Answer

Provide diligent service, protect society, act honorably, advance the profession

Answer

Act honorably, provide diligent service, protect society, advance the profession

Question 11

A company is designing a database that will contain personally identifiable information (PII). To reduce privacy risk, they decide to add controlled noise to query results. This technique is known as:

Accepted Answer

Differential privacy. Differential privacy is a technique that adds controlled noise to query results to protect individual privacy while allowing aggregate analysis. It ensures that the inclusion or exclusion of a single individual's data does not significantly affect the output, thereby reducing privacy risk. This matches the scenario of adding noise to query results for PII.

Answer

Data masking

Answer

Tokenization

Answer

Anonymization

Question 12

Which cryptographic algorithm is an example of a symmetric stream cipher?

Accepted Answer

RC4. RC4 is a symmetric stream cipher that generates a pseudorandom keystream and XORs it with plaintext one byte at a time. It was widely used in WEP, WPA (TKIP), and SSL/TLS before being deprecated due to keystream biases. Stream ciphers encrypt data bit-by-bit or byte-by-byte, unlike block ciphers which process fixed-size blocks.

Answer

AES

Answer

3DES

Answer

RSA

Question 13

During a security audit, it is discovered that a network firewall is allowing traffic based on source IP address only, without inspecting application-layer data. Which type of firewall is this?

Accepted Answer

Packet filter. A packet filter firewall operates at Layer 3 (Network) and Layer 4 (Transport) of the OSI model, making decisions solely based on source and destination IP addresses, ports, and protocols. It does not inspect application-layer data (Layer 7), which matches the scenario where traffic is allowed based on source IP address only. This is the simplest and fastest type of firewall, but it lacks the ability to block attacks embedded in application payloads.

Answer

Circuit-level gateway

Answer

Application gateway

Answer

Stateful inspection

Question 14

In qualitative risk analysis, a risk is assessed with a likelihood of 4 (on a scale of 1-5) and an impact of 5. The risk matrix defines scores of 15-25 as high. What is the risk rating?

Accepted Answer

High. In qualitative risk analysis, the risk score is calculated by multiplying likelihood by impact. Here, likelihood = 4 and impact = 5, so the risk score = 4 × 5 = 20. The risk matrix defines scores of 15–25 as high, so a score of 20 falls into the high category. Therefore, the risk rating is High.

Answer

Low

Answer

Medium

Answer

Critical

Question 15

In a software-defined network (SDN) architecture, the control plane is separated from the data plane. A network administrator is troubleshooting packet forwarding delays. Which plane is directly responsible for forwarding packets?

Accepted Answer

Data plane. In SDN, the data plane (also called the forwarding plane) is directly responsible for forwarding packets based on flow table entries installed by the controller. It handles per-packet operations like looking up destination addresses, applying actions (e.g., output to port, drop, modify header), and forwarding at line rate. Packet forwarding delays are typically caused by data plane issues such as flow table misses, hardware forwarding pipeline congestion, or inefficient TCAM lookups.

Answer

Application plane

Answer

Control plane

Answer

Management plane

Question 16

An organization wants to avoid a particular risk entirely by not engaging in the activity that creates the risk. Which risk response strategy is being used?

Accepted Answer

Avoid. Risk avoidance is the strategy of eliminating the risk by not performing the activity that creates it — for example, deciding not to store credit card data at all to avoid PCI DSS exposure. It is the only strategy that reduces risk to zero for that specific activity, though it may forfeit business benefits. The question's phrasing 'not engaging in the activity' is the textbook definition of avoidance.

Answer

Transfer

Answer

Mitigate

Answer

Accept

Question 17

An organization's security operations center (SOC) uses a SIEM to correlate logs. The SOC manager wants to automate response actions for low-severity alerts. Which technology would best support this goal?

Accepted Answer

SOAR platform. A SOAR (Security Orchestration, Automation, and Response) platform is designed to ingest alerts from SIEM and other sources, apply playbooks, and execute automated response actions such as disabling accounts, blocking IPs, or opening tickets. It is the technology category purpose-built for automating low-severity alert triage and response. SIEM correlates and detects; SOAR orchestrates and acts.

Answer

Network firewall

Answer

Threat intelligence platform

Answer

Vulnerability scanner

Question 18

A company's security team uses a tool that instruments the application at runtime to monitor and block attacks. This is an example of:

Accepted Answer

RASP. RASP (Runtime Application Self-Protection) instruments the application at runtime, embedding security checks inside the application to detect and block attacks in real time. It operates within the application's execution context, allowing it to monitor data flow, method calls, and user input.

Answer

IAST

Answer

SAST

Answer

DAST

Question 19

An LDAP distinguished name (DN) includes the attribute 'CN=John Doe,OU=Sales,DC=company,DC=com'. What does 'CN' stand for?

Accepted Answer

Common Name. In an LDAP distinguished name, CN stands for Common Name, which identifies the object (e.g., a user or group) by its common name attribute. In 'CN=John Doe,OU=Sales,DC=company,DC=com', CN=John Doe is the leaf RDN identifying the user. This is standard LDAP/X.500 naming.

Answer

Country Name

Answer

Certificate Name

Answer

Container Name

Question 20

During an incident response, the team identifies that the attacker gained access through a compromised service account with domain admin privileges. Which of the following steps should be taken FIRST to contain the incident?

Accepted Answer

Disable the compromised account and revoke its tokens.. Disabling the compromised account and revoking its tokens (e.g., Kerberos TGTs via `Set-ADAccountControl -Disable` and clearing cached tickets) immediately stops the attacker's current authentication and lateral movement capabilities. This is the fastest containment step because the service account with Domain Admin privileges is the direct vector; isolating systems or resetting all passwords is slower and may not address active token reuse.

Answer

Isolate all affected systems from the network.

Answer

Reset all user passwords.

Answer

Perform a full forensic analysis before any action.