CISSP Practice Test 26 — 15 Questions

Question 1

A network administrator is deploying a wireless network for a small business and wants to ensure strong security. Which of the following is the best choice for authentication in a WPA3 Personal network?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Simultaneous Authentication of Equals (SAE). Simultaneous Authentication of Equals (SAE) is the correct choice because WPA3 Personal replaces the vulnerable Pre-Shared Key (PSK) handshake with SAE, which provides a secure key exchange resistant to offline dictionary attacks. SAE uses a Dragonfly handshake based on a zero-knowledge proof, ensuring that even if an attacker captures the handshake, they cannot brute-force the password without being present for each guess.

Answer

EAP-TLS

Answer

TKIP

Answer

Pre-shared key (PSK)

Question 2

A security architect is designing a zero trust network. Which principle is fundamental to a zero trust architecture?

Accepted Answer

Never trust, always verify. Zero trust architecture (ZTA) fundamentally rejects implicit trust based on network location. The principle 'never trust, always verify' mandates continuous authentication and authorization for every access request, regardless of whether it originates from inside or outside the network perimeter. This is enforced through micro-segmentation, least-privilege access, and per-session verification, often using technologies like identity-aware proxies and software-defined perimeters (SDP).

Answer

Trust but verify

Answer

Rely on perimeter defenses

Answer

Trust internal traffic implicitly

Question 3

An organization implements a data loss prevention (DLP) solution to monitor data in motion. Which type of data is typically most challenging to detect?

Accepted Answer

Encrypted traffic. Encrypted traffic is the most challenging data in motion for DLP to inspect because the payload is obfuscated by encryption protocols such as TLS 1.3 or IPsec. Without decryption (e.g., via a proxy with TLS interception), the DLP sensor cannot read the content to match patterns or keywords, rendering traditional deep packet inspection ineffective.

Answer

Data in images

Answer

Structured data in CSV files

Answer

Unstructured data in email attachments

Question 4

An organization is implementing a bring-your-own-device (BYOD) policy. Which security control should be enforced to ensure that only compliant devices can access corporate resources?

Accepted Answer

Implementing network access control (NAC). Network access control (NAC) is the correct control because it evaluates device posture (e.g., OS patch level, antivirus status, disk encryption) against a compliance policy before granting network access. NAC can quarantine non-compliant devices to a remediation VLAN or deny access entirely, ensuring only trusted endpoints reach corporate resources. This is distinct from generic encryption or authentication controls, as NAC enforces a dynamic, policy-based admission decision at the network layer.

Answer

Using a VPN concentrator

Answer

Requiring strong passwords

Answer

Enabling full disk encryption

Question 5

An organization is developing a security governance framework to align with business objectives. Which group should have ultimate authority and responsibility for the cybersecurity program?

Accepted Answer

Board of directors. The board of directors holds ultimate fiduciary duty for the organization, including oversight of risk management and cybersecurity. They approve the security governance framework and ensure it aligns with business objectives, as they are legally accountable for the entire enterprise. The CISO and CEO implement the program, but the board retains final authority.

Answer

IT steering committee

Answer

Chief Information Security Officer (CISO)

Answer

Chief Executive Officer (CEO)

Question 6

Drag and drop the steps for conducting a risk assessment in the correct order.

Accepted Answer

Step 1: Identify assets
Step 2: Identify threats and vulnerabilities
Step 3: Determine likelihood and impact
Step 4: Calculate risk
Step 5: Recommend treatments. Risk assessment begins with asset identification, then threat/vulnerability identification, likelihood/impact determination, risk calculation, and treatment recommendations.

Answer

Step 1: Identify threats and vulnerabilities
Step 2: Identify assets
Step 3: Determine likelihood and impact
Step 4: Calculate risk
Step 5: Recommend treatments

Answer

Step 1: Identify assets
Step 2: Determine likelihood and impact
Step 3: Identify threats and vulnerabilities
Step 4: Calculate risk
Step 5: Recommend treatments

Answer

Step 1: Calculate risk
Step 2: Identify assets
Step 3: Identify threats and vulnerabilities
Step 4: Determine likelihood and impact
Step 5: Recommend treatments

Question 7

A security analyst observes a network attack where an attacker sends forged ARP messages to associate the attacker's MAC address with the IP address of the default gateway. This attack occurs at which layer of the OSI model?

Accepted Answer

Layer 2 – Data Link. ARP operates at Layer 2 (Data Link) because it maps IP addresses (Layer 3) to MAC addresses (Layer 2) and is encapsulated directly within an Ethernet frame, not an IP packet. The attack described—ARP spoofing—forges ARP replies to poison the target's ARP cache, which is a Layer 2 function. Therefore, the attack occurs at Layer 2 of the OSI model.

Answer

Layer 3 – Network

Answer

Layer 1 – Physical

Answer

Layer 4 – Transport

Question 8

A company is deploying a VPN solution for remote employees using SSL/TLS VPN. Which TWO security considerations are important when implementing this type of VPN? (Select two.)

Accepted Answer

Implement strong authentication mechanisms such as multi-factor authentication. SSL/TLS VPNs operate at the application layer and are exposed to the internet, making them vulnerable to web-based attacks such as SQL injection and cross-site scripting. Strong authentication, including multi-factor authentication (MFA), is critical to prevent unauthorized access even if credentials are compromised. Patching and hardening the SSL VPN gateway against web application attacks is equally important to mitigate vulnerabilities in the underlying web server or VPN appliance.

Answer

Use IPsec in transport mode for better performance

Answer

Use pre-shared keys for authentication

Answer

Disable encryption to improve speed

Question 9

An organization uses OAuth 2.0 for delegated access to APIs. A developer creates a public client application that runs on mobile devices. Which OAuth 2.0 grant type is MOST appropriate for this scenario?

Accepted Answer

Authorization Code Grant with PKCE. The Authorization Code Grant with PKCE (Proof Key for Code Exchange) is the most appropriate for a public client on a mobile device because it prevents authorization code interception attacks. PKCE replaces the client secret with a dynamically generated code verifier and challenge, ensuring that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original verifier. This is the OAuth 2.0 Security Best Current Practice (BCP) recommendation for native and mobile apps.

Answer

Client Credentials Grant

Answer

Implicit Grant

Answer

Resource Owner Password Credentials Grant

Question 10

An organization wants to ensure that only devices that meet security policies can connect to the network. Which technology should be deployed?

Accepted Answer

NAC. Network Access Control (NAC) is the correct technology because it enforces security policies by assessing the compliance of devices (e.g., patch level, antivirus status, OS version) before granting network access. NAC can quarantine non-compliant devices, redirect them to a remediation network, or block them entirely, ensuring only authorized and policy-compliant endpoints connect.

Answer

Firewall

Answer

SIEM

Answer

IDS

Question 11

Which TWO of the following are essential components of a data classification policy? (Select two.)

Accepted Answer

Roles and responsibilities for data classification. Roles and responsibilities are essential because a data classification policy must clearly define who is accountable for classifying data, who can assign classification levels, and who is responsible for maintaining the labels. Without this, classification efforts become inconsistent and unenforceable, leading to security gaps. The CISSP emphasizes that governance requires clear assignment of ownership and decision-making authority for data assets.

Answer

Data retention periods for each classification level

Answer

Methods for secure data destruction

Answer

Encryption standards for each classification level

Question 12

During a security audit of a financial application, the auditor discovers that the application uses a custom encryption algorithm for storing sensitive data. The developer claims it is more efficient than AES. What should the auditor recommend?

Accepted Answer

Migrate to a widely-accepted encryption standard such as AES. Custom encryption algorithms are highly risky because they have not undergone the extensive peer review and cryptanalysis that standards like AES have. Even if the developer claims better efficiency, the lack of proven security guarantees makes the application vulnerable to attacks. The correct recommendation is to migrate to a widely-accepted standard such as AES, which is FIPS 197 validated and trusted for protecting sensitive financial data.

Answer

Conduct additional penetration testing on the encryption implementation

Answer

Accept the risk if the algorithm is more efficient

Answer

Perform a cryptoanalysis of the algorithm to validate its strength

Question 13

A vulnerability scanner reports a vulnerability with a CVSS score of 9.8. What does this score indicate?

Accepted Answer

Critical severity. A CVSS score of 9.8 falls within the range of 9.0–10.0, which is classified as 'Critical' severity according to the CVSS v3.1 specification. This score typically indicates a vulnerability that can be exploited remotely without authentication and with low attack complexity, often leading to complete compromise of confidentiality, integrity, and availability.

Answer

High severity

Answer

Medium severity

Answer

Low severity

Question 14

A security architect is selecting an access control model for a system that must prevent users from reading objects at a higher classification level. Which model enforces this property?

Accepted Answer

Bell-LaPadula. The Bell-LaPadula model enforces mandatory access control (MAC) with the *-property (no write-down) and the simple security property (no read-up). The question specifically asks to prevent reading objects at a higher classification level, which is exactly the 'no read-up' rule of Bell-LaPadula. This model is designed for confidentiality-focused systems, such as military or government classified environments.

Answer

Clark-Wilson

Answer

Biba

Answer

Brewer-Nash

Question 15

A security analyst notes that a recent penetration test successfully exploited a vulnerability in a legacy application that cannot be patched. The analyst recommends implementing network segmentation to limit the application's exposure. This recommendation is an example of:

Accepted Answer

Risk mitigation. Implementing network segmentation to limit exposure of an unpatched legacy application is a classic example of risk mitigation. By isolating the application on a separate network segment (e.g., using VLANs or firewall rules), the analyst reduces the likelihood or impact of a successful exploit, even though the underlying vulnerability remains unpatched. This directly aligns with the CISSP definition of risk mitigation: applying controls to reduce risk to an acceptable level.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer