CISSP Practice Test 26 — 15 Questions

Question 1

An organization is designing a multicast network for live video streaming. They need to ensure that only authorized receivers can access the multicast group. Which technique should be implemented?

Accepted Answer

IGMP filtering. IGMP filtering allows the network to control which hosts are permitted to join a multicast group by filtering IGMP membership reports at the access layer. This ensures that only authorized receivers can become members of the multicast group, providing access control for live video streaming. It is the most direct technique for enforcing authorization at the receiver level.

Answer

Multicast VLAN registration

Answer

Static IGMP entries

Answer

IGMP snooping with port security

Question 2

Which TWO of the following are valid reasons for conducting a business impact analysis (BIA)?

Accepted Answer

To identify critical business processes and their dependencies. A Business Impact Analysis (BIA) is specifically designed to identify critical business processes and their dependencies on resources such as personnel, systems, and data. This identification is foundational for prioritizing recovery strategies in business continuity planning, as it directly links operational needs to technical infrastructure.

Answer

To identify vulnerabilities in the network infrastructure

Answer

To perform a full security audit of the organization

Answer

To create a list of all hardware and software assets

Question 3

A security team is evaluating the results of a penetration test. The test revealed that a low-privileged user could escalate privileges to domain administrator. This is a critical finding. Which of the following should be the immediate next step?

Accepted Answer

Implement patch management for the exploited vulnerability. The immediate priority after discovering a privilege escalation vulnerability is to remediate the root cause—typically a missing patch or misconfiguration—to prevent further exploitation. In a penetration test context, the finding indicates a technical flaw (e.g., a missing security update for CVE-2021-42287 or a misconfigured Active Directory ACL) that must be patched or hardened first. Full incident response (A) is premature without evidence of active compromise, and re-imaging (B) or account termination (C) are reactive measures that do not address the underlying vulnerability.

Answer

Conduct a full incident response

Answer

Re-image all affected systems

Answer

Terminate the user's account

Question 4

Which TWO of the following are characteristics of a VPN that uses TLS?

Accepted Answer

Provides confidentiality. TLS-based VPNs, such as OpenVPN in TLS mode, provide confidentiality through encryption of the tunneled traffic using symmetric ciphers (e.g., AES) negotiated during the TLS handshake. They also provide integrity via message authentication codes (e.g., HMAC) applied to each record, ensuring data has not been altered in transit. These are fundamental security services of the TLS protocol itself.

Answer

Requires a digital certificate on the server

Answer

Operates at the network layer

Answer

Typically uses UDP port 500

Question 5

A company experiences a data breach. Which step should be taken first according to best practices?

Accepted Answer

Contain the breach. According to incident response best practices (NIST SP 800-61), the first priority after confirming a breach is to contain it. This prevents further data exfiltration, limits lateral movement by an attacker, and preserves forensic evidence. Containment actions may include isolating affected systems, blocking malicious IPs at the firewall, or revoking compromised credentials.

Answer

Inform affected parties

Answer

Notify law enforcement

Answer

Assess the damage

Question 6

Which two methods provide strong encryption and authentication for wireless networks? (Choose TWO.)

Accepted Answer

WPA2-Enterprise. WPA2-Enterprise (C) is correct because it uses IEEE 802.1X authentication with a RADIUS server, providing mutual authentication and per-session dynamic encryption keys via the 4-way handshake using AES-CCMP. WPA3 (E) is correct because it introduces Simultaneous Authentication of Equals (SAE) to replace the pre-shared key (PSK) handshake, offering forward secrecy and stronger encryption with GCMP-256, and also supports 802.1X for enterprise deployments.

Answer

WEP

Answer

WPA2-PSK

Answer

MAC filtering

Question 7

A company wants to implement 802.1X authentication on their wired network. Which components are required?

Accepted Answer

Supplicant, authenticator, and authentication server. 802.1X requires three distinct roles to function: the supplicant (client software requesting access), the authenticator (network device like a switch that enforces port-based access control), and the authentication server (typically a RADIUS server that validates credentials). Without all three, the EAP (Extensible Authentication Protocol) exchange cannot complete, as the authenticator acts as a proxy between the supplicant and the authentication server. Option C is correct because it lists all three mandatory components.

Answer

Supplicant and authenticator

Answer

Authenticator and authentication server

Answer

Supplicant and authentication server

Question 8

An organization is preparing for an ISO 27001 certification audit. The audit will be performed by an external body. This type of audit is classified as:

Accepted Answer

External audit. An external audit is performed by an independent third-party organization, such as a certification body, to assess compliance against a standard like ISO 27001. In this scenario, the audit is conducted by an external body specifically for certification purposes, which directly matches the definition of an external audit. This type of audit provides an unbiased evaluation of the Information Security Management System (ISMS) and is required for formal certification.

Answer

Self-assessment

Answer

Peer review

Answer

Internal audit

Question 9

A company's risk assessment identifies a high likelihood of a data breach due to outdated encryption standards. The cost to upgrade encryption is $50,000, and the estimated loss from a breach is $2,000,000. The risk manager decides to implement the upgrade. Which risk treatment option is being applied?

Accepted Answer

Risk mitigation. The risk manager is applying risk mitigation by implementing the encryption upgrade to reduce the likelihood or impact of a data breach. This directly addresses the identified risk by deploying a stronger cryptographic control, such as moving from AES-128 to AES-256 or replacing deprecated TLS 1.0/1.1 with TLS 1.3, thereby lowering the residual risk to an acceptable level.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk enhancement

Answer

Risk transfer

Question 10

A password policy requires passwords to be at least 12 characters, with uppercase, lowercase, digits, and special characters. Which of the following is an example of a password that meets the policy?

Accepted Answer

Password123!. (Password123!) meets the policy because it is 12 characters long and includes uppercase (P), lowercase (assword), digits (123), and a special character (!). The policy requires all four character types, and this password satisfies each requirement without any ambiguity.

Answer

Abcdefghijkl

Answer

Pa$$w0rd

Answer

MyP@ssw0rd1

Answer

SecureP@ss1

Question 11

An organization needs to ensure that its employees understand their responsibilities regarding information security. Which of the following is the MOST effective way to achieve this?

Accepted Answer

Implement a security awareness program with regular training and assessments.. A security awareness program with regular training and assessments is the most effective way to ensure employees understand their responsibilities because it establishes a continuous learning cycle. Unlike one-time events, it reinforces secure behaviors through repetition, real-world scenarios, and measurable assessments, aligning with the NIST SP 800-50 framework for building a security-conscious culture.

Answer

Distribute a security policy document and require a signature.

Answer

Conduct a one-time annual security briefing.

Answer

Display security posters in common areas.

Question 12

Which THREE are essential elements of a Transport Layer Security (TLS) handshake? (Choose three.)

Accepted Answer

Key generation. Key generation is essential because during a TLS handshake, the client and server derive session keys using the pre-master secret exchanged via asymmetric encryption (e.g., RSA or Diffie-Hellman). These keys are then used for symmetric encryption of the session, ensuring confidentiality and integrity. Without key generation, no secure communication channel can be established.

Answer

User authentication

Answer

Session ticket exchange

Question 13

A security engineer is evaluating a web application for common vulnerabilities. The application uses a Content Management System (CMS) that is outdated and has known vulnerabilities. Additionally, the application displays detailed error messages and uses default administrative credentials. Which TWO of the following OWASP Top 10 categories are most relevant to these issues?

Accepted Answer

Vulnerable and Outdated Components. A is correct because the outdated CMS with known vulnerabilities directly corresponds to OWASP A06:2021 – Vulnerable and Outdated Components. This category covers using software versions with unpatched security flaws, which attackers can exploit via public exploit databases or automated scanners. B is correct because displaying detailed error messages and using default administrative credentials are classic examples of Security Misconfiguration (OWASP A05:2021). This occurs when security settings are not properly defined, implemented, or maintained, allowing attackers to gain information or unauthorized access.

Answer

Injection

Answer

Cryptographic Failures

Answer

Broken Access Control

Question 14

A company is designing a recovery site for its critical database. The recovery time objective (RTO) is 2 hours, and the recovery point objective (RPO) is 15 minutes. Which of the following replication strategies is BEST suited?

Accepted Answer

Synchronous replication to a hot site. Synchronous replication writes data to both the primary and the hot site simultaneously, ensuring zero data loss upon failover. With an RPO of 15 minutes, synchronous replication can meet this requirement because it commits transactions at both sites before acknowledging completion. A hot site is fully configured and ready to take over within the RTO of 2 hours, making this combination the best fit.

Answer

Asynchronous replication to a warm site

Answer

Full backups every 24 hours to a cold site

Answer

Weekly snapshots to a warm site

Question 15

Which THREE of the following are examples of data at rest?

Accepted Answer

Data stored on a hard drive. Data at rest refers to data that is physically stored on a persistent medium and is not currently moving across a network or being processed. Data stored on a hard drive is a classic example because the data resides on a non-volatile storage device, whether it is an internal HDD, SSD, or external drive. The data remains on the medium until it is read, modified, or deleted, and it is typically protected by encryption mechanisms such as BitLocker or FileVault.

Answer

Data in an email in transit

Answer

Data on a network cable