CISSP Practice Test 27 — 15 Questions

Question 1

An organization is implementing biometric authentication. Which factor should be considered to minimize the false rejection rate?

Accepted Answer

Lower the sensitivity threshold [correct]. The false rejection rate (FRR) is the likelihood that the system incorrectly rejects an authorized user. Lowering the sensitivity threshold makes the system less strict, reducing false rejections (FRR) but increasing false acceptance (FAR). Therefore, Option A is the correct factor to minimize FRR.

Answer

Increase enrollment sample quality

Answer

Use liveness detection

Answer

Store templates securely

Question 2

Which TWO of the following are principles of the Bell-LaPadula security model?

Accepted Answer

No read up. The Bell-LaPadula model enforces mandatory access control (MAC) to protect confidentiality. Option D (No read up) is correct because a subject cannot read an object at a higher classification level, preventing unauthorized access to sensitive information. Option E (No write down) is correct because a subject cannot write to an object at a lower classification level, preventing the downgrading of classified data.

Answer

Separation of duty

Answer

No write up

Answer

No read down

Question 3

Which THREE of the following are essential components of an effective incident response plan according to NIST SP 800-61?

Accepted Answer

Preparation. NIST SP 800-61 defines the incident response lifecycle as having four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Preparation is the foundational phase that establishes the incident response capability, including creating policies, forming a team, and acquiring necessary tools before any incident occurs.

Answer

Notification

Answer

Vulnerability scanning

Question 4

Which TWO are essential components of a security policy framework?

Accepted Answer

Roles and responsibilities. Roles and responsibilities (D) are essential because they define who is accountable for implementing, maintaining, and enforcing the security policy. Without clear assignment of duties, policy execution becomes unenforceable and audit trails lack ownership, violating the separation of duties principle central to the Security and Risk Management domain.

Answer

Specific encryption key lengths

Answer

Incident response flowcharts

Answer

Network topology diagrams

Question 5

Which TWO of the following are principles of the data minimization concept under privacy regulations such as GDPR?

Accepted Answer

Collect only the personal data that is directly relevant and necessary for the specified purpose. Data minimization under GDPR (Article 5(1)(c)) requires that personal data collected be 'adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.' This principle directly mandates collecting only the data that is directly relevant and necessary for the specified purpose, preventing over-collection and reducing privacy risk.

Answer

Ensure personal data is accurate and kept up to date

Answer

Store personal data for as long as possible for future analysis

Answer

Provide individuals with access to their data upon request

Question 6

An organization wants to implement a security mechanism that ensures all accesses are mediated and cannot be bypassed, is tamperproof, and is small enough to be verified. This describes which concept?

Accepted Answer

Reference Monitor. The reference monitor is an abstract model that enforces access control with the properties: complete mediation, tamperproof, and verifiable.

Answer

Trusted Computing Base (TCB)

Answer

Trusted Platform Module (TPM)

Answer

Security Kernel

Question 7

Which TWO of the following are valid types of data classification labels commonly used in commercial organizations?

Accepted Answer

Confidential. Confidential is a valid data classification label in commercial organizations, typically used to protect sensitive business information that could cause harm if disclosed. It is part of common classification schemes such as Public, Internal, Confidential, and Restricted, aligning with ISO/IEC 27001 guidelines for information asset management.

Answer

Top Secret

Answer

Unclassified

Answer

For Official Use Only

Question 8

A security manager is evaluating risk responses for a high-likelihood, low-impact risk. The cost of mitigation exceeds the potential loss. Which risk response strategy is most appropriate?

Accepted Answer

Accept. When the cost of mitigation exceeds the potential loss, accepting the risk is the most cost-effective response.

Answer

Avoid

Answer

Mitigate

Answer

Transfer

Question 9

Which TWO of the following are effective methods for detecting unauthorized access to a network? (Choose two.)

Accepted Answer

Security information and event management (SIEM). A SIEM aggregates and correlates logs from multiple sources (e.g., firewalls, servers, IDS) in real time, enabling detection of anomalous patterns indicative of unauthorized access. It provides centralized visibility and alerting that can identify a breach even when individual logs appear benign.

Answer

Vulnerability scanner

Answer

Antivirus software

Answer

Firewall rule review

Question 10

An organization wants to enable single sign-on (SSO) across multiple web applications using an XML-based protocol that supports browser redirect flows. Which technology is most appropriate?

Accepted Answer

SAML 2.0. SAML 2.0 is XML-based and uses browser redirects for SSO between IdP and SPs.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect (OIDC)

Question 11

A database administrator (DBA) is responsible for implementing access controls and backup procedures for a customer database containing PII. The DBA reports to the data owner regarding security measures. Which role best describes the DBA's responsibilities?

Accepted Answer

Data custodian. The data custodian is responsible for the day-to-day management and security of data, including implementing controls, backups, and access management, on behalf of the data owner.

Answer

Data steward

Answer

Data owner

Answer

Data processor

Question 12

During a Business Impact Analysis (BIA), the maximum amount of time a business process can be unavailable before causing significant harm is determined. Which metric represents this?

Accepted Answer

Maximum Tolerable Period of Disruption (MTPD). Maximum Tolerable Period of Disruption (MTPD) is the longest time a process can be disrupted before recovery is required.

Answer

Work Recovery Time (WRT)

Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Question 13

Which TWO of the following are valid reasons to implement network segmentation?

Accepted Answer

To isolate sensitive data and systems from the rest of the network.. Network segmentation isolates sensitive data and systems by creating separate broadcast domains or VLANs, restricting unauthorized access and lateral movement. This is a core security principle for protecting critical assets, as it limits the attack surface and enforces access controls between segments.

Answer

To eliminate single points of failure.

Answer

To reduce network latency.

Answer

To simplify routing tables.

Question 14

A small business wants to ensure compliance with GDPR for its customer data. What is the initial action required to comply with GDPR?

Accepted Answer

Map data flows and identify personal data. Before implementing controls or appointing a DPO, the organization must first understand what data it processes and where it flows. Mapping data flows and identifying personal data is the foundational step for all subsequent compliance activities.

Answer

Obtain consent from all data subjects

Answer

Implement pseudonymization techniques

Answer

Conduct a Data Protection Impact Assessment (DPIA)

Question 15

Which THREE of the following are characteristics of a federated identity management system?

Accepted Answer

It relies on standard protocols such as SAML or OpenID Connect. Federated identity management systems rely on standard protocols like SAML (Security Assertion Markup Language) or OpenID Connect to exchange authentication and authorization data between identity providers (IdPs) and service providers (SPs). These protocols enable trust relationships across different security domains without requiring shared directories or a single IdP.

Answer

It operates with a single identity provider for all organizations

Answer

It requires all participating organizations to use the same user directory