CISSP Practice Test 27 — 15 Questions

Question 1

A financial institution is implementing a data loss prevention (DLP) solution to protect customer financial information. The DLP system must detect and block the transmission of credit card numbers via email. Which of the following is the BEST approach to ensure accurate detection while minimizing false positives?

Accepted Answer

Apply a regular expression that validates the Luhn algorithm in addition to pattern matching. Option A is correct because combining a regular expression for credit card number patterns with Luhn algorithm validation significantly reduces false positives. The Luhn algorithm checks the mathematical validity of the number (e.g., checksum), ensuring that random digit sequences matching the pattern are not flagged as credit card numbers. This dual-layer approach is a standard DLP best practice for accurately detecting sensitive data like credit card numbers.

Answer

Hash all outbound emails and compare against a database of known credit card hashes

Answer

Use a simple regular expression matching patterns like '\d{4}-\d{4}-\d{4}-\d{4}'

Answer

Rely on machine learning classifiers trained on past credit card data

Question 2

An organization uses a data loss prevention (DLP) system to monitor outbound emails. Which data classification type would the DLP most likely use to detect sensitive information leaving the network?

Accepted Answer

Content-based classification. Content-based classification inspects the actual data within outbound emails—such as credit card numbers, social security numbers, or other regex-defined patterns—to detect sensitive information. DLP systems rely on content analysis (e.g., regular expressions, exact data matching, or fingerprinting) to identify and block policy violations, making this the correct classification type for detecting sensitive data leaving the network.

Answer

Context-based classification

Answer

User-based classification

Answer

Role-based classification

Question 3

A company is implementing a data masking solution for a test database that mirrors production. Which masking technique preserves referential integrity while obfuscating sensitive values?

Accepted Answer

Deterministic encryption. Deterministic encryption (C) is correct because it uses a consistent key and algorithm to always produce the same ciphertext for a given plaintext value, allowing foreign key relationships to be maintained across tables. This preserves referential integrity while obfuscating sensitive data, as the encrypted values can still be joined reliably. Static data masking (B) replaces values with fictional but consistent substitutes, but it does not use encryption and may not guarantee the same level of consistency for complex referential constraints without careful design.

Answer

Hash-based masking

Answer

Static data masking

Answer

Dynamic data masking

Question 4

Which THREE of the following are key considerations when implementing a data retention policy for an organization subject to multiple legal jurisdictions?

Accepted Answer

Varying statutory retention periods across jurisdictions. Option A is correct because different legal jurisdictions impose distinct statutory retention periods for various data types (e.g., GDPR requires retention no longer than necessary, while HIPAA mandates 6 years for medical records). A data retention policy must account for these varying minimums to ensure compliance across all applicable laws. Failing to reconcile conflicting periods can lead to legal penalties or data deletion before a jurisdiction’s requirement is met.

Answer

The organization's ability to delete data after the minimum retention period

Answer

The data owner's personal preference for deletion timelines

Question 5

A security architect is designing controls for a cloud-based file storage service that stores personally identifiable information (PII). Which control best ensures that data remains encrypted at rest without involving the cloud provider's key management?

Accepted Answer

Client-side encryption. Client-side encryption ensures data is encrypted before it leaves the client device, so the cloud provider never has access to the plaintext or the encryption keys. This guarantees that the data remains encrypted at rest in the cloud storage without relying on the provider's key management infrastructure, meeting the requirement of keeping the provider out of the key management loop.

Answer

Tokenization of PII fields

Answer

Transport Layer Security (TLS) for data in transit

Answer

Server-side encryption with customer-managed keys

Question 6

A government agency's data retention policy requires that classified documents be destroyed after 10 years. Which method ensures both the information and the media are completely destroyed in a way that is verifiable and auditable?

Accepted Answer

Incineration in a certified facility. Incineration in a certified facility is the only option that completely destroys both the information and the physical media, leaving no residue that could be reconstructed. For classified government documents, the destruction must be verifiable and auditable, which a certified incineration facility provides through documented chain-of-custody and destruction certificates. This method ensures the media is physically reduced to ash, eliminating any possibility of data recovery, unlike logical or magnetic techniques.

Answer

Overwriting the data seven times

Answer

Degaussing the storage media

Answer

Deleting all files and emptying the recycle bin

Question 7

Refer to the exhibit. An analyst attempts to read /data/confidential. What will be the outcome?

Accepted Answer

Access is denied because Analysts are explicitly denied. The policy explicitly denies the 'Analysts' group access to /data/confidential. In RBAC or DAC-based file systems (e.g., Linux ACLs or Windows NTFS), an explicit deny entry overrides any conflicting allow entry, regardless of the order of evaluation. Since the analyst is a member of the 'Analysts' group, the deny rule applies, and access is denied.

Answer

Access is granted because no 'combine' method is specified, so permit wins

Answer

The policy is ambiguous and will result in an error

Answer

Access is granted because Analysts are in the 'allowed' list

Question 8

A multinational corporation must ensure that data leaving the organization's network is classified and labeled appropriately. Which of the following is the MOST effective method to enforce consistent labeling across all data types?

Accepted Answer

Implement automated data classification tools that scan for sensitive content and apply labels. Automated data classification tools (e.g., Microsoft Purview, Symantec DLP) use content inspection, pattern matching, and machine learning to scan data at rest, in use, and in transit. They apply consistent labels based on predefined policies (e.g., regex for PII, fingerprinting for IP), ensuring uniform labeling across all data types without relying on human consistency or manual effort.

Answer

Appoint data stewards in each department to manually review and label data

Answer

Require all employees to complete annual training on data classification

Answer

Encrypt all data in transit and at rest to prevent unauthorized access

Question 9

Which THREE of the following are valid methods to reduce the risk of data exfiltration via removable media in a high-security environment?

Accepted Answer

Disable USB ports via group policy and physically lock cases. Disabling USB ports via Group Policy (using administrative templates to set 'Removable Storage: Deny write access' to 'Enabled') combined with physically locking cases (e.g., using case locks or cable locks to prevent unauthorized access to internal USB headers) provides a dual-layer preventive control. This directly eliminates the attack vector by removing both logical and physical access to removable media, which is the most effective method in a high-security environment.

Answer

Require annual security awareness training on data handling

Answer

Use full disk encryption on all endpoints

Question 10

Which TWO of the following are essential characteristics of an effective information classification scheme?

Accepted Answer

Should have clear labels that map to specific handling procedures. Option C is correct because an effective classification scheme must have clear labels (e.g., 'Confidential', 'Secret') that directly map to specific handling procedures (e.g., encryption at rest, access control lists, retention periods). This ensures that data owners and custodians know exactly how to protect each classification level without ambiguity.

Answer

Should have at least seven classification levels to capture granularity

Answer

Must be accompanied by mandatory training for all users

Answer

Should be based on the encryption algorithm used to protect the data

Question 11

A company requires employees to authenticate using a smart card and PIN to access the corporate network. This is an example of which type of authentication?

Accepted Answer

Two-factor authentication. This scenario requires two distinct authentication factors: something you have (the smart card) and something you know (the PIN). Smart cards store a private key or certificate that must be unlocked by the PIN, and both factors must be presented simultaneously to authenticate. This meets the NIST SP 800-63 definition of multi-factor authentication, specifically two-factor authentication.

Answer

Single-factor authentication

Answer

Biometric authentication

Answer

Single sign-on

Question 12

A security architect is designing access controls for a healthcare application where permissions are based on the user's role, the sensitivity of the data, and the context of the access (e.g., time of day). Which access control model best fits this requirement?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) is the correct model because it evaluates access decisions based on multiple attributes: the user's role, the data sensitivity (object attributes), and environmental context such as time of day. Unlike simpler models, ABAC can combine subject, resource, and environment attributes using policy rules (e.g., XACML or ALFA) to enforce fine-grained, context-aware permissions, which is essential for healthcare applications with dynamic compliance requirements like HIPAA.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 13

An organization is implementing federated identity to allow partners to access its web application. The solution must support single logout and attribute exchange. Which protocol is most appropriate?

Accepted Answer

SAML 2.0. SAML 2.0 is the most appropriate protocol because it natively supports both single logout (SLO) and attribute exchange as core features. It uses XML-based assertions to transfer identity and attribute data between an identity provider (IdP) and a service provider (SP), and its SLO mechanism ensures that when a user logs out from one application, all sessions across participating services are terminated simultaneously.

Answer

OpenID Connect

Answer

LDAP

Answer

OAuth 2.0

Question 14

During an audit, it is discovered that several users have inherited permissions through nested group memberships that violate least privilege. What is the best approach to correct this?

Accepted Answer

Implement periodic access reviews and attestation. Periodic access reviews and attestation (Option A) are the best approach because they establish a continuous governance process where data owners or managers formally confirm that inherited permissions from nested group memberships remain appropriate. This directly addresses the root cause—unchecked group nesting—by enforcing regular validation of access rights against the principle of least privilege, rather than relying on a one-time fix or training.

Answer

Re-certify group memberships quarterly

Answer

Provide training on least privilege

Answer

Revoke all group memberships and assign individually

Question 15

A security engineer is troubleshooting an authentication failure for a Windows domain user. The user receives 'Access denied' when trying to access a file server. The Kerberos ticket-granting ticket was successfully obtained. What is the most likely issue?

Accepted Answer

The user does not have permission to the file server resource. Since the Kerberos ticket-granting ticket (TGT) was successfully obtained, the user has authenticated to the domain and the Kerberos authentication process is functioning correctly. The 'Access denied' error at the file server indicates that the user lacks the necessary permissions on the specific resource (share or NTFS), which is a separate authorization step after successful authentication.

Answer

The file server is not trusted for delegation

Answer

The user account is locked out

Answer

Time skew between client and domain controller