CISSP Practice Test 28 — 15 Questions

Question 1

A company is implementing a digital signature system to ensure non-repudiation. The security architect must select a hash function that meets the required security properties. Which THREE of the following are necessary properties for the hash function?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Preimage resistance. A hash function must be preimage resistant (unable to invert), second preimage resistant (cannot find another input with the same hash), and collision resistant (cannot find two inputs with the same hash). Reversibility is not a property of hash functions—they are one-way. Determinism is inherent to all hash functions but is not a security property.

Answer

Reversibility

Answer

Determinism

Question 2

An organization is implementing a new governance framework to align IT with business goals. Which framework is specifically designed for IT service management?

Accepted Answer

ITIL. ITIL (Information Technology Infrastructure Library) provides best practices for IT service management.

Answer

ISO/IEC 27001

Answer

COBIT 2019

Answer

NIST Cybersecurity Framework

Question 3

A financial institution is migrating its customer data to a cloud environment. The cloud provider offers encryption at rest and in transit using AES-256 and TLS 1.2+. The compliance team requires that the organization maintain full control of encryption keys to meet regulatory obligations such as PCI DSS and local banking laws. The data is highly sensitive and includes personally identifiable information (PII). Which solution should the security architect recommend?

Accepted Answer

Implement client-side encryption with keys stored on-premises. Client-side encryption with keys stored on-premises ensures the organization retains exclusive control over encryption keys. Relying on cloud provider's encryption with KMS gives key management to the provider, which may not satisfy compliance. Accepting provider encryption without additional controls surrenders control. Tokenization can protect data but removes original format, which may not be acceptable for all uses.

Answer

Use tokenization instead of encryption

Answer

Use the cloud provider's default encryption with their key management service

Answer

Accept the provider's encryption without additional controls

Question 4

In a PKI hierarchy, a relying party needs to verify a certificate's validity. To reduce latency and improve privacy, which mechanism allows the relying party to obtain the revocation status without contacting the CA directly for each verification?

Accepted Answer

OCSP stapling. OCSP stapling allows the server to provide a time-stamped OCSP response from the CA, reducing the client's need to contact the CA directly.

Answer

Certificate Transparency (CT) logs

Answer

Certificate pinning

Answer

Certificate Revocation List (CRL)

Question 5

During a SOC 2 audit, the auditor evaluates controls over a period of time to assess their operating effectiveness. Which type of SOC report is being performed?

Accepted Answer

SOC 2 Type II. SOC 2 Type II reports assess the operating effectiveness of controls over a period of time, while Type I reports are at a point in time.

Answer

SOC 1 Type I

Answer

SOC 3

Answer

SOC 2 Type I

Question 6

A SOC analyst receives an alert from the SIEM indicating a large volume of outbound data from a sensitive database server to an external IP address. The analyst queries the SIEM and finds the server communicated with the external IP during non-business hours. Which type of incident is most likely occurring?

Accepted Answer

Data breach. Large outbound data transfer to an external IP outside business hours suggests a data breach, possibly exfiltration.

Answer

Unauthorized access

Answer

Denial of Service (DoS)

Answer

Malware infection

Question 7

A software development team is adopting secure coding practices. They decide to implement input validation for all user-supplied data. Which approach is recommended as the most effective for preventing injection attacks?

Accepted Answer

Whitelist validation to allow only known good patterns. Whitelist (allowlist) validation defines acceptable input patterns and rejects everything else, which is more effective than trying to block malicious patterns.

Answer

Encoding input before processing

Answer

Using regular expressions to sanitize input

Answer

Blacklist validation to block known malicious patterns

Question 8

A company plans to implement a disaster recovery site that can be operational within 2 hours of a failure. Which type of DR site best meets this requirement?

Accepted Answer

Hot site. Hot sites are fully operational and can be activated within minutes to a few hours.

Answer

Warm site

Answer

Cold site

Answer

Reciprocal agreement

Question 9

Which governance framework is specifically designed to help organizations manage and protect their information assets by providing a comprehensive set of controls based on a risk management approach?

Accepted Answer

ISO/IEC 27001. ISO/IEC 27001 is an international standard for information security management systems (ISMS) that provides a risk-based approach to managing information security.

Answer

NIST Cybersecurity Framework

Answer

COBIT 2019

Answer

ITIL

Question 10

A security architect is reviewing a design for an e-commerce application. The architect recommends implementing defense in depth. Which of the following is an example of this principle?

Accepted Answer

Implementing both a web application firewall (WAF) and input validation. Defense in depth uses multiple layers of security controls so that if one fails, others still provide protection.

Answer

Encrypting data at rest only

Answer

Using a single firewall at the network perimeter

Answer

Requiring strong passwords for all users

Question 11

Which type of risk remains after management has implemented controls to mitigate the identified risks?

Accepted Answer

Residual risk. Residual risk is the risk that remains after controls are applied. Inherent risk is the risk before controls.

Answer

Acceptable risk

Answer

Control risk

Answer

Inherent risk

Question 12

An organization is developing an incident response plan. Which component is responsible for defining the specific conditions that constitute an incident?

Accepted Answer

Incident categories. Incident categories define what events are considered incidents, enabling consistent classification and response.

Answer

Communication plan

Answer

Recovery procedures

Answer

Legal notification requirements

Question 13

In LDAP, what does the Distinguished Name (DN) uniquely identify?

Accepted Answer

An entry in the directory. The DN is the unique identifier for an entry in the LDAP directory, consisting of a sequence of Relative Distinguished Names (RDNs).

Answer

The root of the directory

Answer

The schema of the directory

Answer

A group within the directory

Question 14

Your organization, a multinational e-commerce company, has suffered a ransomware attack that encrypted critical database servers and file shares. The ransom note demands payment in cryptocurrency within 48 hours or the data will be permanently destroyed. The company has a backup strategy that includes daily full backups and hourly incremental backups, stored both on-site and off-site. However, during the incident response, you discover that the most recent on-site backups are also encrypted because the backup server was connected to the network and affected by the same ransomware. Off-site backups are on tape and were last rotated out 72 hours ago. The CEO is pressuring to pay the ransom to restore operations quickly. Which option should the incident response team prioritize to minimize data loss and reputational damage?

Accepted Answer

Restore data from the off-site tape backups taken 72 hours ago.. Restoring from off-site tape backups taken 72 hours ago is the best course because they are not encrypted and provide a viable recovery point. Option A (pay ransom) is risky—no guarantee of decryption and encourages attackers. Option C (rebuild servers from scratch without restoring data) would result in significant data loss and is not efficient. Option D (negotiate) wastes valuable time and does not guarantee recovery.

Answer

Pay the ransom and hope the attackers provide a working decryption key.

Answer

Rebuild servers from scratch using latest known good configurations without restoring data.

Answer

Attempt to negotiate with the attackers for a lower ransom and more time.

Question 15

A software vulnerability allows an attacker to overwrite a return address on the stack to execute arbitrary code. What mitigation technique randomizes the memory layout to prevent the attacker from predicting target addresses?

Accepted Answer

ASLR (Address Space Layout Randomization). ASLR (Address Space Layout Randomization) randomizes the base addresses of executable regions, making it harder to exploit buffer overflows.

Answer

Stack canary

Answer

Data Execution Prevention (DEP)

Answer

NX bit (No-Execute)