CISSP Practice Test 28 — 15 Questions

Question 1

A red team exercise is planned to simulate a sophisticated adversary. The blue team is aware of the exercise but not the exact methods. The red team is given a budget to acquire attack tools. What is the primary advantage of this approach over a traditional penetration test?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It evaluates the organization's detection and response capabilities. A red team exercise with a known-but-not-detailed blue team specifically tests the organization's detection and response capabilities under realistic adversarial conditions. Unlike a traditional penetration test, which focuses on identifying vulnerabilities, this approach evaluates how well the blue team can detect, analyze, and respond to stealthy, multi-stage attacks that mimic a sophisticated adversary. The red team's budget for attack tools allows them to simulate advanced persistent threats (APTs) that challenge the blue team's security operations center (SOC) processes and incident response procedures.

Answer

It ensures that the blue team is not alerted to the test

Answer

It provides comprehensive vulnerability coverage

Answer

It is more cost-effective than a penetration test

Question 2

Which THREE are core principles of secure system design?

Accepted Answer

Least privilege. Least privilege (C) is a core secure design principle because each user, process, or service should be granted only the minimum access rights and permissions required to perform its function, limiting the blast radius of a compromise. Fail securely (D) is correct because systems should default to a safe, denying state when errors, exceptions, or failures occur, so that a failure does not inadvertently expose data or bypass controls. Defense in depth (E) is correct because relying on multiple, layered, and independent security controls ensures that if one control fails, others still protect the asset. Complexity (A) is not a security principle; unnecessary complexity actually increases the attack surface and the likelihood of misconfiguration and vulnerabilities. Security through obscurity (B) is not a core principle because hiding design details or secrets does not provide real protection once the obscurity is bypassed or discovered, and it should never replace proper security controls.

Answer

Complexity increases security

Answer

Security through obscurity

Question 3

A security team is reviewing network segmentation strategies. Which TWO of the following are benefits of using VLANs? (Select TWO.)

Accepted Answer

They allow logical grouping of devices regardless of physical location. VLANs operate at Layer 2 (Data Link Layer) and allow network administrators to segment devices into distinct broadcast domains based on logical criteria such as department or function, regardless of their physical location on the network. This logical grouping reduces the scope of broadcast traffic because broadcasts are confined to the VLAN, not the entire physical network. By containing broadcasts, VLANs improve network performance and security by limiting unnecessary traffic and isolating potential threats.

Answer

They provide encryption of network traffic

Answer

They eliminate the need for firewalls

Answer

They provide inherent protection against ARP spoofing

Question 4

Which TWO of the following are examples of types of security assessments?

Accepted Answer

Vulnerability scan. A vulnerability scan (A) is a recognized type of security assessment because it systematically probes hosts, services, and applications for known weaknesses using signature/CVE-based checks, producing a report of findings. A penetration test (E) is also a security assessment type, as it goes beyond scanning by actively exploiting vulnerabilities under a defined scope and rules of engagement to demonstrate real-world impact. The other options are operational or administrative controls rather than assessment types: a firewall rule review (B) is a configuration audit of one control, password policy enforcement (C) is a preventive administrative control, and antivirus update (D) is routine maintenance of a protective tool.

Answer

Firewall rule review

Answer

Password policy enforcement

Answer

Antivirus update

Question 5

A security team is selecting tools for code review. Which THREE of the following are characteristics of Static Application Security Testing (SAST) tools?

Accepted Answer

They require access to the source code. SAST tools analyze source code, bytecode, or binary code without executing the application. They require access to the source code to perform static analysis, scanning for security flaws such as injection vulnerabilities, buffer overflows, and insecure cryptographic implementations. This allows developers to identify and fix vulnerabilities early in the development lifecycle, before the code is compiled or deployed.

Answer

They are typically used after deployment

Answer

They analyze the application while it is running

Question 6

When implementing a federated identity management system, which TWO components are essential for establishing trust between Identity Provider and Service Provider? (Select two.)

Accepted Answer

Metadata exchange. Metadata exchange (A) is essential because the IdP and SP must exchange XML metadata documents describing their entity IDs, endpoints (SSO, SLO), supported bindings, and signing/encryption certificates before any assertion can be trusted. Public key certificates (E) are essential because the SP validates the IdP's digital signature on SAML assertions (or the IdP validates tokens) using the IdP's public key, establishing cryptographic trust; the private key never leaves the IdP. Together, metadata exchange distributes the certificates and endpoint configuration that make signature verification and secure message routing possible. User directory synchronization (B) is not required — federated identity relies on just-in-time provisioning or attribute statements rather than replicating directories. Single logout (C) is a session-management convenience, not a trust-establishment requirement. Shared secret (D) applies to symmetric schemes like WS-Security or OAuth client secrets, but SAML federation trust is built on asymmetric keys and metadata, not a shared secret.

Answer

User directory synchronization

Answer

Single logout

Answer

Shared secret

Question 7

Which TWO are examples of 'something you know' authentication factors?

Accepted Answer

PIN. A PIN is a classic 'something you know' factor because it is a memorized numeric secret the user provides to authenticate, making option A correct. A security question answer is likewise knowledge-based: the user recalls a fact or personal detail previously registered, so option B is correct. The remaining options are not knowledge factors: a retina scan (C) and a fingerprint (D) are 'something you are' biometric factors, and a smart card (E) is a 'something you have' possession factor.

Answer

Retina scan

Answer

Fingerprint

Answer

Smart card

Question 8

A security manager is planning a penetration test and needs to ensure proper rules of engagement are established. Which TWO of the following are essential components of the rules of engagement?

Accepted Answer

Scope definition including in-scope systems. Scope definition (B) is essential because it explicitly lists in-scope systems, IP ranges, and exclusions, preventing unauthorized access and legal liability. Written authorization from management (C) provides the legal and contractual basis for the test, ensuring the penetration test is conducted with informed consent and documented approval.

Answer

Vulnerability scoring methodology

Answer

Previous test results

Answer

List of tools to be used

Question 9

A company is designing an access control system for a highly sensitive database. They want to ensure that only authorized users can access data, and that access is automatically revoked when the user's context changes (e.g., job role change). Which model BEST meets these requirements?

Accepted Answer

Attribute-based access control (ABAC) with dynamic policy evaluation.. ABAC with dynamic policy evaluation is the best fit because it uses attributes (user, resource, environment) to make real-time access decisions. This allows access to be automatically revoked when context changes, such as a job role update, without manual intervention or periodic reviews.

Answer

Discretionary access control (DAC) with access control lists.

Answer

Role-based access control (RBAC) with periodic reviews.

Answer

Mandatory access control (MAC) with security labels.

Question 10

A network administrator notices that users in the accounting department can access the internet but are unable to access the internal payroll server (10.10.10.50). The firewall rule allows traffic from the accounting subnet (10.10.20.0/24) to the payroll server. What is the most likely issue?

Accepted Answer

The payroll server's default gateway does not have a route back to 10.10.20.0/24.. The most likely issue is that the payroll server's default gateway does not have a route back to the accounting subnet (10.10.20.0/24). Even if the firewall permits outbound traffic from the accounting subnet to the payroll server, the return traffic from the server must be routed back through the firewall or a router that knows how to reach 10.10.20.0/24. Without a return route, the server's response packets are dropped, causing a one-way communication failure.

Answer

DNS is not resolving the payroll server's IP address.

Answer

The firewall rule is applied to the outbound interface only.

Answer

The accounting subnet is blocked by an implicit deny rule.

Question 11

During a penetration test, the tester successfully gains access to a server and then attempts to move laterally to other systems. This phase is known as:

Accepted Answer

Post-exploitation and lateral movement. After initial access is gained, the phase where the tester moves from the compromised host to other systems within the network is specifically called post-exploitation and lateral movement. This involves using the foothold to pivot, escalate privileges, and access additional resources, which is distinct from the initial exploitation step.

Answer

Scanning and enumeration

Answer

Exploitation

Answer

Reconnaissance

Question 12

A network architect is designing a network to comply with PCI DSS requirements that cardholder data must be encrypted during transmission over open networks. Which protocol should be used for encrypting traffic between a point-of-sale (POS) terminal and the payment gateway?

Accepted Answer

TLS 1.2. TLS 1.2 is the correct choice because it is a widely accepted, secure protocol for encrypting data in transit, and it meets PCI DSS requirements for strong cryptography. PCI DSS explicitly prohibits the use of SSL and early TLS versions (1.0) due to known vulnerabilities, and TLS 1.2 provides robust cipher suites and forward secrecy.

Answer

TLS 1.0

Answer

SSH

Answer

SSL 3.0

Question 13

A security analyst detects an attack where the attacker sends forged ARP messages to associate the attacker's MAC address with the IP address of the default gateway. Which OSI layer is primarily targeted by this attack?

Accepted Answer

Layer 2 – Data Link. ARP operates at Layer 2 (Data Link) because it maps IP addresses (Layer 3) to MAC addresses (Layer 2) within a single broadcast domain. By forging ARP replies, the attacker poisons the ARP cache of hosts, causing frames destined for the default gateway to be sent to the attacker's MAC address. This directly targets the address resolution process that bridges Layer 2 and Layer 3, but the attack itself is executed at the Data Link layer.

Answer

Layer 4 – Transport

Answer

Layer 3 – Network

Answer

Layer 1 – Physical

Question 14

Which TWO of the following are key objectives of a security assessment? (Select exactly 2.)

Accepted Answer

Identify vulnerabilities in systems and applications.. A is correct because identifying vulnerabilities is a primary objective of a security assessment, such as a vulnerability scan or penetration test, which systematically discovers weaknesses in systems and applications (e.g., missing patches, misconfigurations, or insecure code). B is correct because assessing the effectiveness of existing security controls (e.g., firewalls, IDS/IPS, access controls) is a core goal, often achieved through control testing or validation to determine if controls are properly implemented and functioning as intended.

Answer

Exploit vulnerabilities to gain unauthorized access.

Answer

Prioritize threats based on business impact.

Answer

Implement new security controls to address findings.

Question 15

Which THREE of the following are valid countermeasures against buffer overflow attacks?

Accepted Answer

Stack canaries. Stack canaries are correct because they place a known value (canary) between the buffer and control data on the stack. Before a function returns, the canary is checked; if it has been overwritten (indicating a buffer overflow), the program terminates, preventing code execution. This directly detects stack-based buffer overflows before they can hijack the return address.

Answer

Full disk encryption

Answer

Input validation using allowlists