CISSP Practice Test 29 — 15 Questions

Question 1

An organization is developing an incident response plan. Which component is primarily responsible for defining the criteria for escalating an incident to senior management and legal counsel?

Accepted Answer

Escalation paths. Escalation paths specify the conditions and hierarchy for notifying higher-level management and legal teams based on incident severity and impact.

Answer

Communication plan

Answer

Recovery procedures

Answer

Incident categories

Question 2

A security team is investigating a vulnerability where an attacker can intercept and modify data as it moves between processes within a CPU's secure enclave. Which technology is designed to protect against such attacks by creating a trusted execution environment?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel SGX provides a TEE that isolates code and data in enclaves, protecting from other processes.

Answer

Trusted Platform Module (TPM)

Answer

Measured Boot

Answer

Secure Boot

Question 3

In Kerberos authentication, which component issues a Ticket Granting Ticket (TGT) after verifying the user's credentials?

Accepted Answer

Authentication Server (AS). The Authentication Server (AS) verifies the user's credentials and issues a TGT, which the user can then use to request service tickets from the TGS.

Answer

Domain Controller

Answer

Ticket Granting Server (TGS)

Answer

Key Distribution Center (KDC)

Question 4

An organization is implementing a new access control system. They want to ensure that users are who they claim to be, that actions can be traced to individuals, and that access rights are managed appropriately. Which framework encompasses all three of these goals?

Accepted Answer

AAA framework. The AAA framework (Authentication, Authorization, and Accounting) covers identification/authentication, authorization (access rights), and accounting (audit trails for non-repudiation).

Answer

COBIT 2019

Answer

CIA triad

Answer

ISO/IEC 27001

Question 5

An attacker who has compromised the Kerberos Key Distribution Center (KDC) could forge a Ticket Granting Ticket (TGT) to impersonate any user. This type of attack is known as:

Accepted Answer

Golden ticket attack. A golden ticket attack involves forging a TGT using the KRBTGT account hash, granting access to any resource in the domain.

Answer

Silver ticket attack

Answer

Pass-the-ticket attack

Answer

Kerberos poisoning attack

Question 6

A company is outsourcing its customer support operations to a third-party vendor. The vendor will have access to sensitive customer data. Which of the following should be the primary security requirement in the contract with the vendor?

Accepted Answer

The vendor must comply with the company's security policies and standards.. The primary security requirement in a contract with a third-party vendor that accesses sensitive data is to mandate compliance with the company's security policies and standards. This ensures consistent and comprehensive protection across all aspects of vendor operations, including access controls, data handling, incident response, and oversight of subcontractors. Option A (annual penetration testing) is a valuable specific security control but not the overarching requirement; it should be part of the policies with which the vendor must comply. Option B (background checks on employees) is an important personnel security measure but is typically a component of the company's security policies rather than the primary contractual requirement. Option C (providing a list of all subcontractors) is relevant for supply chain risk management, but again, the fundamental requirement is that the vendor adheres to the company's policies, which would include requirements for subcontractor disclosure and management. Therefore, policy compliance is the overarching contractual necessity that encompasses all other specific controls.

Answer

The vendor must perform annual penetration testing.

Answer

The vendor must conduct background checks on all employees.

Answer

The vendor must provide a list of all subcontractors.

Question 7

During the requirements gathering phase of a secure SDLC, the team uses a threat modeling approach that focuses on identifying threats such as spoofing, tampering, and denial of service. Which threat modeling methodology is being employed?

Accepted Answer

STRIDE. STRIDE is a threat modeling framework developed by Microsoft that categorizes threats into six categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Answer

PASTA

Answer

Trike

Answer

OCTAVE

Question 8

A security manager is reviewing metrics and sees that the "mean time to remediate" for critical vulnerabilities has increased over the past quarter. This metric is an example of a:

Accepted Answer

Key Performance Indicator (KPI). Mean time to remediate is a Key Performance Indicator (KPI) used to measure the effectiveness of vulnerability management processes.

Answer

Security baseline

Answer

Key Goal Indicator (KGI)

Answer

Key Risk Indicator (KRI)

Question 9

A security team is implementing data loss prevention (DLP) to protect sensitive information. Which DLP type is best suited to monitor and block sensitive data leaving the corporate network via email or web traffic?

Accepted Answer

Network DLP. Network DLP inspects traffic at egress points to prevent unauthorized data transmission.

Answer

Cloud DLP

Answer

Endpoint DLP

Answer

Classification-based controls

Question 10

A company uses differential privacy to release aggregate statistics from a dataset containing sensitive employee information. Which of the following is true regarding differential privacy?

Accepted Answer

It works by adding noise to the data or query results to protect individual privacy. Differential privacy adds calibrated noise to query results to mask individual contributions, ensuring that the inclusion or exclusion of any single record does not significantly affect the output.

Answer

It ensures that no individual's data can ever be inferred from the released statistics

Answer

It requires that data be encrypted before release

Answer

It is a method of pseudonymization that replaces identifiers with pseudonyms

Question 11

A security architect is implementing a system that must prevent conflicts of interest for a consulting firm serving competing clients. Which security model is best suited for this requirement?

Accepted Answer

Brewer-Nash. The Brewer-Nash (Chinese Wall) model prevents consultants from accessing data of competing clients once they have accessed one client's data.

Answer

Take-Grant

Answer

Clark-Wilson

Answer

Graham-Denning

Question 12

A company is deploying a hypervisor to run multiple virtual servers. To minimize the risk of VM escape attacks, which type of hypervisor should they choose and what hardening measure is most effective?

Accepted Answer

Type 1 hypervisor with minimal services and regular patching. Type 1 hypervisors (bare-metal) have a smaller attack surface than Type 2. Regular patching and secure configuration are essential.

Answer

Type 2 hypervisor with regular patching

Answer

Type 2 hypervisor with host-based firewall

Answer

Type 1 hypervisor with no additional hardening

Question 13

An organization wants to ensure that its web application is secure by analyzing the source code for vulnerabilities without executing the code. Which type of testing is most appropriate?

Accepted Answer

Static Application Security Testing (SAST). SAST (Static Application Security Testing) analyzes source code at rest, without executing it, making it ideal for finding vulnerabilities early in the development lifecycle.

Answer

Interactive Application Security Testing (IAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Runtime Application Self-Protection (RASP)

Question 14

A financial application uses a third-party library for PDF generation. A security review finds that the library is no longer maintained and has known vulnerabilities. What is the BEST course of action?

Accepted Answer

Replace the library with a maintained alternative.. The best course of action because replacing the library with a maintained alternative directly addresses the root cause of using an unmaintained library with known vulnerabilities. Option A is not the best because restricting network access reduces exposure but does not fix the underlying vulnerabilities. Option B is not the best because encrypting PDF files protects the content but does not prevent exploitation of the library. Option C is not the best because a web application firewall can mitigate some attacks but is not a comprehensive solution for known vulnerabilities in the library.

Answer

Restrict network access to the PDF server.

Answer

Encrypt all PDF files after generation.

Answer

Implement a web application firewall to block attacks targeting the library.

Question 15

A company is implementing a data classification scheme. Which category should be assigned to internal memos about employee benefit plans that are not intended for public disclosure?

Accepted Answer

Private/Internal. Commercial classification schemes typically use 'Private' for internal data that could cause harm if disclosed, such as employee benefit details.

Answer

Confidential/Restricted

Answer

Public

Answer

Sensitive