CISSP Practice Test 29 — 15 Questions

Question 1

Refer to the exhibit. A user in the 10.1.0.0/16 range attempts to retrieve the object s3://example-bucket/secret/top_secret.pdf. What will be the result?

Accepted Answer

The request is denied because the condition in the first statement does not match the IP range.. Option D is correct because the first statement in the policy has a condition that restricts access to requests originating from the IP range 10.2.0.0/16. Since the user is in the 10.1.0.0/16 range, the condition is not satisfied, so the first statement does not apply. Without an explicit Allow that matches the request, the default implicit Deny takes effect, resulting in the request being denied.

Answer

The request is denied because the first statement allows but the second denies.

Answer

The request is allowed because the Deny statement only applies to the secret prefix, and the IP condition is satisfied for the user in 10.1.0.0/16.

Answer

The request is allowed because the first statement matches and allows.

Question 2

Refer to the exhibit. The firewall rules above are applied to the outside interface. A penetration tester from the internet attempts to establish a connection to 192.168.1.10 on TCP port 8080. What will happen?

Accepted Answer

The connection is denied because the port is not explicitly allowed. Option D is correct because firewall rules operate on an implicit-deny model: if no rule explicitly permits traffic, it is denied by default. Since the exhibit shows no rule allowing TCP port 8080 from the internet to 192.168.1.10, the connection is dropped. The destination is reachable (192.168.1.10 is a valid internal IP), but the lack of an explicit permit for port 8080 causes the denial.

Answer

The connection is permitted only if the tester uses a VPN

Answer

The connection is permitted

Answer

The connection is denied because the destination is not reachable

Question 3

An organization uses a role-based access control (RBAC) model. After an audit, it was discovered that users have accumulated excessive permissions due to role proliferation. The security architect proposes migrating to an attribute-based access control (ABAC) model. Which challenge is MOST likely to be encountered during this migration?

Accepted Answer

Increased complexity in defining and managing attributes.. Option D is correct because migrating from RBAC to ABAC requires defining a comprehensive set of attributes (subject, resource, environment) and the policies that combine them, which is inherently more complex than managing static role assignments. Role proliferation in RBAC often results from an attempt to mimic attribute-based decisions, but ABAC shifts the complexity from role engineering to attribute governance and policy logic, making attribute definition and management the primary challenge.

Answer

Difficulty in assigning roles to users.

Answer

Reduced performance due to policy evaluation overhead.

Answer

Lack of support for ABAC in legacy applications.

Question 4

A password policy requires passwords to be at least 12 characters, with uppercase, lowercase, digits, and special characters. Which of the following is an example of a password that meets the policy?

Accepted Answer

Password123!. Option E (Password123!) meets the policy because it is 12 characters long and includes uppercase (P), lowercase (assword), digits (123), and a special character (!). The policy requires all four character types, and this password satisfies each requirement without any ambiguity.

Answer

Abcdefghijkl

Answer

Pa$$w0rd

Answer

MyP@ssw0rd1

Answer

SecureP@ss1

Question 5

A security architect is considering secure design principles. Which two principles are essential for a defense-in-depth strategy? (Select TWO.)

Accepted Answer

Layered security. Layered security (defense in depth) is essential because it implements multiple, overlapping security controls so that if one layer fails, another layer continues to provide protection. This principle ensures that no single vulnerability can compromise the entire system, which is the core of a defense-in-depth strategy. Least privilege is equally essential because it restricts users and processes to only the minimum permissions necessary, limiting the blast radius of any breach and preventing lateral movement across layers.

Answer

Single point of failure

Answer

Open design

Answer

Fail safe

Question 6

A company uses VLANs to separate traffic between the IT, HR, and Finance departments. A user in the HR VLAN reports that she cannot access a file server located in the IT VLAN. The file server's default gateway is correctly set to the IT VLAN interface. All workstations have correct IP addresses and subnet masks. What is the most likely cause of this issue?

Accepted Answer

No routing is configured between the HR and IT VLANs.. VLANs create separate broadcast domains, so traffic between different VLANs must be routed. Since the HR workstation is in a different VLAN than the file server, and no routing is configured between the HR and IT VLANs, the HR workstation cannot reach the file server even though the server's default gateway is correctly set. This is the most likely cause because all other network settings (IP addresses, subnet masks, switch port configurations) are described as correct.

Answer

Spanning Tree Protocol (STP) is blocking the link between the HR and IT switches.

Answer

The HR workstation has an incorrect subnet mask.

Answer

The HR VLAN switch port is incorrectly configured with the wrong VLAN ID.

Question 7

A network security analyst receives an alert from the intrusion detection system (IDS) indicating a high volume of TCP SYN packets to a single external IP address from a compromised internal host. This is characteristic of which type of attack?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target, exhausting its connection table and preventing legitimate connections. The IDS alert specifically describes a compromised internal host generating many SYN packets to a single external IP, which matches the classic behavior of a SYN flood where the attacker spoofs the source IP or uses a bot to saturate the target's resources.

Answer

Man-in-the-middle

Answer

ARP spoofing

Answer

DNS amplification

Question 8

A network engineer is troubleshooting a slow VPN connection between two sites. The link is symmetric 100 Mbps, but throughput tests show only 20 Mbps. The VPN uses AES-256 encryption. What is the most likely cause?

Accepted Answer

CPU bottleneck on the VPN endpoints. AES-256 encryption is computationally intensive, and the throughput of a VPN is often limited by the cryptographic processing capacity of the endpoint CPUs rather than the link bandwidth. A symmetric 100 Mbps link with only 20 Mbps throughput strongly indicates that the VPN endpoints cannot encrypt/decrypt fast enough, creating a CPU bottleneck.

Answer

Packet loss due to link congestion

Answer

MTU mismatch causing fragmentation

Answer

Incorrect TCP window scaling

Question 9

Refer to the exhibit. A security auditor is reviewing the network ACLs for a cloud VPC. Which of the following is the most significant security concern?

Accepted Answer

SSH (port 22) is allowed from a large IP range. Allowing SSH (port 22) from a large IP range (e.g., 0.0.0.0/0 or a wide CIDR) exposes the management interface to the entire internet, making it trivial for attackers to launch brute-force or credential-stuffing attacks. This violates the principle of least privilege and is a common misconfiguration that leads to unauthorized access.

Answer

The outbound rules allow all traffic

Answer

RDP (port 3389) is allowed from a trusted internal subnet

Answer

The VPC ID is exposed

Question 10

A company needs to provide secure remote access to employees using company-issued laptops. The solution must support both web applications and legacy client-server apps without installing client software on the laptops. Which VPN technology is best?

Accepted Answer

SSL VPN with clientless web access and port forwarding. SSL VPN with clientless web access and port forwarding is the best choice because it meets the requirement of supporting both web applications and legacy client-server apps without installing client software. Clientless web access provides secure HTTPS-based access to internal web applications via a browser, while port forwarding allows legacy TCP-based client-server applications to be tunneled through the SSL VPN without requiring a full VPN client on the laptop. This approach leverages the existing browser and OS capabilities, eliminating the need for additional software installation.

Answer

L2TP over IPsec

Answer

MPLS Layer 3 VPN

Answer

IPsec tunnel mode

Question 11

During a security assessment, a penetration tester successfully performed a VLAN hopping attack from a host in VLAN 10 to a host in VLAN 20. The switches are configured with IEEE 802.1Q trunking. Which misconfiguration likely allowed this attack?

Accepted Answer

Dynamic Trunking Protocol (DTP) is enabled on access ports. D is correct because VLAN hopping attacks exploit Dynamic Trunking Protocol (DTP) to negotiate a trunk link between an attacker's host and a switch port. If DTP is enabled on an access port, the attacker can spoof DTP messages to form a trunk, gaining access to traffic from multiple VLANs, including VLAN 20 from VLAN 10.

Answer

The native VLAN is not used on any trunk ports

Answer

Spanning Tree Protocol is disabled

Answer

Port security is disabled on all ports

Question 12

An organization is designing a multicast network for live video streaming. They need to ensure that only authorized receivers can access the multicast group. Which technique should be implemented?

Accepted Answer

IGMP filtering. IGMP filtering allows the network to control which hosts are permitted to join a multicast group by filtering IGMP membership reports at the access layer. This ensures that only authorized receivers can become members of the multicast group, providing access control for live video streaming. It is the most direct technique for enforcing authorization at the receiver level.

Answer

Multicast VLAN registration

Answer

Static IGMP entries

Answer

IGMP snooping with port security

Question 13

A security analyst receives an alert that a host in the internal network is sending abnormal amounts of traffic to an external IP. The traffic uses destination port 53. What is the most likely attack?

Accepted Answer

DNS tunneling. The alert describes a host sending abnormal traffic to an external IP on destination port 53, which is the default port for DNS. DNS tunneling exploits the DNS protocol to encapsulate non-DNS data (e.g., commands or exfiltrated files) within DNS queries and responses, allowing covert communication through firewalls that typically allow DNS traffic. The abnormal volume of traffic to a single external IP is a classic indicator of a DNS tunnel, as the compromised host continuously sends encoded data to an external command-and-control server.

Answer

DNS cache poisoning

Answer

DNS amplification

Answer

DNS zone transfer

Question 14

During a security audit, it is discovered that a network firewall is allowing traffic based on source IP address only, without inspecting application-layer data. Which type of firewall is this?

Accepted Answer

Packet filter. A packet filter firewall operates at Layer 3 (Network) and Layer 4 (Transport) of the OSI model, making decisions solely based on source and destination IP addresses, ports, and protocols. It does not inspect application-layer data (Layer 7), which matches the scenario where traffic is allowed based on source IP address only. This is the simplest and fastest type of firewall, but it lacks the ability to block attacks embedded in application payloads.

Answer

Circuit-level gateway

Answer

Application gateway

Answer

Stateful inspection

Question 15

A company uses BGP to exchange routes with its ISP. To prevent prefix hijacking, which mechanism should be implemented?

Accepted Answer

RPKI. RPKI (Resource Public Key Infrastructure) is the correct mechanism because it cryptographically validates the origin AS of a BGP route announcement, preventing prefix hijacking by ensuring that only the legitimate owner of an IP prefix can announce it. Unlike other options, RPKI provides a trust anchor based on the IP address allocation hierarchy, making it the only solution that directly addresses the root cause of hijacking—unauthorized origin AS claims.

Answer

BGP MD5 authentication

Answer

BGP community values

Answer

AS-path filtering

CISSP Practice Test 29 — 15 Questions

Exhibit

CISSP Practice Test 29 — 15 Questions

Exhibit