CISSP Practice Test 29 — 15 Questions

Question 1

Which wireless security protocol replaces the pre-shared key (PSK) authentication with Simultaneous Authentication of Equals (SAE) to provide stronger security and forward secrecy?

Accepted Answer

WPA3. WPA3 replaces the Pre-Shared Key (PSK) authentication used in WPA2 with Simultaneous Authentication of Equals (SAE), defined in IEEE 802.11-2016 and specified in RFC 7664. SAE provides forward secrecy by using a Diffie-Hellman key exchange that ensures even if the long-term password is compromised, past session keys remain secure. This eliminates vulnerabilities to offline dictionary attacks that plague WPA2-PSK.

Answer

WEP

Answer

WPA2 with TKIP

Answer

WPA2 with CCMP

Question 2

A company wants to test the effectiveness of its security controls without causing disruption. Which type of assessment is most appropriate?

Accepted Answer

Vulnerability scan. A vulnerability scan is the most appropriate assessment because it passively identifies known vulnerabilities (e.g., missing patches, misconfigurations) without exploiting them, ensuring no disruption to production systems. Unlike active exploitation tests, vulnerability scanners use non-intrusive probes (e.g., banner grabbing, version fingerprinting) that do not trigger denial-of-service or system crashes. This aligns with the requirement to test control effectiveness while maintaining operational stability.

Answer

Penetration test

Answer

Security audit

Answer

Red team exercise

Question 3

A security analyst is conducting a review of aggregated logs from firewalls, IDS, and servers to detect anomalous behavior. This activity is best described as:

Accepted Answer

Security log analysis. Security log analysis involves the systematic review of logs from firewalls, IDS, and servers to identify patterns, anomalies, or indicators of compromise. This activity directly matches the scenario of detecting anomalous behavior through aggregated log review, which is a core practice in security monitoring and incident detection.

Answer

Risk assessment

Answer

Vulnerability scanning

Answer

Penetration testing

Question 4

A multinational corporation has experienced several security incidents where terminated employees retained access to internal systems for weeks after their departure. The HR department manually terminates accounts by sending notifications to IT, but the process is often delayed or missed. The company uses an identity management system (IDM) that supports automated provisioning and deprovisioning. The security team is tasked with reducing the risk of unauthorized access by former employees. Which of the following is the most effective course of action?

Accepted Answer

Integrate the HR system with the identity management system for automated deprovisioning. Integrating the HR system with the identity management (IDM) system enables automated deprovisioning, ensuring that when an employee is terminated in HR records, the IDM immediately triggers account disablement across all connected systems. This eliminates the manual delay and human error inherent in the current notification-based process, directly addressing the root cause of the risk.

Answer

Require terminated employees to change their passwords upon exit

Answer

Increase frequency of access reviews and audits to identify stale accounts

Answer

Implement a user self-service portal for managers to disable accounts

Question 5

An organization is designing a multicast network for live video streaming. They need to ensure that only authorized receivers can access the multicast group. Which technique should be implemented?

Accepted Answer

IGMP filtering. IGMP filtering allows the network to control which hosts are permitted to join a multicast group by filtering IGMP membership reports at the access layer. This ensures that only authorized receivers can become members of the multicast group, providing access control for live video streaming. It is the most direct technique for enforcing authorization at the receiver level.

Answer

Multicast VLAN registration

Answer

Static IGMP entries

Answer

IGMP snooping with port security

Question 6

Which TWO of the following are valid reasons for conducting a business impact analysis (BIA)?

Accepted Answer

To identify critical business processes and their dependencies. A Business Impact Analysis (BIA) is specifically designed to identify critical business processes and their dependencies on resources such as personnel, systems, and data. This identification is foundational for prioritizing recovery strategies in business continuity planning, as it directly links operational needs to technical infrastructure.

Answer

To identify vulnerabilities in the network infrastructure

Answer

To perform a full security audit of the organization

Answer

To create a list of all hardware and software assets

Question 7

Which THREE of the following are key practices in the OWASP ASVS (Application Security Verification Standard) for secure software? (Select exactly three.)

Accepted Answer

Secure error handling and logging. Option A (Secure error handling and logging) is correct because ASVS V7 requires applications to handle errors safely and log security-relevant events without leaking sensitive data such as stack traces, credentials, or internal paths. Option C (Authentication and session management) is correct because ASVS V2 and V3 define requirements for credential storage, password policies, MFA, session token entropy, and session invalidation. Option E (Input validation and sanitization) is correct because ASVS V5 mandates server-side input validation and output encoding to prevent injection flaws like SQLi and XSS. Option B (Integration with password managers) is not an ASVS practice; ASVS addresses password handling requirements, not client-side password manager integration. Option D (Network segmentation between tiers) is not part of ASVS, which focuses on application-level security requirements rather than infrastructure network architecture.

Answer

Integration with password managers

Answer

Network segmentation between tiers

Question 8

A security team is evaluating the results of a penetration test. The test revealed that a low-privileged user could escalate privileges to domain administrator. This is a critical finding. Which of the following should be the immediate next step?

Accepted Answer

Implement patch management for the exploited vulnerability. The immediate priority after discovering a privilege escalation vulnerability is to remediate the root cause—typically a missing patch or misconfiguration—to prevent further exploitation. In a penetration test context, the finding indicates a technical flaw (e.g., a missing security update for CVE-2021-42287 or a misconfigured Active Directory ACL) that must be patched or hardened first. Full incident response (A) is premature without evidence of active compromise, and re-imaging (B) or account termination (C) are reactive measures that do not address the underlying vulnerability.

Answer

Conduct a full incident response

Answer

Re-image all affected systems

Answer

Terminate the user's account

Question 9

Which TWO of the following are characteristics of a VPN that uses TLS?

Accepted Answer

Provides confidentiality. TLS-based VPNs, such as OpenVPN in TLS mode, provide confidentiality through encryption of the tunneled traffic using symmetric ciphers (e.g., AES) negotiated during the TLS handshake. They also provide integrity via message authentication codes (e.g., HMAC) applied to each record, ensuring data has not been altered in transit. These are fundamental security services of the TLS protocol itself.

Answer

Requires a digital certificate on the server

Answer

Operates at the network layer

Answer

Typically uses UDP port 500

Question 10

A company experiences a data breach. Which step should be taken first according to best practices?

Accepted Answer

Contain the breach. According to incident response best practices (NIST SP 800-61), the first priority after confirming a breach is to contain it. This prevents further data exfiltration, limits lateral movement by an attacker, and preserves forensic evidence. Containment actions may include isolating affected systems, blocking malicious IPs at the firewall, or revoking compromised credentials.

Answer

Inform affected parties

Answer

Notify law enforcement

Answer

Assess the damage

Question 11

A security analyst is configuring a SIEM to improve threat detection. Which THREE of the following are essential capabilities of a SIEM system?

Accepted Answer

Reporting and dashboarding. Option C (Reporting and dashboarding) is correct because a SIEM must present security data through dashboards and scheduled or ad hoc reports, giving analysts and compliance teams visibility into trends, incidents, and KPIs derived from correlated events. Option D (Real-time correlation and alerting) is correct because the core value of a SIEM is correlating events from multiple sources against rules, signatures, or behavioral logic and generating timely alerts when suspicious patterns match. Option E (Log aggregation and normalization) is correct because a SIEM must collect logs from disparate devices and applications and normalize them into a common schema (for example, parsing syslog, Windows Event Log, and CEF into consistent fields) so correlation and search can work across sources. Option A (Vulnerability scanning) is not correct because vulnerability assessment is typically performed by dedicated scanners such as Nessus or Qualys, even though their findings may be forwarded to a SIEM. Option B (Automated patch deployment) is not correct because patch management is handled by configuration management or endpoint management tools like WSUS, SCCM, or Intune, not by the SIEM itself.

Answer

Vulnerability scanning

Answer

Automated patch deployment

Question 12

Which two methods provide strong encryption and authentication for wireless networks? (Choose TWO.)

Accepted Answer

WPA2-Enterprise. WPA2-Enterprise (C) is correct because it uses IEEE 802.1X authentication with a RADIUS server, providing mutual authentication and per-session dynamic encryption keys via the 4-way handshake using AES-CCMP. WPA3 (E) is correct because it introduces Simultaneous Authentication of Equals (SAE) to replace the pre-shared key (PSK) handshake, offering forward secrecy and stronger encryption with GCMP-256, and also supports 802.1X for enterprise deployments.

Answer

WEP

Answer

WPA2-PSK

Answer

MAC filtering

Question 13

A company wants to implement 802.1X authentication on their wired network. Which components are required?

Accepted Answer

Supplicant, authenticator, and authentication server. 802.1X requires three distinct roles to function: the supplicant (client software requesting access), the authenticator (network device like a switch that enforces port-based access control), and the authentication server (typically a RADIUS server that validates credentials). Without all three, the EAP (Extensible Authentication Protocol) exchange cannot complete, as the authenticator acts as a proxy between the supplicant and the authentication server. Option C is correct because it lists all three mandatory components.

Answer

Supplicant and authenticator

Answer

Authenticator and authentication server

Answer

Supplicant and authentication server

Question 14

An organization is preparing for an ISO 27001 certification audit. The audit will be performed by an external body. This type of audit is classified as:

Accepted Answer

External audit. An external audit is performed by an independent third-party organization, such as a certification body, to assess compliance against a standard like ISO 27001. In this scenario, the audit is conducted by an external body specifically for certification purposes, which directly matches the definition of an external audit. This type of audit provides an unbiased evaluation of the Information Security Management System (ISMS) and is required for formal certification.

Answer

Self-assessment

Answer

Peer review

Answer

Internal audit

Question 15

A company's risk assessment identifies a high likelihood of a data breach due to outdated encryption standards. The cost to upgrade encryption is $50,000, and the estimated loss from a breach is $2,000,000. The risk manager decides to implement the upgrade. Which risk treatment option is being applied?

Accepted Answer

Risk mitigation. The risk manager is applying risk mitigation by implementing the encryption upgrade to reduce the likelihood or impact of a data breach. This directly addresses the identified risk by deploying a stronger cryptographic control, such as moving from AES-128 to AES-256 or replacing deprecated TLS 1.0/1.1 with TLS 1.3, thereby lowering the residual risk to an acceptable level.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk enhancement

Answer

Risk transfer