CISSP Practice Test 3 — 10 Questions

Question 1

A large financial institution is migrating its core banking system to a private cloud. The architecture must protect against data leakage between different business units sharing the same physical infrastructure. The system uses a hypervisor and virtual machines. Each business unit has its own security classification. The security requirement is that no VM belonging to a lower classification should be able to read data from a higher classification VM, even if the hypervisor is compromised. The architect proposes using mandatory access control at the hypervisor level. However, the IT team notes that a hypervisor compromise could bypass MAC. Additionally, they need to ensure that data at rest is encrypted and keys are stored securely. Which of the following would BEST meet the requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a hardware security module (HSM) to manage keys and implement full memory encryption using AES-256 with integrity protection, and use a trusted execution environment (TEE) for each VM, ensuring that even the hypervisor cannot access VM memory.. It addresses the core requirement: preventing data leakage even if the hypervisor is compromised. By using a hardware security module (HSM) for key management, full memory encryption with AES-256 and integrity protection, and a trusted execution environment (TEE) for each VM, the solution ensures that VM memory is encrypted and isolated at the hardware level. The hypervisor, even if compromised, cannot access the decrypted memory of a VM, thus enforcing the security classification separation regardless of hypervisor integrity.

Answer

Implement network segmentation with VLANs and IPsec encryption between VMs.

Answer

Deploy a data loss prevention (DLP) system to monitor data transfers between VMs.

Answer

Use a public key infrastructure (PKI) to issue certificates for each VM and enforce mutual TLS for all inter-VM communication.

Question 2

A company is designing a disaster recovery plan. They need to recover critical systems within 4 hours and lose no more than 15 minutes of data. Which combination of RTO and RPO should be specified?

Accepted Answer

RTO = 4 hours, RPO = 15 minutes. RTO (Recovery Time Objective) is the maximum acceptable downtime, here 4 hours. RPO (Recovery Point Objective) is the maximum acceptable data loss, here 15 minutes.

Answer

RTO = 15 minutes, RPO = 4 hours

Answer

RTO = 4 hours, RPO = 4 hours

Answer

RTO = 15 minutes, RPO = 15 minutes

Question 3

A network security analyst receives an alert from the intrusion detection system (IDS) indicating a high volume of TCP SYN packets to a single external IP address from a compromised internal host. This is characteristic of which type of attack?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target, exhausting its connection table and preventing legitimate connections. The IDS alert specifically describes a compromised internal host generating many SYN packets to a single external IP, which matches the classic behavior of a SYN flood where the attacker spoofs the source IP or uses a bot to saturate the target's resources.

Answer

Man-in-the-middle

Answer

ARP spoofing

Answer

DNS amplification

Question 4

A development team is adopting a secure SDLC. Which phase should include threat modeling to identify potential security vulnerabilities early?

Accepted Answer

Design. Threat modeling is a structured activity that identifies potential threats, vulnerabilities, and attack vectors against a system. It is most effective during the Design phase because architectural decisions, data flow diagrams, trust boundaries, and component interactions are being defined, allowing security controls to be built in rather than bolted on later. Performing threat modeling here aligns with the 'shift left' principle of secure SDLC, reducing cost and effort compared to retrofitting security after implementation.

Answer

Implementation

Answer

Testing

Answer

Requirements gathering

Question 5

Which of the following is the PRIMARY purpose of a business impact analysis (BIA) in business continuity planning?

Accepted Answer

Identify critical business functions and dependencies. The primary purpose of a business impact analysis (BIA) is to identify critical business functions and their dependencies on resources such as personnel, systems, data, and third-party services. This identification drives all subsequent continuity planning by quantifying the impact of disruptions and establishing the basis for recovery strategies. Without a BIA, recovery objectives and plans would be based on assumptions rather than empirical data about operational priorities.

Answer

Develop and test the continuity plan

Answer

Determine recovery time objectives (RTO) and recovery point objectives (RPO)

Answer

Create the business continuity plan document

Question 6

A software company uses a third-party library that has a known critical vulnerability. The library is used extensively and rewriting the code would take months. What is the BEST immediate action to reduce risk?

Accepted Answer

Implement a Web Application Firewall (WAF) rule to block exploitation. Implementing a Web Application Firewall (WAF) rule to block exploitation provides an immediate, compensating control that mitigates the known vulnerability without requiring code changes. This is the best immediate action because it buys time for a permanent fix while reducing risk, aligning with the principle of defense in depth. The WAF can inspect HTTP/HTTPS traffic for attack patterns (e.g., SQL injection, path traversal) specific to the vulnerable library and block malicious requests at the application layer.

Answer

Remove the library from the codebase immediately

Answer

Disable the vulnerable feature in the library

Answer

Increase logging and monitoring to detect exploitation attempts

Question 7

A company has implemented a new web application firewall (WAF) and wants to test its effectiveness. Which of the following testing methods would provide the MOST accurate assessment?

Accepted Answer

Conduct a penetration test that includes attempts to bypass the WAF.. A penetration test that actively attempts to bypass the WAF provides the most accurate assessment because it simulates a real attacker's behavior, testing the WAF's ability to detect and block evasion techniques such as HTTP parameter pollution, encoding obfuscation, and SQL injection payload splitting. This method validates the WAF's effectiveness under realistic adversarial conditions, revealing gaps that passive or disabled-state testing cannot uncover.

Answer

Perform a vulnerability scan on the web application with the WAF disabled.

Answer

Review the WAF logs for any blocked attacks.

Answer

Run an automated web application scanner against the application with the WAF enabled.

Question 8

A security architect is designing a network for a high-security data center. The requirement is to ensure that even if an attacker compromises one server, they cannot easily move laterally to other servers in the same data center. Which network design principle should be applied?

Accepted Answer

Microsegmentation (e.g., using virtual firewalls on each hypervisor). Microsegmentation (D) is the correct network design principle because it enforces granular, per-workload firewall rules—often implemented via virtual firewalls on each hypervisor or using VXLAN/ACL policies—that restrict east-west traffic between servers. Even if an attacker compromises one server, microsegmentation prevents lateral movement by allowing only explicitly permitted inter-server communication, effectively isolating the breach to the compromised host.

Answer

Principle of least privilege

Answer

Defense in depth

Answer

Single point of failure elimination

Question 9

A company deploys DNSSEC to protect its DNS infrastructure. Which cryptographic operation does DNSSEC primarily use to ensure the authenticity and integrity of DNS data?

Accepted Answer

Digital signatures of DNS records. DNSSEC primarily uses digital signatures to ensure the authenticity and integrity of DNS data. Each DNS zone is signed with a private key, and resolvers verify the signatures using the corresponding public key, which is published as a DNSKEY record. This process allows the resolver to cryptographically confirm that the data has not been modified in transit and originates from the authoritative source.

Answer

Hashing of DNS responses without keys

Answer

Transport Layer Security for DNS

Answer

Symmetric encryption of DNS queries

Question 10

Drag and drop the steps for a disaster recovery (DR) plan activation in the correct order.

Accepted Answer

1. Declare disaster, 2. Notify stakeholders, 3. Failover to alternate site, 4. Restore operations, 5. Test and resume normal operations. The correct order for DR plan activation is: declare disaster first to initiate the plan, then notify all stakeholders, perform failover to the alternate site, restore operations from backups or other means, and finally test and resume normal operations. This sequence ensures that activation is acknowledged, resources are aware, critical systems are recovered, and operations can safely return to normal after validation.

Answer

1. Notify stakeholders, 2. Declare disaster, 3. Failover to alternate site, 4. Test and resume normal operations, 5. Restore operations

Answer

1. Declare disaster, 2. Failover to alternate site, 3. Notify stakeholders, 4. Restore operations, 5. Test and resume normal operations

Answer

1. Declare disaster, 2. Notify stakeholders, 3. Restore operations, 4. Failover to alternate site, 5. Test and resume normal operations