CISSP Practice Test 30 — 15 Questions

Question 1

A password policy requires passwords to be at least 12 characters, with uppercase, lowercase, digits, and special characters. Which of the following is an example of a password that meets the policy?

Accepted Answer

Password123!. (Password123!) meets the policy because it is 12 characters long and includes uppercase (P), lowercase (assword), digits (123), and a special character (!). The policy requires all four character types, and this password satisfies each requirement without any ambiguity.

Answer

Abcdefghijkl

Answer

Pa$$w0rd

Answer

MyP@ssw0rd1

Answer

SecureP@ss1

Question 2

An organization needs to ensure that its employees understand their responsibilities regarding information security. Which of the following is the MOST effective way to achieve this?

Accepted Answer

Implement a security awareness program with regular training and assessments.. A security awareness program with regular training and assessments is the most effective way to ensure employees understand their responsibilities because it establishes a continuous learning cycle. Unlike one-time events, it reinforces secure behaviors through repetition, real-world scenarios, and measurable assessments, aligning with the NIST SP 800-50 framework for building a security-conscious culture.

Answer

Distribute a security policy document and require a signature.

Answer

Conduct a one-time annual security briefing.

Answer

Display security posters in common areas.

Question 3

Which THREE are essential elements of a Transport Layer Security (TLS) handshake? (Choose three.)

Accepted Answer

Key generation. Key generation is essential because during a TLS handshake, the client and server derive session keys using the pre-master secret exchanged via asymmetric encryption (e.g., RSA or Diffie-Hellman). These keys are then used for symmetric encryption of the session, ensuring confidentiality and integrity. Without key generation, no secure communication channel can be established.

Answer

User authentication

Answer

Session ticket exchange

Question 4

A security engineer is evaluating a web application for common vulnerabilities. The application uses a Content Management System (CMS) that is outdated and has known vulnerabilities. Additionally, the application displays detailed error messages and uses default administrative credentials. Which TWO of the following OWASP Top 10 categories are most relevant to these issues?

Accepted Answer

Vulnerable and Outdated Components. A is correct because the outdated CMS with known vulnerabilities directly corresponds to OWASP A06:2021 – Vulnerable and Outdated Components. This category covers using software versions with unpatched security flaws, which attackers can exploit via public exploit databases or automated scanners. B is correct because displaying detailed error messages and using default administrative credentials are classic examples of Security Misconfiguration (OWASP A05:2021). This occurs when security settings are not properly defined, implemented, or maintained, allowing attackers to gain information or unauthorized access.

Answer

Injection

Answer

Cryptographic Failures

Answer

Broken Access Control

Question 5

A company is designing a recovery site for its critical database. The recovery time objective (RTO) is 2 hours, and the recovery point objective (RPO) is 15 minutes. Which of the following replication strategies is BEST suited?

Accepted Answer

Synchronous replication to a hot site. Synchronous replication writes data to both the primary and the hot site simultaneously, ensuring zero data loss upon failover. With an RPO of 15 minutes, synchronous replication can meet this requirement because it commits transactions at both sites before acknowledging completion. A hot site is fully configured and ready to take over within the RTO of 2 hours, making this combination the best fit.

Answer

Asynchronous replication to a warm site

Answer

Full backups every 24 hours to a cold site

Answer

Weekly snapshots to a warm site

Question 6

Which THREE of the following are examples of data at rest?

Accepted Answer

Data stored on a hard drive. Data at rest refers to data that is physically stored on a persistent medium and is not currently moving across a network or being processed. Data stored on a hard drive is a classic example because the data resides on a non-volatile storage device, whether it is an internal HDD, SSD, or external drive. The data remains on the medium until it is read, modified, or deleted, and it is typically protected by encryption mechanisms such as BitLocker or FileVault.

Answer

Data in an email in transit

Answer

Data on a network cable

Question 7

Which TWO of the following are principles of the Bell-LaPadula security model?

Accepted Answer

No read up. The Bell-LaPadula model enforces mandatory access control (MAC) to protect confidentiality. Option D (No read up) is correct because a subject cannot read an object at a higher classification level, preventing unauthorized access to sensitive information. Option E (No write down) is correct because a subject cannot write to an object at a lower classification level, preventing the downgrading of classified data.

Answer

Separation of duty

Answer

No write up

Answer

No read down

Question 8

Which THREE of the following are essential components of an effective incident response plan according to NIST SP 800-61?

Accepted Answer

Preparation. NIST SP 800-61 defines the incident response lifecycle as having four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Preparation is the foundational phase that establishes the incident response capability, including creating policies, forming a team, and acquiring necessary tools before any incident occurs.

Answer

Notification

Answer

Vulnerability scanning

Question 9

Which TWO are essential components of a security policy framework?

Accepted Answer

Roles and responsibilities. Roles and responsibilities (D) are essential because they define who is accountable for implementing, maintaining, and enforcing the security policy. Without clear assignment of duties, policy execution becomes unenforceable and audit trails lack ownership, violating the separation of duties principle central to the Security and Risk Management domain.

Answer

Specific encryption key lengths

Answer

Incident response flowcharts

Answer

Network topology diagrams

Question 10

Which TWO of the following are principles of the data minimization concept under privacy regulations such as GDPR?

Accepted Answer

Collect only the personal data that is directly relevant and necessary for the specified purpose. Data minimization under GDPR (Article 5(1)(c)) requires that personal data collected be 'adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.' This principle directly mandates collecting only the data that is directly relevant and necessary for the specified purpose, preventing over-collection and reducing privacy risk.

Answer

Ensure personal data is accurate and kept up to date

Answer

Store personal data for as long as possible for future analysis

Answer

Provide individuals with access to their data upon request

Question 11

Which TWO of the following are valid types of data classification labels commonly used in commercial organizations?

Accepted Answer

Confidential. Confidential is a valid data classification label in commercial organizations, typically used to protect sensitive business information that could cause harm if disclosed. It is part of common classification schemes such as Public, Internal, Confidential, and Restricted, aligning with ISO/IEC 27001 guidelines for information asset management.

Answer

Top Secret

Answer

Unclassified

Answer

For Official Use Only

Question 12

A security manager is evaluating risk responses for a high-likelihood, low-impact risk. The cost of mitigation exceeds the potential loss. Which risk response strategy is most appropriate?

Accepted Answer

Accept. Risk acceptance is the appropriate response when the cost of mitigating a risk exceeds the potential loss and the risk falls within the organization's risk tolerance. For a high-likelihood, low-impact risk where mitigation is not cost-effective, accepting the risk (with documented awareness and monitoring) is the rational business decision.

Answer

Avoid

Answer

Mitigate

Answer

Transfer

Question 13

Which TWO of the following are effective methods for detecting unauthorized access to a network? (Choose two.)

Accepted Answer

Security information and event management (SIEM). A SIEM aggregates and correlates logs from multiple sources (e.g., firewalls, servers, IDS) in real time, enabling detection of anomalous patterns indicative of unauthorized access. It provides centralized visibility and alerting that can identify a breach even when individual logs appear benign.

Answer

Vulnerability scanner

Answer

Antivirus software

Answer

Firewall rule review

Question 14

Which TWO of the following are valid reasons to implement network segmentation?

Accepted Answer

To isolate sensitive data and systems from the rest of the network.. Network segmentation isolates sensitive data and systems by creating separate broadcast domains or VLANs, restricting unauthorized access and lateral movement. This is a core security principle for protecting critical assets, as it limits the attack surface and enforces access controls between segments.

Answer

To eliminate single points of failure.

Answer

To reduce network latency.

Answer

To simplify routing tables.

Question 15

Which THREE of the following are valid methods for securely disposing of magnetic hard drives?

Accepted Answer

Physical shredding. Physical shredding (B) is correct because it mechanically destroys the platters into small particles, making any magnetic data recovery physically impossible. Overwriting with random data over multiple passes (C) is correct because it replaces the original magnetic patterns with new data, rendering the previous contents unrecoverable even with laboratory techniques. Degaussing (D) is correct because exposing the drive to a strong magnetic field erases the magnetic alignment on the platters, effectively destroying the data and often rendering the drive unusable. Deleting files and emptying the recycle bin (A) only removes file system references while the data remains on the platters, and quick formatting (E) merely rewrites the file system metadata without overwriting the actual data, so neither is a secure disposal method.

Answer

Deleting files and emptying recycle bin

Answer

Quick formatting