CISSP Practice Test 30 — 15 Questions

Question 1

An organization is required to declassify a document that was previously classified as 'Secret' under government guidelines. What process must be followed before the document can be released to the public?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A declassification review by authorized personnel must be conducted. Declassification is a formal review process to determine if the information still requires protection. It must be performed by authorized personnel following established procedures.

Answer

The data owner must reclassify it as 'Unclassified' without further action

Answer

The document can be released immediately after the classification period expires

Answer

The document should be shredded and a new version created without classified markings

Question 2

Which of the following is a key element of the rules of engagement for a penetration test?

Accepted Answer

Emergency stop criteria. Rules of engagement must include written authorization and define the scope, including systems to be tested and emergency stop criteria.

Answer

The tester's compensation

Answer

The tester's background check

Answer

The number of vulnerabilities to find

Question 3

During a Kerberos authentication process, the client receives a Ticket Granting Ticket (TGT) from the Authentication Server (AS). Later, the client presents the TGT to the Ticket Granting Server (TGS) to request a service ticket. Which of the following best describes the purpose of the TGT?

Accepted Answer

It allows the client to request additional service tickets without re-authentication.. The TGT is a credential that proves the user has been authenticated by the AS and is allowed to request service tickets without re-entering credentials.

Answer

It verifies the client's IP address to prevent replay attacks.

Answer

It encrypts the session key between the client and the target service.

Answer

It authenticates the user to the target service directly.

Question 4

Which OAuth 2.0 grant type is recommended for a public client (e.g., single-page application) that cannot securely store a client secret?

Accepted Answer

Authorization code grant with PKCE. The authorization code grant with PKCE (Proof Key for Code Exchange) is designed for public clients to prevent interception of the authorization code.

Answer

Resource owner password credentials grant

Answer

Implicit grant

Answer

Client credentials grant

Question 5

A financial institution stores customer PII, including Social Security numbers (SSNs). Under privacy regulations, SSNs are considered sensitive PII. Which of the following techniques would best reduce the risk of re-identification while preserving the utility of the data for statistical analysis?

Accepted Answer

Differential privacy by adding calibrated noise to the dataset. Differential privacy adds noise to query results to protect individual records while allowing aggregate analysis, balancing privacy and utility.

Answer

Anonymization by removing all direct identifiers

Answer

Encrypting the entire dataset at rest

Answer

Pseudonymization by replacing names with random identifiers

Question 6

During a forensic investigation, an analyst must collect volatile data in the correct order. Which of the following sequences correctly follows the order of volatility?

Accepted Answer

CPU registers → cache → RAM → swap → disk. The order of volatility prioritizes collecting data from most volatile to least volatile to avoid loss.

Answer

Disk → RAM → CPU registers → cache → swap

Answer

RAM → CPU registers → swap → disk → remote logging

Answer

Swap → RAM → cache → CPU registers → disk

Question 7

A financial application requires strict integrity controls to prevent unauthorized modifications. The security team implements a model where users cannot write data to higher integrity levels (no write up) and cannot read data from lower integrity levels (no read down). Which model is being applied?

Accepted Answer

Biba. Biba model enforces integrity: no write up (subjects cannot write to higher integrity objects) and no read down (subjects cannot read lower integrity data).

Answer

Bell-LaPadula

Answer

Graham-Denning

Answer

Clark-Wilson

Question 8

An organization is implementing a Public Key Infrastructure (PKI) to support secure email and web communications. The PKI includes a root CA, intermediate CAs, and end-entity certificates. Which of the following best describes the role of the root CA in this hierarchy?

Accepted Answer

It is self-signed and forms the trust anchor. The root CA is the top-level entity that signs its own certificate (self-signed) and issues certificates to intermediate CAs. It is the trust anchor for the entire PKI.

Answer

It performs key escrow for all users

Answer

It issues certificates directly to end users

Answer

It validates certificate revocation lists (CRLs)

Question 9

Which metric defines the maximum amount of data loss an organization can tolerate during a disaster?

Accepted Answer

RPO. Recovery Point Objective (RPO) determines the acceptable data loss measured in time.

Answer

MTD

Answer

MTTR

Answer

RTO

Question 10

Which of the following is the most important factor when prioritizing vulnerability remediation in a vulnerability management program?

Accepted Answer

Exploitability and business impact. Risk-based prioritization considers exploitability and potential impact, not just CVSS score.

Answer

CVSS base score

Answer

Number of systems affected

Answer

Time since discovery

Question 11

An organization requires a commercial integrity model where users cannot modify data in higher integrity levels and cannot read data from lower integrity levels. Which model should they implement?

Accepted Answer

Biba. The Biba model addresses integrity through *no write up* and *no read down* rules.

Answer

Bell-LaPadula

Answer

Clark-Wilson

Answer

Take-Grant

Question 12

Which of the following is a key component of the rules of engagement for a penetration test?

Accepted Answer

Emergency stop criteria. Rules of engagement must include written authorization, scope definition, and emergency stop criteria to ensure legal and safe testing.

Answer

Exploitation techniques to use

Answer

CVSS score of vulnerabilities

Answer

Number of vulnerabilities found

Question 13

Which phase of the data lifecycle involves the removal of data from active storage and placement into long-term storage for potential future use?

Accepted Answer

Archive. The archive phase moves data from active use to long-term storage for retention purposes, often for compliance or historical reference.

Answer

Use

Answer

Destroy

Answer

Store

Question 14

A company's vulnerability management program requires that all critical vulnerabilities be remediated within 30 days. A critical vulnerability is discovered in a legacy system that cannot be patched because the vendor no longer supports it. Which of the following is the best compensating control?

Accepted Answer

Segment the system from the rest of the network. Network segmentation isolates the legacy system, reducing the attack surface. HIDS only detects, not prevents. Logging and monitoring are detective controls. Encryption does not prevent exploitation of the vulnerability.

Answer

Deploy a host-based intrusion detection system (HIDS)

Answer

Increase logging and monitoring

Answer

Encrypt all data at rest on the system

Question 15

An organization requires users to authenticate with a password and a one-time code sent to their mobile phone. This is an example of which authentication method?

Accepted Answer

Multi-factor authentication. Using two different types of factors (password - Type 1, OTP - Type 2) constitutes multi-factor authentication.

Answer

Two-step verification

Answer

Single-factor authentication

Answer

Step-up authentication