CISSP Practice Test 3 — 30 Questions

Question 1

A security analyst is reviewing a web application and notices that it includes a feature that allows users to view their own profile by providing a user ID in the URL (e.g., /profile?userid=123). The application does not verify that the logged-in user owns that profile. Which vulnerability is present?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Insecure direct object reference (IDOR). The application exposes an internal object reference (the userid parameter) and fails to perform an authorization check that the logged-in user owns that object. This is the textbook definition of an Insecure Direct Object Reference (IDOR), classified under OWASP as Broken Access Control (A01:2021). Because the URL directly maps to a backend record without an ownership check, an attacker can simply increment the userid value to view other users' profiles.

Answer

Security misconfiguration

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Question 2

Which metric defines the maximum amount of data loss an organization can tolerate during a disaster?

Accepted Answer

RPO. Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time — for example, an RPO of 4 hours means the organization can tolerate losing up to 4 hours of data. It directly drives backup frequency and replication strategy. RTO, by contrast, defines how long recovery can take, not how much data can be lost.

Answer

MTD

Answer

MTTR

Answer

RTO

Question 3

What is the primary purpose of a configuration management database (CMDB) in asset management?

Accepted Answer

Provide a repository of configuration items and their relationships. The primary purpose of a configuration management database (CMDB) is to provide a repository of configuration items (CIs) and their relationships, enabling IT service management processes like change management, incident management, and asset management. It tracks the components of an IT environment and how they interconnect.

Answer

Monitor network traffic for anomalies

Answer

Store and manage data classification labels

Answer

Track software licenses and compliance

Question 4

An organization is implementing a Public Key Infrastructure (PKI) to support secure email and web communications. The PKI includes a root CA, intermediate CAs, and end-entity certificates. Which of the following best describes the role of the root CA in this hierarchy?

Accepted Answer

It is self-signed and forms the trust anchor. The root CA is the top of the PKI hierarchy and is self-signed, meaning its certificate is signed by its own private key. It serves as the ultimate trust anchor: all trust in the chain derives from it, and its public key is distributed out-of-band to relying parties. In a well-designed hierarchy, the root CA issues certificates only to intermediate CAs, not directly to end entities, to protect its private key.

Answer

It performs key escrow for all users

Answer

It issues certificates directly to end users

Answer

It validates certificate revocation lists (CRLs)

Question 5

Which of the following is the most important factor when prioritizing vulnerability remediation in a vulnerability management program?

Accepted Answer

Exploitability and business impact. Prioritizing vulnerability remediation should be driven by exploitability (is there a known exploit, is it weaponized, is it reachable) combined with business impact (what asset is affected, what data or process is at risk). This risk-based approach ensures limited remediation resources are directed at the vulnerabilities that pose the greatest actual threat to the organization. CVSS alone does not capture business context.

Answer

CVSS base score

Answer

Number of systems affected

Answer

Time since discovery

Question 6

A financial application requires strict integrity controls to prevent unauthorized modifications. The security team implements a model where users cannot write data to higher integrity levels (no write up) and cannot read data from lower integrity levels (no read down). Which model is being applied?

Accepted Answer

Biba. The Biba integrity model is defined by the 'no write up' and 'no read down' rules, which prevent subjects at a lower integrity level from writing to higher levels and prevent subjects at a higher level from reading lower-level (potentially tainted) data. This directly matches the scenario's requirement to prevent unauthorized modifications by preserving integrity across levels. Biba is the integrity counterpart to Bell-LaPadula, which focuses on confidentiality.

Answer

Bell-LaPadula

Answer

Graham-Denning

Answer

Clark-Wilson

Question 7

During a forensic investigation, an analyst must collect volatile data in the correct order. Which of the following sequences correctly follows the order of volatility?

Accepted Answer

CPU registers → cache → RAM → swap → disk. The order of volatility (RFC 3227) dictates that the most ephemeral data must be captured first because it disappears fastest. CPU registers and cache lose their contents within nanoseconds to milliseconds, RAM persists only while powered, swap holds paged memory on disk, and the disk itself is the most persistent. Therefore CPU registers → cache → RAM → swap → disk is the correct forensic collection sequence.

Answer

Disk → RAM → CPU registers → cache → swap

Answer

RAM → CPU registers → swap → disk → remote logging

Answer

Swap → RAM → cache → CPU registers → disk

Question 8

An organization wants to implement single sign-on across multiple web applications using an XML-based protocol that supports identity provider (IdP) and service provider (SP) initiated flows. Which technology should they choose?

Accepted Answer

SAML 2.0. SAML 2.0 is the XML-based federation standard that defines both IdP-initiated and SP-initiated SSO flows using assertions, AuthnRequests, and Response messages. It is the classic choice for browser-based SSO across multiple web applications where the identity provider and service provider exchange XML over HTTP POST or redirect bindings. OpenID Connect and OAuth 2.0 are JSON/REST-based, and Kerberos is a ticket-based network authentication protocol, not a web SSO federation standard.

Answer

OpenID Connect

Answer

OAuth 2.0

Answer

Kerberos

Question 9

An organization deploys a hypervisor to host multiple virtual machines. To mitigate the risk of VM escape attacks, which of the following is the most effective security measure?

Accepted Answer

Disabling all unnecessary hypervisor services and applying security patches. Disabling unnecessary hypervisor services reduces the attack surface available to a guest attempting VM escape, and applying hypervisor security patches closes known vulnerabilities (e.g., VENOM, CVE-2015-3456) that allow guest-to-host breakout. Since the hypervisor is the isolation boundary between VMs and the host, hardening and patching it directly addresses the escape vector. This is the most effective preventive control because it targets the root cause rather than the symptoms.

Answer

Using Type 2 hypervisor only

Answer

Using VLANs to isolate VM traffic

Answer

Enabling VM snapshots for quick recovery

Question 10

A government agency requires a security model that prevents users from reading documents classified above their clearance level and from writing classified information to lower-level systems. Which model enforces these constraints?

Accepted Answer

Bell-LaPadula. Bell-LaPadula is the mandatory access control model focused on confidentiality, enforcing 'no read up' (simple security property) and 'no write down' (star property). These two rules exactly match the requirement: users cannot read above their clearance and cannot write classified data to lower levels. Biba, Brewer-Nash, and Clark-Wilson address integrity or conflict-of-interest, not confidentiality.

Answer

Biba

Answer

Brewer-Nash

Answer

Clark-Wilson

Question 11

Which OAuth 2.0 grant type is recommended for a public client (e.g., single-page application) that cannot securely store a client secret?

Accepted Answer

Authorization code grant with PKCE. Authorization Code grant with PKCE (Proof Key for Code Exchange, RFC 7636) is the OAuth 2.0 best current practice for public clients like SPAs and mobile apps that cannot keep a client secret confidential. PKCE adds a dynamically generated code_verifier and its hashed code_challenge to the authorization request, so even if the authorization code is intercepted, it cannot be exchanged without the verifier. This mitigates authorization code interception attacks that plague public clients.

Answer

Resource owner password credentials grant

Answer

Implicit grant

Answer

Client credentials grant

Question 12

During a risk communication session, the security team needs to present risk analysis results to executive management. Which approach is most effective for this audience?

Accepted Answer

A high-level summary highlighting top risks and recommended actions. Executive management needs decision-oriented information, not technical detail, so a concise summary of the top risks with clear recommended actions and business impact enables them to prioritize funding and accept or mitigate risk. This aligns with the CISSP principle that risk communication must be tailored to the audience's role and decision-making authority. Presenting the highest-priority risks with actionable recommendations supports governance and informed risk acceptance.

Answer

Raw data from the risk assessment without interpretation

Answer

A comprehensive report with all risk register entries

Answer

Detailed technical explanations of each vulnerability

Question 13

An organization is required to report a personal data breach to the supervisory authority within 72 hours. Which regulation imposes this requirement?

Accepted Answer

GDPR. The GDPR (General Data Protection Regulation) Article 33 mandates that controllers notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to rights and freedoms. This 72-hour window is a signature GDPR requirement. No other listed regulation imposes this specific timeline for personal data breaches.

Answer

PCI DSS

Answer

SOX

Answer

HIPAA

Question 14

An organization wants to identify vulnerabilities in their network without attempting to exploit them. Which type of security assessment should they perform?

Accepted Answer

Vulnerability assessment. A vulnerability assessment is the correct choice because it is a systematic review of security weaknesses in a network or system that identifies vulnerabilities without actively exploiting them. This assessment typically uses automated scanning tools (e.g., Nessus, OpenVAS) to compare system configurations against known vulnerability databases (e.g., CVE, NVD) and reports potential issues, but does not attempt to gain unauthorized access or cause disruption.

Answer

Penetration test

Answer

Security audit

Answer

Security review

Question 15

During a vulnerability management lifecycle, after vulnerabilities are identified and prioritized, what is the NEXT step?

Accepted Answer

Remediation. The vulnerability management lifecycle is typically: identify → prioritize (assess/rank) → remediate → verify → report, with risk acceptance as an alternative outcome to remediation. After vulnerabilities are identified and prioritized, the next action is to remediate (patch, mitigate, or compensate), because prioritization exists to drive remediation decisions. Verification and reporting come after remediation to confirm the fix and communicate status.

Answer

Verification

Answer

Reporting

Answer

Risk acceptance

Question 16

Which of the following is a key requirement for an effective backup strategy to ensure data can be recovered after a ransomware attack?

Accepted Answer

Backups are encrypted and stored offline or air-gapped.. For ransomware resilience, backups must be isolated from the production environment so that malware cannot encrypt or delete them along with production data. Encrypting backups and storing them offline or air-gapped ensures that even if attackers compromise the network and credentials, the backup copies remain intact and recoverable. This directly addresses the ransomware threat model where attackers target connected backups first.

Answer

Incremental backups are performed monthly.

Answer

Backups use the same credentials as the production environment.

Answer

Backups are stored on the same network as production.

Question 17

Which type of data is considered sensitive PII and requires enhanced protection?

Accepted Answer

Social Security number. A Social Security number is a government-issued unique identifier that, if exposed, enables identity theft and fraud, so it is classified as sensitive PII requiring enhanced protection under regulations like GLBA, HIPAA, and state privacy laws. Names, email addresses, and phone numbers are PII but generally lower sensitivity, while job titles are typically not considered sensitive PII at all. The SSN is the classic example of high-sensitivity personal data.

Answer

Name and email address

Answer

Job title

Answer

Phone number

Question 18

An organization wants to ensure that data is protected throughout its lifecycle. Which step in the data lifecycle is most critical for enforcing data retention policies?

Accepted Answer

Archive. The Archive phase of the data lifecycle is where data retention policies are enforced, because this is the stage where data is moved to long-term storage and governed by retention schedules, legal holds, and disposition rules. Retention policies define how long data must be kept and when it must be securely destroyed, and these controls are applied at the archive stage. Without proper archival governance, data may be retained indefinitely or destroyed prematurely, violating regulatory requirements.

Answer

Use

Answer

Create/Collect

Answer

Share

Question 19

A healthcare organization must decommission an old server containing patient health information (PHI) stored on solid-state drives (SSDs). Standard overwriting techniques are ineffective for SSDs due to wear-leveling and bad block mapping. Which sanitization method is most appropriate for these drives?

Accepted Answer

Physical destruction such as shredding or pulverizing. Physical destruction (e.g., shredding or pulverizing) is recommended for SSDs because overwriting may not reach all cells, and degaussing does not affect flash memory.

Answer

Cryptographic erasure by deleting the encryption key

Answer

Degaussing with a high-coercivity degausser

Answer

Overwriting with the DoD 5220.22-M 7-pass standard

Question 20

In a Privileged Access Management (PAM) solution, which feature provides temporary elevation of privileges for specific tasks, reducing the risk of standing privileges?

Accepted Answer

Just-in-time (JIT) access. Just-in-time (JIT) access in a PAM solution provides temporary, on-demand elevation of privileges for specific tasks, eliminating standing privileges that attackers can exploit. It typically involves approval workflows, time-bound access, and automatic revocation. This reduces the attack surface and limits lateral movement.

Answer

Password vaulting

Answer

Break-glass account

Answer

Session recording