CISSP Practice Test 31 — 15 Questions

Question 1

In OAuth 2.0, which grant type is recommended for a native mobile application that cannot securely store a client secret, and uses PKCE?

Accepted Answer

Authorization Code grant with PKCE. The Authorization Code grant with PKCE is designed for public clients like mobile apps to prevent interception of the authorization code.

Answer

Client Credentials grant

Answer

Implicit grant

Answer

Device Code grant

Question 2

Match each security model to its primary characteristic.

Accepted Answer

Bell-LaPadula: Enforces confidentiality by preventing read up and write down. The correct matches are: Bell-LaPadula (confidentiality, no read up/no write down), Biba (integrity, no read down/no write up), Clark-Wilson (integrity, well-formed transactions and separation of duties), and Brewer-Nash (confidentiality, conflict of interest). Common confusions involve swapping the rules between Bell-LaPadula and Biba.

Answer

Bell-LaPadula: Enforces integrity by preventing read down and write up

Answer

Biba: Enforces confidentiality by preventing read up and write down

Question 3

A healthcare organization covered by HIPAA wants to share protected health information (PHI) with a third-party billing service. What must be in place to comply with HIPAA?

Accepted Answer

A business associate agreement (BAA). HIPAA requires covered entities to have a business associate agreement (BAA) with any third party that will handle PHI on their behalf. The BAA ensures the business associate will safeguard the PHI.

Answer

A memorandum of understanding (MOU)

Answer

A data processing agreement under GDPR

Answer

A consent form from each patient

Question 4

An organization's security policy requires that all data at rest must be encrypted. Which security principle is primarily being addressed?

Accepted Answer

Confidentiality. Encryption of data at rest protects against unauthorized access, thus ensuring confidentiality.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 5

Under the Sarbanes-Oxley Act (SOX), which of the following is an example of an IT general control that supports financial reporting?

Accepted Answer

Change management process for the financial system. IT general controls (ITGC) include access controls, change management, backup and recovery, and computer operations. Change management ensures that changes to financial systems are authorized and tested.

Answer

Data encryption for customer PII

Answer

Firewall rule to block unauthorized traffic

Answer

Automated calculation of interest on loans

Question 6

During a security review of a web application, testers discover that the application discloses detailed error messages to users, including stack traces. Which secure coding best practice is being violated?

Accepted Answer

Error handling. Error handling best practices dictate that generic error messages should be shown to users, while detailed errors (e.g., stack traces) should be logged internally to avoid information disclosure.

Answer

Input validation

Answer

Secure logging

Answer

Output encoding

Question 7

An organization deploys a hypervisor to host multiple virtual machines. To mitigate the risk of VM escape attacks, which of the following is the most effective security measure?

Accepted Answer

Disabling all unnecessary hypervisor services and applying security patches. Keeping the hypervisor patched and minimized reduces attack surface and addresses known vulnerabilities that could be exploited for VM escape.

Answer

Using Type 2 hypervisor only

Answer

Using VLANs to isolate VM traffic

Answer

Enabling VM snapshots for quick recovery

Question 8

An organization is migrating to a new application that uses serialized objects to transfer data between services. The security team is concerned about insecure deserialization attacks. Which of the following controls is most effective in preventing deserialization vulnerabilities?

Accepted Answer

Applying cryptographic integrity checks (e.g., HMAC) to serialized objects. Integrity checks (e.g., digital signatures) ensure that serialized data has not been tampered with, preventing malicious objects from being deserialized.

Answer

Implementing input validation on deserialized data

Answer

Using a allowlist of classes allowed to be deserialized

Answer

Running deserialization in a sandboxed environment

Question 9

During a business impact analysis (BIA), which metric represents the maximum amount of time a business process can be disrupted before causing significant harm to the organization?

Accepted Answer

Maximum Tolerable Period of Disruption (MTPD). Maximum Tolerable Period of Disruption (MTPD) or Maximum Tolerable Downtime (MTD) is the longest time a process can be unavailable before causing severe damage. RTO is the recovery time objective, RPO is recovery point objective, and WRT is work recovery time.

Answer

Work Recovery Time (WRT)

Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Question 10

During a business impact analysis (BIA), the recovery point objective (RPO) for a critical database is determined to be 2 hours. What does this mean?

Accepted Answer

Data backups must be taken at least every 2 hours. RPO defines the maximum acceptable data loss measured in time. An RPO of 2 hours means that data can be lost up to the last 2 hours before the disruption.

Answer

Data can be recovered from any point within the past 2 hours

Answer

The maximum tolerable downtime is 2 hours

Answer

The database must be fully recovered within 2 hours of a disaster

Question 11

A company's disaster recovery plan includes an agreement with another company to provide backup computing facilities in case of a disaster. The agreement allows the second company to use the facilities for its own operations if needed. This arrangement is best described as:

Accepted Answer

Reciprocal agreement. A reciprocal agreement is an arrangement between two organizations to provide backup facilities to each other, but it may be unreliable if both need the resources simultaneously.

Answer

Hot site

Answer

Warm site

Answer

Cold site

Question 12

Which role in an incident response team is primarily responsible for coordinating communication with external parties, such as the media and regulators?

Accepted Answer

Communications lead. The communications lead manages external messaging during an incident.

Answer

Legal counsel

Answer

Incident manager

Answer

Forensic investigator

Question 13

A government agency requires a security model that prevents users from reading documents classified above their clearance level and from writing classified information to lower-level systems. Which model enforces these constraints?

Accepted Answer

Bell-LaPadula. The Bell-LaPadula model is a state machine model that enforces confidentiality via the *no read up* (simple security property) and *no write down* (*-property) rules.

Answer

Biba

Answer

Brewer-Nash

Answer

Clark-Wilson

Question 14

A company decides to purchase cyber insurance to cover potential losses from data breaches. Which risk response strategy does this represent?

Accepted Answer

Transfer. Transfer involves shifting the risk to a third party, such as through insurance.

Answer

Accept

Answer

Avoid

Answer

Mitigate

Question 15

A development team is designing a new application and wants to ensure that if a failure occurs, the system remains secure by default. Which design principle should they apply?

Accepted Answer

Fail-secure. Fail-secure ensures that when a system fails, it defaults to a secure state (e.g., denying access) rather than an insecure one.

Answer

Least privilege

Answer

Defense in depth

Answer

Separation of duties