CISSP Practice Test 32 — 15 Questions

Question 1

A company's software asset management team discovers an unauthorized copy of a licensed application installed on several employee workstations. What is the primary risk associated with this finding?

Accepted Answer

Legal liability for software piracy. Unauthorized software can expose the organization to legal liability for copyright infringement, security vulnerabilities due to lack of patching, and compliance issues.

Answer

Reduction in employee productivity

Answer

Increased storage consumption

Answer

Incompatibility with other systems

Question 2

An organization uses full disk encryption on all laptops containing sensitive data. A laptop is to be decommissioned, and the data must be sanitized. The laptop's SSD cannot be overwritten reliably due to wear-leveling. Which method is most appropriate?

Accepted Answer

Cryptographic erasure by destroying the encryption key. Cryptographic erasure (destroying the encryption key) renders data inaccessible if encryption is strong, suitable for SSDs.

Answer

Degaussing

Answer

DoD 5220.22-M 7-pass overwrite

Answer

Physical destruction (shredding)

Question 3

What is the primary purpose of a configuration management database (CMDB) in asset management?

Accepted Answer

Provide a repository of configuration items and their relationships. A CMDB is used to store information about configuration items (CIs) and their relationships, helping manage IT assets and their interdependencies.

Answer

Monitor network traffic for anomalies

Answer

Store and manage data classification labels

Answer

Track software licenses and compliance

Question 4

An organization wants to test its web application for vulnerabilities by running the application and probing it with malicious inputs. Which tool is BEST suited for this purpose?

Accepted Answer

OWASP ZAP. DAST tools like OWASP ZAP and Burp Suite probe running applications to find vulnerabilities.

Answer

Checkmarx

Answer

SonarQube

Answer

Veracode

Question 5

A security analyst is reviewing a web application and notices that it includes a feature that allows users to view their own profile by providing a user ID in the URL (e.g., /profile?userid=123). The application does not verify that the logged-in user owns that profile. Which vulnerability is present?

Accepted Answer

Insecure direct object reference (IDOR). Insecure Direct Object References (IDOR) occur when an application exposes direct references to internal objects (like user IDs) without proper access control checks. This allows an attacker to access other users' data by manipulating the ID.

Answer

Security misconfiguration

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Question 6

Which of the following is the primary purpose of a Change Advisory Board (CAB)?

Accepted Answer

To provide oversight and approval for significant changes. The CAB reviews and approves changes to ensure they are properly assessed and minimize risk.

Answer

To implement changes as requested by management

Answer

To review security incidents after they occur

Answer

To approve all changes to the production environment

Question 7

A security architect is deploying a public key infrastructure (PKI) and wants to ensure that certificate revocation status is verified efficiently without relying on a centralized CRL distribution point. Which technique should be used?

Accepted Answer

OCSP Stapling. OCSP stapling allows a TLS server to present a signed OCSP response from the CA, reducing load on the CA and providing timely revocation status.

Answer

Certificate Transparency Logs

Answer

Certificate Pinning

Answer

Self-Signed Certificates

Question 8

During a vulnerability assessment, a security analyst discovers that a web application uses a library known to be vulnerable to Log4Shell (CVE-2021-44228). Which type of vulnerability does this represent?

Accepted Answer

Vulnerable components. Log4Shell is a remote code execution vulnerability in the Log4j library, an example of using vulnerable components (third-party libraries with known vulnerabilities).

Answer

Server-side request forgery (SSRF)

Answer

Insecure deserialization

Answer

Security misconfiguration

Question 9

A development team is implementing cryptographic functions for a new application. They need to store passwords securely. Which of the following is the most appropriate approach?

Accepted Answer

Use a key derivation function (e.g., bcrypt) with a per-user salt. Passwords should be salted and hashed using a strong, slow hash function like bcrypt, scrypt, or PBKDF2. Salting prevents rainbow table attacks.

Answer

Encrypt passwords using AES-256 with a static key

Answer

Store passwords in plaintext but in a protected database

Answer

Hash passwords with SHA-256 without salt

Question 10

An organization wants to implement single sign-on across multiple web applications using an XML-based protocol that supports identity provider (IdP) and service provider (SP) initiated flows. Which technology should they choose?

Accepted Answer

SAML 2.0. SAML 2.0 is an XML-based protocol for SSO that supports both IdP and SP initiated flows and uses assertions.

Answer

OpenID Connect

Answer

OAuth 2.0

Answer

Kerberos

Question 11

During a vulnerability management lifecycle, after vulnerabilities are identified and prioritized, what is the NEXT step?

Accepted Answer

Remediation. Remediation (patching or mitigating) follows prioritization.

Answer

Verification

Answer

Reporting

Answer

Risk acceptance

Question 12

A company is implementing an access control system where permissions are granted based on attributes such as user role, department, time of day, and device trust score. This approach allows for fine-grained policies that can adapt to context. Which access control model is being used?

Accepted Answer

ABAC (Attribute-Based Access Control). ABAC (Attribute-Based Access Control) uses attributes of the user, resource, and environment to determine access. It is more flexible than RBAC or MAC.

Answer

MAC (Mandatory Access Control)

Answer

DAC (Discretionary Access Control)

Answer

RBAC (Role-Based Access Control)

Question 13

During a digital forensics investigation, a security analyst must preserve evidence in order of volatility. Which of the following represents the correct sequence from most volatile to least volatile?

Accepted Answer

CPU registers → Cache → RAM → Swap → Disk → Remote logging → Physical media. The order of volatility prioritizes capturing data that changes most quickly first.

Answer

Physical media → Remote logging → Disk → Swap → RAM → Cache → CPU registers

Answer

Cache → CPU registers → RAM → Swap → Remote logging → Disk → Physical media

Answer

RAM → CPU registers → Cache → Swap → Disk → Remote logging → Physical media

Question 14

Under GDPR, a company processes personal data on behalf of a data controller. Which role does the company fulfill?

Accepted Answer

Data processor. A data processor processes data on behalf of the controller, subject to strict contractual and regulatory obligations.

Answer

Data custodian

Answer

Data controller

Answer

Data subject

Question 15

A company must destroy a set of hard drives containing sensitive customer data. The drives are magnetic (HDDs). Which destruction method provides the highest assurance of data irrecoverability?

Accepted Answer

Degaussing. Degaussing disrupts the magnetic field on HDDs, making data unrecoverable, and is considered highly effective for magnetic media.

Answer

Overwriting with a single pass of zeros

Answer

Physical destruction by drilling

Answer

Cryptographic erasure