CISSP Practice Test 32 — 15 Questions

Question 1

In a qualitative risk assessment, a risk with a likelihood rating of 'High' and an impact rating of 'Critical' would typically fall into which category?

Accepted Answer

High risk. In a qualitative risk matrix, likelihood and impact ratings are combined to produce an overall risk level. A 'High' likelihood paired with a 'Critical' impact sits at the top of the matrix and is classified as High risk, warranting immediate treatment. Lower combinations (e.g., High likelihood + Low impact) would map to Medium or Low.

Answer

Medium risk

Answer

Low risk

Answer

De minimis risk

Question 2

In SAML 2.0, which component is responsible for authenticating the user and generating an assertion?

Accepted Answer

Identity Provider (IdP). In SAML 2.0, the Identity Provider (IdP) is the entity that authenticates the user and issues the SAML assertion containing authentication and attribute statements. The Service Provider (SP) consumes that assertion to grant access. The IdP is the authoritative source of identity, so it is the component that generates the assertion.

Answer

Service Provider (SP)

Answer

Certificate Authority (CA)

Answer

Relying Party (RP)

Question 3

Which of the following metrics is used to determine the maximum amount of data loss an organization can tolerate in a disaster?

Accepted Answer

RPO. RPO (Recovery Point Objective) defines the maximum tolerable amount of data loss measured in time. It represents the point in time to which data must be recovered after a disruption, effectively setting the maximum age of the most recent backup that can be restored. For example, an RPO of 4 hours means the organization can tolerate losing up to 4 hours of data, so backups must occur at least every 4 hours.

Answer

MTTR

Answer

RTO

Answer

MTD

Question 4

A security architect is designing a system that must prevent conflicts of interest when a consultant works for two competing clients. Which security model ensures that the consultant cannot access data from one client if they have already accessed data from the other?

Accepted Answer

Brewer-Nash. Brewer-Nash, also known as the Chinese Wall model, is specifically designed to prevent conflicts of interest by dynamically restricting access based on a user's previous access history. Once a consultant accesses data from one client, the model blocks access to any data belonging to a competing client. This is implemented through dynamically changing access control lists that track what each user has already accessed, ensuring that no user can simultaneously hold data from two competing companies.

Answer

Clark-Wilson

Answer

Biba

Answer

Bell-LaPadula

Question 5

Which access control model bases decisions on attributes of the user, resource, and environment, and can use Boolean logic to define policies?

Accepted Answer

Attribute-Based Access Control (ABAC). ABAC (Attribute-Based Access Control) evaluates attributes of the subject (user), object (resource), and environment (context such as time, location, or threat level) to make access decisions. It supports Boolean logic (AND, OR, NOT) to combine these attributes into fine-grained policies, enabling dynamic and context-aware authorization. This contrasts with RBAC, which relies on roles, and MAC/DAC, which use labels or ownership, respectively.

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Question 6

Which of the following is a key difference between a policy and a guideline in information security governance?

Accepted Answer

Policies are mandatory, while guidelines are recommended. Policies are formal, high-level statements that mandate specific behaviors or requirements across the organization; compliance is compulsory. Guidelines, in contrast, are non-mandatory recommendations or best practices that offer advice on how to achieve policy objectives. This distinction is fundamental to information security governance because it clarifies which documents carry enforcement weight and which are merely advisory.

Answer

Policies are created by IT, while guidelines are created by executives

Answer

Policies are technical, while guidelines are managerial

Answer

Policies are static, while guidelines are updated frequently

Question 7

Match each access control type to its description.

Accepted Answer

DAC: Access rights are assigned based on the identity of the user and the discretion of the data owner.. The four main access control models are DAC (owner-based), MAC (label-based), RBAC (role-based), and ABAC (attribute-based). Common confusions include swapping DAC with MAC and RBAC with ABAC.

Answer

DAC: Access is controlled by comparing security labels with user clearances; users cannot change access.

Answer

RBAC: Access decisions are based on attributes of the user, resource, and environment.

Question 8

A security analyst is identifying incident categories for a new incident response plan. Which TWO of the following are valid incident categories according to standard IR frameworks?

Accepted Answer

Denial of Service (DoS). Option B, Denial of Service (DoS), is a valid incident category because standard IR frameworks such as NIST SP 800-61 and SANS categorize attacks that degrade or block availability of systems and networks (e.g., volumetric floods, SYN floods, application-layer exhaustion) as a distinct incident type requiring specific detection and containment playbooks. Option D, Insider threat, is also a valid category because incidents involving authorized users—whether malicious, negligent, or compromised—such as data exfiltration, privilege abuse, or credential misuse are treated as a separate class due to their unique investigative and legal handling needs. The remaining options are not incident categories: A, Change request, is an ITIL change-management artifact, not an incident type; C, Patch management failure, is a vulnerability or configuration management issue that may contribute to an incident but is not itself a standard IR category; and E, Business continuity exercise, is a planned testing activity, not a security incident.

Answer

Change request

Answer

Patch management failure

Answer

Business continuity exercise

Question 9

After a penetration test, the tester provides a report that includes vulnerabilities found, exploitation details, and recommended fixes. Which step of the penetration testing process does this represent?

Accepted Answer

Reporting. The reporting phase is the final step in the penetration testing process, where the tester documents all findings, including vulnerabilities discovered, exploitation details, and recommended remediation steps. This report is delivered to the client to provide a clear understanding of the security posture and actionable fixes. Without this step, the test results would have no value for improving security.

Answer

Post-exploitation

Answer

Planning and scoping

Answer

Reconnaissance

Question 10

Which IPsec protocol provides both authentication and encryption of the packet payload, but does not encrypt the IP header?

Accepted Answer

ESP in transport mode. ESP in transport mode encrypts the payload and provides authentication (via an optional ICV), but it does not encrypt the IP header. This matches the question's requirement of payload authentication and encryption without header encryption. In contrast, AH authenticates the entire packet (including the IP header) but provides no encryption.

Answer

AH in transport mode

Answer

AH in tunnel mode

Answer

ESP in tunnel mode

Question 11

A security architect is designing a system to protect against side-channel attacks that exploit electromagnetic emanations. Which TWO controls are most effective?

Accepted Answer

TEMPEST shielding. TEMPEST shielding (B) is correct because TEMPEST is the standard for reducing compromising emanations, including electromagnetic radiation from monitors, cables, and processors, that can leak data to nearby receivers; shielding enclosures and filtered power/communications lines directly mitigate this side-channel. A Faraday cage (E) is also correct because it blocks external electromagnetic fields and contains internal emissions, preventing EM leakage from being intercepted, which is the core defense against emanation-based side-channel attacks. Data encryption at rest (A) protects stored data but does not stop electromagnetic emissions from a running system. An intrusion detection system (C) monitors network or host activity for malicious behavior and does not address physical EM leakage. Time-based access controls (D) restrict when users may access resources and are irrelevant to electromagnetic side-channel exploitation.

Answer

Data encryption at rest

Answer

Intrusion detection system

Answer

Time-based access controls

Question 12

An employee leaves the company, and their user account is not disabled. This creates a security risk known as:

Accepted Answer

Orphaned account. An orphaned account is a user account that remains active in the identity management system after the employee has left the organization. This creates a security risk because the account can be exploited by attackers or former employees to gain unauthorized access to systems, data, or network resources, bypassing access controls that rely on account deactivation.

Answer

Insider threat

Answer

Privilege creep

Answer

Separation of duties violation

Question 13

A web application exposes an API that allows users to fetch data from internal network resources based on a URL parameter. An attacker discovers they can use this API to access internal servers that are not meant to be public. Which vulnerability is being exploited?

Accepted Answer

Server-side request forgery (SSRF). SSRF allows an attacker to induce the server to make requests to internal or external resources, bypassing firewalls and access controls.

Answer

Insecure direct object reference (IDOR)

Answer

Remote code execution (RCE)

Answer

Cross-site request forgery (CSRF)

Question 14

An organization is selecting security metrics to report to the board. Which THREE metrics would best demonstrate the effectiveness of the vulnerability management program?

Accepted Answer

Open vulnerability count by severity. These three metrics cover remediation speed, current risk posture, and compliance with patching policies, which are key indicators.

Answer

Number of employees in IT security

Answer

Budget for security tools

Question 15

During an audit, it is discovered that a database containing personally identifiable information (PII) has been retained for 10 years beyond the regulatory requirement. The data owner has not approved the retention extension. Which data lifecycle principle is primarily being violated?

Accepted Answer

Storage limitation. Storage limitation requires that PII be kept only as long as necessary for the stated purpose or as required by regulation, and then securely deleted. Retaining data 10 years beyond the regulatory requirement, without the data owner's approval for an extension, directly violates this principle. The other principles address collection scope, purpose of use, and accuracy/consistency — not retention duration.

Answer

Data minimization

Answer

Purpose limitation

Answer

Integrity