CISSP Practice Test 32 — 15 Questions

Question 1

A company is implementing a secure multi-tenant cloud environment. The primary security requirement is that tenants cannot access each other's data even if the hypervisor is compromised. Which architecture best meets this requirement?

Accepted Answer

Use a Trusted Execution Environment (TEE) such as Intel SGX to isolate tenant processes and memory.. A Trusted Execution Environment (TEE) like Intel SGX creates hardware-enforced enclaves that isolate tenant processes and memory at the CPU level. Even if the hypervisor is compromised, the enclave's memory is encrypted and inaccessible to the host OS or hypervisor, ensuring tenant data remains confidential. This directly meets the requirement that tenants cannot access each other's data despite a hypervisor breach.

Answer

Encrypt each tenant's data with a single master key stored in the hypervisor.

Answer

Implement Mandatory Access Control (MAC) on the hypervisor.

Answer

Use VLANs to isolate tenant traffic at the network layer.

Question 2

A company is deploying a new application that processes personally identifiable information (PII) in a hybrid cloud environment. The security architect needs to ensure that encryption keys are never exposed to the cloud provider. Which solution should be recommended?

Accepted Answer

Client-side encryption with keys stored on-premises. Client-side encryption ensures that encryption keys are generated and managed on-premises, never transmitted to the cloud provider. This directly meets the requirement that keys are never exposed to the cloud provider, as all cryptographic operations occur before data leaves the customer's controlled environment.

Answer

Envelope encryption with a key management service

Answer

Server-side encryption with cloud provider managed keys

Answer

Server-side encryption with customer-provided keys

Question 3

A user reports that a VPN client cannot connect to the corporate gateway. The exhibit shows an excerpt from the client log. What does this indicate?

Accepted Answer

The client does not trust the CA that issued the server certificate. The client log indicates a certificate validation failure during the TLS handshake. The error 'unable to get local issuer certificate' or similar means the client cannot find a trusted root CA that issued the server's certificate. This is a classic PKI trust issue, not an expiration or missing client certificate problem.

Answer

The VPN server certificate is expired

Answer

The server is using a self-signed certificate

Answer

The client certificate is missing

Question 4

A security architect is designing a cryptographic system for a high-security environment where data must be encrypted both at rest and in transit, with granular access control. The system must be efficient for large volumes of data. Which approach is most appropriate?

Accepted Answer

Use asymmetric encryption for key exchange and symmetric encryption for data (hybrid cryptosystem).. Option C is correct because a hybrid cryptosystem combines the efficiency of symmetric encryption (e.g., AES-256) for bulk data encryption with the secure key distribution of asymmetric encryption (e.g., RSA or ECDH). This approach ensures strong confidentiality for large volumes of data at rest and in transit, while enabling granular access control through per-user or per-session key management.

Answer

Use symmetric encryption (e.g., AES-256) for all data and share keys out-of-band.

Answer

Use only asymmetric encryption (e.g., RSA) for all data.

Answer

Use hash functions (e.g., SHA-256) to ensure confidentiality.

Question 5

A security analyst is reviewing logs and notices multiple failed login attempts from a single IP address followed by a successful login. What should the analyst do next?

Accepted Answer

Investigate the successful login. The correct answer is C because a successful login immediately following multiple failed attempts from the same IP address is a classic indicator of a brute-force or password-spraying attack that succeeded. The analyst must investigate the successful login to determine if it was legitimate or an account compromise, checking for anomalous behavior, time of access, and any subsequent actions. Ignoring or prematurely blocking the IP could destroy forensic evidence or lock out a legitimate user, while disabling the account without investigation may be premature if the login was authorized.

Answer

Disable the account immediately

Answer

Ignore, as failed logins are normal

Answer

Block the IP address

Question 6

A company needs to protect data at rest in a cloud storage system. Which THREE encryption methods are appropriate for this purpose?

Accepted Answer

Client-side encryption with key management. Client-side encryption with key management (B) ensures data is encrypted before it leaves the client device, so the cloud provider never has access to plaintext or the encryption keys. This is a fundamental control for protecting data at rest in untrusted environments, as it decouples key management from the storage provider.

Answer

Stream cipher without authentication (e.g., RC4)

Answer

MD5 hashing

Question 7

A security analyst is tasked with identifying vulnerabilities in a web application that is still in development. The application code is not yet stable, and frequent changes are expected. Which testing approach would be most appropriate to identify vulnerabilities without hindering the development process?

Accepted Answer

Static application security testing (SAST). Static Application Security Testing (SAST) is the most appropriate approach because it analyzes source code, byte code, or binary code without executing the application, making it ideal for early-stage development where code is unstable and frequently changing. SAST can be integrated into the development pipeline (e.g., as a pre-commit hook or CI/CD step) to identify vulnerabilities like SQL injection, XSS, or buffer overflows without requiring a running application or hindering the iterative development process.

Answer

Fuzz testing

Answer

Manual penetration testing

Answer

Dynamic application security testing (DAST)

Question 8

A cloud security architect is designing a system that must comply with the principle of data sovereignty. Which three controls should be implemented? (Select THREE.)

Accepted Answer

Enforce contractual clauses with cloud provider regarding data location. Option B is correct because contractual clauses with the cloud provider legally bind the provider to store and process data only within specified geographic boundaries, directly enforcing data sovereignty. This is a governance control that ensures compliance with local laws, such as GDPR or Brazil's LGPD, by restricting data movement across jurisdictions.

Answer

Encrypt data at rest using customer-managed keys

Answer

Use a virtual private network (VPN) for all transfers

Question 9

A vulnerability scan report shows that a web server has a critical vulnerability with a CVSS score of 9.8. However, the server is behind a WAF that blocks the attack vector, and the vulnerability is in a deprecated feature that cannot be removed until the next major release. What should the security manager do first?

Accepted Answer

Document the compensating control and accept the residual risk. Option C is correct because the WAF serves as a compensating control that effectively mitigates the attack vector for this vulnerability, and the residual risk has been formally documented and accepted by management. In the absence of an immediate patch or removal of the deprecated feature, documenting the compensating control and accepting the residual risk is the appropriate risk management decision per the organization's risk appetite and the NIST SP 800-30 risk assessment framework.

Answer

Remove the server from production

Answer

Ignore the finding because the WAF blocks it

Answer

Immediately patch the vulnerability

Question 10

A security analyst reviews system logs and notices multiple failed SSH login attempts from a single IP address over the past hour. The attempts are spaced 30 seconds apart and target different usernames. Which type of attack is most likely occurring?

Accepted Answer

Brute force password guessing. The observed pattern—multiple failed SSH login attempts from a single IP, spaced 30 seconds apart, targeting different usernames—is characteristic of a brute force password guessing attack. Unlike a dictionary attack, which uses a precompiled list of likely passwords, a brute force attack systematically tries all possible password combinations for each username, often with a delay to evade rate limiting.

Answer

Distributed denial-of-service (DDoS) attack

Answer

Dictionary attack

Answer

Man-in-the-middle attack

Question 11

A red team exercise is planned to simulate a sophisticated adversary. The blue team is aware of the exercise but not the exact methods. The red team is given a budget to acquire attack tools. What is the primary advantage of this approach over a traditional penetration test?

Accepted Answer

It evaluates the organization's detection and response capabilities. Option C is correct because a red team exercise with a known-but-not-detailed blue team specifically tests the organization's detection and response capabilities under realistic adversarial conditions. Unlike a traditional penetration test, which focuses on identifying vulnerabilities, this approach evaluates how well the blue team can detect, analyze, and respond to stealthy, multi-stage attacks that mimic a sophisticated adversary. The red team's budget for attack tools allows them to simulate advanced persistent threats (APTs) that challenge the blue team's security operations center (SOC) processes and incident response procedures.

Answer

It ensures that the blue team is not alerted to the test

Answer

It provides comprehensive vulnerability coverage

Answer

It is more cost-effective than a penetration test

Question 12

A vulnerability scanner reports a medium-severity finding on a web server. After investigating, the system administrator claims the finding is a false positive because the service in question is not actually running. Which step should the security analyst take next?

Accepted Answer

Verify the service status using system commands or network scans. Option A is correct because the security analyst must independently verify the administrator's claim before taking any action. The vulnerability scanner may have detected a service on a different port or the service may be bound to a non-standard interface; using system commands (e.g., `netstat -tulpn` or `ss -tulpn`) or a targeted network scan (e.g., `nmap -sV -p `) provides objective evidence of whether the service is actually listening. Relying solely on the administrator's assertion without verification could lead to a missed true positive, especially if the service is hidden or misconfigured.

Answer

Remove the finding from the report since the administrator confirmed it

Answer

Close the finding as accepted risk

Answer

Escalate the issue to management for risk acceptance

Question 13

A security tester needs to test a new application for vulnerabilities but is concerned about contaminating the production database with test data. What is the best practice for conducting such tests?

Accepted Answer

Create a separate test environment with anonymized production data. Option B is correct because creating a separate test environment with anonymized production data ensures that testing does not affect the integrity or availability of the production database while still using realistic data to uncover vulnerabilities. Anonymization techniques, such as data masking or tokenization, remove personally identifiable information (PII) while preserving referential integrity and data distribution, allowing for accurate security testing without contaminating production systems.

Answer

Perform the test on the production environment during off-hours

Answer

Test only from the network perimeter to avoid data exposure

Answer

Use synthetic data that mimics production but is not real

Question 14

A company's compliance officer wants to ensure that the organization's security controls meet regulatory requirements for data protection. The officer requests a review of the controls against the regulation's specific clauses. Which type of assessment is most appropriate?

Accepted Answer

Compliance audit. A compliance audit is the correct assessment type because it systematically evaluates security controls against specific regulatory clauses (e.g., GDPR Article 32, HIPAA Security Rule §164.312). Unlike risk or vulnerability assessments, a compliance audit maps controls directly to legal requirements to verify adherence, often using checklists and evidence collection.

Answer

Risk assessment

Answer

Vulnerability assessment

Answer

Penetration test

Question 15

During an internal audit, an organization discovers that a critical application has not been patched for six months. The application is business-critical and cannot be taken offline during business hours. Which of the following is the best course of action?

Accepted Answer

Implement compensating controls and schedule patching at the next available maintenance window. Option A is correct because compensating controls (e.g., network segmentation, WAF rules, or host-based IPS) reduce the immediate risk while the critical application remains online. Scheduling patching for the next maintenance window aligns with change management and ensures the patch is tested and applied without disrupting business operations. This balances security needs with operational continuity, a core principle of risk management.

Answer

Accept the risk and continue operations

Answer

Apply the patch immediately during off-hours even if it risks downtime

Answer

Disconnect the application until it is patched