CISSP Practice Test 33 — 15 Questions

Question 1

A security architect is designing a system for a government agency that requires strict confidentiality controls. Data must be classified at multiple levels (e.g., Top Secret, Secret, Confidential). Users at a lower classification should not be able to read data at a higher classification, and users at a higher classification should not be able to write data to a lower classification. Which security model enforces these rules?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Bell-LaPadula model. The Bell-LaPadula model is specifically designed for confidentiality and enforces two core rules: the Simple Security Property (no read up — a subject at a lower classification cannot read data at a higher classification) and the *-Property (no write down — a subject at a higher classification cannot write to a lower classification). These exactly match the government agency's requirements.

Answer

Biba model

Answer

Clark-Wilson model

Answer

Brewer-Nash model

Question 2

In an OAuth 2.0 authorization code flow with PKCE, what is the primary purpose of the code verifier and code challenge?

Accepted Answer

To ensure the client that requested the code is the same one redeeming it. In OAuth 2.0 authorization code flow with PKCE, the code verifier and code challenge are used to prove that the client redeeming the authorization code is the same client that initiated the authorization request. The client generates a random code verifier, hashes it to create the code challenge, sends the challenge with the authorization request, and later sends the verifier with the token request — the authorization server verifies they match. This prevents authorization code interception attacks, especially for public clients.

Answer

To encrypt the authorization code

Answer

To authenticate the end user

Answer

To generate the ID token

Question 3

A healthcare organization uses a custom application to manage patient records. The application uses a database with encrypted columns for sensitive data. The security team discovers that an insider has been copying encrypted data to an external drive. While the data is encrypted, the encryption key is stored in a configuration file accessible to the application. Which additional control would best mitigate this risk?

Accepted Answer

Store the encryption key in a hardware security module (HSM) with access policies.. Storing the encryption key in an HSM with strict access policies removes the key from the application-accessible configuration file, so even an insider with file access cannot retrieve the key. HSMs provide tamper-resistant hardware key storage, enforce cryptographic access controls, and can require dual control or M-of-N authentication, directly mitigating the risk of key exfiltration alongside encrypted data.

Answer

Enable audit logging on the application.

Answer

Implement role-based access control on the configuration file.

Answer

Use transparent data encryption (TDE) at the database level.

Question 4

A security analyst discovers that a business unit is storing sensitive data on a file share without classification labels. What is the first step to remediate?

Accepted Answer

Notify the data owner to classify the data. The first step in remediating unclassified sensitive data is to notify the data owner, who is responsible for assigning classification labels based on organizational policy. Without classification, subsequent security controls (e.g., encryption, access controls) cannot be correctly applied because the data's sensitivity level is unknown. This aligns with the CISSP principle that data classification must precede protection mechanisms.

Answer

Move the data to a secure server

Answer

Immediately delete the data

Answer

Encrypt the file share

Question 5

During a security incident, the incident response team identifies that an attacker exfiltrated data via a compromised service account. Which of the following is the BEST immediate step to contain the incident?

Accepted Answer

Revoke the service account's privileges. The best immediate containment step is to revoke the service account's privileges (option C), because disabling or removing the account's permissions stops the attacker from continuing to use it for exfiltration or lateral movement while preserving the account object for forensic review. Containment focuses on cutting off the adversary's access path, and privilege revocation is faster and more decisive than a password change alone, which could still leave the account usable if the attacker has other credential material or persistence. Notifying law enforcement (A) is a later communication step, enabling detailed auditing (B) is a detection/visibility measure rather than containment, and changing the password (D) may not fully stop an active session or token already in the attacker's possession.

Answer

Notify law enforcement

Answer

Enable detailed auditing on the account

Answer

Change the password of the service account

Question 6

Which security control is most effective for preventing unauthorized access to a data center?

Accepted Answer

Mantrap. A mantrap is a physical security control consisting of two interlocking doors with a small vestibule between them, allowing only one person through at a time and preventing tailgating. It is the most effective control for preventing unauthorized physical access to a data center because it enforces one-person-at-a-time entry and can integrate with authentication and detection.

Answer

Biometric authentication

Answer

Access logs

Answer

Video surveillance

Question 7

A security architect is evaluating hypervisor security for a multi-tenant cloud environment. Which type of hypervisor is considered more secure because it runs directly on the hardware without a host operating system, reducing the attack surface?

Accepted Answer

Type 1 hypervisor. A Type 1 hypervisor (also called a bare-metal hypervisor) runs directly on the host's physical hardware, with no intervening host operating system. Because there is no general-purpose OS layer to exploit, the attack surface is significantly smaller than a Type 2 hypervisor, which depends on a full host OS. This architectural reduction in exploitable code is why Type 1 hypervisors are preferred in multi-tenant cloud environments.

Answer

Virtual machine monitor

Answer

Containers

Answer

Type 2 hypervisor

Question 8

An organization uses a system where access decisions are based on user attributes (e.g., job title, clearance), resource attributes (e.g., classification), and environmental factors (e.g., time of day). This is an example of:

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) makes access decisions by evaluating attributes of the user (e.g., job title, clearance), the resource (e.g., classification), and the environment (e.g., time of day). This dynamic, policy-based approach is exactly what the question describes. ABAC is more granular than RBAC and allows for complex, context-aware rules.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 9

Under the GDPR, what is the maximum time frame for notifying the supervisory authority of a personal data breach?

Accepted Answer

72 hours. Article 33 of the GDPR requires that, in the case of a personal data breach, the controller notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of the breach. This 72-hour window is the maximum time frame specified by the regulation. If notification is not made within 72 hours, it must be accompanied by reasons for the delay.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 10

An organization is implementing DNSSEC to protect its DNS infrastructure. Which of the following best describes the primary security benefit of DNSSEC?

Accepted Answer

Authentication of DNS data origin and integrity. DNSSEC (Domain Name System Security Extensions) provides origin authentication and data integrity verification for DNS responses through digital signatures. It uses public-key cryptography to sign DNS resource record sets (RRSIG records), allowing resolvers to verify that the data has not been modified in transit and originates from the authoritative source. This prevents attacks such as DNS cache poisoning and man-in-the-middle spoofing, but does not provide confidentiality or availability protections.

Answer

Prevention of DDoS attacks on DNS servers

Answer

Anonymization of DNS queries

Answer

Encryption of DNS queries and responses

Question 11

A security analyst is evaluating secure email protocols. Which TWO of the following provide both encryption and digital signing of email messages?

Accepted Answer

S/MIME. S/MIME (Option A) is correct because it uses X.509 digital certificates to provide end-to-end message encryption and digital signing of email content, ensuring confidentiality, integrity, authentication, and non-repudiation. PGP/GPG (Option C) is also correct because it uses public/private key pairs to encrypt and digitally sign email messages, offering the same cryptographic protections for message body and attachments. SSL/TLS (Option B) only encrypts the transport channel between mail clients and servers (e.g., IMAP over TLS, SMTP over TLS) and does not itself digitally sign messages. SSH (Option D) is a secure remote-access and tunneling protocol unrelated to email message signing or encryption. IPsec (Option E) secures IP packets at the network layer for VPNs and does not provide email-level signing or encryption.

Answer

SSL/TLS

Answer

SSH

Answer

IPsec

Question 12

A security analyst is setting up a vulnerability scanning program. Which TWO of the following are best practices for determining scanning frequency?

Accepted Answer

Scan after significant changes to the infrastructure. Option B is correct because scanning after significant infrastructure changes (new hosts, patched services, reconfigurations, or new deployments) catches newly introduced vulnerabilities and misconfigurations before attackers can exploit them, which is a core tenet of continuous vulnerability management. Option C is correct because scanning frequency should be driven by the organization's risk appetite and tolerance, ensuring that high-value or high-risk assets are scanned more often while lower-risk systems may be scanned less frequently, balancing security coverage against operational cost. Option A is incorrect because an annual scan is far too infrequent to detect and remediate vulnerabilities before exploitation, and it ignores risk-based scheduling. Option D is incorrect because relying only on public disclosure events is reactive and misses internally discovered or non-public vulnerabilities. Option E is incorrect because a uniform interval ignores asset criticality and exposure, contradicting risk-based vulnerability management.

Answer

Scan once per year to minimize operational impact

Answer

Scan only when vulnerabilities are publicly disclosed

Answer

Use the same interval for all systems regardless of criticality

Question 13

A security team is performing a risk assessment on a legacy application that uses insecure deserialization. Which TWO of the following are recommended approaches to mitigate the risk of insecure deserialization?

Accepted Answer

Implementing integrity checks (e.g., digital signatures) on serialized objects. Option A is correct because applying integrity checks such as digital signatures or HMACs to serialized objects lets the receiving application verify that the data was not tampered with before deserialization, preventing attackers from injecting malicious serialized payloads. Option C is correct because an allow list (whitelist) restricts deserialization to only explicitly permitted, trusted classes, blocking the instantiation of dangerous gadget classes that enable remote code execution. Option B is not recommended as a primary mitigation because encryption provides confidentiality but does not prevent an attacker who can supply or replay ciphertext from triggering malicious deserialization, and it does not validate object integrity or class types. Option D is not appropriate because generic exception handling only masks errors and does not stop malicious objects from being deserialized and executed. Option E is not a mitigation because logging deserialization attempts is a detective control that records activity but does not prevent exploitation.

Answer

Encrypting the serialized data

Answer

Using generic exception handling to catch errors

Answer

Logging all deserialization attempts

Question 14

A SOC analyst receives an alert for a high number of outbound connections to a known malicious IP. Which action should be taken first?

Accepted Answer

Isolate the affected host. The correct first action is to isolate the affected host (Option D). This prevents further data exfiltration and gives the analyst a safe environment to investigate the compromise. Blocking the IP (Option B) stops the immediate traffic but leaves the host under attacker control. Running an antivirus scan (Option C) or notifying management (Option A) are secondary steps that should occur after containment.

Answer

Notify management

Answer

Block the IP at the firewall

Answer

Run an antivirus scan

Question 15

An organization wants to implement single sign-on (SSO) for multiple cloud applications. Which of the following is the most secure and scalable approach?

Accepted Answer

Implement SAML-based federation. SAML-based federation is the most secure and scalable approach for SSO across multiple cloud applications because it uses a trusted identity provider (IdP) to authenticate users and issue signed assertions, eliminating password sharing and enabling centralized access control. It is an industry standard (OASIS) designed specifically for cross-domain SSO, supporting strong authentication and fine-grained attribute sharing. This makes it both secure (no credential proliferation) and scalable (new apps can be added by trusting the IdP).

Answer

Use OAuth for authentication

Answer

Use the same password for all applications

Answer

Implement LDAP directory