CISSP Practice Test 33 — 15 Questions

Question 1

A security analyst is reviewing logs from a web application firewall (WAF) and notices multiple requests containing the payload "1=1--" in the query string. The analyst suspects a SQL injection attack. Which of the following is the BEST immediate action to validate the suspicion?

Accepted Answer

Check the application logs for database error messages.. Checking the application logs for database error messages is the best immediate action because SQL injection attempts often trigger verbose database errors (e.g., MySQL syntax errors, ODBC error codes) that confirm the injection point. This passive validation requires no additional tools and directly correlates the WAF alert with backend behavior, avoiding the risk of actively exploiting a live system.

Answer

Use a manual SQL injection tool like sqlmap to test the application.

Answer

Implement prepared statements in the application code.

Answer

Run a vulnerability scan with a SQL injection detection module.

Question 2

A security team is analyzing logs from multiple sources and notices anomalous outbound traffic to a known command-and-control server. What is the most likely conclusion?

Accepted Answer

A host is compromised and is beaconing. Anomalous outbound traffic to a known command-and-control (C2) server is a classic indicator of compromise (IoC). Compromised hosts often beacon outbound to C2 infrastructure using HTTP, HTTPS, or DNS tunnels to receive instructions or exfiltrate data. This pattern is distinct from normal traffic and is a primary focus of network security monitoring and intrusion detection systems (IDS).

Answer

A misconfigured firewall is causing traffic

Answer

An employee is streaming video to a personal server

Answer

The network is under a DDoS attack

Question 3

An organization is implementing a security information and event management (SIEM) system. Which THREE factors are most critical for the SIEM to provide actionable security insights?

Accepted Answer

Real-time alerting capabilities. Real-time alerting is critical because SIEM must detect and notify security teams of ongoing threats within seconds to minutes, enabling timely incident response. Without near-instantaneous correlation and alerting, attackers can achieve their objectives (e.g., lateral movement, data exfiltration) before the organization even knows an incident occurred. This aligns with the NIST SP 800-61 incident response lifecycle, where detection and analysis must be rapid to contain damage.

Answer

Ability to store raw logs for one year

Answer

Low false-positive rate

Question 4

A security analyst is conducting a review of aggregated logs from firewalls, IDS, and servers to detect anomalous behavior. This activity is best described as:

Accepted Answer

Security log analysis. Security log analysis involves the systematic review of logs from firewalls, IDS, and servers to identify patterns, anomalies, or indicators of compromise. This activity directly matches the scenario of detecting anomalous behavior through aggregated log review, which is a core practice in security monitoring and incident detection.

Answer

Risk assessment

Answer

Vulnerability scanning

Answer

Penetration testing

Question 5

Based on the vulnerability scan exhibit, which vulnerability should be remediated first?

Accepted Answer

OpenSSL Heartbleed vulnerability. The OpenSSL Heartbleed vulnerability (CVE-2014-0160) allows an attacker to read up to 64 KB of memory from a vulnerable server, potentially exposing private keys, session tokens, and passwords. This is a critical remote code execution and information disclosure flaw that requires immediate remediation because it compromises the confidentiality of all encrypted communications. In contrast, the other vulnerabilities are less severe: SSH weak MAC algorithms reduce cryptographic strength but do not directly leak data, and SMTP open relay is a misconfiguration that enables spam but not direct data theft.

Answer

All vulnerabilities equally because they have the same host

Answer

SSH weak MAC algorithms

Answer

SMTP open relay

Question 6

A company's security team discovers that a critical web application has a SQL injection vulnerability. However, the team is unable to remediate it immediately due to a dependency on a third-party component. Which of the following is the BEST approach to manage the risk while awaiting a patch?

Accepted Answer

Accept the risk and implement compensating controls like input validation at the network layer. Option A is correct because when a vulnerability cannot be patched immediately, compensating controls are the best risk management approach. Implementing input validation at the network layer (e.g., via a web application firewall or network-based IPS) can block SQL injection patterns before they reach the vulnerable application, reducing the likelihood of exploitation without requiring changes to the third-party component.

Answer

Deploy a web application firewall with a rule to block SQL injection patterns

Answer

Increase logging and monitoring of the application

Answer

Disable the vulnerable feature entirely

Question 7

Which of the following is the primary purpose of a security assessment?

Accepted Answer

To identify weaknesses and measure control effectiveness. The primary purpose of a security assessment is to systematically identify vulnerabilities, threats, and weaknesses in an organization's information systems, and to evaluate the effectiveness of existing security controls. This aligns with the CISSP domain of Security Assessment and Testing, where the goal is to measure control performance against a baseline, not to immediately remediate or enforce compliance.

Answer

To fix all vulnerabilities immediately

Answer

To ensure compliance with regulations

Answer

To punish non-compliant employees

Question 8

A security professional is tasked with testing the effectiveness of security controls in a production environment without causing disruption. Which type of assessment should be performed?

Accepted Answer

Vulnerability scan. A vulnerability scan is the correct choice because it is a non-intrusive, automated assessment that identifies known vulnerabilities (e.g., missing patches, misconfigurations) by comparing system states against a database of CVEs and configuration benchmarks (e.g., CIS benchmarks). It does not exploit vulnerabilities or generate attack traffic, making it safe for production environments. In contrast, penetration tests and red team exercises involve active exploitation and simulated attacks that risk service disruption.

Answer

Penetration test

Answer

Red team exercise

Answer

Social engineering test

Question 9

Which TWO of the following are examples of types of security assessments?

Accepted Answer

Vulnerability scan. A vulnerability scan is a security assessment that systematically identifies, categorizes, and reports known vulnerabilities in systems, networks, and applications. It uses automated tools (e.g., Nessus, OpenVAS) to compare system configurations and software versions against databases of known vulnerabilities (e.g., CVE, NVD). This is a core example of a security assessment because it evaluates the security posture without exploiting vulnerabilities, aligning with the 'Security Assessment and Testing' domain.

Answer

Firewall rule review

Answer

Password policy enforcement

Answer

Antivirus update

Question 10

During a penetration test, a tester discovers that the target web application responds to HTTP requests with a "200 OK" status for both valid and invalid session tokens on a particular API endpoint. The application uses JSON Web Tokens (JWT) for authentication. Which of the following vulnerabilities is MOST likely present?

Accepted Answer

Weak JWT signing algorithm. The application returns a 200 OK for both valid and invalid session tokens, which indicates that the server is not validating the JWT signature. This behavior is characteristic of a weak JWT signing algorithm vulnerability, such as when the server accepts 'none' as the algorithm or uses a symmetric key that can be easily guessed. An attacker can forge arbitrary tokens by setting the algorithm to 'none' or by using a known weak secret, gaining unauthorized access.

Answer

Session fixation

Answer

Missing authentication

Answer

Insecure direct object reference

Question 11

A company wants to test the effectiveness of its security controls without causing disruption. Which type of assessment is most appropriate?

Accepted Answer

Vulnerability scan. A vulnerability scan is the most appropriate assessment because it passively identifies known vulnerabilities (e.g., missing patches, misconfigurations) without exploiting them, ensuring no disruption to production systems. Unlike active exploitation tests, vulnerability scanners use non-intrusive probes (e.g., banner grabbing, version fingerprinting) that do not trigger denial-of-service or system crashes. This aligns with the requirement to test control effectiveness while maintaining operational stability.

Answer

Penetration test

Answer

Security audit

Answer

Red team exercise

Question 12

A penetration tester is planning an engagement. Which of the following rules of engagement should be defined before testing begins? (Select TWO.)

Accepted Answer

Emergency contact procedures. Emergency contact procedures (B) are a critical component of the Rules of Engagement (RoE) because they define who to notify if an incident occurs during testing, such as an unintended system outage or detection by security monitoring. Without this, the tester risks legal or operational repercussions. The scope of systems to be tested (C) is equally essential as it explicitly lists IP ranges, hostnames, and network segments authorized for testing, preventing unauthorized access and ensuring compliance with the engagement contract.

Answer

The exact exploits to be used

Answer

The tester's personal compensation

Answer

The names of employees to be targeted

Question 13

Which THREE of the following are commonly used metrics for measuring the effectiveness of a vulnerability management program?

Accepted Answer

Patch coverage percentage. Patch coverage percentage is a direct measure of vulnerability management effectiveness because it tracks the proportion of systems that have received required patches. A high patch coverage percentage indicates that the organization is successfully applying fixes to known vulnerabilities, reducing the attack surface. This metric is commonly used in vulnerability management programs to assess the completeness of remediation efforts.

Answer

Mean time to detect (MTTD)

Answer

Number of security incidents

Question 14

A security analyst notes that a recent penetration test successfully exploited a vulnerability in a legacy application that cannot be patched. The analyst recommends implementing network segmentation to limit the application's exposure. This recommendation is an example of:

Accepted Answer

Risk mitigation. Implementing network segmentation to limit exposure of an unpatched legacy application is a classic example of risk mitigation. By isolating the application on a separate network segment (e.g., using VLANs or firewall rules), the analyst reduces the likelihood or impact of a successful exploit, even though the underlying vulnerability remains unpatched. This directly aligns with the CISSP definition of risk mitigation: applying controls to reduce risk to an acceptable level.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 15

A company is conducting a security assessment of its network infrastructure. Which of the following activities are typically performed during a vulnerability assessment? (Select TWO.)

Accepted Answer

Identification of missing security patches. A is correct because vulnerability assessments focus on identifying and cataloging weaknesses without exploitation. Missing security patches are a common finding from automated scanning tools like Nessus or OpenVAS, which compare system configurations against known vulnerability databases (e.g., CVE). This aligns with the assessment's goal of discovering vulnerabilities, not exploiting them.

Answer

Attempting to crack password hashes

Answer

Social engineering attacks against employees

Answer

Exploiting identified vulnerabilities to gain unauthorized access