CISSP Practice Test 33 — 15 Questions

Question 1

A security architect is selecting a cryptographic algorithm for encrypting data at rest in a backup system. The system requires strong security with a block cipher, and the organization mandates using a NIST-approved algorithm with key sizes of 128, 192, or 256 bits. Which algorithm should be selected?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AES. AES is a NIST-approved symmetric block cipher supporting 128, 192, and 256-bit keys. It is the standard for data at rest encryption.

Answer

RC4

Answer

RSA

Answer

3DES

Question 2

A company is evaluating a third-party software library for use in their application. Which document provides a detailed inventory of the library's components and dependencies to help assess supply chain risk?

Accepted Answer

Software Bill of Materials (SBOM). A Software Bill of Materials (SBOM) lists all components and dependencies, aiding vulnerability management and supply chain security.

Answer

Service Level Agreement (SLA)

Answer

Data processing agreement

Answer

Vulnerability disclosure report

Question 3

An organization is required to report a personal data breach to the supervisory authority within 72 hours. Which regulation imposes this requirement?

Accepted Answer

GDPR. GDPR Article 33 requires data controllers to notify the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

PCI DSS

Answer

SOX

Answer

HIPAA

Question 4

A security analyst is reviewing the error handling of an application. The application currently displays detailed stack traces to users when an exception occurs. Which of the following is the best practice for error handling in production?

Accepted Answer

Display generic error messages to users and log detailed errors for admins. Detailed error messages can leak sensitive information. Production systems should show generic messages to users and log detailed errors for administrators.

Answer

Display detailed errors to users for troubleshooting

Answer

Disable all error reporting to eliminate information leakage

Answer

Encrypt error messages before displaying to users

Question 5

A company wants to ensure that data labeled 'Internal Use Only' is not inadvertently disclosed to unauthorized parties. What is the most effective way to communicate handling requirements to employees?

Accepted Answer

Implementing a data classification policy and training employees on labeling and handling procedures. Clear labeling and documented handling procedures ensure employees know how to treat data appropriately.

Answer

Using data loss prevention (DLP) software

Answer

Encrypting all data at rest

Answer

Restricting access to the data through role-based access control

Question 6

An organization is decommissioning a server containing magnetic hard drives that stored sensitive data. The data has been backed up to tape and the drives are to be reused. Which media sanitization method is most appropriate to ensure data cannot be recovered while preserving the drives for reuse?

Accepted Answer

Overwriting the entire drive with a recognized standard. Overwriting (e.g., DoD 5220.22-M) is effective for magnetic media and allows reuse; degaussing and destruction do not allow reuse.

Answer

Degaussing

Answer

Physical destruction (shredding)

Answer

Cryptographic erasure

Question 7

Under the GDPR, which role is responsible for determining the purposes and means of processing personal data?

Accepted Answer

Data controller. The data controller decides why and how personal data is processed, as defined in GDPR.

Answer

Data processor

Answer

Data subject

Answer

Data protection officer

Question 8

Under HIPAA, what is the primary purpose of a Business Associate Agreement (BAA)?

Accepted Answer

To require the business associate to comply with HIPAA Privacy and Security Rules. A BAA ensures that business associates handling PHI will appropriately safeguard the information.

Answer

To transfer ownership of PHI to the business associate

Answer

To authorize the use of PHI for marketing purposes

Answer

To allow the business associate to disclose PHI to any third party

Question 9

In a Privileged Access Management (PAM) solution, which feature provides temporary elevation of privileges for specific tasks, reducing the risk of standing privileges?

Accepted Answer

Just-in-time (JIT) access. Just-in-time (JIT) access grants privileges only when needed, reducing the attack surface from permanent privileged accounts.

Answer

Password vaulting

Answer

Break-glass account

Answer

Session recording

Question 10

An organization has identified a risk with a high likelihood and high impact. Management decides to implement controls to reduce the likelihood. After controls, the risk is reassessed as medium likelihood and medium impact. What is the residual risk?

Accepted Answer

Medium likelihood, medium impact. Residual risk is the remaining risk after controls are applied. In this case, it is the medium likelihood and medium impact risk.

Answer

Low likelihood, low impact

Answer

High likelihood, high impact

Answer

Control risk is not a defined term

Question 11

Which type of digital forensics involves capturing and analyzing network traffic to investigate a security incident?

Accepted Answer

Network forensics. Network forensics focuses on monitoring and analyzing network traffic for evidence.

Answer

Media analysis

Answer

Log analysis

Answer

Memory forensics

Question 12

A company uses Docker containers for microservices. What is the most important security measure for container images?

Accepted Answer

Use minimal base images and scan them for vulnerabilities. Minimal base images reduce attack surface, and vulnerability scanning detects known issues. Option B is wrong because using 'latest' tags can cause inconsistent builds. Option C is wrong because hardcoding secrets is never recommended. Option D is wrong because running as root is insecure.

Answer

Use the latest version of base image to ensure patches

Answer

Hardcode secrets into the image

Answer

Run containers as root for easier privilege management

Question 13

During a penetration test, the tester gains initial access to a server and then attempts to pivot to other systems. Which phase of the penetration testing process does this represent?

Accepted Answer

Post-exploitation/lateral movement. Post-exploitation/lateral movement involves leveraging initial access to move within the network.

Answer

Reconnaissance

Answer

Exploitation

Answer

Reporting

Question 14

Which physical security concept uses natural surveillance, territorial reinforcement, and access control to deter crime in built environments?

Accepted Answer

CPTED. Crime Prevention Through Environmental Design (CPTED) uses design principles to reduce crime opportunities.

Answer

TEMPEST

Answer

Faraday cage

Answer

Defense in depth

Question 15

An organization wants to ensure that its critical database can be restored to a point within the last 15 minutes in case of failure. Which metric defines this requirement?

Accepted Answer

RPO. RPO (Recovery Point Objective) defines the acceptable data loss in terms of time.

Answer

MTD

Answer

MTTR

Answer

RTO