CISSP Practice Test 35 — 15 Questions

Question 1

During a risk communication session, the security team needs to present risk analysis results to executive management. Which approach is most effective for this audience?

Accepted Answer

A high-level summary highlighting top risks and recommended actions. Executive management requires concise, strategic summaries that highlight key risks and actionable recommendations, focusing on business impact rather than technical details. Option B is incorrect because raw data lacks interpretation, making it difficult for executives to quickly understand implications. Option C is incorrect as a comprehensive report with all register entries is too lengthy for this audience. Option D is incorrect because detailed technical explanations are better suited for technical teams, not executives.

Answer

Raw data from the risk assessment without interpretation

Answer

A comprehensive report with all risk register entries

Answer

Detailed technical explanations of each vulnerability

Question 2

Under the GDPR, a data controller experiences a personal data breach that is likely to result in a risk to the rights and freedoms of individuals. What is the maximum time frame within which the controller must notify the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to rights and freedoms.

Answer

24 hours

Answer

48 hours

Answer

7 days

Question 3

In LDAP, which attribute uniquely identifies an entry within the directory information tree?

Accepted Answer

Distinguished Name (DN). The Distinguished Name (DN) uniquely identifies each entry in the LDAP directory tree.

Answer

Relative Distinguished Name (RDN)

Answer

Organizational Unit (OU)

Answer

Common Name (CN)

Question 4

A cloud service provider uses a Type 1 hypervisor to host multiple virtual machines (VMs) for different customers. Which of the following is a primary security concern specific to this architecture?

Accepted Answer

Virtual machine escape from one guest to the hypervisor or other guests. A VM escape attack occurs when an attacker breaks out of a VM to access the hypervisor or other VMs. This is a critical risk in multi-tenant environments.

Answer

Inability to patch the hypervisor without downtime

Answer

Performance degradation due to resource sharing

Answer

Lack of support for legacy operating systems

Question 5

A security analyst is reviewing logs from multiple systems and needs to ensure that logs are tamper-proof and available for incident investigation. Which of the following is the BEST approach?

Accepted Answer

Centralize logs to a syslog server with cryptographic hashing and append-only access. Centralized log management with write-once, read-many (WORM) storage ensures log integrity and availability for investigation.

Answer

Use a cloud storage bucket with public read access

Answer

Store logs locally on each system with restricted permissions

Answer

Encrypt logs at the source and send via email to the security team

Question 6

In Kerberos authentication, what is the purpose of the Ticket Granting Ticket (TGT)?

Accepted Answer

To prove the user's identity to the Ticket Granting Service (TGS). The TGT is obtained from the AS and used to request service tickets from the TGS without re-entering credentials.

Answer

To store the user's password hash

Answer

To encrypt all communication between client and server

Answer

To authenticate the user to the resource server directly

Question 7

Which of the following is a lightweight directory access protocol used for accessing and maintaining distributed directory information?

Accepted Answer

LDAP. LDAP (Lightweight Directory Access Protocol) is used for directory services.

Answer

OAuth

Answer

Kerberos

Answer

SAML

Question 8

Which role is ultimately accountable for the classification of data within an organization?

Accepted Answer

Data owner. The data owner is the senior-level person who has the authority and accountability for data classification and protection.

Answer

Data steward

Answer

Data custodian

Answer

Data processor

Question 9

An organization is recovering from a ransomware attack that encrypted critical servers. The backup strategy must ensure that the Recovery Point Objective (RPO) of 1 hour is met. Which backup method is MOST appropriate?

Accepted Answer

Continuous data protection (CDP). Continuous data protection (CDP) captures changes in real time, meeting a 1-hour RPO.

Answer

Daily full backups

Answer

Weekly full backups with daily differentials

Answer

Snapshot every 4 hours

Question 10

An organization uses a configuration management database (CMDB). Which of the following is the PRIMARY purpose of a CMDB?

Accepted Answer

Record asset relationships and configurations. A CMDB stores information about hardware and software assets and their relationships, aiding in configuration management and change impact analysis.

Answer

Manage user passwords

Answer

Monitor network performance

Answer

Track software licenses

Question 11

Which physical security design principle emphasizes that the physical environment should be designed to discourage criminal activity by using natural surveillance, access control, and territorial reinforcement?

Accepted Answer

CPTED. CPTED (Crime Prevention Through Environmental Design) uses architectural features to reduce crime.

Answer

TEMPEST

Answer

Fail-safe

Answer

Layered defense

Question 12

Which access control model allows the owner of a resource to grant or deny access to other users?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) enables resource owners to control access.

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 13

What is the primary purpose of a Change Advisory Board (CAB) in change management?

Accepted Answer

To approve and oversee changes to IT systems. The CAB reviews and approves changes to ensure they are properly assessed and minimize risk.

Answer

To conduct vulnerability assessments

Answer

To implement changes in the IT environment

Answer

To respond to security incidents

Question 14

An organization is designing its incident response team roles. Which role is primarily responsible for collecting and preserving evidence for legal proceedings?

Accepted Answer

Forensic investigator. The forensic investigator is trained to handle evidence collection and preservation.

Answer

Communications lead

Answer

Incident manager

Answer

Security analyst

Question 15

Which of the following is a key difference between a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP)?

Accepted Answer

BCP ensures continuity of business operations; DRP restores IT infrastructure. BCP focuses on maintaining business functions during/after a disaster, while DRP focuses on restoring IT systems.

Answer

BCP only addresses natural disasters; DRP addresses all disasters

Answer

BCP is tested annually; DRP is tested monthly

Answer

BCP focuses on IT restoration; DRP focuses on business processes