CISSP Practice Test 35 — 15 Questions

Question 1

A small business wants to ensure compliance with GDPR for its customer data. What is the initial action required to comply with GDPR?

Accepted Answer

Map data flows and identify personal data. The initial action for GDPR compliance is to map data flows and identify what personal data the organization collects, where it resides, how it flows, and who has access. Without this data inventory and mapping, an organization cannot determine lawful basis, apply appropriate controls, or conduct a DPIA. Data mapping is the foundational step that informs all subsequent compliance activities.

Answer

Obtain consent from all data subjects

Answer

Implement pseudonymization techniques

Answer

Conduct a Data Protection Impact Assessment (DPIA)

Question 2

A security architect is implementing a system that must prevent conflicts of interest for a consulting firm serving competing clients. Which security model is best suited for this requirement?

Accepted Answer

Brewer-Nash. The Brewer-Nash model (also called the Chinese Wall model) is specifically designed to prevent conflicts of interest by dynamically restricting access based on what a subject has already accessed. Once a consultant accesses data from one competing client, they are blocked from accessing data about that client's competitors. This dynamic, history-based access control is exactly what the scenario requires.

Answer

Take-Grant

Answer

Clark-Wilson

Answer

Graham-Denning

Question 3

An attacker who has compromised the Kerberos Key Distribution Center (KDC) could forge a Ticket Granting Ticket (TGT) to impersonate any user. This type of attack is known as:

Accepted Answer

Golden ticket attack. A Golden Ticket attack involves compromising the Kerberos Key Distribution Center (KDC), specifically the KRBTGT account's password hash. With this hash, an attacker can forge a legitimate Ticket Granting Ticket (TGT) that grants access to any service or resource in the domain, effectively impersonating any user. This is possible because the KRBTGT account is used to sign all TGTs, and its compromise allows the attacker to mint arbitrary TGTs. The attack is called 'Golden' because it grants unlimited access, akin to having a master key to the domain.

Answer

Silver ticket attack

Answer

Pass-the-ticket attack

Answer

Kerberos poisoning attack

Question 4

An organization is developing an incident response plan. Which component is primarily responsible for defining the criteria for escalating an incident to senior management and legal counsel?

Accepted Answer

Escalation paths. Escalation paths define the criteria, thresholds, and chain of command for moving an incident to higher authority, including when senior management and legal counsel must be engaged. They specify who is notified, under what conditions, and in what timeframe, which is exactly the component that governs escalation to executives and legal. This makes escalation paths the primary owner of that decision logic within the IR plan.

Answer

Communication plan

Answer

Recovery procedures

Answer

Incident categories

Question 5

A database administrator (DBA) is responsible for implementing access controls and backup procedures for a customer database containing PII. The DBA reports to the data owner regarding security measures. Which role best describes the DBA's responsibilities?

Accepted Answer

Data custodian. A data custodian is the role responsible for the day-to-day operational handling of data, including implementing access controls, backups, and technical safeguards, while acting under the direction of the data owner. The DBA in this scenario performs exactly these operational duties and reports to the data owner, which matches the custodian role. The data owner retains ultimate accountability and sets policy, while the custodian executes it.

Answer

Data steward

Answer

Data owner

Answer

Data processor

Question 6

A security team is investigating a vulnerability where an attacker can intercept and modify data as it moves between processes within a CPU's secure enclave. Which technology is designed to protect against such attacks by creating a trusted execution environment?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel SGX creates a trusted execution environment (enclave) inside the CPU that isolates code and data from the rest of the system, including the OS and hypervisor, protecting against interception and modification of data in use. It encrypts enclave memory and enforces access controls at the hardware level, which directly addresses intra-CPU tampering between processes. This is why SGX is the correct answer for protecting data within a secure enclave.

Answer

Trusted Platform Module (TPM)

Answer

Measured Boot

Answer

Secure Boot

Question 7

A security architect is reviewing a design for an e-commerce application. The architect recommends implementing defense in depth. Which of the following is an example of this principle?

Accepted Answer

Implementing both a web application firewall (WAF) and input validation. Defense in depth layers multiple independent controls so that failure of one does not compromise the system. A WAF filters malicious HTTP traffic at the application layer, while input validation rejects malformed or malicious data at the code layer; together they provide overlapping protections against injection and web attacks. This is a textbook example of layered, complementary controls.

Answer

Encrypting data at rest only

Answer

Using a single firewall at the network perimeter

Answer

Requiring strong passwords for all users

Question 8

During a SOC 2 audit, the auditor evaluates controls over a period of time to assess their operating effectiveness. Which type of SOC report is being performed?

Accepted Answer

SOC 2 Type II. A SOC 2 Type II report evaluates the operating effectiveness of controls over a period of time (typically 3–12 months), which is exactly what the auditor is doing here. Type II includes testing of control activities across the audit period, unlike Type I which only assesses design at a point in time.

Answer

SOC 1 Type I

Answer

SOC 3

Answer

SOC 2 Type I

Question 9

Which TWO of the following are examples of non-repudiation controls? (Select two)

Accepted Answer

Audit logs with timestamps. Audit logs with timestamps (C) are a non-repudiation control because they create a tamper-evident, time-stamped record of who did what and when, so a user cannot later credibly deny having performed an action. Digital signatures (D) provide non-repudiation by cryptographically binding a signer's private key to the message, allowing any party to verify origin and integrity and preventing the signer from denying the signature. Firewall rules (A) are a network access control that filters traffic, not a mechanism for proving an action occurred. Encryption of data at rest (B) provides confidentiality, not proof of origin or action. Biometric authentication (E) provides strong authentication (something you are) but by itself does not prevent a user from denying an action after authentication.

Answer

Firewall rules

Answer

Encryption of data at rest

Answer

Biometric authentication

Question 10

Which TWO of the following are examples of Type 3 authentication factors? (Choose two.)

Accepted Answer

Fingerprint. Type 3 authentication factors are "something you are" — biometric characteristics unique to an individual — so B (Fingerprint) is correct because a fingerprint is a physical biometric trait verified by matching minutiae patterns, and E (Retina scan) is correct because it analyzes the unique blood-vessel pattern of the retina, another physiological biometric. The remaining options are not Type 3: A (Password) is a Type 1 factor (something you know), while C (Smart card) and D (One-time password token) are Type 2 factors (something you have), since they rely on possession of a physical device or generated token rather than an inherent biological trait.

Answer

Password

Answer

Smart card

Answer

One-time password token

Question 11

An organization is implementing a Privileged Access Management (PAM) solution. Which THREE of the following are common features of PAM? (Select THREE.)

Accepted Answer

Password vaulting. Password vaulting (B) is a core PAM capability because it stores privileged credentials in an encrypted repository and checks them out to authorized users, removing the need to expose or memorize administrative passwords. Session recording (C) is also a standard PAM feature, as it captures privileged sessions (often via RDP, SSH, or database proxies) for auditing, forensics, and compliance evidence. Just-in-time access (D) is a hallmark of modern PAM because it grants elevated privileges only for a limited time and revokes them automatically, reducing standing administrative rights and the attack surface. Single sign-on (A) and role-based access control (E) are identity and access management concepts that may integrate with PAM, but they are not defining PAM features in the same way as vaulting, session recording, and just-in-time elevation.

Answer

Single sign-on

Answer

Role-based access control

Question 12

A security engineer is hardening a web application against race condition vulnerabilities. Which TWO techniques are effective mitigations?

Accepted Answer

Implementing file locking. Implementing file locking (C) is correct because race conditions arise when concurrent processes access shared resources such as files without synchronization; advisory or mandatory locks (e.g., flock, fcntl) serialize access so one process completes its read-modify-write before another proceeds. Use of atomic transactions (E) is correct because database or filesystem transactions with ACID properties (BEGIN/COMMIT, row-level locking, SELECT ... FOR UPDATE) ensure that check-then-act sequences execute indivisibly, preventing time-of-check-to-time-of-use (TOCTOU) interleavings. Enabling ASLR (A) only randomizes memory layout to hinder exploitation of memory-corruption bugs, not to prevent logical race conditions. Input validation (B) filters malformed or malicious data but does not coordinate concurrent access to shared state. Using prepared statements (D) parameterizes SQL to stop injection attacks, which is unrelated to synchronizing concurrent operations.

Answer

Enabling ASLR

Answer

Input validation

Answer

Using prepared statements

Question 13

A company is deploying a hypervisor to run multiple virtual servers. To minimize the risk of VM escape attacks, which type of hypervisor should they choose and what hardening measure is most effective?

Accepted Answer

Type 1 hypervisor with minimal services and regular patching. A Type 1 (bare-metal) hypervisor runs directly on the hardware with a much smaller attack surface than a Type 2 hypervisor, which sits atop a general-purpose host OS full of exploitable services. Minimizing installed services and applying regular patches further shrinks the attack surface and closes known VM-escape vulnerabilities. Together, these are the most effective mitigations for VM escape risk.

Answer

Type 2 hypervisor with regular patching

Answer

Type 2 hypervisor with host-based firewall

Answer

Type 1 hypervisor with no additional hardening

Question 14

An organization wants to implement a security mechanism that ensures all accesses are mediated and cannot be bypassed, is tamperproof, and is small enough to be verified. This describes which concept?

Accepted Answer

Reference Monitor. A reference monitor is the abstract security concept that enforces access control by mediating every access request between subjects and objects, is tamperproof, and is small enough to be verified. These three properties — complete mediation, tamperproofness, and verifiability — are the defining characteristics of a reference monitor as described in the Orange Book (TCSEC). It is the conceptual model that a security kernel implements in hardware and software.

Answer

Trusted Computing Base (TCB)

Answer

Trusted Platform Module (TPM)

Answer

Security Kernel

Question 15

An organization is implementing a new governance framework to align IT with business goals. Which framework is specifically designed for IT service management?

Accepted Answer

ITIL. ITIL (Information Technology Infrastructure Library) is the framework specifically designed for IT service management (ITSM), providing best practices for service strategy, design, transition, operation, and continual improvement. It focuses on aligning IT services with business needs through processes like incident, problem, change, and service-level management. COBIT is a governance framework, ISO/IEC 27001 is an information security management standard, and NIST CSF is a cybersecurity framework — none are ITSM-specific.

Answer

ISO/IEC 27001

Answer

COBIT 2019

Answer

NIST Cybersecurity Framework