CISSP Practice Test 36 — 15 Questions

Question 1

Which protocol is specifically designed for authorization and not authentication, often using grant types like authorization code and client credentials?

Accepted Answer

OAuth 2.0. OAuth 2.0 is an authorization framework that provides delegated access; it does not authenticate the user.

Answer

SAML 2.0

Answer

OpenID Connect

Answer

Kerberos

Question 2

What is the primary purpose of a Web Application Firewall (WAF) in a deployment environment?

Accepted Answer

Filtering malicious HTTP traffic. A WAF filters, monitors, and blocks HTTP traffic to and from a web application. It helps protect against common web attacks like SQL injection, XSS, and CSRF by analyzing traffic at the application layer.

Answer

Encrypting all web traffic

Answer

Managing user authentication

Answer

Performing vulnerability scanning

Question 3

A company wants to ensure that only authorized software can run on its laptops. They decide to use a hardware component that validates the boot process by measuring each component before it loads. Which technology is being used?

Accepted Answer

Trusted Platform Module (TPM). TPM (Trusted Platform Module) enables measured boot, where the TPM stores measurements of boot components and verifies their integrity.

Answer

Trusted Execution Environment (TEE)

Answer

Security Kernel

Answer

Hypervisor

Question 4

Which access control model allows data owners to grant or revoke access to resources they own, typically implemented using ACLs?

Accepted Answer

DAC. DAC (Discretionary Access Control) enables owners to control access to their resources, commonly via ACLs.

Answer

MAC

Answer

RBAC

Answer

ABAC

Question 5

Which of the following is the correct order of priority for the ISC2 Code of Ethics Canons?

Accepted Answer

Protect society, act honorably, provide diligent service, advance the profession. The canons in order: 1. Protect society, the common good, and the public trust. 2. Act honorably, honestly, justly, responsibly, and legally. 3. Provide diligent and competent service to principals. 4. Advance and protect the profession.

Answer

Advance the profession, protect society, act honorably, provide diligent service

Answer

Provide diligent service, protect society, act honorably, advance the profession

Answer

Act honorably, provide diligent service, protect society, advance the profession

Question 6

A security engineer is analyzing a vulnerability where an attacker can cause a buffer overflow on the stack. Which mitigation technique randomizes memory addresses to make it harder for the attacker to predict the location of shellcode or return addresses?

Accepted Answer

ASLR. ASLR (Address Space Layout Randomization) randomizes the base addresses of stack, heap, and libraries, making it difficult for an attacker to guess memory addresses.

Answer

SafeSEH

Answer

Stack canaries

Answer

DEP/NX bit

Question 7

An organization is conducting a Business Impact Analysis (BIA) as part of its business continuity planning. Which THREE of the following are essential components of a BIA? (Choose three.)

Accepted Answer

Criticality prioritization. The correct options are A, B, and E. Recovery Time Objective (RTO) defines the target time to resume operations; Maximum Tolerable Downtime (MTD) defines the total allowable downtime; Criticality prioritization ranks processes by importance. Option C (Mean Time Between Failures) is a reliability metric, not used in BIA. Option D (Single point of failure identification) is part of vulnerability assessment, not a direct component of BIA.

Answer

Mean Time Between Failures (MTBF)

Answer

Single point of failure identification

Question 8

During a threat modeling session for a new online banking application, the team uses the STRIDE methodology. Which threat category addresses the risk of an attacker modifying transaction data in transit?

Accepted Answer

Tampering. Tampering refers to the malicious modification of data. STRIDE's 'T' stands for Tampering.

Answer

Information Disclosure

Answer

Elevation of Privilege

Answer

Spoofing

Question 9

In a qualitative risk assessment, a risk with a likelihood rating of 'High' and an impact rating of 'Critical' would typically fall into which category?

Accepted Answer

High risk. In a typical 5x5 risk matrix, high likelihood and critical impact place the risk in the 'High' or 'Extreme' risk category, requiring immediate action.

Answer

Medium risk

Answer

Low risk

Answer

De minimis risk

Question 10

A business continuity plan (BCP) differs from a disaster recovery plan (DRP) in that the BCP primarily focuses on:

Accepted Answer

Maintaining critical business processes during a disruption. BCP aims to maintain business functions during and after a disruption, while DRP focuses on IT restoration.

Answer

Securing physical facilities

Answer

Restoring IT systems and infrastructure

Answer

Replacing hardware and software

Question 11

An organization wants to avoid a particular risk entirely by not engaging in the activity that creates the risk. Which risk response strategy is being used?

Accepted Answer

Avoid. Risk avoidance involves eliminating the risk by not performing the activity that causes it. Transfer shifts risk to a third party, mitigate reduces impact/likelihood, and accept acknowledges the risk.

Answer

Transfer

Answer

Mitigate

Answer

Accept

Question 12

An organization's security operations center (SOC) uses a SIEM to correlate logs. The SOC manager wants to automate response actions for low-severity alerts. Which technology would best support this goal?

Accepted Answer

SOAR platform. SOAR (Security Orchestration, Automation and Response) enables automated playbooks for incident response.

Answer

Network firewall

Answer

Threat intelligence platform

Answer

Vulnerability scanner

Question 13

In SAML 2.0, which component is responsible for authenticating the user and generating an assertion?

Accepted Answer

Identity Provider (IdP). The Identity Provider (IdP) authenticates users and creates assertions containing authentication/attribute/authorization data.

Answer

Service Provider (SP)

Answer

Certificate Authority (CA)

Answer

Relying Party (RP)

Question 14

Which phase of the data lifecycle includes the act of securely deleting data that is no longer needed, in accordance with retention policies?

Accepted Answer

Destroy. The destroy phase involves secure disposal of data when it is no longer required, often through purging or destruction.

Answer

Store

Answer

Share

Answer