CISSP Practice Test 37 — 15 Questions

Question 1

In qualitative risk analysis, a risk is assessed with a likelihood of 4 (on a scale of 1-5) and an impact of 5. The risk matrix defines scores of 15-25 as high. What is the risk rating?

Accepted Answer

High. Likelihood × Impact = 4 × 5 = 20, which falls in the high range (15-25).

Answer

Low

Answer

Medium

Answer

Critical

Question 2

Which of the following is the PRIMARY goal of a Business Impact Analysis (BIA) in business continuity planning?

Accepted Answer

To determine the maximum acceptable outage for each process. The BIA identifies critical business processes and their recovery requirements, such as RTO and RPO.

Answer

To test the disaster recovery plan

Answer

To assign roles and responsibilities during a disaster

Answer

To select a hot site vendor

Question 3

A security architect is designing a physical security perimeter for a data center. Which of the following is an example of Crime Prevention Through Environmental Design (CPTED) principle?

Accepted Answer

Designing the landscape to provide clear sightlines from the guard post. CPTED uses natural surveillance, access control, and territorial reinforcement. Clear sightlines allow monitoring and deter crime.

Answer

Using high fences with barbed wire around the facility

Answer

Deploying motion sensors and CCTV cameras

Answer

Installing biometric locks on all server room doors

Question 4

Which component of the CIA triad ensures that information is not disclosed to unauthorized individuals, entities, or processes?

Accepted Answer

Confidentiality. Confidentiality ensures that information is accessible only to those authorized. Integrity ensures accuracy and completeness, and availability ensures timely access.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 5

A security architect is designing a system that must prevent conflicts of interest when a consultant works for two competing clients. Which security model ensures that the consultant cannot access data from one client if they have already accessed data from the other?

Accepted Answer

Brewer-Nash. Brewer-Nash (Chinese Wall) model prevents conflict of interest by dynamically adjusting access based on previously accessed datasets.

Answer

Clark-Wilson

Answer

Biba

Answer

Bell-LaPadula

Question 6

Which of the following metrics is used to determine the maximum amount of data loss an organization can tolerate in a disaster?

Accepted Answer

RPO. RPO defines the acceptable data loss in terms of time.

Answer

MTTR

Answer

RTO

Answer

MTD

Question 7

Which access control model bases decisions on attributes of the user, resource, and environment, and can use Boolean logic to define policies?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) uses attributes and policies to grant access, offering fine-grained control.

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Question 8

An organization's data loss prevention (DLP) solution is configured to block emails containing credit card numbers. This is an example of which type of DLP control?

Accepted Answer

Network DLP. Network DLP monitors and controls data in motion, such as email traffic.

Answer

Classification-based DLP

Answer

Cloud DLP

Answer

Endpoint DLP

Question 9

A company is implementing a hot site as a disaster recovery option. Which of the following best describes a hot site?

Accepted Answer

A facility that is fully configured and ready to operate within hours. A hot site is a fully equipped backup facility that is ready to take over operations immediately, including hardware, software, and data synchronization.

Answer

A facility with basic infrastructure but no equipment

Answer

A reciprocal agreement with another company to share space

Answer

A facility with some equipment but not fully operational

Question 10

A SOC team is using a SIEM to correlate events from multiple sources. They want to automate responses to common threats. Which technology should they integrate to achieve security orchestration and automation?

Accepted Answer

SOAR. SOAR tools automate and orchestrate security responses, integrating with SIEM.

Answer

Vulnerability scanner

Answer

Endpoint detection and response (EDR)

Answer

Network-based IDS

Question 11

Which document provides detailed step-by-step instructions for performing a specific security task?

Accepted Answer

Procedure. A procedure is a detailed, step-by-step document that describes how to perform a task.

Answer

Policy

Answer

Standard

Answer

Guideline

Question 12

A company has a data retention policy requiring customer transaction records to be kept for 7 years. After 7 years, the data should be destroyed. Which phase of the data lifecycle governs this action?

Accepted Answer

Destroy. The destroy phase is where data is permanently removed according to retention policies.

Answer

Use

Answer

Share

Answer