CISSP Practice Test 37 — 15 Questions

Question 1

An organization wants to ensure that its web application is secure by analyzing the source code for vulnerabilities without executing the code. Which type of testing is most appropriate?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) analyzes source code, bytecode, or binaries without executing the application, making it the only option that matches the requirement of reviewing code for vulnerabilities in a non-running state. SAST tools perform data-flow and control-flow analysis to detect issues like SQL injection, buffer overflows, and hardcoded secrets directly in the codebase. Because it operates pre-execution, it can be integrated early in the SDLC (shift-left) and pinpoint the exact file and line of a flaw.

Answer

Interactive Application Security Testing (IAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Runtime Application Self-Protection (RASP)

Question 2

A company is implementing PCI DSS compliance. Which THREE requirements are part of the PCI DSS? (Select THREE)

Accepted Answer

Encrypt transmission of cardholder data across open, public networks. Option C is correct because PCI DSS Requirement 4 mandates protecting cardholder data with strong cryptography during transmission over open, public networks such as the internet. Option D is correct because PCI DSS Requirement 9 requires restricting physical access to cardholder data and systems that store, process, or transmit it. Option E is correct because PCI DSS Requirement 1 requires installing and maintaining firewall and router configurations to protect cardholder data, including controlling traffic between trusted and untrusted networks. Option A is not a standalone PCI DSS requirement as phrased, since the standard addresses encryption of stored data under Requirement 3 but does not simply state 'use only approved encryption algorithms' as a requirement. Option B is not a PCI DSS requirement for all employees; MFA is required for remote access and certain non-console administrative access, not universally for every employee.

Answer

Use only approved encryption algorithms for stored data

Answer

Implement multi-factor authentication for all employees

Question 3

An organization is implementing a new access control system. They want to ensure that users are who they claim to be, that actions can be traced to individuals, and that access rights are managed appropriately. Which framework encompasses all three of these goals?

Accepted Answer

AAA framework. The AAA framework directly addresses the three stated goals: Authentication verifies that users are who they claim to be, Authorization determines what resources they can access and manages their rights, and Accounting (or Auditing) ensures that actions can be traced back to individuals through logging and auditing. This triad of functions is the foundational model for access control in information security, making it the exact match for the question's requirements.

Answer

COBIT 2019

Answer

CIA triad

Answer

ISO/IEC 27001

Question 4

Which THREE of the following are valid types of penetration testing based on the level of knowledge provided to the tester?

Accepted Answer

White box. The three valid penetration-testing types classified by the tester's level of knowledge are White box (B), Grey box (C), and Black box (D). White box testing gives the tester full knowledge of the target, including source code, architecture, and credentials, making it the highest-knowledge category. Grey box testing provides partial knowledge, such as limited documentation or user-level credentials, simulating an insider with some access. Black box testing provides no prior knowledge of the target, simulating an external attacker who must perform reconnaissance. Blue box (A) and Red box (E) are not standard knowledge-based penetration-testing classifications; 'blue team' and 'red team' refer to defensive and offensive roles, not levels of tester knowledge.

Answer

Blue box

Answer

Red box

Question 5

A company uses a cloud storage service. Which asset security control is most important to prevent unauthorized access to data?

Accepted Answer

Encryption in transit and at rest. Encryption in transit (e.g., TLS 1.3) and at rest (e.g., AES-256) is the most important asset security control because it renders data unreadable even if the cloud storage service is compromised or an attacker gains access to the underlying infrastructure. Without encryption, all other controls (logging, reviews, scanning) are reactive and cannot prevent a direct breach of the stored data. This aligns with the CISSP principle of defense in depth, where encryption provides a strong preventive layer for data confidentiality.

Answer

Logging and monitoring

Answer

Periodic access reviews

Answer

Regular vulnerability scanning

Question 6

Which type of SOC report provides a public summary of an organization's controls over security, availability, and confidentiality?

Accepted Answer

SOC 3. SOC 3 reports are designed for public distribution and summarize the findings of a SOC 2 engagement.

Answer

SOC 2 Type II

Answer

SOC 1

Answer

SOC 2 Type I

Question 7

A company is implementing a CI/CD pipeline for a web application. Which security testing method should be integrated into the build stage to catch vulnerabilities early?

Accepted Answer

Static Application Security Testing (SAST) in the build stage. Static Application Security Testing (SAST) analyzes source code without execution, making it suitable for early detection in the build stage of a CI/CD pipeline. Option A is incorrect because open-source vulnerability scanners may not cover custom code and can produce false positives. Option B is incorrect because Dynamic Application Security Testing (DAST) requires a running application and is typically performed in later stages. Option C is incorrect because manual code review is too slow and resource-intensive for continuous integration, while automated SAST fits the speed of CI/CD.

Answer

Only using open-source vulnerability scanners

Answer

Dynamic Application Security Testing (DAST) in the production stage

Answer

Manual code review after each sprint

Question 8

A developer is implementing role-based access control (RBAC). Which THREE components are essential for an RBAC system?

Accepted Answer

Permissions. Permissions are essential in RBAC because they define the actual access rights (e.g., read, write, execute) that are assigned to roles, not directly to users. Without permissions, roles would have no functional authority, and the RBAC model (as defined in NIST SP 800-53 and ANSI INCITS 359) would be unable to enforce any access control decisions. Permissions are the bridge between roles and resources, making them a core component.

Answer

Attributes

Answer

Sessions

Question 9

An organization is planning a penetration test of its internal network. The test team has been given network diagrams, source code access, and administrative credentials. This type of testing is known as:

Accepted Answer

White-box testing. White-box testing (also known as clear-box or structural testing) is characterized by the test team having full knowledge of the internal system architecture, including network diagrams, source code, and administrative credentials. This level of access allows testers to perform a thorough analysis of the application logic, configuration weaknesses, and potential backdoors that would be invisible in a black-box approach. The scenario explicitly states the team was given these artifacts, making white-box testing the correct classification.

Answer

Black-box testing

Answer

Red team testing

Answer

Gray-box testing

Question 10

A security manager is tasked with classifying data based on its sensitivity. Which of the following is the PRIMARY reason for data classification?

Accepted Answer

To ensure appropriate protection measures are applied to data based on its value and sensitivity.. Data classification is the foundational process of assigning a sensitivity label (e.g., Public, Internal, Confidential, Restricted) to information assets. The primary reason is to ensure that appropriate security controls—such as encryption, access control lists (ACLs), and data loss prevention (DLP) policies—are applied proportionally to the data's value and sensitivity, aligning with the principle of defense in depth and risk management.

Answer

To satisfy regulatory requirements for data retention.

Answer

To facilitate data sharing across departments without restrictions.

Answer

To simplify the process of granting access to users.

Question 11

Refer to the exhibit. A SAML response is received by the service provider. Which security issue is present?

Accepted Answer

The assertion is not signed. The SAML response shown in the exhibit lacks a digital signature on the assertion itself. Without the assertion being signed, a man-in-the-middle attacker could modify the assertion content (e.g., change the user identifier or attributes) after the response leaves the identity provider but before it reaches the service provider. SAML Core specification (OASIS SAML 2.0) requires that either the entire response or the individual assertion be signed to ensure integrity and non-repudiation; here, neither is signed, making the assertion vulnerable to tampering.

Answer

The NameID format is incorrect

Answer

The validity window is too short

Answer

The subject confirmation method is insecure

Question 12

An organization requires a security assessment that evaluates controls against a specific standard and results in a formal report. The organization is not required to exploit vulnerabilities. Which type of assessment is this?

Accepted Answer

Security audit. A security audit is a formal, independent evaluation of controls against a predefined standard (e.g., ISO 27001, PCI DSS) that produces a formal report. Unlike other assessments, it does not require exploiting vulnerabilities; it focuses on verifying compliance through evidence collection and testing. This matches the question's requirement for a standard-based evaluation with a formal report and no exploitation.

Answer

Vulnerability assessment

Answer

Penetration test

Answer

Security review

Question 13

A cloud storage bucket access policy grants all principals permission to write objects. What is the primary security risk of this policy?

Accepted Answer

It allows any IP to write objects. The primary security risk is that the policy allows any IP to write objects. Public write access can enable unauthorized data modification, upload of malicious content, storage abuse, and potential data breaches. Public read access is also risky, but write access is more dangerous because it permits altering or injecting data.

Answer

It only allows read from a specific IP

Answer

It allows public read access to all objects

Answer

It denies all access

Question 14

A company develops a web application using microservices architecture deployed on Kubernetes. The security team identifies that the application is vulnerable to injection attacks because user input is concatenated into SQL queries. The development team wants to implement a fix quickly. They propose using parameterized queries, but the database access layer currently uses stored procedures. The team considers modifying the stored procedures to accept parameters and using prepared statements in the code. However, the operations team is concerned about performance impact. Which of the following is the BEST course of action?

Accepted Answer

Implement both parameterized queries and modify stored procedures to use parameters, and then monitor performance.. The best course is to implement both parameterized queries in the application and modify stored procedures to accept parameters, then monitor performance. This defense-in-depth approach ensures that all database access paths are protected against SQL injection, while the monitoring step addresses the operations team's performance concerns with empirical data rather than speculation.

Answer

Use parameterized queries immediately without modifying stored procedures.

Answer

Modify stored procedures to use dynamic SQL with input validation.

Answer

Use input validation only, as stored procedures inherently prevent injection.

Question 15

In a zero trust architecture, which component is responsible for continuously verifying the trustworthiness of a device before granting access to resources?

Accepted Answer

Policy Decision Point (PDP). In a zero trust architecture, the Policy Decision Point (PDP) is the component that evaluates all available telemetry and contextual data—such as device posture, user identity, and behavioral analytics—to make a real-time trust decision. It continuously verifies device trustworthiness by applying dynamic policies (e.g., checking for up-to-date patches, compliance with security baselines, or absence of malware) before granting or denying access to resources. This aligns with the NIST SP 800-207 zero trust model, where the PDP is the logical brain that computes trust levels and issues authorization decisions.

Answer

Policy Enforcement Point (PEP)

Answer

Identity Provider (IdP)

Answer

Policy Administrator (PA)