CISSP Practice Test 37 — 15 Questions

Question 1

Refer to the exhibit. Which of the following statements is correct regarding the connections and access-list?

Accepted Answer

The access-list 'outside_in' is not applied to any interface or is not the primary access-list governing inbound traffic.. The access-list 'outside_in' is applied to the outside interface for inbound traffic. However, the hit counts are all 0, meaning the access-list is not being hit. This suggests that the access-list is not applied to the interface, or the interface has another access-list that allows the traffic, or the connections are established through other means (like stateful inspection). The connections are active, so traffic is passing through the ASA. The access-list with 0 hits indicates it is not the mechanism allowing the traffic.

Answer

The access-list 'outside_in' is applied to the outside interface and is allowing the connections.

Answer

The UDP connection to 198.51.100.2:53 is being allowed by line 2 of the access-list.

Answer

The TCP connection to 203.0.113.5:443 is being denied by the implicit deny rule.

Question 2

Refer to the exhibit. A security administrator is reviewing CloudTrail logs for unusual activity. Which aspect of this event is potentially concerning from a key management perspective?

Accepted Answer

The user agent indicates the request came from AWS Signer using a customer-managed key, which may violate key usage policies.. The event shows a KMS Sign operation using a CMK. The user agent is 'signer.amazonaws.com', which is the AWS Signer service. AWS Signer typically uses its own managed keys. The use of a customer-managed key (CMK) by Signer could indicate that the key is being used outside of its intended purpose or policy, potentially violating key usage restrictions. Also, the source IP is from outside AWS (public IP) which might be unusual if the key is restricted to VPC endpoints.

Answer

The event is read-only and thus not a security concern.

Answer

The message type is DIGEST, which is unusual for signing.

Answer

The signing algorithm used is outdated.

Question 3

Refer to the exhibit. Which of the following is true regarding the wireless clients?

Accepted Answer

The client with MAC 66:77:88:99:aa:bb is using 802.1X authentication.. Client with MAC 00:11:22:33:44:55 is associated to WLAN 1 (Guest) which uses Open authentication. Client 66:77:88:99:aa:bb is associated to WLAN 2 (Corporate) which uses 802.1X. Client cc:dd:ee:ff:00:11 is associated to WLAN 1. Therefore, there are two clients on the Guest WLAN and one on the Corporate WLAN.

Answer

There is only one client on the Corporate WLAN.

Answer

The client with MAC cc:dd:ee:ff:00:11 is using 802.1X authentication.

Answer

All clients are using WPA2 encryption.

Question 4

Refer to the exhibit. An administrator reviews the logs on router1. Which statement describes the events?

Accepted Answer

Two different IP addresses attempted brute-force SSH authentication.. The logs show repeated failed SSH login attempts for the user 'admin' from two different IP addresses (192.0.2.100 and 198.51.100.50). Each IP made three attempts before the connection was closed (likely due to authentication failure threshold). This pattern indicates a brute-force attack on the SSH service.

Answer

The SSH service is disabled on router1.

Answer

A successful SSH login from 192.0.2.100 occurred.

Answer

The router is configured to allow unlimited SSH authentication attempts.

Question 5

Refer to the exhibit. Which of the following is true regarding the BGP routes received from neighbor 10.1.1.2?

Accepted Answer

All three routes are installed in the routing table.. The received routes include 10.10.0.0/16, 10.20.0.0/16, and 10.30.0.0/16. The route to 10.30.0.0/16 is originated from AS 65001 (AS path shows only 65001). The other routes have longer AS paths. The '>' symbol indicates the best path. All received routes are marked as best, meaning they are all installed in the routing table. The route to 10.30.0.0/16 has only one AS hop, so it is directly from AS 65001.

Answer

The route to 10.30.0.0/16 is filtered out by an inbound route-map.

Answer

The route to 10.20.0.0/16 is preferred over 10.10.0.0/16 due to shorter AS path.

Answer

The route to 10.30.0.0/16 has a local preference of 100.

Question 6

Refer to the exhibit. A system administrator reports that SSH public key authentication is failing for a non-root user. The user's public key is correctly placed in ~/.ssh/authorized_keys. Which PAM configuration issue is most likely causing the failure?

Accepted Answer

The pam_nologin.so module is required, which can deny access if /etc/nologin exists.. The PAM configuration includes 'auth required pam_nologin.so' before the system-auth include. The pam_nologin module checks for the existence of /etc/nologin file; if it exists, only root can login. Since PermitRootLogin is no, root cannot login either, so all logins are denied. This is a common misconfiguration. The issue is that pam_nologin is called before the authentication stack, and it denies all non-root logins if /etc/nologin exists.

Answer

PasswordAuthentication is set to no, which conflicts with PAM.

Answer

The pam_nologin.so module is listed twice.

Answer

The pam_securetty.so module is missing for non-root users.

Question 7

A large enterprise uses Active Directory for authentication. Several users report intermittent authentication failures when accessing internal web applications. The help desk confirms that the failures occur at random times and affect both new and existing users. The security team discovers that the system clocks on domain controllers are within acceptable limits, but some client workstations show time drift of up to 10 minutes. The Kerberos protocol is used for authentication. What is the most likely cause of the authentication failures, and what action should be taken?

Accepted Answer

Synchronize all client workstation clocks using a centralized NTP server. Kerberos authentication relies on synchronized clocks between clients and domain controllers, with a default maximum time skew tolerance of 5 minutes (RFC 4120). A client clock drift of up to 10 minutes exceeds this tolerance, causing intermittent authentication failures because Kerberos ticket requests are rejected as invalid or replay attacks. Synchronizing all client workstations to a centralized NTP server resolves the time skew and restores Kerberos authentication reliability.

Answer

Implement password complexity policies to reduce authentication errors

Answer

Enable NTLM fallback authentication for the web applications

Answer

Configure Kerberos ticket lifetimes to 24 hours to reduce sensitivity to time skew

Question 8

A financial services firm recently deployed a multi-factor authentication (MFA) solution for remote access to its trading platform. The MFA requires a one-time password (OTP) via a mobile app, in addition to a username and password. Since deployment, remote traders have complained that the authentication process takes too long, especially during market open hours. The help desk reports that many traders are accidentally locking their accounts due to multiple failed OTP attempts. The security team wants to maintain strong security but improve user experience. Which action should the security team take?

Accepted Answer

Implement risk-based adaptive MFA that prompts only when anomalous activity is detected. Option C is correct because risk-based adaptive MFA evaluates the context of each authentication request (e.g., location, device, time, behavior) and only triggers an OTP challenge when the risk score exceeds a threshold. This reduces friction for legitimate traders during peak hours while maintaining strong security against anomalous access attempts, directly addressing the complaint of slow authentication without weakening the overall security posture.

Answer

Reduce MFA to two factors by removing the OTP requirement

Answer

Remove MFA requirements during peak hours to improve performance

Answer

Extend the OTP validity window to 10 minutes to reduce time pressure

Question 9

A small company with 50 employees operates a flat network where all workstations, servers, and printers are on a single subnet without segmentation. The company recently suffered a ransomware outbreak that spread rapidly from an infected workstation to the file server and multiple other machines, causing significant downtime. The IT manager wants to redesign the network to contain future outbreaks and limit lateral movement. The budget is limited, and the environment uses a mixture of managed and unmanaged switches. Which course of action would BEST mitigate the risk of lateral spread while minimizing cost and complexity?

Accepted Answer

Implement VLANs with ACLs to separate departments and restrict traffic between them.. Implementing VLANs with ACLs segments the flat network into separate broadcast domains, preventing lateral movement by restricting traffic between departments at Layer 2. This directly contains ransomware propagation without requiring new hardware, as VLANs can be configured on existing managed switches, making it cost-effective. ACLs further enforce least-privilege access between VLANs, blocking unauthorized inter-VLAN communication.

Answer

Enable full-disk encryption on all endpoints and servers.

Answer

Upgrade all endpoint antivirus to the latest version and enable real-time scanning.

Answer

Deploy a network-based intrusion detection system (IDS) to alert on suspicious traffic.

Question 10

Your organization is a medium-sized e-commerce company with a hybrid infrastructure: on-premises datacenter and AWS cloud. The security team recently conducted an internal vulnerability scan of the on-premises network and discovered multiple critical vulnerabilities in a legacy ERP system that cannot be patched because the vendor no longer supports it. The ERP system is essential for order processing and cannot be decommissioned. The team also ran a penetration test against the cloud environment and found that an attacker with network access could leverage misconfigured security groups to move laterally between instances. The company has a risk appetite that allows for limited risk acceptance with compensating controls. As the senior security analyst, what is the BEST course of action?

Accepted Answer

Apply virtual patching via an intrusion prevention system (IPS) for the ERP vulnerabilities and implement stricter security group rules in the cloud to restrict lateral movement.. Option B provides compensating controls: virtual patching for the ERP vulnerabilities and stricter security group rules to restrict lateral movement in the cloud. This aligns with the risk appetite by reducing risk without immediate replacement. Option A is too disruptive, option C ignores the need for controls, and option D is a long-term solution that would cause unacceptable disruption.

Answer

Immediately isolate the legacy ERP system from the network and implement a manual workaround for order processing.

Answer

Decommission the legacy ERP system and migrate to a modern alternative, accepting a temporary disruption in operations.

Answer

Accept the risk for both findings and document them in the risk register without additional controls.

Question 11

You are the lead security analyst at a mid-sized financial services firm. At 2:15 PM, the SIEM alerts on multiple failed login attempts from an external IP address against the VPN gateway. The attempts stopped at 2:20 PM, but at 2:30 PM, a user reports that their account was used to send a phishing email to internal employees. You confirm that the user's account has been compromised. The CEO asks for an immediate update. What should be your FIRST action according to the incident response framework your company follows (based on NIST SP 800-61)?

Accepted Answer

Validate the incident and assess its scope and impact.. According to NIST SP 800-61, the first phase of incident response is preparation, followed by detection and analysis. The SIEM alert and user report indicate a potential incident, but you must first validate the incident and assess its scope and impact before taking containment, eradication, or recovery actions. This ensures that resources are not wasted on a false positive and that the response is proportional to the actual threat.

Answer

Preserve forensic evidence by creating a disk image of the user's workstation.

Answer

Immediately notify the legal and compliance teams.

Answer

Isolate the compromised workstation from the network.

Question 12

An organization with 500 employees operates a hybrid infrastructure with on-premises Active Directory and cloud-based services (Office 365, Azure). The security team receives an alert from the SIEM showing a high number of failed login attempts for a service account named 'svc_backup' from an external IP address. The account has delegated permissions to back up all domain controllers. The attempts are ongoing and fall below the lockout threshold to avoid detection. The team suspects a targeted password spraying attack. The helpdesk reports no recent password changes for this account. The incident response plan requires containment within 15 minutes. The cloud services are integrated with AD via Azure AD Connect. Which of the following actions BEST contains the attack while minimizing operational impact?

Accepted Answer

Disable the svc_backup account in Active Directory and notify the backup team to use an alternate account.. Option C is correct because disabling the compromised service account in Active Directory immediately stops the ongoing password spraying attack, preventing further unauthorized access attempts. This action contains the threat within the 15-minute containment window while minimizing operational impact, as the backup team can switch to an alternate account without disrupting critical backup operations. Disabling the account is faster and more reliable than changing the password, which might not propagate immediately to all domain controllers and cloud services via Azure AD Connect.

Answer

Block the external IP address at the firewall.

Answer

Configure Azure AD Conditional Access to require MFA for the account.

Answer

Immediately change the password of the svc_backup account.

Question 13

Your organization, a multinational e-commerce company, has suffered a ransomware attack that encrypted critical database servers and file shares. The ransom note demands payment in cryptocurrency within 48 hours or the data will be permanently destroyed. The company has a backup strategy that includes daily full backups and hourly incremental backups, stored both on-site and off-site. However, during the incident response, you discover that the most recent on-site backups are also encrypted because the backup server was connected to the network and affected by the same ransomware. Off-site backups are on tape and were last rotated out 72 hours ago. The CEO is pressuring to pay the ransom to restore operations quickly. Which option should the incident response team prioritize to minimize data loss and reputational damage?

Accepted Answer

Restore data from the off-site tape backups taken 72 hours ago.. Option C is correct: Restoring from off-site tapes (72 hours old) is the best course because they are not encrypted and provide a viable recovery point. Option A (pay ransom) is risky: no guarantee of decryption and encourages attackers. Option B (negotiate) wastes time. Option D (rebuild without backup) is too slow and likely loses all data.

Answer

Pay the ransom and hope the attackers provide a working decryption key.

Answer

Rebuild servers from scratch using latest known good configurations without restoring data.

Answer

Attempt to negotiate with the attackers for a lower ransom and more time.

Question 14

You are the security manager for a manufacturing company with a large facility that houses production servers and sensitive intellectual property. The facility has a single physical entrance that uses a card reader for access control. During a routine audit, you find that the door prop alarm has been bypassed by taping a magnet to the sensor, allowing the door to stay open without triggering an alert. The security guard station is located 200 feet away and does not have a direct line of sight to the door. Which control should you implement FIRST to prevent unauthorized physical access?

Accepted Answer

Implement a mantrap with two interlocking doors at the entrance.. Option B is the most effective and immediate physical control: a mantrap prevents tailgating and ensures only one person enters per card swipe. Option A (video camera) is detective, not preventive. Option C (security patrol) is resource-intensive and reactive. Option D (biometric reader) adds authentication but does not prevent door propping or tailgating.

Answer

Replace the card reader with a biometric fingerprint scanner.

Answer

Increase the frequency of security patrols around the entrance.

Answer

Install a video surveillance camera to monitor the entrance.

Question 15

You are the chief information security officer (CISO) of a large healthcare organization that handles protected health information (PHI). The organization has recently been acquired by a larger conglomerate, and the new parent company mandates that all subsidiaries adopt a single, unified risk management framework based on NIST SP 800-39. Your current framework is ISO 27005-based and has been effective for years. During the transition, you discover that the parent company's framework requires quantitative risk analysis for all critical assets, while your team has been primarily using qualitative analysis due to lack of accurate financial data. Moreover, the parent company expects all risk assessments to be completed within 30 days, a timeframe your team considers unrealistic given the number of assets. Several key stakeholders are concerned about the additional resource burden and potential disruption to operations. You need to propose a course of action that balances compliance with the parent company's mandate while maintaining operational effectiveness and minimizing risk to patient data.

Accepted Answer

Conduct a gap analysis between ISO 27005 and NIST SP 800-39, then develop a phased transition plan with a longer timeline, presenting it to the parent company's board for approval.. A gap analysis between ISO 27005 and NIST SP 800-39 identifies differences and allows a phased transition plan with a realistic timeline, which is then presented to the parent company for approval. This approach respects both frameworks and addresses stakeholder concerns. Option A is too aggressive and unrealistic. Option C is non-compliant and may lead to conflict. Option D neglects the need for a structured transition and may cause operational disruption.

Answer

Continue using ISO 27005 and argue that it is equally valid, citing the principle of risk management flexibility and the disruption that a transition would cause.

Answer

Hire external consultants to perform the quantitative assessments, allowing the internal team to focus on existing operations, and accept the cost as a business necessity.

Answer

Immediately adopt the NIST framework and begin quantitative assessments, using industry-standard cost estimates to expedite the process within 30 days.

CISSP Practice Test 37 — 15 Questions

Exhibit

CISSP Practice Test 37 — 15 Questions

Exhibit