CISSP Practice Test 38 — 15 Questions

Question 1

A healthcare organization uses a custom application to manage patient records. The application uses a database with encrypted columns for sensitive data. The security team discovers that an insider has been copying encrypted data to an external drive. While the data is encrypted, the encryption key is stored in a configuration file accessible to the application. Which additional control would best mitigate this risk?

Accepted Answer

Store the encryption key in a hardware security module (HSM) with access policies.. Storing the encryption key in an HSM with access policies ensures the key is never in cleartext accessible to the application or user; it also enforces access controls and auditing. Role-based access on the config file is insufficient because the application still needs to read the key. TDE protects data at rest but does not protect the key. Auditing is detective, not preventive.

Answer

Enable audit logging on the application.

Answer

Implement role-based access control on the configuration file.

Answer

Use transparent data encryption (TDE) at the database level.

Question 2

A financial services company is migrating its customer relationship management (CRM) system to a public cloud provider. The CRM contains personally identifiable information (PII) and financial transaction records. The security architect must design a solution that ensures data confidentiality and integrity both at rest and in transit, while complying with PCI DSS requirements. The cloud provider offers a key management service (KMS) that can generate and store encryption keys, a hardware security module (HSM) in the cloud, and a certificate authority for TLS certificates. The architect needs to select the appropriate encryption methods and access controls. The company's security policy requires encryption keys to be rotated every 90 days and stored separately from the data. The cloud provider's KMS supports automatic key rotation, but the HSM requires manual intervention. The CRM application uses a database that supports transparent data encryption (TDE) with keys stored in the KMS, and the application also requires TLS for all network connections. Which course of action best meets all requirements?

Accepted Answer

Use the cloud provider's KMS to generate and store the database encryption key with automatic rotation, and use a certificate from a third-party CA for TLS. Store the KMS key in a separate account and region from the database.. Option D is correct because it uses the KMS with automatic key rotation (meeting the 90-day rotation requirement), stores the key in a separate account and region from the data (satisfying the separation requirement), and uses a third-party CA for TLS (providing strong trust and compliance). Option A stores the key in the same region, violating separation. Option B uses manual rotation, which is error-prone and may not meet the automation expectation. Option C uses self-signed certificates, which do not provide the trust required for external connections and disables automatic rotation, adding manual overhead.

Answer

Use the cloud provider's KMS to generate and store the database encryption key, disable automatic rotation, and manually rotate it every 90 days. Use a self-signed certificate for TLS to save costs.

Answer

Use the cloud HSM to generate and store the database encryption key, manually rotate it every 90 days, and use a certificate from the cloud provider's CA for TLS. Store the HSM key in a different region from the database.

Answer

Use the cloud provider's KMS to generate and store the database encryption key, enable automatic key rotation, and use a separate KMS-managed key for TLS certificates. Store all keys in the same KMS region as the database.

Question 3

A large e-commerce company operates a multi-tier application in a public cloud. The environment includes a web tier, application tier, and database tier. The security team recently deployed a host-based intrusion detection system (HIDS) on all servers. During a routine review, the HIDS alerts show repeated failed login attempts from a single external IP address to several web servers, but no successful logins from that IP. The team also notices that the database servers have been sending outbound traffic to an unknown IP address on port 443, which is unusual because the database servers typically communicate only with the application servers on port 3306 (MySQL). The application team confirms no changes were made recently. The CISO wants an immediate investigation. What should the security team do first?

Accepted Answer

Isolate the database servers from the network and perform forensic analysis on system logs and memory dumps.. Option D is correct because the suspicious outbound traffic from database servers indicates potential data exfiltration. Isolating the affected servers and analyzing their logs and memory will help confirm compromise and contain the incident. Option A is wrong because focusing on the failed logins may miss the active exfiltration. Option B is wrong because restarting servers can destroy forensic evidence. Option C is wrong because blocking the IP on the firewall does not address the potential malware on the database servers.

Answer

Immediately restart all database servers to stop any malicious processes.

Answer

Add a firewall rule to deny outbound traffic from the database tier to the unknown IP.

Answer

Block the external IP that is attempting to log in to the web servers and continue monitoring.

Question 4

A large financial institution is finalizing its annual risk treatment plan based on a recent enterprise risk assessment. The risk appetite statement approved by the board specifies that the organization will accept only low residual risks for financial loss, but is willing to accept moderate risks for reputational damage if cost-benefit justifies. The risk register includes the following findings: 1) A critical SQL injection vulnerability in the online banking portal with high likelihood and critical impact; current controls include a web application firewall (WAF) that is not fully tuned. 2) Use of outdated TLS 1.0 encryption on internal communications between data centers; likelihood is medium, impact is low. 3) Lack of background checks for third-party vendors with access to sensitive data; likelihood is low, impact is moderate. 4) A single point of failure in the primary data center's power supply; likelihood is low, impact is critical. 5) An incident response plan that has not been tested in two years; likelihood is medium, impact is moderate. The CISO must prioritize actions for the upcoming quarter. What is the most appropriate first step?

Accepted Answer

Immediately remediate the SQL injection vulnerability by tuning the WAF and applying vendor patches.. Option A is correct. The SQL injection vulnerability has high likelihood and critical impact, resulting in high risk that exceeds the risk appetite for financial loss. Immediate patching or other remediation is necessary to bring the risk to an acceptable level. Option B (accept outdated encryption) is possible but not the highest priority. Option C (transfer single point of failure) is valid but power supply risk is low likelihood; insurance may not be the first step. Option D (outsource incident response) is not the most urgent; testing the plan is less critical than addressing a high-risk vulnerability.

Answer

Transfer the single point of failure risk by purchasing business interruption insurance.

Answer

Outsource incident response to a managed security service provider (MSSP) to compensate for the untested plan.

Answer

Accept the risk of outdated TLS 1.0 encryption because impact is low.

Question 5

A company develops a web application using microservices architecture deployed on Kubernetes. The security team identifies that the application is vulnerable to injection attacks because user input is concatenated into SQL queries. The development team wants to implement a fix quickly. They propose using parameterized queries, but the database access layer currently uses stored procedures. The team considers modifying the stored procedures to accept parameters and using prepared statements in the code. However, the operations team is concerned about performance impact. Which of the following is the BEST course of action?

Accepted Answer

Implement both parameterized queries and modify stored procedures to use parameters, and then monitor performance.. Option C is correct because it addresses the vulnerability through both parameterized queries and parameterized stored procedures, then monitors performance to address the operations team's concern. Option A is wrong because parameterized queries alone may not protect if the stored procedures still concatenate input. Option B is wrong because dynamic SQL within stored procedures can still be vulnerable to injection. Option D is wrong because input validation alone is not sufficient to prevent injection; stored procedures without parameterization can still be vulnerable.

Answer

Use parameterized queries immediately without modifying stored procedures.

Answer

Modify stored procedures to use dynamic SQL with input validation.

Answer

Use input validation only, as stored procedures inherently prevent injection.

Question 6

A hospital chain collects and stores electronic health records (EHR) for millions of patients. The EHR system is hosted in a private cloud and accessed by doctors, nurses, and administrative staff from various locations. Recently, an internal audit found that several employees shared their login credentials with colleagues to expedite workflows. The hospital must comply with HIPAA and state privacy laws. The security officer wants to implement a solution that minimizes the risk of unauthorized access due to shared credentials while still allowing efficient access for patient care. Which of the following is the BEST approach?

Accepted Answer

Implement single sign-on (SSO) integrated with role-based access control (RBAC) and enforce audit logging of all access. SSO integrated with RBAC reduces the attack surface of shared credentials by centralizing authentication and enforcing least-privilege access based on job roles. Audit logging provides non-repudiation and traceability, which deters credential sharing and satisfies HIPAA's requirement to track access to ePHI. This combination directly addresses the root cause (shared credentials) while maintaining workflow efficiency through seamless authentication.

Answer

Enforce a policy requiring password changes every 30 days and complexity requirements

Answer

Replace passwords with biometric authentication (fingerprint and iris scans) for all users

Answer

Disable remote access to the EHR system and require all access to occur only from within the hospital's LAN

Question 7

A financial services company with 5000 employees uses a hybrid identity model with on-premises Active Directory (AD) synchronized to Azure AD via Azure AD Connect. The company has recently deployed Microsoft 365 and uses it for email and file sharing. Users authenticate to Azure AD using password hash synchronization (PHS) with Seamless Single Sign-On (SSO). The security team has implemented Conditional Access policies to require multi-factor authentication (MFA) for all external access and for access to sensitive financial applications. Recently, the help desk has received numerous complaints from users working remotely that they are frequently prompted for MFA, even multiple times during a single work session, causing frustration and productivity loss. Additionally, some users report that they are unable to access certain financial applications despite being in the correct group membership. An investigation reveals that Azure AD Connect synchronization is occurring successfully and that MFA configurations appear correct. The security team suspects that the issue may be related to the Conditional Access session settings or token lifetimes. What is the BEST course of action to diagnose and resolve the primary issue of excessive MFA prompts while maintaining security?

Accepted Answer

Review the Conditional Access policy for the financial applications to ensure that the 'Session' controls are configured to 'Use app enforced restrictions' and adjust MFA trust settings.. Option C is correct because the issue of excessive MFA prompts while maintaining security is best resolved by reviewing the Conditional Access session controls. Specifically, the 'Sign-in frequency' and 'Persistent browser session' settings in the session controls determine how often users are re-prompted for MFA. By adjusting these settings (e.g., setting sign-in frequency to a longer duration like 24 hours) and ensuring MFA trust settings are configured to allow trusted devices or locations, the security team can reduce unnecessary prompts without weakening security. This directly addresses the user complaints while keeping Conditional Access policies intact.

Answer

Implement a privileged identity management (PIM) solution to manage access to the financial applications.

Answer

Increase the sign-in frequency and session timeout values in the Conditional Access policies for all users to 24 hours.

Answer

Disable Seamless SSO and require users to enter passwords each time to ensure token freshness.

Question 8

A hospital is implementing an access control system for its electronic health record (EHR) application. The system must ensure that only authorized healthcare providers can access patient records based on their role (doctor, nurse, administrator), department (cardiology, oncology, etc.), and patient consent status. The hospital also needs to support break-the-glass access for emergencies. The current solution uses static role-based access control (RBAC) but fails to enforce department-level restrictions and consent checks. What is the most appropriate access control model to address these requirements?

Accepted Answer

Implement an attribute-based access control (ABAC) system. Attribute-based access control (ABAC) is the correct choice because it can dynamically evaluate multiple attributes—such as user role, department, patient consent status, and emergency context—to grant or deny access. Unlike static RBAC, ABAC supports fine-grained, context-aware policies that can enforce department-level restrictions and consent checks, and it can incorporate break-the-glass rules by evaluating an emergency attribute or time-based condition.

Answer

Enhance the existing RBAC model with more granular roles for each department

Answer

Use mandatory access control (MAC) with security labels per patient record

Answer

Apply discretionary access control (DAC) allowing providers to set access permissions

Question 9

A healthcare organization is implementing a new SIEM solution to centralize log management from its network devices, servers, and applications. The compliance team requires that all logs be retained for at least one year to meet HIPAA regulations. The SIEM platform has limited storage capacity and uses a hot/warm/cold tier architecture. The system currently ingests about 500 GB of logs per day. The security team wants to ensure that critical logs (e.g., authentication failures, privilege escalations) remain immediately searchable for at least 90 days, while less critical logs can be moved to cheaper storage after 30 days. What is the most cost-effective storage strategy that meets all requirements?

Accepted Answer

Store critical logs in hot storage for 90 days, then move all logs to warm/cold storage for the remainder of the year.. Option D is correct because it aligns the SIEM's hot/warm/cold tier architecture with the organization's retention and searchability requirements. Critical logs remain in hot storage for 90 days for immediate searching, then all logs are moved to cheaper warm/cold storage for the remaining 275 days to meet the one-year HIPAA retention mandate. This balances cost efficiency with compliance, avoiding unnecessary hot storage costs for non-critical logs beyond 30 days.

Answer

Store all logs in hot storage for 90 days, then archive to cold storage indefinitely.

Answer

Store only critical logs in hot storage for 1 year, delete non-critical logs after 30 days.

Answer

Store all logs in hot storage for 30 days, then delete them after 90 days.

Question 10

A multinational corporation operates a private MPLS VPN network connecting 50 branch offices to a central data center. The network uses BGP as the routing protocol within the VPN, with each branch announcing its internal prefixes to the data center routers. Over the past week, several branch offices have reported intermittent connectivity issues, with traffic being routed to incorrect destinations before recovering. Network logs show that during these incidents, the data center router receives unexpected BGP updates from one of the branch routers, advertising prefixes that belong to other branches. BGP sessions remain established without flaps. The security team is concerned that this could be a route leak or intentional hijack. The network engineer has verified that all BGP sessions are authenticated with MD5 and that RPKI validation is not currently deployed. Which course of action should the engineer take first to mitigate the issue?

Accepted Answer

Configure inbound BGP prefix filtering on the data center routers.. The intermittent connectivity issues are caused by a branch router advertising prefixes that belong to other branches, which is a classic route leak or hijack scenario. Configuring inbound BGP prefix filtering on the data center routers is the immediate and most effective mitigation because it allows the engineer to explicitly define which prefixes are accepted from each BGP neighbor, preventing unauthorized or incorrect routes from being installed in the routing table. This approach does not require additional infrastructure or protocol changes and directly addresses the root cause of the traffic misdirection.

Answer

Implement BGP Flowspec to rate-limit traffic to the affected prefixes.

Answer

Deploy RPKI validation across all routers.

Answer

Increase the BGP hold timer on data center routers.

Question 11

A small business wants to implement a secure wireless network for its office. They have a limited budget and want to ensure that data in transit is encrypted and that only authorized devices can connect. The office has 20 employees and a few guests. The business owner has heard about WPA2 and WPA3. They are concerned about security but also about compatibility with older devices. Which of the following is the BEST recommendation for a security architect?

Accepted Answer

Deploy WPA3-Enterprise with a RADIUS server and use TLS 1.3 for authentication, and for devices that do not support WPA3, use a separate SSID with WPA2-Enterprise and strong passphrase.. Option A is the best recommendation because it balances security, compatibility, and budget. WPA3-Enterprise with a RADIUS server and TLS 1.3 provides strong, per-user authentication and encryption for modern devices, while a separate SSID with WPA2-Enterprise (not PSK) allows older devices to connect securely without compromising the network's overall security posture. This dual-SSID approach ensures that all traffic is encrypted and only authorized devices can connect, addressing the business's core requirements.

Answer

Use WPA2-PSK with a long complex passphrase and change it monthly.

Answer

Use open network with MAC filtering to control access.

Answer

Deploy WPA3-Personal with SAE and disable all older protocols.

Question 12

A large financial institution is migrating its core banking system to a private cloud. The architecture must protect against data leakage between different business units sharing the same physical infrastructure. The system uses a hypervisor and virtual machines. Each business unit has its own security classification. The security requirement is that no VM belonging to a lower classification should be able to read data from a higher classification VM, even if the hypervisor is compromised. The architect proposes using mandatory access control at the hypervisor level. However, the IT team notes that a hypervisor compromise could bypass MAC. Additionally, they need to ensure that data at rest is encrypted and keys are stored securely. Which of the following would BEST meet the requirement?

Accepted Answer

Use a hardware security module (HSM) to manage keys and implement full memory encryption using AES-256 with integrity protection, and use a trusted execution environment (TEE) for each VM, ensuring that even the hypervisor cannot access VM memory.. Option D is correct because it addresses the core requirement: preventing data leakage even if the hypervisor is compromised. By using a hardware security module (HSM) for key management, full memory encryption with AES-256 and integrity protection, and a trusted execution environment (TEE) for each VM, the solution ensures that VM memory is encrypted and isolated at the hardware level. The hypervisor, even if compromised, cannot access the decrypted memory of a VM, thus enforcing the security classification separation regardless of hypervisor integrity.

Answer

Implement network segmentation with VLANs and IPsec encryption between VMs.

Answer

Deploy a data loss prevention (DLP) system to monitor data transfers between VMs.

Answer

Use a public key infrastructure (PKI) to issue certificates for each VM and enforce mutual TLS for all inter-VM communication.

Question 13

A government agency requires a new secure document management system that enforces mandatory access control with the properties that users cannot read documents at a higher classification and cannot write documents to a lower classification (to prevent data leaking). The system must also support different categories (compartments) within the same classification level, and a user with access to one compartment should not be able to access another compartment unless explicitly allowed. The architect is considering the Bell-LaPadula model. However, the Bell-LaPadula model's *-property (no write-down) addresses the write issue, but there is also a need to handle compartment isolation. Which additional model or mechanism should be incorporated to ensure compartment isolation?

Accepted Answer

Use a lattice-based access control (LBAC) that extends Bell-LaPadula by defining a security lattice that includes compartments and categories, ensuring that a subject's clearance must dominate the object's classification, including compartments.. Option C is correct because lattice-based access control (LBAC) extends the Bell-LaPadula model by defining a security lattice that includes both hierarchical classifications (e.g., Top Secret, Secret) and non-hierarchical categories (compartments). In this lattice, a subject's clearance must dominate an object's classification across both dimensions, ensuring that a user with access to one compartment cannot access another unless their clearance includes that specific category. This directly enforces the required compartment isolation while maintaining the *-property (no write-down) for data leakage prevention.

Answer

Apply the Brewer-Nash (Chinese Wall) model which enforces conflict of interest by preventing access to multiple compartments that conflict.

Answer

Implement Biba's integrity model which prevents write-up, thus complementing Bell-LaPadula.

Answer

Use role-based access control (RBAC) to define compartments.

Question 14

A global technology firm has implemented a continuous integration/continuous deployment (CI/CD) pipeline for its flagship software product. The security testing team is tasked with integrating security testing into the pipeline. The team has decided to use a static application security testing (SAST) tool and a software composition analysis (SCA) tool. They are currently running both tools every night against the entire codebase, but the developers complain that the reports are too long and often contain false positives. The team wants to improve the efficiency without sacrificing security coverage. Which of the following is the BEST strategy?

Accepted Answer

Implement a developers' feedback loop for false positives and tune the tools.. Option B is correct because tuning the SAST and SCA tools based on developer feedback directly addresses the false positive issue while maintaining security coverage. By establishing a feedback loop, the team can adjust rule sets, suppress known false positives, and reduce report noise without reducing scan frequency or scope. This approach aligns with the principle of continuous improvement in DevSecOps, ensuring that security testing remains efficient and actionable.

Answer

Decrease the scan frequency to weekly to reduce noise.

Answer

Replace SAST with dynamic application security testing (DAST) for more accurate results.

Answer

Run SAST and SCA only on new code changes committed to the main branch.

Question 15

A healthcare organization recently experienced a data breach. The incident response team traced the breach to a compromised third-party vendor that had remote access to the organization's network. The vendor's credentials were stolen via a phishing attack. The organization's security policy requires that all third-party remote access be monitored and logged. During the investigation, it was discovered that the vendor's session traffic was not logged because the logging system was misconfigured. The security team needs to prevent similar incidents in the future. Which of the following is the MOST effective remediation?

Accepted Answer

Implement a privileged access management (PAM) solution with session recording.. Option C is correct because a Privileged Access Management (PAM) solution with session recording directly addresses the root cause: the logging system was misconfigured and failed to capture third-party remote access traffic. PAM enforces centralized control, vaulting credentials, and recording all sessions (e.g., via RDP, SSH) in a tamper-proof audit trail, ensuring that even if credentials are stolen, every keystroke and screen activity is logged and monitored. This provides the forensic evidence needed to detect and investigate unauthorized actions, closing the gap left by the misconfigured logging system.

Answer

Require multi-factor authentication for all third-party access.

Answer

Conduct regular phishing simulations for third-party vendors.

Answer

Disable all third-party remote access until a new vendor vetting process is established.