CISSP Practice Test 38 — 15 Questions

Question 1

Which of the following is a key difference between a policy and a guideline in information security governance?

Accepted Answer

Policies are mandatory, while guidelines are recommended. Policies are high-level, mandatory statements that define the organization's security posture. Guidelines are recommendations that suggest best practices but are not mandatory.

Answer

Policies are created by IT, while guidelines are created by executives

Answer

Policies are technical, while guidelines are managerial

Answer

Policies are static, while guidelines are updated frequently

Question 2

A company is designing a secure application that requires hardware-based key storage and remote attestation. Which THREE technologies provide hardware root of trust? Select three.

Accepted Answer

Hardware Security Module (HSM). TPM, TEE (e.g., Intel SGX, ARM TrustZone), and HSM provide hardware-based security functions and root of trust.

Answer

Virtual Trusted Platform Module (vTPM)

Answer

Software Guard Extensions (SGX)

Question 3

A company is implementing a Data Loss Prevention (DLP) program. Which THREE of the following are common types of DLP controls?

Accepted Answer

Network DLP. Common DLP types are network, endpoint, and cloud DLP.

Answer

Application DLP

Answer

Physical DLP

Question 4

Which of the following is an example of a social engineering attack?

Accepted Answer

A phishing email requesting credentials. Social engineering exploits human psychology to gain information or access.

Answer

A brute-force attack on a password

Answer

SQL injection on a web application

Answer

A DDoS attack on a server

Question 5

A company's security team uses a tool that instruments the application at runtime to monitor and block attacks. This is an example of:

Accepted Answer

RASP. RASP (Runtime Application Self-Protection) integrates with the application to detect and block attacks in real time.

Answer

IAST

Answer

SAST

Answer

DAST

Question 6

A security team is planning to integrate security testing into the software development lifecycle. They want to identify vulnerabilities early and often. Which TWO of the following testing methods should be implemented during the development phase (before deployment) to catch code-level vulnerabilities?

Accepted Answer

Interactive Application Security Testing (IAST). SAST (Static Application Security Testing) analyzes source code for vulnerabilities without executing it. IAST (Interactive Application Security Testing) combines SAST and DAST by instrumenting the application and analyzing runtime behavior. Both are suitable for development phase. DAST requires a running application, and penetration testing is usually done later.

Answer

Penetration testing

Answer

Vulnerability scanning

Answer

Dynamic Application Security Testing (DAST)

Question 7

Which cryptographic algorithm is a symmetric block cipher widely used for encrypting sensitive data, with key sizes of 128, 192, or 256 bits?

Accepted Answer

AES. AES is a symmetric block cipher with standard key sizes of 128, 192, and 256 bits.

Answer

RSA

Answer

RC4

Answer

ECC

Question 8

An LDAP distinguished name (DN) includes the attribute 'CN=John Doe,OU=Sales,DC=company,DC=com'. What does 'CN' stand for?

Accepted Answer

Common Name. CN stands for Common Name, which typically represents the user's name or the hostname of a device.

Answer

Country Name

Answer

Certificate Name

Answer

Container Name

Question 9

A security architect is designing a physical security system for a data center. Which of the following is an example of a layered physical control at the perimeter?

Accepted Answer

Fencing around the property. Fencing is a perimeter control that provides a physical barrier around the facility.

Answer

Biometric access to server room

Answer

Locked server cabinets

Answer

CCTV in the lobby

Question 10

Which document is mandatory, high-level, and sets the direction for security within an organization?

Accepted Answer

Policy. A security policy is a high-level, mandatory document that establishes the overall security direction and principles. Standards, baselines, guidelines, and procedures are more detailed.

Answer

Standard

Answer

Procedure

Answer

Baseline

Question 11

An organization is evaluating a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in a file access routine. The routine checks if a user has permission to open a file, then later opens the file. Which of the following best describes the potential exploitation?

Accepted Answer

An attacker modifies the file after the permission check but before the open operation. A TOCTOU attack occurs when the resource state changes between the check and the use. For example, an attacker could replace the file after authorization but before open.

Answer

An attacker exploits a weak cryptographic algorithm

Answer

An attacker performs a buffer overflow to gain elevated privileges

Answer

An attacker intercepts the network traffic to steal credentials

Question 12

An organization implements Single Sign-On (SSO) using SAML 2.0. A user attempts to access a cloud application (Service Provider) but is not authenticated. The Service Provider redirects the user to the Identity Provider (IdP) for authentication. Which type of SAML flow is this?

Accepted Answer

SP-initiated SSO. In SP-initiated SSO, the user first tries to access the SP, which then redirects to the IdP.

Answer

AuthN-initiated SSO

Answer

Assertion-initiated SSO

Answer

IdP-initiated SSO

Question 13

Which of the following is the PRIMARY purpose of the confidentiality principle in the CIA triad?

Accepted Answer

Preventing unauthorized access to information. Confidentiality ensures that information is not disclosed to unauthorized individuals, entities, or processes.

Answer

Ensuring data is accurate and complete

Answer

Ensuring that users are who they claim to be

Answer

Guaranteeing that systems are available when needed

Question 14

A government contractor handles data classified as 'Secret'. According to government data classification levels, which of the following is the correct order from most restrictive to least restrictive?

Accepted Answer

Top Secret, Secret, Confidential, Unclassified. Government classification levels, from most restrictive to least restrictive, are: Top Secret, Secret, Confidential, Unclassified.

Answer

Confidential, Secret, Top Secret, Unclassified

Answer

Unclassified, Confidential, Secret, Top Secret

Answer

Secret, Top Secret, Confidential, Unclassified

Question 15

Which digital forensics tool is specifically designed for memory forensics?

Accepted Answer

Volatility. Volatility is an open-source framework for extracting artifacts from RAM dumps.

Answer

Wireshark

Answer

EnCase

Answer

FTK