CISSP Practice Test 39 — 15 Questions

Question 1

A healthcare organization recently experienced a data breach. The incident response team traced the breach to a compromised third-party vendor that had remote access to the organization's network. The vendor's credentials were stolen via a phishing attack. The organization's security policy requires that all third-party remote access be monitored and logged. During the investigation, it was discovered that the vendor's session traffic was not logged because the logging system was misconfigured. The security team needs to prevent similar incidents in the future. Which of the following is the MOST effective remediation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a privileged access management (PAM) solution with session recording.. A Privileged Access Management (PAM) solution with session recording directly addresses the root cause: the logging system was misconfigured and failed to capture third-party remote access traffic. PAM enforces centralized control, vaulting credentials, and recording all sessions (e.g., via RDP, SSH) in a tamper-proof audit trail, ensuring that even if credentials are stolen, every keystroke and screen activity is logged and monitored. This provides the forensic evidence needed to detect and investigate unauthorized actions, closing the gap left by the misconfigured logging system.

Answer

Require multi-factor authentication for all third-party access.

Answer

Conduct regular phishing simulations for third-party vendors.

Answer

Disable all third-party remote access until a new vendor vetting process is established.

Question 2

A company collects PII from European customers for order processing. Under GDPR, they engage a third-party logistics provider to handle shipping. Which role does the logistics provider typically assume in this scenario?

Accepted Answer

Data processor. Under GDPR, the logistics provider processes personal data on behalf of the company and therefore assumes the role of data processor. The company that determines the purposes and means of processing is the data controller, and the processor acts only on the controller's documented instructions. This controller-processor relationship must be governed by a written data processing agreement.

Answer

Data controller

Answer

Data custodian

Answer

Data subject

Question 3

An organization is implementing network segmentation. They need to place publicly accessible servers (e.g., web and email) in a separate network that is isolated from the internal LAN but still allows controlled access from the internet. Which architecture should they use?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a network segment that sits between the internet and the internal LAN, hosting publicly accessible servers like web and email. It uses firewall rules to allow inbound traffic from the internet to the DMZ servers while blocking direct access to the internal network, and typically permits only specific outbound responses or updates from the DMZ to the internal LAN. This architecture provides the isolation and controlled access required by the scenario.

Answer

Micro-segmentation

Answer

VPN

Answer

VLAN

Question 4

Based on the vulnerability scan exhibit, which vulnerability should be remediated first?

Accepted Answer

OpenSSL Heartbleed vulnerability. The OpenSSL Heartbleed vulnerability (CVE-2014-0160) allows an attacker to read up to 64 KB of memory from a vulnerable server, potentially exposing private keys, session tokens, and passwords. This is a critical information disclosure flaw that requires immediate remediation because it compromises the confidentiality of all encrypted communications. In contrast, the other vulnerabilities are less severe: SSH weak MAC algorithms reduce cryptographic strength but do not directly leak data, and SMTP open relay is a misconfiguration that enables spam but not direct data theft.

Answer

All vulnerabilities equally because they have the same host

Answer

SSH weak MAC algorithms

Answer

SMTP open relay

Question 5

During the requirements gathering phase of a software development project, which threat modeling methodology is most commonly used to identify threats such as spoofing, tampering, and elevation of privilege?

Accepted Answer

STRIDE. STRIDE is a threat modeling methodology developed by Microsoft that categorizes threats into six types: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. During the requirements gathering phase, STRIDE is commonly used to systematically identify and classify potential security threats against each system component, making it the correct choice for identifying threats like spoofing, tampering, and elevation of privilege.

Answer

CVSS

Answer

OCTAVE

Answer

PASTA

Question 6

A security analyst is selecting forensic tools for an investigation. Which TWO tools are best suited for memory forensics? (Select TWO.)

Accepted Answer

Volatility. Volatility is a dedicated memory forensics framework; FTK can also capture and analyze memory, though it's more general. EnCase is disk forensics, Wireshark network, Autopsy disk.

Answer

Wireshark

Answer

Autopsy

Answer

EnCase

Question 7

A SOC analyst at Tier 1 identifies a potential malware infection on a user workstation. What is the next step in the standard incident response process?

Accepted Answer

Escalate the incident to Tier 2 analyst for further investigation. Tier 1 analysts typically triage alerts and escalate if they cannot resolve them.

Answer

Update the SIEM correlation rule to ignore similar alerts

Answer

Disconnect the workstation from the network immediately

Answer

Perform a deep forensic analysis of the workstation

Question 8

A security architect is designing a zero-trust network. Which principle is fundamental to a zero-trust architecture (ZTA) such as BeyondCorp?

Accepted Answer

Never trust, always verify. In a zero-trust architecture (ZTA) like Google's BeyondCorp, the foundational principle is 'never trust, always verify.' This means no entity—user, device, or network—is trusted by default, regardless of its location (inside or outside the corporate perimeter). Every access request must be authenticated, authorized, and continuously validated before granting access to resources, eliminating implicit trust based on network location.

Answer

Trust but verify

Answer

Trust internal users implicitly

Answer

Trust network location as a primary factor

Question 9

Which governance framework provides guidance specifically for aligning IT services with business needs and includes a service lifecycle?

Accepted Answer

ITIL. ITIL (Information Technology Infrastructure Library) is the framework specifically focused on IT service management, providing guidance on aligning IT services with business needs through a service lifecycle (strategy, design, transition, operation, continual service improvement). Its service lifecycle model is the defining characteristic referenced in the question.

Answer

ISO/IEC 27001

Answer

NIST Cybersecurity Framework

Answer

COBIT 2019

Question 10

An organization implements a security model where users can only read objects at or below their security clearance, and can only write to objects at or above their clearance. This model primarily ensures:

Accepted Answer

Confidentiality. The described model is the Bell-LaPadula model: 'no read up' (subjects can only read at or below their clearance) and 'no write down' (subjects can only write at or above their clearance). Both rules exist to prevent sensitive information from leaking to lower classification levels, so the model primarily ensures confidentiality.

Answer

Integrity

Answer

Accountability

Answer

Availability

Question 11

An organization is implementing network segmentation to enhance security. They create a DMZ to host public-facing servers and want to ensure that if a server is compromised, the attacker cannot pivot to the internal network. Which firewall placement best achieves this?

Accepted Answer

Implement a screened subnet with two firewalls: one between internet and DMZ, and one between DMZ and internal network. A screened subnet architecture uses two firewalls to create a DMZ that is logically isolated from both the internet and the internal network. The first firewall (internet-facing) controls inbound traffic to the DMZ, while the second firewall (internal-facing) strictly controls outbound traffic from the DMZ to the internal network, typically allowing only specific return traffic. This prevents an attacker who compromises a DMZ server from directly initiating connections to internal hosts, as the internal firewall would block such traffic unless explicitly permitted.

Answer

Place the DMZ on the internal network side with a strong host-based firewall on each server

Answer

Place a single firewall between the internet and the DMZ, and allow traffic from DMZ to internal network

Answer

Use a stateful firewall that only allows return traffic from internal to DMZ

Question 12

An organization is implementing DNSSEC to protect against DNS spoofing attacks. Which of the following best describes the primary security function provided by DNSSEC?

Accepted Answer

Authenticating the origin and ensuring integrity of DNS responses. DNSSEC (Domain Name System Security Extensions) provides data origin authentication and data integrity for DNS responses using digital signatures based on public-key cryptography. It does not encrypt DNS data or provide anonymity; instead, it allows a resolver to verify that a DNS response has not been modified in transit and that it originates from the authoritative source. This directly counters DNS spoofing attacks by ensuring the response is authentic and untampered.

Answer

Providing anonymous DNS resolution

Answer

Encrypting DNS queries to prevent eavesdropping

Answer

Blocking malicious DNS queries at the resolver

Question 13

An organization is transitioning from waterfall to agile development. How should security be integrated into the new process to align with the SDLC?

Accepted Answer

Include security requirements in user stories and conduct threat modeling each iteration. In agile development, security must be integrated continuously throughout each iteration, not deferred to the end. Option D is correct because it embeds security into the user story definition (including acceptance criteria for security requirements) and mandates threat modeling each iteration, which aligns with the iterative, incremental nature of agile and ensures security is addressed early and often, reducing risk and rework.

Answer

Perform a single security review at the end of the release cycle

Answer

Conduct security testing only during the integration phase

Answer

Skip threat modeling and rely solely on automated scanning

Question 14

A security engineer is recommending a VPN protocol for remote access. The requirements are: strong encryption, perfect forward secrecy, use of elliptic curve cryptography, and minimal overhead. Which VPN protocol best meets these requirements?

Accepted Answer

WireGuard. WireGuard is the correct choice because it uses modern elliptic curve cryptography (Curve25519) for key exchange, provides perfect forward secrecy by default through ephemeral session keys, and has minimal overhead due to its streamlined codebase (roughly 4,000 lines of code) and lack of stateful configuration. It operates over UDP with a simple cryptographic design that meets all specified requirements without the complexity of IPsec or SSL/TLS.

Answer

L2TP/IPsec

Answer

IPsec with ESP in tunnel mode

Answer

SSL/TLS VPN

Question 15

A development team is implementing a new feature that processes sensitive user data. Which of the following is the most secure approach to prevent data leakage during processing?

Accepted Answer

Use memory encryption for all user data.. Memory encryption protects sensitive user data while it resides in RAM, preventing unauthorized access through memory dumps, cold boot attacks, or other memory-scraping techniques. This is the most secure approach because it safeguards data during the entire processing lifecycle, unlike other options that leave data exposed in memory or rely on post-processing cleanup.

Answer

Use a separate virtual machine for each request.

Answer

Store all data in a temporary file and delete it after processing.

Answer

Log all data access for auditing.