CISSP Practice Test 39 — 15 Questions

Question 1

A company's data classification policy labels information as 'Internal Use Only' and 'Confidential.' An employee emails a 'Confidential' document to an external partner without authorization. Which type of data security objective has been violated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Confidentiality. Confidentiality ensures that data is not disclosed to unauthorized parties. Sending a 'Confidential' document to an external partner without authorization violates confidentiality. Option A (Non-repudiation) is about proof of origin, not disclosure. Option C (Availability) is about ensuring data is accessible when needed. Option D (Integrity) is about accuracy and completeness of data.

Answer

Non-repudiation

Answer

Availability

Answer

Integrity

Question 2

A company uses a qualitative risk analysis matrix where likelihood ranges from 1 to 5 and impact ranges from 1 to 5. A risk with a likelihood of 4 and an impact of 5 would fall into which risk level if the matrix defines high risk as scores above 15, medium as 10-15, and low as below 10?

Accepted Answer

High. In qualitative risk analysis using a 5x5 matrix, the score is typically the product of likelihood and impact. 4 x 5 = 20, which is above 15, indicating high risk.

Answer

Medium

Answer

Critical

Answer

Low

Question 3

Under the GDPR, which THREE of the following are rights of data subjects? (Select THREE.)

Accepted Answer

Right to erasure (right to be forgotten). GDPR grants data subjects rights including the right to access, right to erasure ('right to be forgotten'), and right to data portability. The right to sell data is not a GDPR right, and the right to ignore processing is not a formal right.

Answer

Right to ignore processing

Answer

Right to sell data

Question 4

Which TWO principles are fundamental to a defense-in-depth security architecture?

Accepted Answer

Diversity of defense. Options A and D are correct: Defense in depth relies on layered security controls (D) and diversity of defense (A) to ensure that if one layer fails, others still protect. Option B (centralized logging) is a good practice but not a fundamental principle of defense in depth. Option C (single point of failure) is the opposite of what defense in depth aims to avoid. Option E (minimal user training) is counterproductive to security.

Answer

Centralized logging

Answer

Single point of failure

Answer

Minimal user training

Question 5

An organization is planning an external audit for SOC 2 Type II compliance. Which TWO of the following are true about this type of audit?

Accepted Answer

It reports on controls over a period of time, typically 6–12 months. SOC 2 Type II is a third-party audit over a period, and it tests controls related to security, availability, etc.

Answer

It is an internal audit performed by the organization's staff

Answer

It focuses solely on financial reporting controls

Answer

It is a public document available to anyone

Question 6

A company wants to ensure its internal web application is free from security flaws during development. Which testing approach analyzes source code without executing the program?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code in a non-runtime environment, identifying vulnerabilities early in the SDLC.

Answer

IAST

Answer

RASP

Answer

DAST

Question 7

An organization is implementing a defense-in-depth strategy for a data center. Which THREE of the following are examples of physical security controls that align with layered defense?

Accepted Answer

Card reader at building entrance. Layered physical security includes perimeter fencing, building access controls (e.g., card readers), and internal secure areas (e.g., server cages).

Answer

Antivirus software

Answer

Intrusion detection system on the network

Question 8

Which TWO of the following are examples of non-repudiation controls? (Select two)

Accepted Answer

Audit logs with timestamps. Non-repudiation ensures that a party cannot deny an action. Digital signatures and audit logs with timestamps provide evidence of actions.

Answer

Firewall rules

Answer

Encryption of data at rest

Answer

Biometric authentication

Question 9

A security analyst is reviewing a web application that handles financial transactions. Which TWO of the following are effective controls against Cross-Site Request Forgery (CSRF)?

Accepted Answer

Setting cookies with the SameSite attribute to Strict. CSRF tokens are unique per request and validate the source, while SameSite cookies restrict cookie sending to same-site requests.

Answer

Using HTTPS for all pages

Answer

Enforcing strong password policies

Answer

Implementing input validation on all user inputs

Question 10

During a forensic investigation, which TWO of the following are essential steps to maintain chain of custody?

Accepted Answer

Labeling evidence with date, time, and collector's name. Chain of custody requires documenting every transfer of evidence and ensuring it is signed and secured.

Answer

Storing evidence on a shared network drive

Answer

Encrypting the evidence file to prevent viewing

Answer

Performing a hash of the evidence immediately

Question 11

Which TWO of the following are characteristics of a SOC 2 Type II report?

Accepted Answer

Covers the design and operating effectiveness of controls over a period of time. SOC 2 Type II reports assess controls over a period of time and cover trust service criteria including security and availability.

Answer

Is a public summary report available to anyone

Answer

Focuses only on financial reporting controls

Answer

Evaluates controls at a single point in time

Question 12

Which TWO of the following are essential elements of a secure software development lifecycle (SSDLC)? (Select exactly 2.)

Accepted Answer

Security testing during the verification phase. Options A and B are correct because threat modeling during design and security testing during verification are standard phases in SSDLC. Option C is wrong because code obfuscation after compilation is a post-development technique, not a lifecycle element. Option D is wrong because penetration testing after deployment is part of security testing, but not a separate phase; it is typically performed during the testing phase. Option E is wrong because user acceptance testing is functional, not security-focused.

Answer

Code obfuscation after compilation

Answer

Penetration testing after deployment

Answer

User acceptance testing before release

Question 13

Which of the following is the correct order of the ISC2 Code of Ethics canons from highest to lowest priority?

Accepted Answer

Protect society, act honorably, provide diligent service, advance the profession. The ISC2 Code of Ethics canons are, in priority order: Protect society, the common good, and the public trust; Act honorably, honestly, and justly; Provide diligent and competent service to principals; and Advance and protect the profession.

Answer

Act honorably, protect society, provide diligent service, advance the profession

Answer

Advance the profession, protect society, act honorably, provide diligent service

Answer

Provide diligent service, advance the profession, protect society, act honorably

Question 14

Which TWO of the following are lawful bases for processing personal data under the GDPR? (Select two)

Accepted Answer

Consent of the data subject. Consent and legitimate interests are two of the lawful bases under Article 6 of the GDPR.

Answer

Data subject's employment status

Answer

Data subject's nationality

Answer

Profit maximization

Question 15

An organization is planning its disaster recovery strategy. Which THREE options are considered recovery site types? (Select THREE.)

Accepted Answer

Hot site. Hot, warm, and cold sites are standard DR site types. Reciprocal agreements and cloud DR are strategies but not physical site types.

Answer

Cloud DR

Answer

Reciprocal agreement