CISSP Practice Test 4 — 10 Questions

Question 1

A multinational corporation is expanding its operations into a new country with strict data protection laws. The company needs to ensure compliance while maintaining operational efficiency. Which of the following is the BEST approach to manage this risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Adopt a privacy-by-design framework and conduct a Data Protection Impact Assessment (DPIA) before launching operations.. A privacy-by-design framework ensures data protection is embedded into systems and processes from the outset, while a Data Protection Impact Assessment (DPIA) systematically identifies and mitigates privacy risks specific to the new jurisdiction. This proactive, risk-based approach aligns with regulatory requirements like the GDPR and demonstrates due diligence, reducing the likelihood of non-compliance and operational disruption.

Answer

Accept the risk of non-compliance as a cost of doing business and set aside a contingency fund for fines.

Answer

Assign legal counsel to review local laws and implement a one-time compliance checklist.

Answer

Create a uniform global privacy policy that satisfies all jurisdictions with minimal adjustments.

Question 2

A security engineer is troubleshooting a network where internal users can access internet websites but cannot reach the company's external VPN server (IP 203.0.113.50, UDP port 500). The firewall rule for VPN traffic is correctly configured. What is the most likely cause?

Accepted Answer

The VPN server is not listening on UDP port 500.. The symptom—internal users can reach internet websites but cannot reach the external VPN server—indicates a host-level issue rather than a network or firewall problem. Since the firewall rule for VPN traffic is correctly configured and other traffic flows normally, the most likely cause is that the VPN server itself is not listening on UDP port 500, which is the standard port for IPsec IKE (Internet Key Exchange) traffic. This could be due to a misconfiguration, service failure, or the server being configured to use a different port or protocol.

Answer

The VPN server is using TCP port 443 instead of UDP 500.

Answer

The firewall rule is applied to the wrong interface.

Answer

The firewall is stateful and blocking the return traffic.

Question 3

A security analyst is reviewing logs from a web application firewall (WAF) and notices multiple requests containing the payload "1=1--" in the query string. The analyst suspects a SQL injection attack. Which of the following is the BEST immediate action to validate the suspicion?

Accepted Answer

Check the application logs for database error messages.. Checking the application logs for database error messages is the best immediate action because SQL injection attempts often trigger verbose database errors (e.g., MySQL syntax errors, ODBC error codes) that confirm the injection point. This passive validation requires no additional tools and directly correlates the WAF alert with backend behavior, avoiding the risk of actively exploiting a live system.

Answer

Use a manual SQL injection tool like sqlmap to test the application.

Answer

Implement prepared statements in the application code.

Answer

Run a vulnerability scan with a SQL injection detection module.

Question 4

A business continuity coordinator is planning a test of the disaster recovery plan. Which type of test involves a walk-through of the plan with key stakeholders without actually invoking the technical recovery?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based session where key stakeholders walk through the disaster recovery plan step-by-step without invoking any technical recovery procedures. This validates roles, responsibilities, and decision-making processes in a low-risk environment, ensuring the plan's logic is sound before any actual failover or system restoration is attempted.

Answer

Full interruption test

Answer

Checklist review

Answer

Parallel test

Question 5

A company uses BGP to exchange routes with its ISP. To prevent prefix hijacking, which mechanism should be implemented?

Accepted Answer

RPKI. RPKI (Resource Public Key Infrastructure) is the correct mechanism because it cryptographically validates the origin AS of a BGP route announcement, preventing prefix hijacking by ensuring that only the legitimate owner of an IP prefix can announce it. Unlike other options, RPKI provides a trust anchor based on the IP address allocation hierarchy, making it the only solution that directly addresses the root cause of hijacking—unauthorized origin AS claims.

Answer

BGP MD5 authentication

Answer

BGP community values

Answer

AS-path filtering

Question 6

During a security assessment, a consultant discovers that a legacy VPN solution uses MS-CHAPv2 for authentication and does not support IKE. The protocol is known to be vulnerable to dictionary attacks. Which VPN protocol is most likely being used?

Accepted Answer

PPTP. MS-CHAPv2 is a Microsoft proprietary authentication protocol used by PPTP (Point-to-Point Tunneling Protocol). PPTP does not support IKE (Internet Key Exchange) and relies on MS-CHAPv2, which is vulnerable to dictionary attacks due to its weak hashing and lack of mutual authentication. The combination of MS-CHAPv2 authentication and the absence of IKE support directly points to PPTP as the VPN protocol in use.

Answer

IPsec with IKEv2

Answer

SSL/TLS VPN

Answer

L2TP/IPsec

Question 7

An organization is implementing a bring-your-own-device (BYOD) policy. The security architect must ensure that corporate data on the device is protected from unauthorized access if the device is lost or stolen, while minimizing impact on user privacy. Which solution is most appropriate?

Accepted Answer

Use mobile device management (MDM) to create a secure container for corporate apps and data. A secure container (often implemented via MDM with app wrapping or per-app VPN) creates an encrypted, isolated partition on the device for corporate apps and data. This ensures that if the device is lost or stolen, the corporate data remains encrypted and inaccessible without the container's authentication, while personal apps and data outside the container remain untouched, thus minimizing privacy impact.

Answer

Require employees to use company-issued devices only

Answer

Disable camera and microphone on the device

Answer

Full device encryption with remote wipe capability

Question 8

An organization is adopting a microservices architecture. Which security control is most effective for ensuring that inter-service communication is authenticated and authorized?

Accepted Answer

Implementing mutual TLS (mTLS) between services. Mutual TLS (mTLS) is the most effective control because it provides both authentication and encryption for inter-service communication. In a microservices architecture, mTLS ensures that each service presents a valid X.509 certificate, and both sides verify each other's identity before any data exchange, preventing unauthorized or spoofed services from communicating. This aligns with the principle of zero trust, where no implicit trust is granted based on network location.

Answer

Relying on network segmentation and IP allowlisting

Answer

Using JSON Web Tokens (JWT) in the HTTP header

Answer

Using pre-shared API keys for each service pair

Question 9

Which type of security testing involves analyzing source code for vulnerabilities without executing the code?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It operates by scanning the codebase for patterns known to be insecure (e.g., SQL injection via string concatenation) using techniques like data flow analysis, taint tracking, and pattern matching, all performed at rest.

Answer

Penetration testing

Answer

IAST

Answer

DAST

Question 10

During a penetration test, an ethical hacker sets up a rogue access point with the same SSID as the corporate network and broadcasts a stronger signal. Users inadvertently connect to the rogue AP, allowing the hacker to capture credentials. What is this attack called?

Accepted Answer

Evil twin attack. Evil twin attack. This attack involves setting up a rogue access point that broadcasts the same SSID as a legitimate corporate network but with a stronger signal, causing users to connect to it instead. Once connected, the attacker can capture credentials or other sensitive data through man-in-the-middle techniques, exploiting the lack of mutual authentication in many Wi-Fi implementations.

Answer

Deauthentication attack

Answer

ARP spoofing

Answer

Karma attack