CISSP Practice Test 4 — 10 Questions

Question 1

A software development company uses a continuous integration/continuous deployment (CI/CD) pipeline that automatically builds and deploys code to production after passing automated tests. The code repository contains proprietary algorithms and customer data. A recent incident was traced to an attacker who injected malicious code into a library that was pulled from a public package repository during the build process. The company wants to prevent similar supply chain attacks without significantly slowing development. Which of the following is the BEST course of action?

Accepted Answer

Implement a private repository that mirrors approved open-source libraries and enforces signature verification and hash checks before allowing use. Option D is correct because implementing a private repository that mirrors only approved, vetted open-source libraries with enforced signature verification and hash checks directly addresses supply chain attacks by ensuring that only trusted, integrity-verified code enters the build pipeline. This approach prevents malicious code from public repositories from being pulled automatically, without requiring manual review of every library (which would slow development) or relying on post-build scanning that cannot prevent the initial injection. It aligns with the principle of secure software supply chain management by establishing a trusted source of components.

Answer

Require all developers to perform manual code review of every third-party library before inclusion

Answer

Perform static application security testing (SAST) on the entire codebase including libraries

Answer

Increase the frequency of vulnerability scanning on the production environment and delay deployment of any library that has a deprecation notice

Question 2

A multinational corporation maintains site-to-site IPsec VPN tunnels between its headquarters and three regional branch offices. Over the past week, the tunnels have been dropping intermittently, causing disruption to real-time applications. The network team checked logs and found frequent 'Phase 2 rekey failure' messages. The tunnels are configured with IKEv1 and preshared keys. The headquarters uses a Cisco ASA, and the branches use various vendors' firewalls. The team verified that firewall policies allow IPsec traffic, and there is no packet loss on the WAN links. Which action should the team take to resolve the issue most effectively?

Accepted Answer

Adjust the Dead Peer Detection (DPD) intervals and Phase 2 lifetime settings to be consistent across all sites.. The frequent 'Phase 2 rekey failure' messages indicate a mismatch in IPsec security association (SA) parameters between the Cisco ASA and the branch firewalls. IKEv1 Phase 2 lifetimes and Dead Peer Detection (DPD) intervals must be consistent across all peers; otherwise, one side may attempt to rekey or declare the peer dead while the other expects a different timing, causing intermittent tunnel drops. Adjusting these values to match across all sites resolves the rekey failures without compromising security or requiring a protocol migration.

Answer

Increase the MTU on the WAN interfaces to 1500 bytes on all firewalls.

Answer

Change the encryption algorithm from AES-256 to 3DES on all peers.

Answer

Migrate all VPN connections from IPsec to SSL VPN using clientless access.

Question 3

Drag and drop the steps for a secure software development lifecycle (SDLC) in the correct order.

Question 4

Drag and drop the steps for implementing a digital signature using asymmetric cryptography in the correct order.

Question 5

Drag and drop the steps for conducting a risk assessment in the correct order.

Question 6

An organization wants to protect sensitive data stored on laptops. Which of the following is the MOST effective control to prevent data loss if a laptop is stolen?

Accepted Answer

Full-disk encryption (FDE). Full-disk encryption (FDE) renders the data on the laptop unreadable without the decryption key, even if the storage drive is removed and analyzed. This is the most effective preventive control against data loss from theft because it protects data at rest regardless of physical access to the device.

Answer

BIOS password

Answer

Asset tracking software

Answer

Remote wipe capability

Question 7

Which TWO of the following are essential components of a data classification policy? (Select two.)

Accepted Answer

Roles and responsibilities for data classification. Roles and responsibilities are essential because a data classification policy must clearly define who is accountable for classifying data, who can assign classification levels, and who is responsible for maintaining the labels. Without this, classification efforts become inconsistent and unenforceable, leading to security gaps. The CISSP emphasizes that governance requires clear assignment of ownership and decision-making authority for data assets.

Answer

Data retention periods for each classification level

Answer

Methods for secure data destruction

Answer

Encryption standards for each classification level

Question 8

A security architect is designing a secure enclave for processing highly sensitive data. The architecture must ensure that even if the operating system is compromised, the enclave's memory contents remain confidential and integrity-protected. Which technology should be used?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel Software Guard Extensions (SGX) is the correct choice because it provides hardware-enforced isolation of memory regions (enclaves) that remain confidential and integrity-protected even if the operating system or hypervisor is compromised. SGX encrypts enclave memory on-die and decrypts it only within the CPU, preventing any privileged software from reading or tampering with the data.

Answer

Full disk encryption (FDE) with a strong passphrase

Answer

Trusted Platform Module (TPM)

Answer

Hypervisor-based isolation

Question 9

A small business wants to implement multifactor authentication (MFA) for remote access to its internal network. The solution must be cost-effective and easy to deploy. Which combination is most appropriate?

Accepted Answer

Password and one-time passcode sent via SMS. Option B is correct because it combines a password (something you know) with a one-time passcode sent via SMS (something you have), satisfying the definition of multifactor authentication. SMS-based OTP is cost-effective and easy to deploy for a small business, as it requires no additional hardware or complex infrastructure, leveraging existing mobile networks.

Answer

Fingerprint scanner and password

Answer

Smart card and PIN

Answer

Password and security questions

Question 10

A company deploys a web application that uses TLS to protect data in transit. The security team discovers that the server supports TLS 1.0 and uses a 1024-bit RSA certificate. What is the most significant security concern?

Accepted Answer

The server supports TLS 1.0. TLS 1.0 is a deprecated protocol with known vulnerabilities, including susceptibility to BEAST and POODLE attacks, which can allow an attacker to decrypt intercepted traffic. While a 1024-bit RSA key is weak, the most immediate and significant risk is the use of an outdated protocol that is actively exploited in the field. Disabling TLS 1.0 and enforcing TLS 1.2 or higher is the critical first step to secure data in transit.

Answer

The certificate uses RSA 1024-bit key

Answer

The server does not support HTTP/2

Answer

The server enables TLS session tickets