CISSP Practice Test 40 — 15 Questions

Question 1

A company is designing a disaster recovery strategy for its e-commerce platform. The platform requires an RTO of 2 hours and an RPO of 15 minutes. Which TWO strategies would BEST meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud DR with continuous data replication. Hot site and cloud DR with continuous replication can meet aggressive RTO/RPO.

Answer

Tape backup restoration

Answer

Cold site

Answer

Warm site

Question 2

Match each access control type to its description.

Accepted Answer

DAC: Access rights are assigned based on the identity of the user and the discretion of the data owner.. The four main access control models are DAC (owner-based), MAC (label-based), RBAC (role-based), and ABAC (attribute-based). Common confusions include swapping DAC with MAC and RBAC with ABAC.

Answer

DAC: Access is controlled by comparing security labels with user clearances; users cannot change access.

Answer

RBAC: Access decisions are based on attributes of the user, resource, and environment.

Question 3

An organization is developing a new application that collects and processes European customers' personal data. To comply with the privacy by design principles under GDPR, which THREE measures should be implemented? (Select THREE.)

Accepted Answer

Retain the data only as long as necessary to fulfill the purpose (storage limitation). Privacy by design principles include data minimization (collect only necessary data), purpose limitation (use data only for specified purpose), and storage limitation (retain data only as long as needed). Encryption is a security measure, not a privacy by design principle. Consent is important but not a design principle per se.

Answer

Encrypt all personal data at rest and in transit

Answer

Obtain explicit consent from users before data collection

Question 4

Which TWO of the following are examples of security metrics that can be used as key performance indicators (KPIs)?

Accepted Answer

Mean time to remediate critical vulnerabilities. Security KPIs often include patch compliance percentages and mean time to remediate critical vulnerabilities.

Answer

Number of servers in the data center

Answer

Total IT budget

Answer

Number of employees in the security department

Question 5

A security analyst is reviewing logs from multiple systems in a centralized log management platform. Which TWO of the following are primary benefits of centralized log management?

Accepted Answer

Simplifies compliance with log retention requirements. Centralized log management facilitates correlation across systems and simplifies compliance by providing a single source for log retention and review.

Answer

Eliminates the need for log retention policies

Answer

Reduces the volume of logs generated

Answer

Automatically patches vulnerabilities

Question 6

Which TWO of the following are benefits of authenticated vulnerability scanning compared to unauthenticated scanning?

Accepted Answer

Can detect vulnerabilities that require valid credentials to be seen. Authenticated scans have deeper access, allowing them to detect vulnerabilities that require valid credentials, such as missing patches and configuration issues.

Answer

Reduces network traffic

Answer

Eliminates false positives entirely

Answer

Does not require network access

Question 7

A SOC manager is designing a tiered incident response team. Which THREE of the following are standard roles in an incident response team according to industry best practices?

Accepted Answer

Forensic Investigator. Standard IR team roles include IR manager, security analyst, forensic investigator, communications lead, and legal counsel.

Answer

Human Resources Representative

Answer

Chief Financial Officer

Question 8

A company is implementing PCI DSS compliance. Which THREE requirements are part of the PCI DSS? (Select THREE)

Accepted Answer

Encrypt transmission of cardholder data across open, public networks. PCI DSS has 12 requirements including installing firewalls, encrypting cardholder data, and restricting physical access. Implementing MFA for all users is not a specific requirement (though it may be part of access control).

Answer

Use only approved encryption algorithms for stored data

Answer

Implement multi-factor authentication for all employees

Question 9

A security analyst is evaluating a web application firewall (WAF). Which TWO features are most critical for preventing common web attacks?

Accepted Answer

Signature-based detection.. Signature-based detection catches known attack patterns; behavioral analysis identifies anomalies and unknown attacks. SSL inspection is for decryption, not prevention. Rate limiting is for availability. Virtual patching is a specific technique that is less critical than core detection engines.

Answer

Virtual patching.

Answer

SSL inspection.

Answer

Rate limiting.

Question 10

Which of the following are characteristics of a Trusted Execution Environment (TEE)? (Choose TWO)

Accepted Answer

It provides hardware-enforced isolation from the main OS. A TEE provides hardware-enforced isolation and a secure area for code execution, protecting sensitive data from the main OS.

Answer

It is only available in cloud environments

Answer

It runs as a separate virtual machine

Answer

It requires a TPM chip

Question 11

A security engineer is hardening a web application against race condition vulnerabilities. Which TWO techniques are effective mitigations?

Accepted Answer

Implementing file locking. Using atomic operations and implementing proper locking mechanisms prevent race conditions. Input validation alone does not prevent race conditions.

Answer

Enabling ASLR

Answer

Input validation

Answer

Using prepared statements

Question 12

A data breach has occurred involving a database that contains personally identifiable information (PII). As part of incident response, the organization needs to identify all roles responsible for data protection. Which TWO roles are primarily accountable for data classification and protection requirements according to typical data governance frameworks?

Accepted Answer

Senior management. The data owner is accountable for classification and protection requirements, while senior management has ultimate accountability.

Answer

Data subject

Answer

Data steward

Answer

Data custodian

Question 13

A security analyst is reviewing the authentication mechanism of a web application. Which TWO of the following are examples of broken authentication vulnerabilities?

Accepted Answer

Lack of multi-factor authentication for sensitive actions. Allowing weak passwords (e.g., 'password123') and not having multi-factor authentication (MFA) are broken authentication issues. Session timeout is a security control, not a vulnerability. Verbose error messages are a misconfiguration, and IDOR is an access control issue.

Answer

Insecure direct object reference in profile URLs

Answer

Verbose error messages disclosing user IDs

Answer

Session timeout set to 60 minutes

Question 14

An organization is designing a security operations center (SOC) with three tiers. Which TWO of the following are typical responsibilities of Tier 1 analysts? (Select TWO)

Accepted Answer

Monitoring SIEM alerts and performing initial triage. Tier 1 analysts monitor alerts, perform initial triage, and escalate as needed.

Answer

Performing threat hunting

Answer

Conducting in-depth forensic analysis

Answer

Developing new detection rules for the SIEM

Question 15

A security analyst is identifying incident categories for a new incident response plan. Which TWO of the following are valid incident categories according to standard IR frameworks?

Accepted Answer

Denial of Service (DoS). Common incident categories include Denial of Service, malware, data breach, insider threat, unauthorized access, and social engineering.

Answer

Change request

Answer

Patch management failure

Answer

Business continuity exercise