CISSP Practice Test 40 — 15 Questions

Question 1

Which THREE of the following are examples of asymmetric cryptographic algorithms? (Select THREE.)

Accepted Answer

Elliptic Curve Cryptography (ECC). Elliptic Curve Cryptography (ECC) is an asymmetric cryptographic algorithm that uses the algebraic structure of elliptic curves over finite fields to provide security with smaller key sizes compared to RSA. It relies on the Elliptic Curve Discrete Logarithm Problem (ECDLP) for its security, making it computationally infeasible to derive the private key from the public key. ECC is widely used in modern protocols such as TLS, SSH, and Bitcoin for key exchange and digital signatures.

Answer

AES

Answer

Blowfish

Question 2

Which of the following BEST describes the difference between a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP)?

Accepted Answer

BCP ensures business functions continue, DRP restores IT operations. D is correct because the Business Continuity Plan (BCP) focuses on maintaining critical business functions during and after a disruption, ensuring minimal impact on operations, while the Disaster Recovery Plan (DRP) is a subset of BCP that specifically addresses the restoration of IT infrastructure, systems, and data after a disaster. The BCP encompasses broader organizational resilience, including manual workarounds and alternate sites, whereas the DRP targets technical recovery procedures such as system rebuilds, data restoration from backups, and failover to redundant systems.

Answer

BCP deals with natural disasters, DRP deals with cyberattacks

Answer

BCP is for IT systems, DRP is for business processes

Answer

BCP is a subset of DRP

Question 3

A financial institution is required to comply with SOX. Which of the following is a key focus area for IT under SOX?

Accepted Answer

IT general controls for financial systems. SOX Section 404 requires management to assess and auditors to attest to the effectiveness of internal controls over financial reporting (ICFR). IT general controls (ITGCs) — change management, access control, IT operations, and SDLC controls — are the primary mechanism by which IT supports that assertion for financial systems. Encryption, breach notification, and privacy are important but are not the defining IT compliance focus of SOX.

Answer

Encryption of data at rest

Answer

Breach notification procedures

Answer

Privacy of customer data

Question 4

A data warehouse contains anonymized customer transaction data used for analytics. The anonymization process removed direct identifiers and applied k-anonymity with k=10. An attacker obtains the dataset and attempts to re-identify individuals using auxiliary information. Which of the following best describes the residual privacy risk?

Accepted Answer

Moderate risk because k-anonymity does not protect against attribute disclosure if the group is homogeneous. k-anonymity means each record is indistinguishable from at least k-1 other records, but attacks like homogeneity or background knowledge can still lead to re-identification, especially if auxiliary data is available.

Answer

No risk because anonymization eliminates all PII

Answer

High risk because k=10 is too small to provide meaningful privacy

Answer

Low risk because k=10 ensures a group of at least 10 individuals

Question 5

Which of the following best describes the primary purpose of an incident response plan?

Accepted Answer

To provide a structured approach for managing and resolving security incidents. An incident response plan provides a structured approach to manage and resolve security incidents, minimizing impact.

Answer

To replace the need for a disaster recovery plan

Answer

To assign blame after an incident occurs

Answer

To document all security controls in place

Question 6

During a code review, a developer identifies a SQL injection vulnerability. What is the most effective fix?

Accepted Answer

Implement parameterized queries.. Parameterized queries (prepared statements) ensure user input is treated as data, not executable code. Stored procedures can still be vulnerable if dynamically built. Escaping input is error-prone. ORMs often use SQL underneath and may not prevent injection if misused.

Answer

Use stored procedures exclusively.

Answer

Use an ORM framework.

Answer

Escape all input.

Question 7

An organization has a maximum tolerable downtime (MTD) of 8 hours for a critical application. The recovery time objective (RTO) is set to 4 hours. Which of the following best describes the purpose of the RTO?

Accepted Answer

The time within which IT systems must be restored. RTO defines the maximum time allowed to restore IT services after a disaster, ensuring the MTD is not exceeded.

Answer

The total downtime the organization can tolerate

Answer

The maximum amount of data loss acceptable

Answer

The time required to repair a failed component

Question 8

Refer to the exhibit. A security analyst receives this alert. What is the most likely explanation for the successful login after the account was disabled?

Accepted Answer

The account disabling had not yet propagated to all domain controllers, allowing authentication against a non-updated DC.. Option A is correct: in an Active Directory environment, account disablement is replicated between domain controllers using multi-master replication, which is not instantaneous, so a logon attempt can still succeed against a DC that has not yet received the change. This is the classic explanation for a successful authentication shortly after an account was disabled, especially if the authenticating DC differs from the one where the change was made. Option B is possible in theory but is not the most likely explanation and would require an unlogged administrative action, which the scenario does not support. Option C is inaccurate because domain controllers do not cache accounts in a way that lets a disabled account authenticate; credential caching occurs on client workstations for interactive logons. Option D is incorrect because a replay attack would not bypass the disabled-account state on a DC that has already applied the change.

Answer

The account was re-enabled by an administrator without logging.

Answer

The account was cached in the domain controller, allowing authentication despite being disabled.

Answer

The attacker used a replay attack to bypass authentication.

Question 9

A developer is implementing cryptographic storage for sensitive user data. Which of the following is a cryptographic best practice?

Accepted Answer

Using AES-256 in Galois/Counter Mode (GCM) for authenticated encryption. Industry-standard algorithms like AES-256 and SHA-256 are recommended, while MD5 and SHA-1 are deprecated due to weaknesses. Authenticated encryption (e.g., GCM) provides both confidentiality and integrity.

Answer

Using a static initialization vector (IV) for all encryption operations

Answer

Encrypting data with a hardcoded key in source code

Answer

Hashing passwords with MD5 for performance

Question 10

A security engineer is investigating a covert channel in a system. Which TWO types of covert channels could be used to leak information from a high-security to a low-security process?

Accepted Answer

Covert timing channel. Option C, a covert timing channel, is correct because it leaks information by modulating the timing of events (e.g., CPU scheduling, packet delays, or response latencies) so that a high-security process signals bits to a low-security process without sharing a direct data object. Option E, a covert storage channel, is correct because it leaks information by writing to and reading from a shared storage resource (e.g., file locks, disk sectors, or memory locations) whose presence or value is observable across security levels. Option A, TOCTOU, is a race-condition vulnerability class, not a covert channel type, so it does not belong. Option B, emanations, refers to unintentional electromagnetic or acoustic leakage, which is a side-channel phenomenon rather than the intentional signaling mechanism of a covert channel. Option D, side-channel, is a broader category of information leakage (e.g., power, cache, or timing analysis) and is not one of the two standard covert channel types asked for here.

Answer

TOCTOU

Answer

Emanations

Answer

Side-channel

Question 11

Which of the following is a key requirement under the GDPR regarding personal data breaches?

Accepted Answer

Notify the supervisory authority within 72 hours. Under GDPR Article 33, a controller must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. This 72-hour window is the core regulatory deadline tested here. Notification to individuals (Article 34) is only required when the breach poses a high risk, and it has no fixed 24-hour deadline.

Answer

Conduct a privacy impact assessment within 30 days

Answer

Report the breach to law enforcement immediately

Answer

Notify affected individuals within 24 hours

Question 12

A company is merging with another and must integrate security policies. What is the first step?

Accepted Answer

Conduct a gap analysis. The first step in integrating security policies during a merger is to conduct a gap analysis. This systematically compares the existing policies, controls, and compliance requirements of both organizations against each other and against relevant standards (e.g., ISO 27001, NIST SP 800-53). Without understanding the current state and discrepancies, any subsequent policy creation, training, or adoption of a stricter policy would be uninformed and likely ineffective.

Answer

Train all employees

Answer

Create a new policy

Answer

Adopt the stricter policy

Question 13

A security team is planning a social engineering test for their organization. Which of the following scenarios would BEST assess the effectiveness of security awareness training?

Accepted Answer

Sending a phishing email that mimics a common internal communication.. Sending a phishing email that mimics a common internal communication directly tests whether employees can recognize and report a realistic social engineering attempt, which is the primary goal of security awareness training. This scenario evaluates the human firewall by simulating the most prevalent attack vector—email-based phishing—and measures the effectiveness of training in reducing click-through rates and increasing reporting behavior.

Answer

Calling employees and pretending to be IT support to obtain passwords.

Answer

Attempting to tailgate into a secure facility.

Answer

Searching through trash bins for sensitive documents.

Question 14

Which authentication factor type is a smart card?

Accepted Answer

Type 2 (something you have). A smart card is a Type 2 authentication factor because it falls under the 'something you have' category. The card itself is a physical device that stores a digital certificate or cryptographic key, which the user must possess to authenticate. Unlike knowledge-based or biometric factors, possession of the smart card is the core authentication mechanism, often combined with a PIN (Type 1) for two-factor authentication.

Answer

Somewhere you are

Answer

Type 3 (something you are)

Answer

Type 1 (something you know)

Question 15

Under the ISC2 Code of Ethics, which canon takes precedence over all others?

Accepted Answer

Protect society, the common good, and the infrastructure. The ISC2 Code of Ethics canons are ordered by precedence, and the first canon—'Protect society, the common good, and the infrastructure'—takes priority over all others. This means that when ethical obligations conflict, a CISSP must prioritize the safety and well-being of society and critical infrastructure above duties to clients, employers, or the profession. The remaining canons are subordinate and must be interpreted in light of this primary obligation.

Answer

Provide diligent and competent service to principals

Answer

Act honorably, honestly, justly, responsibly, and legally

Answer

Advance and protect the profession