CISSP Practice Test 41 — 15 Questions

Question 1

A company is implementing PCI DSS compliance. Which requirement is related to protecting cardholder data at rest?

Accepted Answer

Protect stored cardholder data. PCI DSS Requirement 3 is 'Protect stored cardholder data,' which specifically addresses data at rest through encryption, truncation, masking, and hashing. This requirement mandates protections for cardholder data wherever it is stored, including databases, files, and backups.

Answer

Restrict physical access to cardholder data

Answer

Encrypt transmission of cardholder data over open networks

Answer

Install and maintain a firewall configuration

Question 2

A user reports that they cannot access a file share after being moved to a different department. The file share is secured with NTFS permissions and share permissions. The user is a member of the 'Marketing' group, but the file share is only accessible by 'Sales' group. What is the most likely reason?

Accepted Answer

The user is not a member of the Sales group. The user is unable to access the file share because the share is explicitly configured to allow access only to the 'Sales' group. Since the user has been moved to a different department and is now a member of 'Marketing' rather than 'Sales', they lack the necessary group membership. Even if share permissions were permissive, NTFS permissions would still need to grant access; however, the core issue is that the user is not in the required group. This is the most direct and likely reason for the access failure.

Answer

The share permissions deny access to Marketing

Answer

The user's account is disabled

Answer

The NTFS permissions deny access

Question 3

Which TWO are security benefits of using a federated identity model?

Accepted Answer

Simplified user management across organizations. Option A (Simplified user management across organizations) is correct because federation lets each organization manage its own users in its own identity provider (IdP) while relying parties trust assertions via standards like SAML 2.0 or OpenID Connect, eliminating the need to duplicate accounts and provisioning across partner domains. Option D (Reduced risk of credential theft) is correct because users authenticate only to their home IdP and services receive tokens/assertions rather than reusable passwords, so credentials are not stored or transmitted to every relying party, shrinking the attack surface for credential harvesting. Option B is not marked correct because federation shifts trust to the IdP and does not inherently strengthen authentication strength; that requires MFA, certificate-based auth, or similar controls. Option C is wrong because password policies still apply at the IdP and are not eliminated by federation. Option E is wrong because federation is not inherently a single point of failure; well-designed deployments use multiple IdPs, failover, and fallback authentication to avoid that.

Answer

Stronger authentication due to shared trust

Answer

Elimination of password policies

Answer

Single point of failure for authentication

Question 4

During a security assessment, a penetration tester discovers that a web application exposes internal IP addresses in error messages. Which vulnerability category does this represent?

Accepted Answer

Security misconfiguration. Exposing internal IP addresses in error messages is a classic example of a security misconfiguration (C). The web application is likely configured to output detailed error messages (e.g., stack traces or debug information) that include internal network details, which should be suppressed in production environments. This violates the principle of least information disclosure and is categorized under security misconfiguration because it stems from improper default or runtime settings.

Answer

Broken access control

Answer

Sensitive data exposure

Answer

Insecure deserialization

Question 5

During an internal security assessment, a tester uses a tool to attempt to crack password hashes extracted from a domain controller. Which phase of the penetration testing process does this represent?

Accepted Answer

Post-exploitation. C is correct because cracking password hashes extracted from a domain controller occurs after the tester has already gained access to the system. This activity is part of the post-exploitation phase, where the tester escalates privileges, extracts credentials, and moves laterally. In this context, the tester is using a tool like John the Ripper or Hashcat to crack NTLM hashes, which is a classic post-exploitation step to obtain plaintext passwords for further access.

Answer

Reconnaissance

Answer

Reporting

Answer

Exploitation

Question 6

A security policy requires that a user cannot have both the ability to create purchase orders and approve invoices. This is an example of:

Accepted Answer

Separation of duties. Separation of duties is a principle that prevents a single individual from having control over all aspects of a critical process. In this case, requiring that a user cannot both create purchase orders and approve invoices ensures that no single person can initiate and authorize a transaction, reducing the risk of fraud or error. This is a classic example of separation of duties.

Answer

Need-to-know

Answer

Least privilege

Answer

Job rotation

Question 7

A security architect is evaluating security models for a multilevel secure system. Which model enforces the * property (no write down) and is typically used for confidentiality?

Accepted Answer

Bell-LaPadula. The Bell-LaPadula model enforces the * (star) property, which prohibits subjects from writing to objects at a lower classification level (no write down). This property, combined with the simple security property (no read up), ensures that information cannot flow from higher to lower security levels, making it the standard model for enforcing confidentiality in multilevel secure systems.

Answer

Clark-Wilson

Answer

Brewer-Nash

Answer

Biba

Question 8

An organization is implementing privacy by design in a new application that collects user location data. Which practice best aligns with the data minimization principle?

Accepted Answer

Collecting location data only when the app is actively in use. Data minimization means collecting only the data that is necessary for the specified purpose. Collecting location data only when the app is actively in use limits collection to the minimum needed for the app's functionality, directly aligning with the principle.

Answer

Encrypting location data both at rest and in transit

Answer

Anonymizing location data after collection

Answer

Obtaining explicit consent from users before collection

Question 9

A forensic investigator arrives at a crime scene involving a compromised server. The server is still running. According to the order of volatility, which of the following should the investigator capture FIRST?

Accepted Answer

CPU registers. The order of volatility ranks evidence by how quickly it disappears, and CPU registers/cache are the most volatile — they change with every instruction cycle and are lost the instant power is cut or the process is preempted. Capturing CPU registers first preserves the most perishable evidence before it is overwritten. RAM, disk, and network connections are progressively less volatile by comparison.

Answer

RAM contents

Answer

Hard disk contents

Answer

Network connections

Question 10

A company is designing a disaster recovery plan. They need to recover critical systems within 4 hours and lose no more than 15 minutes of data. Which combination of RTO and RPO should be specified?

Accepted Answer

RTO = 4 hours, RPO = 15 minutes. RTO (Recovery Time Objective) defines the maximum acceptable downtime — how long until systems are restored — so 4 hours matches the requirement to recover critical systems within 4 hours. RPO (Recovery Point Objective) defines the maximum acceptable data loss measured in time, so 15 minutes matches the requirement to lose no more than 15 minutes of data. Option C is the only pairing that maps each objective to its correct definition.

Answer

RTO = 15 minutes, RPO = 4 hours

Answer

RTO = 4 hours, RPO = 4 hours

Answer

RTO = 15 minutes, RPO = 15 minutes

Question 11

A security architect is designing an authentication system for a healthcare application that requires strong security. The system will use a password and a one-time passcode sent via SMS. How many authentication factor types are being used?

Accepted Answer

Two. Password is Type 1 (something you know), SMS OTP is Type 2 (something you have, as the phone is possessed). Only two factor types are used.

Answer

Three

Answer

Four

Answer

One

Question 12

Which of the following is the primary purpose of a security assessment?

Accepted Answer

To identify and evaluate security risks. A security assessment's primary purpose is to systematically identify and evaluate security risks by analyzing assets, threats, vulnerabilities, and existing controls. This aligns with the NIST SP 800-115 framework, which defines assessment as the process of determining how effectively an entity is meeting specific security objectives, not as a remediation or enforcement activity.

Answer

To fix all vulnerabilities

Answer

To achieve compliance with regulations

Answer

To punish non-compliant employees

Question 13

An organization is implementing a security information and event management (SIEM) system. Which THREE factors are most critical for the SIEM to provide actionable security insights?

Accepted Answer

Real-time alerting capabilities. Option A (Real-time alerting capabilities) is critical because a SIEM must detect and notify on security events as they occur, enabling rapid incident response before attackers can escalate or exfiltrate data. Option C (Correlation rules that match attack patterns) is essential because correlation engines combine events across multiple sources to identify multi-stage attack sequences (e.g., brute force followed by successful login), which isolated log entries would not reveal. Option E (Accurate and normalized log sources) is fundamental because the SIEM's analytics depend on consistent, correctly parsed data in a common schema; if sources are missing, malformed, or unnormalized, correlation and alerting produce unreliable results. Option B (storing raw logs for one year) is a retention/compliance consideration rather than a driver of actionable insight, and Option D (low false-positive rate) is a desirable tuning outcome, not a foundational input factor like the three marked correct.

Answer

Ability to store raw logs for one year

Answer

Low false-positive rate

Question 14

A healthcare organization must decommission a server containing protected health information (PHI). Which data sanitization method ensures the data is irrecoverable while complying with regulatory requirements?

Accepted Answer

Physically shred the hard drive. Physical destruction, such as shredding, is the most secure method of data sanitization (the 'Destroy' level in NIST SP 800-88). It physically breaks the media into tiny pieces, ensuring that data is completely irrecoverable. This is the most compliant method under regulations like HIPAA for decommissioning assets containing PHI. Degaussing (Option B) is only effective for magnetic media (HDDs) and is completely ineffective on Solid-State Drives (SSDs), which are common in modern servers. Overwriting (Option D) and formatting (Option A) do not meet the strict destruction standards required for decommissioning high-sensitivity PHI assets.

Answer

Reformat the hard drive with a quick format

Answer

Degauss the hard drive

Answer

Overwrite the hard drive with a single pass of zeros

Question 15

A government contractor handles classified information up to the Secret level. The company's data classification policy recently changed, requiring that all documents marked as 'Confidential' be reclassified as 'Secret' after review. Who is ultimately accountable for ensuring that reclassification is performed correctly?

Accepted Answer

Data owner. The data owner is the senior-level manager accountable for data classification and protection. They have the authority and responsibility to assign classification levels and ensure data is properly classified.

Answer

Data custodian

Answer

Data subject

Answer

Data steward