CISSP Practice Test 41 — 15 Questions

Question 1

Which TWO of the following are OAuth 2.0 grant types? (Choose two.)

Accepted Answer

Client credentials. Authorization code and client credentials are standard OAuth 2.0 grant types.

Answer

SAML assertion

Answer

LDAP bind

Answer

Kerberos ticket

Question 2

A company is implementing a PKI to support secure web browsing. Which of the following are commonly used to enhance the security of certificate validation? (Choose TWO)

Accepted Answer

OCSP stapling. OCSP stapling allows the server to present a timestamped OCSP response, reducing load on CA. Certificate pinning associates a host with a specific certificate or public key to prevent MITM attacks.

Answer

Certificate revocation lists (CRLs)

Answer

Self-signed root certificates

Answer

Wildcard certificates

Question 3

A company is evaluating disaster recovery strategies and wants to minimize both RTO and RPO. Which THREE options provide the best combination of low RTO and low RPO? (Select THREE)

Accepted Answer

Cloud DR with replication. Hot sites, cloud DR, and replication provide rapid recovery with minimal data loss.

Answer

Reciprocal agreement

Answer

Cold site

Question 4

An organization is implementing a Privileged Access Management (PAM) solution. Which THREE of the following are common features of PAM? (Select THREE.)

Accepted Answer

Password vaulting. PAM typically includes password vaulting, session recording, and just-in-time access. Break-glass accounts are also a feature, but the question asks for three of the most common.

Answer

Single sign-on

Answer

Role-based access control

Question 5

A security manager is choosing a risk response for a high-impact, high-likelihood risk. Which TWO responses are most appropriate? (Select TWO)

Accepted Answer

Risk mitigation. For high-impact, high-likelihood risks, avoidance (eliminating the activity) or mitigation (reducing impact/likelihood) are common. Transfer (insurance) may also be used but is less comprehensive. Acceptance is for low risks.

Answer

Risk research

Answer

Risk acceptance

Answer

Risk deferral

Question 6

A security architect is evaluating access control models for a healthcare system where users have specific roles (e.g., doctor, nurse, admin) and permissions are assigned based on those roles. However, the architect also wants to incorporate attributes such as time of day, patient consent status, and device type. Which TWO models should be combined to meet these requirements?

Accepted Answer

ABAC. RBAC provides role-based permissions, while ABAC adds flexibility with attributes. Combining them allows fine-grained control.

Answer

Clark-Wilson

Answer

MAC

Answer

DAC

Question 7

Which TWO of the following are examples of risk response strategies?

Accepted Answer

Risk acceptance. Risk avoidance eliminates the risk by not performing the activity that gives rise to it. Risk acceptance acknowledges the risk and makes a conscious decision to accept its potential consequences without additional mitigation, often because the cost of mitigation exceeds the potential impact.

Answer

Risk analysis

Answer

Risk identification

Answer

Risk communication

Question 8

An organization is implementing OpenID Connect (OIDC) for authentication. Which THREE of the following are components of OIDC? (Choose three.)

Accepted Answer

Authorization code flow. OIDC uses ID token, UserInfo endpoint, and OAuth 2.0 authorization framework.

Answer

Kerberos ticket granting ticket

Answer

SAML assertion

Question 9

A security architect is designing a secure communication channel between two remote sites over the internet. Which TWO of the following protocols should be used to ensure confidentiality, integrity, and authentication?

Accepted Answer

IPsec with ESP in tunnel mode. Options C (IPsec with ESP in tunnel mode) and E (L2TP over IPsec) provide encryption and authentication for site-to-site VPNs. IPsec ESP in tunnel mode encrypts the entire IP packet and provides integrity and authentication, making it suitable for secure site-to-site communication. L2TP over IPsec combines Layer 2 tunneling with IPsec encryption, offering a secure VPN tunnel. PPTP is outdated and insecure. SSL/TLS is typically used for client-to-site VPNs, not site-to-site. MPLS is a WAN technology but does not inherently provide encryption or authentication.

Answer

PPTP

Answer

SSL/TLS

Answer

MPLS

Question 10

A security analyst is evaluating access control models for a healthcare organization that needs to enforce both confidentiality and integrity. Which TWO models should be considered? Select two.

Accepted Answer

Bell-LaPadula. Bell-LaPadula enforces confidentiality; Biba enforces integrity. Together they address both requirements.

Answer

Take-Grant

Answer

Clark-Wilson

Answer

Brewer-Nash

Question 11

An organization is updating its incident response plan. According to best practices, which THREE components should be included in the plan?

Accepted Answer

Roles and responsibilities. An IR plan should include roles, communication plan, and recovery procedures.

Answer

Vendor product list

Answer

Employee performance reviews

Question 12

After a penetration test, the tester provides a report that includes vulnerabilities found, exploitation details, and recommended fixes. Which step of the penetration testing process does this represent?

Accepted Answer

Reporting. The reporting phase is the final step in the penetration testing process, where the tester documents all findings, including vulnerabilities discovered, exploitation details, and recommended remediation steps. This report is delivered to the client to provide a clear understanding of the security posture and actionable fixes. Without this step, the test results would have no value for improving security.

Answer

Post-exploitation

Answer

Planning and scoping

Answer

Reconnaissance

Question 13

A security auditor is reviewing an organization's governance framework. Which TWO of the following are commonly used frameworks for IT governance and security management?

Accepted Answer

ISO/IEC 27001. COBIT 2019 is a framework for IT governance and management. ISO/IEC 27001 is an international standard for information security management systems.

Answer

PMBOK

Answer

TOGAF

Answer

Six Sigma

Question 14

In the context of business continuity planning, which THREE of the following are typically identified during a business impact analysis (BIA)? (Select THREE.)

Accepted Answer

Critical business processes. During BIA, critical processes are identified, and metrics such as MTD (maximum tolerable downtime) and RPO (recovery point objective) are determined. Vendor contracts are not part of BIA; they are part of procurement or vendor management.

Answer

Preferred vendor contracts

Answer

Employee performance metrics

Question 15

An organization is developing a privacy program. Which THREE of the following are core principles of privacy by design? (Select 3)

Accepted Answer

Data minimization. Privacy by design includes data minimization, purpose limitation, and storage limitation among its principles.

Answer

Open data sharing

Answer

Maximum data retention