CISSP Practice Test 42 — 15 Questions

Question 1

A security architect is designing a system that must ensure integrity of commercial transactions. Which of the following models are specifically focused on integrity? (Choose TWO)

Accepted Answer

Biba. Biba is an integrity model using no write up/no read down. Clark-Wilson is a commercial integrity model based on well-formed transactions and separation of duties.

Answer

Take-Grant

Answer

Brewer-Nash

Answer

Bell-LaPadula

Question 2

Which IPsec protocol provides both authentication and encryption of the packet payload, but does not encrypt the IP header?

Accepted Answer

ESP in transport mode. ESP in transport mode encrypts the payload and provides authentication (via an optional ICV), but it does not encrypt the IP header. This matches the question's requirement of payload authentication and encryption without header encryption. In contrast, AH authenticates the entire packet (including the IP header) but provides no encryption.

Answer

AH in transport mode

Answer

AH in tunnel mode

Answer

ESP in tunnel mode

Question 3

An organization is reviewing its media sanitization procedures. Which TWO methods are considered acceptable for sanitizing solid-state drives (SSDs) according to NIST SP 800-88 guidelines?

Accepted Answer

Cryptographic erase. For SSDs, cryptographic erase and physical destruction are recommended. Overwriting is unreliable due to wear-leveling, and degaussing does not work on SSDs.

Answer

Degaussing

Answer

Overwriting with a random pattern

Answer

Data wiping software

Question 4

A security engineer is hardening a system against buffer overflow attacks. Which of the following are effective mitigations? (Choose THREE)

Accepted Answer

Address Space Layout Randomization (ASLR). ASLR randomizes memory addresses, DEP prevents code execution on the stack/heap, and stack canaries detect buffer overflows before control data is corrupted.

Answer

Using unpatched software

Answer

Disabling ASLR

Question 5

In the context of identity management, which TWO of the following are risks associated with orphaned accounts? (Choose two.)

Accepted Answer

Compliance violations. Orphaned accounts can be used by former employees or attackers, and may violate compliance.

Answer

Reduced system performance

Answer

Enhanced audit logging

Answer

Increased help desk calls

Question 6

Which THREE of the following are valid types of penetration testing based on the level of knowledge provided to the tester?

Accepted Answer

White box. Penetration tests can be black box (no knowledge), white box (full knowledge), or grey box (partial knowledge).

Answer

Blue box

Answer

Red box

Question 7

Which TWO of the following are examples of Type 3 authentication factors? (Choose two.)

Accepted Answer

Fingerprint. Type 3 factors are biometrics: fingerprint and retina scan.

Answer

Password

Answer

Smart card

Answer

One-time password token

Question 8

A security architect is designing a system to protect against side-channel attacks that exploit electromagnetic emanations. Which TWO controls are most effective?

Accepted Answer

TEMPEST shielding. TEMPEST shielding reduces emanations, and Faraday cages block electromagnetic signals. While physical access control is important, it does not directly address emanations.

Answer

Data encryption at rest

Answer

Intrusion detection system

Answer

Time-based access controls

Question 9

An employee leaves the company, and their user account is not disabled. This creates a security risk known as:

Accepted Answer

Orphaned account. An orphaned account is a user account that remains active in the identity management system after the employee has left the organization. This creates a security risk because the account can be exploited by attackers or former employees to gain unauthorized access to systems, data, or network resources, bypassing access controls that rely on account deactivation.

Answer

Insider threat

Answer

Privilege creep

Answer

Separation of duties violation

Question 10

A company wants to implement multi-factor authentication (MFA) for remote access. Which combination of factors represents something you have and something you are?

Accepted Answer

Smart card and fingerprint. A smart card is a physical device that you possess (something you have), and a fingerprint is a biometric characteristic unique to you (something you are). This combination satisfies the multi-factor authentication requirement by using two distinct factors from different categories, which is more secure than using two factors from the same category.

Answer

Password and PIN

Answer

Hardware token and mobile phone

Answer

Password and SMS code

Question 11

A web application exposes an API that allows users to fetch data from internal network resources based on a URL parameter. An attacker discovers they can use this API to access internal servers that are not meant to be public. Which vulnerability is being exploited?

Accepted Answer

Server-side request forgery (SSRF). SSRF allows an attacker to induce the server to make requests to internal or external resources, bypassing firewalls and access controls.

Answer

Insecure direct object reference (IDOR)

Answer

Remote code execution (RCE)

Answer

Cross-site request forgery (CSRF)

Question 12

An organization is selecting security metrics to report to the board. Which THREE metrics would best demonstrate the effectiveness of the vulnerability management program?

Accepted Answer

Open vulnerability count by severity. These three metrics cover remediation speed, current risk posture, and compliance with patching policies, which are key indicators.

Answer

Number of employees in IT security

Answer

Budget for security tools

Question 13

A security analyst discovers that a business unit is storing sensitive data on a file share without classification labels. What is the first step to remediate?

Accepted Answer

Notify the data owner to classify the data. The first step in remediating unclassified sensitive data is to notify the data owner, who is responsible for assigning classification labels based on organizational policy. Without classification, subsequent security controls (e.g., encryption, access controls) cannot be correctly applied because the data's sensitivity level is unknown. This aligns with the CISSP principle that data classification must precede protection mechanisms.

Answer

Move the data to a secure server

Answer

Immediately delete the data

Answer

Encrypt the file share

Question 14

Which security control is most effective for preventing unauthorized access to a data center?

Accepted Answer

Mantrap. A mantrap provides a physical barrier that prevents tailgating and ensures one person enters at a time. Biometrics and video surveillance are controls but less direct prevention. Access logs are detective.

Answer

Biometric authentication

Answer

Access logs

Answer

Video surveillance

Question 15

During a code review, a developer identifies a SQL injection vulnerability. What is the most effective fix?

Accepted Answer

Implement parameterized queries.. Parameterized queries (prepared statements) ensure user input is treated as data, not executable code. Stored procedures can still be vulnerable if dynamically built. Escaping input is error-prone. ORMs often use SQL underneath and may not prevent injection if misused.

Answer

Use stored procedures exclusively.

Answer

Use an ORM framework.

Answer

Escape all input.