CISSP Practice Test 42 — 15 Questions

Question 1

Refer to the exhibit. A legal hold exception preserves FinancialRecords FIN-001 and FIN-002. What is the correct action for FinancialRecords that are not under legal hold?

Accepted Answer

They should be deleted after 2555 days. In CISSP and general data lifecycle management, a retention policy defines the maximum period for which data should be kept. Once the retention period (e.g., 2555 days / 7 years) expires, the standard and legally compliant action is to securely destroy/delete the data to limit liability and adhere to data minimization principles (unless a legal hold is active). Archiving is a method of retention, not an action taken after the retention period expires. Therefore, Option C (deleted after 2555 days) is typically the correct compliance action, not Option B.

Answer

They should be audited and then preserved indefinitely

Answer

They should be archived after 2555 days

Answer

They should be deleted after 365 days

Question 2

Which TWO of the following are key elements of a disaster recovery plan (DRP)?

Accepted Answer

Communication and notification procedures. Option A (Communication and notification procedures) is correct because a DRP must define exactly who is contacted, in what order, through which channels (phone, email, out-of-band), and how stakeholders, staff, and vendors are notified during and after a disruptive event. Option D (Recovery priorities and order of restoration) is correct because a DRP must specify the sequence in which systems, applications, and services are brought back online, typically driven by criticality and dependencies so the most vital functions are restored first. Options B and C are incorrect because standard operating procedures for daily tasks and patch management schedules are routine operational/IT management artifacts, not disaster recovery elements. Option E is incorrect because the business impact analysis (BIA) is an input that feeds the DRP by identifying critical processes and RTO/RPO targets, but the BIA results themselves are not a key element of the plan.

Answer

Standard operating procedures for daily tasks

Answer

Patch management schedules

Answer

Business impact analysis (BIA) results

Question 3

An organization is required to retain audit logs for seven years due to regulatory compliance. The logs are currently stored on a file server that is approaching capacity. What is the BEST way to manage log storage?

Accepted Answer

Compress logs and move them to low-cost archival storage.. It balances the seven-year retention requirement with storage constraints by compressing logs (reducing size) and moving them to low-cost archival storage (e.g., cold storage or tape). This preserves data integrity and accessibility for compliance audits while freeing up space on the primary file server.

Answer

Reduce the logging level to generate less data.

Answer

Delete logs older than one year.

Answer

Increase the frequency of log rotation.

Question 4

Which of the following is the PRIMARY purpose of a business impact analysis (BIA) in business continuity planning?

Accepted Answer

Identify critical business functions and dependencies. The primary purpose of a business impact analysis (BIA) is to identify critical business functions and their dependencies on resources such as personnel, systems, data, and third-party services. This identification drives all subsequent continuity planning by quantifying the impact of disruptions and establishing the basis for recovery strategies. Without a BIA, recovery objectives and plans would be based on assumptions rather than empirical data about operational priorities.

Answer

Develop and test the continuity plan

Answer

Determine recovery time objectives (RTO) and recovery point objectives (RPO)

Answer

Create the business continuity plan document

Question 5

A company has multiple offices connected via a WAN. They want to ensure that all traffic between offices is encrypted and authenticated. Which technology is most appropriate?

Accepted Answer

IPsec VPN. IPsec VPN is the most appropriate technology because it operates at the network layer (Layer 3) and provides both encryption and authentication for all IP traffic between sites over an untrusted WAN. It uses protocols such as ESP (Encapsulating Security Payload) for confidentiality and AH (Authentication Header) or ESP for integrity and authentication, ensuring that all inter-office traffic is protected in transit.

Answer

MPLS

Answer

DMVPN

Answer

SSL VPN

Question 6

A developer is tasked with securely storing user passwords in a database. Which of the following is the most secure approach?

Accepted Answer

Hash the password with bcrypt using a unique salt per user. Bcrypt is a computationally expensive, adaptive hashing algorithm designed specifically for password storage. It incorporates a unique salt per user to prevent rainbow table attacks and its work factor can be increased over time to counter faster hardware, making it the most secure option among those listed.

Answer

Do not store passwords; use federated identity

Answer

Encrypt the password using AES and store the ciphertext

Answer

Hash the password with MD5 and store the hash

Question 7

A security analyst is conducting a vulnerability scan of a web application. The scan identifies several vulnerabilities, but the analyst wants to minimize false positives. Which type of vulnerability scan would be most appropriate?

Accepted Answer

Authenticated scan. An authenticated scan uses valid credentials to log into the target system, allowing the scanner to access deeper configuration details and patch levels. This reduces false positives by distinguishing between vulnerabilities that are actually present and those that appear due to incomplete visibility, such as missing patches that are actually applied but not visible to an unauthenticated scanner.

Answer

External scan

Answer

Passive scan

Answer

Unauthenticated scan

Question 8

During a code review, a developer encounters the following code snippet in a Java web application used to authenticate users:

String query = "SELECT * FROM users WHERE username = '" + request.getParameter("user") + "' AND password = '" + request.getParameter("pass") + "'";

Which of the following is the MOST effective remediation?

Accepted Answer

Replace the concatenated query with a prepared statement and bind parameters. Prepared statements with parameterized queries separate SQL logic from user input, preventing SQL injection entirely. In Java, using PreparedStatement with bind variables (e.g., `ps.setString(1, user)`) ensures the database treats input as data, not executable code, which is the only reliable defense against SQL injection attacks.

Answer

Use regular expressions to validate the username and password inputs

Answer

Encode the input using HTML entity encoding before inclusion in the query

Answer

Escape single quotes in the input parameters

Question 9

A PAM configuration contains pam_tally2.so with deny=5 and unlock_time=300. What is the effect of this configuration?

Accepted Answer

Users are locked out after 5 failed login attempts, and automatically unlocked after 5 minutes. The PAM configuration shows pam_tally2.so with deny=5 and unlock_time=300. Pam_tally2.so with deny=5 locks the user account after 5 failed authentication attempts, and unlock_time=300 sets the automatic unlock period to 300 seconds (5 minutes). This is a standard PAM (Pluggable Authentication Modules) configuration for account lockout policies, commonly used on Linux systems to mitigate brute-force attacks.

Answer

The account is disabled after 5 successful logins

Answer

Passwords must be changed every 5 days

Answer

Users are locked out after 5 failed attempts until manually unlocked

Question 10

Which THREE of the following are common methods used in security assessment and testing? (Select exactly 3.)

Accepted Answer

Penetration testing. Penetration testing is a common method in security assessment and testing that simulates real-world attacks to identify exploitable vulnerabilities. Unlike vulnerability scanning, which only identifies potential weaknesses, penetration testing actively exploits them to validate security controls and measure the impact of a breach.

Answer

Risk analysis

Answer

Forensic analysis

Question 11

Which THREE of the following are recognized roles in asset security?

Accepted Answer

Data custodian. The data custodian (A) is responsible for implementing and maintaining security controls according to the data owner's directives, such as applying encryption, managing backups, and enforcing access controls. This role is recognized in asset security because it bridges policy and operational execution, ensuring the CIA triad is maintained on the stored or processed data.

Answer

Data subject

Answer

Data auditor

Question 12

A network engineer is configuring an IPsec VPN in tunnel mode. Which IPsec protocol provides both authentication and encryption of the entire IP packet?

Accepted Answer

ESP (Encapsulating Security Payload). ESP (Encapsulating Security Payload) in tunnel mode provides both authentication and encryption for the entire original IP packet, including the original header and payload. It encapsulates the packet with a new IP header and ESP trailer, ensuring confidentiality via encryption and integrity via authentication. This makes it the correct choice for a VPN requiring both security services.

Answer

IKE (Internet Key Exchange)

Answer

ISAKMP

Answer

AH (Authentication Header)

Question 13

An organization is required to retain security logs for a minimum of one year to meet compliance regulations. Which practice is most directly related to this requirement?

Accepted Answer

Log retention requirements. The requirement to retain security logs for a minimum of one year is directly about the duration logs must be stored. Option D, 'Log retention requirements,' is the practice that defines this storage duration, ensuring compliance with regulations such as PCI DSS or SOX. This is a policy-driven specification of how long logs are kept, not how they are reviewed, formatted, or collected.

Answer

Log review frequency

Answer

Log format standardization

Answer

Centralized log management

Question 14

A software development company uses a continuous integration/continuous deployment (CI/CD) pipeline that automatically builds and deploys code to production after passing automated tests. The code repository contains proprietary algorithms and customer data. A recent incident was traced to an attacker who injected malicious code into a library that was pulled from a public package repository during the build process. The company wants to prevent similar supply chain attacks without significantly slowing development. Which of the following is the BEST course of action?

Accepted Answer

Implement a private repository that mirrors approved open-source libraries and enforces signature verification and hash checks before allowing use. Implementing a private repository that mirrors only approved, vetted open-source libraries with enforced signature verification and hash checks directly addresses supply chain attacks by ensuring that only trusted, integrity-verified code enters the build pipeline. This approach prevents malicious code from public repositories from being pulled automatically, without requiring manual review of every library (which would slow development) or relying on post-build scanning that cannot prevent the initial injection. It aligns with the principle of secure software supply chain management by establishing a trusted source of components.

Answer

Require all developers to perform manual code review of every third-party library before inclusion

Answer

Perform static application security testing (SAST) on the entire codebase including libraries

Answer

Increase the frequency of vulnerability scanning on the production environment and delay deployment of any library that has a deprecation notice

Question 15

Which access control model assigns permissions based on a user's job function?

Accepted Answer

RBAC. Role-Based Access Control (RBAC) assigns permissions to roles, and users are assigned to roles based on their job function. This means a user's access is determined by their role (e.g., 'HR Manager', 'Financial Analyst'), not by individual object ownership or attributes. RBAC is the standard model for enforcing least privilege in enterprise environments.

Answer

MAC

Answer

DAC

Answer

ABAC