CISSP Practice Test 43 — 15 Questions

Question 1

A security engineer is configuring a firewall that makes decisions based on source/destination IP addresses and port numbers without tracking the state of connections. Which type of firewall is this?

Accepted Answer

Packet filter firewall. A packet filter firewall operates at Layers 3 and 4 of the OSI model, making forwarding decisions solely based on static fields such as source/destination IP addresses and port numbers. It does not maintain any connection state table, meaning each packet is evaluated independently without reference to previous packets. This stateless behavior is the defining characteristic that distinguishes it from stateful inspection firewalls.

Answer

Stateful inspection firewall

Answer

Application proxy firewall

Answer

Next-generation firewall

Question 2

Under the ISC2 Code of Ethics, which canon has the highest priority?

Accepted Answer

Protect society. The ISC2 Code of Ethics canons are ordered by priority: Protect society, the common good, necessary public trust and confidence, and the infrastructure; Act honorably, honestly, justly, responsibly, and legally; Provide diligent and competent service to principals; and Advance and protect the profession. Therefore, 'Protect society' is the highest priority canon.

Answer

Advance the profession

Answer

Provide diligent service

Answer

Act honorably

Question 3

Which VPN technology operates at Layer 2 of the OSI model and is often used in combination with IPsec to provide encryption?

Accepted Answer

L2TP. L2TP (Layer 2 Tunneling Protocol) operates at Layer 2 of the OSI model, encapsulating PPP frames to create a virtual point-to-point link. It is commonly combined with IPsec (specifically ESP in tunnel mode) to provide encryption, authentication, and integrity, as L2TP itself offers no confidentiality. This combination is defined in RFC 3193 and is widely used for remote-access VPNs.

Answer

WireGuard

Answer

IPsec

Answer

PPTP

Question 4

Which vulnerability scoring system provides a standardized severity rating for vulnerabilities based on exploitability and impact metrics?

Accepted Answer

CVSS. The Common Vulnerability Scoring System (CVSS) provides a standardized, quantitative framework for rating the severity of security vulnerabilities. It calculates a score from 0.0 to 10.0 based on exploitability metrics (e.g., attack vector, complexity, privileges required) and impact metrics (e.g., confidentiality, integrity, availability), enabling organizations to prioritize remediation efforts consistently.

Answer

NVD

Answer

CVE

Answer

CWE

Question 5

Which component of the AAA framework is responsible for determining what resources a user can access and what actions they can perform?

Accepted Answer

Authorization. Authorization is the AAA component that determines what resources a user can access and what actions they can perform after identity has been verified. It evaluates access policies, group memberships, and permissions to grant or deny specific operations. Authentication proves identity, accounting tracks activity, and auditing reviews logs — none of these define access rights.

Answer

Auditing

Answer

Authentication

Answer

Accounting

Question 6

You are the chief information security officer (CISO) of a large healthcare organization that handles protected health information (PHI). The organization has recently been acquired by a larger conglomerate, and the new parent company mandates that all subsidiaries adopt a single, unified risk management framework based on NIST SP 800-39. Your current framework is ISO 27005-based and has been effective for years. During the transition, you discover that the parent company's framework requires quantitative risk analysis for all critical assets, while your team has been primarily using qualitative analysis due to lack of accurate financial data. Moreover, the parent company expects all risk assessments to be completed within 30 days, a timeframe your team considers unrealistic given the number of assets. Several key stakeholders are concerned about the additional resource burden and potential disruption to operations. You need to propose a course of action that balances compliance with the parent company's mandate while maintaining operational effectiveness and minimizing risk to patient data.

Accepted Answer

Conduct a gap analysis between ISO 27005 and NIST SP 800-39, then develop a phased transition plan with a longer timeline, presenting it to the parent company's board for approval.. The best course of action is to conduct a gap analysis between the current ISO 27005 framework and the mandated NIST SP 800-39, then propose a phased transition plan with a realistic timeline. This balances compliance with the parent company's mandate while addressing the team's concerns about the 30-day timeframe and resource burden. Presenting it to the board for approval ensures executive buy-in and allows for negotiation of the timeline.

Answer

Continue using ISO 27005 and argue that it is equally valid, citing the principle of risk management flexibility and the disruption that a transition would cause.

Answer

Hire external consultants to perform the quantitative assessments, allowing the internal team to focus on existing operations, and accept the cost as a business necessity.

Answer

Immediately adopt the NIST framework and begin quantitative assessments, using industry-standard cost estimates to expedite the process within 30 days.

Question 7

A company is developing a mobile payment application. To comply with PCI DSS, what should be implemented to protect cardholder data during transmission?

Accepted Answer

Implement TLS 1.2 or higher with strong ciphers.. TLS 1.2 or higher with strong ciphers is the correct choice because PCI DSS Requirement 4 mandates that cardholder data must be encrypted using strong cryptography (e.g., TLS 1.2/1.3) during transmission over open, public networks. TLS provides mutual authentication, data integrity, and confidentiality through a handshake that negotiates a session key, protecting against eavesdropping and tampering.

Answer

Apply base64 encoding.

Answer

Use RC4 encryption.

Answer

Use SSL 3.0.

Question 8

A security analyst is examining a memory dump from a compromised workstation. Which TWO tools are commonly used for memory forensics?

Accepted Answer

Volatility. Volatility (C) is the de facto open-source framework for memory forensics, designed to parse raw memory images and extract artifacts such as processes, network connections, and injected code via plugins. Rekall (D) is another memory forensics framework, originally forked from Volatility, that analyzes RAM dumps for malware and rootkit indicators. Both operate directly on memory captures, which is exactly what the analyst needs. Wireshark (A) is a network protocol analyzer that inspects packet captures, not RAM dumps. EnCase (B) and FTK Imager (E) are disk imaging and file-system forensic tools, not memory analysis frameworks.

Answer

Wireshark

Answer

EnCase

Answer

FTK Imager

Question 9

During a penetration test, the tester has obtained initial access and is now trying to move laterally to other systems. Which phase of the penetration testing process does this represent?

Accepted Answer

Post-exploitation/lateral movement. The post-exploitation/lateral movement phase occurs after initial access is gained, where the tester uses compromised systems as pivot points to access other network segments, often leveraging tools like PsExec, WMI, or SMB relay to move across hosts. This phase is distinct from exploitation, which focuses on gaining the initial foothold, and reconnaissance, which occurs before any access is obtained.

Answer

Reconnaissance

Answer

Reporting

Answer

Exploitation

Question 10

Which TWO of the following are fundamental phases of a secure software development lifecycle (SSDLC) where security should be integrated? (Select exactly two.)

Accepted Answer

Testing and validation. Requirements gathering (E) is a fundamental SSDLC phase where security must be integrated, since security requirements, compliance obligations, and risk analysis (e.g., misuse/abuse cases, data classification) are defined before design and coding begin. Testing and validation (A) is also a fundamental SSDLC phase where security is integrated through activities such as static/dynamic application security testing (SAST/DAST), penetration testing, and vulnerability validation to confirm controls work as intended. Software retirement (B) is a lifecycle consideration but not one of the core SSDLC phases emphasized for security integration in this context. User acceptance testing (C) is a type of testing, not a distinct fundamental SSDLC phase, and it focuses on business fitness rather than security-specific validation. Production operations (D) is an operational/maintenance concern outside the core development lifecycle phases where security is primarily built in.

Answer

Software retirement

Answer

User acceptance testing

Answer

Production operations

Question 11

An organization has implemented a new SIEM system. What is the most critical factor for its effectiveness?

Accepted Answer

The ability to correlate events. The most critical factor for a SIEM's effectiveness is its ability to correlate events across diverse log sources to detect complex attack patterns, such as a lateral movement chain or a multi-stage exploit. Without correlation, a SIEM is merely a log aggregator, unable to distinguish a true security incident from isolated benign events. Correlation engines apply rule-based or statistical analysis (e.g., using Sigma rules or machine learning) to identify relationships between seemingly unrelated log entries, which is the core value proposition of a SIEM.

Answer

The cost of the solution

Answer

The speed of data ingestion

Answer

The number of log sources integrated

Question 12

A user reports that a VPN client cannot connect to the corporate gateway. The client log shows the following excerpt: "TLS Error: server certificate verification failed: unable to get local issuer certificate." What does this indicate?

Accepted Answer

The client does not trust the CA that issued the server certificate. The log message 'unable to get local issuer certificate' indicates that the client cannot locate or trust the CA certificate that issued the VPN server certificate. This is a trust chain issue, not an expired server certificate, a self-signed certificate, or a missing client certificate.

Answer

The VPN server certificate is expired

Answer

The server is using a self-signed certificate

Answer

The client certificate is missing

Question 13

Refer to the exhibit. A security analyst reviews this event log entry. What does this event indicate?

Event Log Entry:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Event ID: 4625
Task Category: Logon
Level: Information
Keywords: Audit Failure
User: N/A
Computer: SRV01
Description:
An account failed to log on.

Subject:
	Security ID:		SYSTEM
	Account Name:		SRV01$
	Account Domain:		CORP
	Logon ID:		0x3E7

Logon Type:			3

Account For Which Logon Failed:
	Security ID:		S-1-5-21-...
	Account Name:		jdoe
	Account Domain:		CORP

Failure Information:
	Failure Reason:		Account locked out.
	Status:			0xC0000234
	Sub Status:		0x0

Accepted Answer

A failed logon attempt due to account lockout. The event log entry shows Event ID 4625 (an account failed to log on) with Status 0xC0000234, which is the code for 'Account locked out.' This indicates a failed logon attempt because the account is locked out, not a successful logon and not a privilege escalation exploit.

Answer

A successful logon by the SYSTEM account

Answer

A successful logon by a user account

Answer

An attempted exploit of a privilege escalation vulnerability

Question 14

During a security assessment, a penetration tester successfully performs an ARP spoofing attack, redirecting traffic through their machine. This attack exploits which protocol vulnerability?

Accepted Answer

Stateless nature of ARP with no authentication. ARP spoofing succeeds because ARP is a stateless protocol that does not authenticate or verify the legitimacy of ARP replies. Any host on a local network can send an unsolicited ARP reply (gratuitous ARP) to associate any IP address with any MAC address, allowing an attacker to redirect traffic without any validation mechanism.

Answer

Lack of encryption in ARP packets

Answer

Weakness in the IP address resolution algorithm

Answer

Use of broadcast frames for all requests

Question 15

A network engineer is troubleshooting a slow VPN connection between two sites. The link is symmetric 100 Mbps, but throughput tests show only 20 Mbps. The VPN uses AES-256 encryption. What is the most likely cause?

Accepted Answer

CPU bottleneck on the VPN endpoints. AES-256 encryption is computationally intensive, and the throughput of a VPN is often limited by the cryptographic processing capacity of the endpoint CPUs rather than the link bandwidth. A symmetric 100 Mbps link with only 20 Mbps throughput strongly indicates that the VPN endpoints cannot encrypt/decrypt fast enough, creating a CPU bottleneck.

Answer

Packet loss due to link congestion

Answer

MTU mismatch causing fragmentation

Answer

Incorrect TCP window scaling