CISSP Practice Test 43 — 15 Questions

Question 1

An organization is implementing DNSSEC to protect its DNS infrastructure. Which of the following best describes the primary security benefit of DNSSEC?

Accepted Answer

Authentication of DNS data origin and integrity. DNSSEC (Domain Name System Security Extensions) provides origin authentication and data integrity verification for DNS responses through digital signatures. It uses public-key cryptography to sign DNS resource record sets (RRSIG records), allowing resolvers to verify that the data has not been modified in transit and originates from the authoritative source. This prevents attacks such as DNS cache poisoning and man-in-the-middle spoofing, but does not provide confidentiality or availability protections.

Answer

Prevention of DDoS attacks on DNS servers

Answer

Anonymization of DNS queries

Answer

Encryption of DNS queries and responses

Question 2

A SOC analyst receives an alert for a high number of outbound connections to a known malicious IP. Which action should be taken first?

Accepted Answer

Isolate the affected host. The correct first action is to isolate the affected host (Option D). This prevents further data exfiltration and gives the analyst a safe environment to investigate the compromise. Blocking the IP (Option B) stops the immediate traffic but leaves the host under attacker control. Running an antivirus scan (Option C) or notifying management (Option A) are secondary steps that should occur after containment.

Answer

Notify management

Answer

Block the IP at the firewall

Answer

Run an antivirus scan

Question 3

Under GDPR, which of the following is a valid lawful basis for processing personal data?

Accepted Answer

Vital interests. GDPR Article 6 lists lawful bases including consent, contract, legal obligation, vital interests, public task, and legitimate interests. 'Vital interests' is a valid basis.

Answer

Corporate policy

Answer

Profit motive

Answer

Marketing preference

Question 4

During a penetration testing engagement, which TWO of the following are essential components of the rules of engagement document?

Accepted Answer

Emergency stop criteria. In penetration testing, the rules of engagement (ROE) document defines the operational parameters, including emergency stop criteria (Option B) and scope definition (Option D). Written authorization from management (Option E) is a separate prerequisite document granting legal permission to test; it is not part of the ROE. Vulnerability severity ratings (Option A) are found in the final report, and detailed exploit code (Option C) is a technical artifact not included in the ROE.

Answer

Vulnerability severity ratings

Answer

Detailed exploit code

Answer

Written authorization from management

Question 5

An organization is transitioning from waterfall to agile development. How should security be integrated into the new process to align with the SDLC?

Accepted Answer

Include security requirements in user stories and conduct threat modeling each iteration. In agile development, security must be integrated continuously throughout each iteration, not deferred to the end. Option D is correct because it embeds security into the user story definition (including acceptance criteria for security requirements) and mandates threat modeling each iteration, which aligns with the iterative, incremental nature of agile and ensures security is addressed early and often, reducing risk and rework.

Answer

Perform a single security review at the end of the release cycle

Answer

Conduct security testing only during the integration phase

Answer

Skip threat modeling and rely solely on automated scanning

Question 6

A security analyst discovers that a service account in Active Directory has not had its password changed in 5 years and has domain admin privileges. The account is used by a legacy application that does not support modern authentication protocols. Which of the following is the MOST secure approach to manage this account?

Accepted Answer

Decommission the legacy application and migrate to a modern alternative that supports secure authentication. The most secure approach because it eliminates the risk by decommissioning the legacy application and migrating to a modern alternative that supports secure authentication protocols such as Kerberos or modern federation. This removes the need for a highly privileged service account with a non-expiring password and resolves the underlying issue. Option A is not suitable because group Managed Service Accounts (gMSAs) require the application to support modern authentication and the system must meet domain functional level requirements. Option B does not address the lack of automatic password rotation and still leaves a static credential vulnerable to theft. Option D would break the application immediately without a solution.

Answer

Convert the account to a group Managed Service Account (gMSA)

Answer

Set a very long, complex password and store it in a password manager

Answer

Disable the account and create a new service account with limited privileges

Question 7

A security engineer is evaluating a system that uses a Trusted Platform Module (TPM) for secure boot. The TPM measures the boot components and stores the measurements in Platform Configuration Registers (PCRs). Which of the following is a primary security goal achieved by this process?

Accepted Answer

Ensures the boot process has not been tampered with. Measured boot ensures that each boot component's hash is extended into PCRs. The TPM can attest these measurements to a remote verifier, proving the boot integrity.

Answer

Provides full disk encryption

Answer

Prevents all malware from executing

Answer

Authenticates the user during boot

Question 8

Which TWO of the following are essential components of a quantitative risk analysis formula? (Choose two.)

Accepted Answer

Annual Rate of Occurrence (ARO). In quantitative risk analysis, the formula for calculating Annualized Loss Expectancy (ALE) is ALE = SLE × ARO. The Single Loss Expectancy (SLE) represents the monetary loss expected from a single occurrence of a risk, calculated as Asset Value × Exposure Factor (EF). The Annual Rate of Occurrence (ARO) is the expected frequency of that risk occurring per year. Both SLE and ARO are direct, essential multipliers in the core ALE formula, making them fundamental components of the quantitative risk analysis equation.

Answer

Exposure Factor (EF)

Answer

Residual Risk

Answer

Control Frequency (CF)

Question 9

Your organization is forming an incident response team (IRT). According to NIST SP 800-61, which TWO roles are considered core to the incident response team?

Accepted Answer

Technical Lead. NIST SP 800-61 Rev. 2 identifies the Team Manager and the Technical Lead as core roles within an incident response team. The Manager oversees the response process, allocates resources, and coordinates communication, while the Technical Lead drives the technical analysis, containment, and eradication efforts. These two roles are essential for both strategic direction and hands-on technical execution during an incident.

Answer

Public Relations

Answer

Legal Counsel

Answer

Human Resources

Question 10

Match each business continuity term to its definition.

Accepted Answer

RTO: The maximum amount of time a system or application can be down after a disaster without causing significant damage to the business.. Correct matches: RTO defines the acceptable downtime; RPO defines acceptable data loss; MTD is the total tolerable downtime; BIA is the analysis process identifying critical functions. Common confusions involve swapping time-based metrics (RTO/RPO/MTD) or misapplying process terms (BIA).

Answer

RTO: The maximum age of data that an organization can lose during a disaster without causing significant business damage.

Answer

BIA: The maximum time to recover a business process after a disaster.

Question 11

An organization is implementing a change management process. Which group is responsible for reviewing and approving major changes?

Accepted Answer

Change Advisory Board (CAB). The Change Advisory Board (CAB) is the formal group within ITIL-based change management responsible for reviewing, assessing, and approving major or high-risk changes. Major changes typically require a CAB meeting to evaluate impact, resource requirements, and rollback plans before authorization. This ensures changes do not introduce security vulnerabilities or disrupt critical operations.

Answer

Project management office

Answer

Incident response team

Answer

Security operations center

Question 12

In IPsec, which protocol provides both authentication and encryption for the packet payload, but does not encrypt the IP header?

Accepted Answer

ESP (Encapsulating Security Payload). ESP (Encapsulating Security Payload) provides both authentication and encryption for the packet payload, while leaving the IP header unencrypted. This allows intermediate routers to process the packet normally, as the header remains in plaintext, but the payload is protected for confidentiality and integrity.

Answer

IKE (Internet Key Exchange)

Answer

ISAKMP (Internet Security Association and Key Management Protocol)

Answer

AH (Authentication Header)

Question 13

A company uses a cloud storage service. Which asset security control is most important to prevent unauthorized access to data?

Accepted Answer

Encryption in transit and at rest. Encryption in transit (e.g., TLS 1.3) and at rest (e.g., AES-256) is the most important asset security control because it renders data unreadable even if the cloud storage service is compromised or an attacker gains access to the underlying infrastructure. Without encryption, all other controls (logging, reviews, scanning) are reactive and cannot prevent a direct breach of the stored data. This aligns with the CISSP principle of defense in depth, where encryption provides a strong preventive layer for data confidentiality.

Answer

Logging and monitoring

Answer

Periodic access reviews

Answer

Regular vulnerability scanning

Question 14

A large e-commerce company operates a multi-tier application in a public cloud. The environment includes a web tier, application tier, and database tier. The security team recently deployed a host-based intrusion detection system (HIDS) on all servers. During a routine review, the HIDS alerts show repeated failed login attempts from a single external IP address to several web servers, but no successful logins from that IP. The team also notices that the database servers have been sending outbound traffic to an unknown IP address on port 443, which is unusual because the database servers typically communicate only with the application servers on port 3306 (MySQL). The application team confirms no changes were made recently. The CISO wants an immediate investigation. What should the security team do first?

Accepted Answer

Isolate the database servers from the network and perform forensic analysis on system logs and memory dumps.. The correct first step is to isolate the database servers and perform forensic analysis (Option B) because the outbound traffic on port 443 from database servers to an unknown IP is a strong indicator of data exfiltration or command-and-control activity. Isolating the servers prevents further data loss and preserves volatile evidence (memory, logs) for analysis. Option A is wrong because restarting servers may destroy forensic evidence. Option C is wrong because simply adding a firewall rule does not address the root cause—malware or unauthorized access on the database servers. Option D is wrong because blocking the external IP from web server login attempts does not investigate the active exfiltration from the database tier.

Answer

Immediately restart all database servers to stop any malicious processes.

Answer

Add a firewall rule to deny outbound traffic from the database tier to the unknown IP.

Answer

Block the external IP that is attempting to log in to the web servers and continue monitoring.

Question 15

Which type of SOC report provides a public summary of an organization's controls over security, availability, and confidentiality?

Accepted Answer

SOC 3. SOC 3 reports are designed for public distribution and summarize the findings of a SOC 2 engagement.

Answer

SOC 2 Type II

Answer

SOC 1

Answer

SOC 2 Type I