CISSP Practice Test 44 — 15 Questions

Question 1

A company is implementing a CI/CD pipeline for a web application. Which security testing method should be integrated into the build stage to catch vulnerabilities early?

Accepted Answer

Static Application Security Testing (SAST) in the build stage. Static Application Security Testing (SAST) analyzes source code without execution, making it suitable for early detection in the build stage of a CI/CD pipeline. Option A is incorrect because open-source vulnerability scanners may not cover custom code and can produce false positives. Option B is incorrect because Dynamic Application Security Testing (DAST) requires a running application and is typically performed in later stages. Option C is incorrect because manual code review is too slow and resource-intensive for continuous integration, while automated SAST fits the speed of CI/CD.

Answer

Only using open-source vulnerability scanners

Answer

Dynamic Application Security Testing (DAST) in the production stage

Answer

Manual code review after each sprint

Question 2

A developer is implementing role-based access control (RBAC). Which THREE components are essential for an RBAC system?

Accepted Answer

Permissions. Permissions are essential in RBAC because they define the actual access rights (e.g., read, write, execute) that are assigned to roles, not directly to users. Without permissions, roles would have no functional authority, and the RBAC model (as defined in NIST SP 800-53 and ANSI INCITS 359) would be unable to enforce any access control decisions. Permissions are the bridge between roles and resources, making them a core component.

Answer

Attributes

Answer

Sessions

Question 3

An organization is planning a penetration test of its internal network. The test team has been given network diagrams, source code access, and administrative credentials. This type of testing is known as:

Accepted Answer

White-box testing. White-box testing (also known as clear-box or structural testing) is characterized by the test team having full knowledge of the internal system architecture, including network diagrams, source code, and administrative credentials. This level of access allows testers to perform a thorough analysis of the application logic, configuration weaknesses, and potential backdoors that would be invisible in a black-box approach. The scenario explicitly states the team was given these artifacts, making white-box testing the correct classification.

Answer

Black-box testing

Answer

Red team testing

Answer

Gray-box testing

Question 4

A penetration tester is planning an engagement. Which of the following rules of engagement should be defined before testing begins? (Select TWO.)

Accepted Answer

Emergency contact procedures. Emergency contact procedures (B) are a critical component of the Rules of Engagement (RoE) because they define who to notify if an incident occurs during testing, such as an unintended system outage or detection by security monitoring. Without this, the tester risks legal or operational repercussions. The scope of systems to be tested (C) is equally essential as it explicitly lists IP ranges, hostnames, and network segments authorized for testing, preventing unauthorized access and ensuring compliance with the engagement contract.

Answer

The exact exploits to be used

Answer

The tester's personal compensation

Answer

The names of employees to be targeted

Question 5

A security manager is tasked with classifying data based on its sensitivity. Which of the following is the PRIMARY reason for data classification?

Accepted Answer

To ensure appropriate protection measures are applied to data based on its value and sensitivity.. Data classification is the foundational process of assigning a sensitivity label (e.g., Public, Internal, Confidential, Restricted) to information assets. The primary reason is to ensure that appropriate security controls—such as encryption, access control lists (ACLs), and data loss prevention (DLP) policies—are applied proportionally to the data's value and sensitivity, aligning with the principle of defense in depth and risk management.

Answer

To satisfy regulatory requirements for data retention.

Answer

To facilitate data sharing across departments without restrictions.

Answer

To simplify the process of granting access to users.

Question 6

Refer to the exhibit. A SAML response is received by the service provider. Which security issue is present?

Accepted Answer

The assertion is not signed. The SAML response shown in the exhibit lacks a digital signature on the assertion itself. Without the assertion being signed, a man-in-the-middle attacker could modify the assertion content (e.g., change the user identifier or attributes) after the response leaves the identity provider but before it reaches the service provider. SAML Core specification (OASIS SAML 2.0) requires that either the entire response or the individual assertion be signed to ensure integrity and non-repudiation; here, neither is signed, making the assertion vulnerable to tampering.

Answer

The NameID format is incorrect

Answer

The validity window is too short

Answer

The subject confirmation method is insecure

Question 7

An organization requires a security assessment that evaluates controls against a specific standard and results in a formal report. The organization is not required to exploit vulnerabilities. Which type of assessment is this?

Accepted Answer

Security audit. A security audit is a formal, independent evaluation of controls against a predefined standard (e.g., ISO 27001, PCI DSS) that produces a formal report. Unlike other assessments, it does not require exploiting vulnerabilities; it focuses on verifying compliance through evidence collection and testing. This matches the question's requirement for a standard-based evaluation with a formal report and no exploitation.

Answer

Vulnerability assessment

Answer

Penetration test

Answer

Security review

Question 8

An organization's data retention policy requires that financial records be kept for seven years. After that period, the records must be destroyed in a manner that prevents reconstruction. Which of the following is the best sanitization method for paper records containing sensitive financial data?

Accepted Answer

Cross-cut shredding. Cross-cut shredding reduces paper to small particles, making reconstruction extremely difficult and is a common method for destroying paper records.

Answer

Overwriting with random patterns multiple times

Answer

Cryptographic erasure

Answer

Degaussing with a strong magnetic field

Question 9

In a zero trust architecture, which component is responsible for continuously verifying the trustworthiness of a device before granting access to resources?

Accepted Answer

Policy Decision Point (PDP). In a zero trust architecture, the Policy Decision Point (PDP) is the component that evaluates all available telemetry and contextual data—such as device posture, user identity, and behavioral analytics—to make a real-time trust decision. It continuously verifies device trustworthiness by applying dynamic policies (e.g., checking for up-to-date patches, compliance with security baselines, or absence of malware) before granting or denying access to resources. This aligns with the NIST SP 800-207 zero trust model, where the PDP is the logical brain that computes trust levels and issues authorization decisions.

Answer

Policy Enforcement Point (PEP)

Answer

Identity Provider (IdP)

Answer

Policy Administrator (PA)

Question 10

A financial services company uses a custom web application for online banking. The application is developed in-house using Java and deployed on Apache Tomcat servers. Recently, the security team discovered that the application is vulnerable to a critical remote code execution (RCE) vulnerability due to insecure deserialization of untrusted data. The vulnerability exists in a module that processes session objects. The development team has been assigned to fix this issue. They propose the following options:

A. Implement a custom deserialization filter using ObjectInputFilter to whitelist only expected classes.
B. Replace Java serialization with JSON serialization using a library like Jackson, and configure it to disallow polymorphic deserialization by default.
C. Encrypt all serialized objects using AES-256 before sending them to the client.
D. Use a Web Application Firewall (WAF) to block requests containing known deserialization payloads.

The application must maintain high availability and minimal latency. Which option provides the MOST effective and sustainable remediation?

Accepted Answer

Replace Java serialization with JSON serialization using a library like Jackson, and configure it to disallow polymorphic deserialization by default.. Replacing Java serialization with JSON is the most effective and sustainable remediation because it eliminates the root cause of the vulnerability—insecure deserialization of untrusted data. JSON deserialization does not inherently allow arbitrary code execution, and disabling polymorphic deserialization prevents type‐confusion attacks. A whitelist filter (Option A) is a good mitigation but can be bypassed if incomplete and requires ongoing maintenance. A WAF (Option D) is a compensating control that does not fix the underlying flaw and can often be evaded with obfuscated payloads; it also affects availability and latency. Encryption (Option C) protects confidentiality but does not prevent deserialization attacks, as the data is still insecure after decryption.

Answer

Implement a custom deserialization filter using ObjectInputFilter to whitelist only expected classes.

Answer

Encrypt all serialized objects using AES-256 before sending them to the client.

Answer

Use a Web Application Firewall (WAF) to block requests containing known deserialization payloads.

Question 11

An organization is implementing a security program and wants to ensure it meets legal and regulatory requirements. The security manager is reviewing the concept of due care. Which best describes due care in the context of information security?

Accepted Answer

The level of prudence expected from a reasonable organization in the same industry. Due care is the legal concept that an organization must act with the level of prudence that a reasonable organization in the same industry would exercise to protect sensitive information. It is not merely compliance with laws (option C), but a broader standard of care that includes implementing reasonable security measures, even where specific regulations do not mandate them. In information security, due care is demonstrated through policies, procedures, and controls that a prudent organization would adopt to avoid negligence liability.

Answer

The process of responding to security incidents after they occur

Answer

The selection of security controls based on cost-benefit analysis

Answer

Compliance with all applicable laws and regulations

Question 12

A development team is implementing a microservices architecture. Which of the following is the BEST approach to secure inter-service communication?

Accepted Answer

Implement mutual TLS (mTLS) between services. Mutual TLS (mTLS) is the best approach because it provides both encryption and bidirectional authentication between services, ensuring that only authorized services can communicate. Unlike token-based methods, mTLS verifies the identity of both the client and server using X.509 certificates, which is critical in a zero-trust microservices environment where network boundaries are porous.

Answer

Use JSON Web Tokens (JWT) for each request

Answer

Use API keys transmitted in HTTP headers

Answer

Place all services behind a single API gateway

Question 13

A network administrator is configuring DNSSEC to protect against DNS spoofing. Which record type is used to provide cryptographic verification of DNS data origins?

Accepted Answer

RRSIG. RRSIG (Resource Record Signature) is the DNSSEC record type that contains the cryptographic signature for a DNS record set. It provides data origin authentication and integrity verification by allowing resolvers to validate that the DNS data came from the authoritative source and was not modified in transit.

Answer

DS

Answer

DNSKEY

Answer

NSEC

Question 14

A large healthcare organization is subject to both HIPAA and GDPR. They are creating a data retention policy for electronic protected health information (ePHI) concerning European patients. HIPAA requires retention for 6 years from creation or last effective date, while GDPR requires that personal data not be kept longer than necessary for the purpose, with a general guideline of retaining for the duration of the relationship plus a reasonable period. The organization wants to minimize storage costs while ensuring compliance. Which approach should they take?

Accepted Answer

Implement a tiered retention policy based on data classification. A tiered retention policy based on data classification allows the organization to apply different retention periods to different categories of ePHI, satisfying both HIPAA's 6-year minimum for medical records and GDPR's principle of storage limitation. This approach minimizes storage costs by deleting data that is no longer necessary for the original purpose (e.g., billing records after the statutory period) while retaining data that must be kept longer (e.g., patient treatment records). It avoids the all-or-nothing trap of picking a single regulatory timeline, which would either violate GDPR (if retaining too long) or HIPAA (if deleting too soon).

Answer

Retain data for the longer of the two regulatory requirements (HIPAA 6 years)

Answer

Retain all data indefinitely

Answer

Retain data for the shorter requirement (GDPR-defined necessity period)

Question 15

In a virtualized environment, which security control is most effective for isolating VMs from each other?

Accepted Answer

Hypervisor-level network policies. Hypervisor-level network policies, such as virtual switches with port groups and VLAN tagging, enforce isolation directly at the hypervisor layer, ensuring that VM traffic is segmented without relying on guest OS configurations. This control is independent of the VM's own firewall settings and can prevent lateral movement even if a VM is compromised, because the hypervisor mediates all network I/O.

Answer

Host-based firewall on each VM

Answer

Physical separation

Answer

Virtual LAN (VLAN) segmentation