CISSP Practice Test 44 — 15 Questions

Question 1

Under GDPR, which of the following is a valid lawful basis for processing personal data?

Accepted Answer

Vital interests. GDPR Article 6(1) lists six lawful bases for processing personal data: consent, contract, legal obligation, vital interests, public task, and legitimate interests. 'Vital interests' is one of these — it covers processing necessary to protect someone's life.

Answer

Corporate policy

Answer

Profit motive

Answer

Marketing preference

Question 2

Which TWO of the following are characteristics of a Privileged Access Management (PAM) solution? (Choose two.)

Accepted Answer

Session recording. Option B (Session recording) is correct because PAM solutions commonly record and audit privileged sessions (e.g., via SSH/RDP proxies) to provide accountability and forensic evidence for administrative activity. Option D (Password vaulting) is correct because PAM centrally stores, checks out, and rotates privileged credentials (such as root, admin, and service accounts) in an encrypted vault, which is a core PAM capability. Option A (Self-service password reset) is typically an identity management/helpdesk feature for standard users, not a defining PAM characteristic. Option C (Single sign-on for all users) is an access-management/SSO capability rather than PAM-specific, since PAM focuses on privileged accounts and sessions. Option E (OpenID Connect authentication) is an authentication protocol/federation mechanism, not a characteristic that defines a PAM solution.

Answer

Self-service password reset

Answer

Single sign-on for all users

Answer

OpenID Connect authentication

Question 3

A health records system requires that doctors can write new records but cannot modify existing ones, and integrity is maintained through separation of duties. Which security model best fits this requirement?

Accepted Answer

Clark-Wilson. The Clark-Wilson model enforces integrity through well-formed transactions and separation of duties, which directly matches the requirement that doctors can write new records but cannot modify existing ones. It uses constrained data items (CDIs), transformation procedures (TPs), and integrity verification procedures (IVPs) to ensure that only authorized users can perform specific operations, preventing unauthorized modifications.

Answer

Brewer-Nash

Answer

Biba

Answer

Bell-LaPadula

Question 4

A development team heavily uses third-party libraries. What is the most effective way to manage vulnerabilities in these libraries?

Accepted Answer

Use a Software Composition Analysis (SCA) tool and monitor CVE databases. Software Composition Analysis (SCA) tools automate the identification of third-party libraries and their versions, cross-referencing them against known vulnerability databases such as the National Vulnerability Database (NVD) and Common Vulnerabilities and Exposures (CVE) lists. This provides continuous monitoring and alerting for newly disclosed vulnerabilities, which is the most effective and scalable approach for managing the large number of dependencies in modern development. Manual review or ignoring vulnerabilities is impractical and insecure, while relying on 'no known vulnerabilities' is a false premise.

Answer

Only use libraries from sources with no known vulnerabilities

Answer

Ignore vulnerabilities unless a known exploit exists

Answer

Manually review each library's source code for flaws

Question 5

A security administrator is configuring a stateful firewall to allow HTTP traffic from the internet to a web server. The firewall uses a default-deny policy. What is the correct rule placement?

Accepted Answer

Place the allow rule before the deny all rule. In a stateful firewall with a default-deny policy, rules are processed in sequential order from top to bottom. Placing the allow rule before the deny all rule ensures that HTTP traffic (TCP port 80) is explicitly permitted before the catch-all deny rule drops all unmatched packets. If the deny all rule were placed first, all traffic would be dropped, including the intended HTTP traffic, making the allow rule unreachable.

Answer

Place the allow rule after the deny all rule

Answer

Use a stateless firewall instead

Answer

Use an implicit deny rule

Question 6

A network administrator is configuring SNMPv3 for monitoring network devices. The organization requires both authentication and encryption of SNMP traffic. Which combination of protocols should be used to meet this requirement?

Accepted Answer

SHA for authentication, AES for privacy. SNMPv3 supports both authentication and encryption via separate User-based Security Model (USM) parameters. To meet the requirement for both, you must select an authentication protocol (e.g., SHA) and a privacy (encryption) protocol (e.g., AES). Option C correctly pairs SHA for authentication with AES for privacy, providing integrity verification and confidentiality of SNMP messages.

Answer

MD5 for authentication, no privacy

Answer

SHA for authentication, no privacy

Answer

MD5 for authentication, DES for privacy

Question 7

Which TWO of the following are differences between OAuth 2.0 and OpenID Connect (OIDC)?

Accepted Answer

OAuth 2.0 is for authorization, while OIDC is for authentication. OAuth 2.0 is fundamentally an authorization framework (RFC 6749) that grants delegated access to resources, while OpenID Connect (OIDC) is an authentication layer built on top of OAuth 2.0 (specified in OpenID Connect Core 1.0) that verifies the end-user's identity. OIDC extends OAuth 2.0 by adding an ID token (a JWT) that contains claims about the authenticated user, whereas OAuth 2.0 alone does not provide identity information.

Answer

OAuth 2.0 supports device code grant, OIDC does not

Answer

OIDC is XML-based, while OAuth 2.0 is JSON-based

Answer

OAuth 2.0 requires a client secret, OIDC does not

Question 8

A security analyst discovers that a service account in Active Directory has not had its password changed in 5 years and has domain admin privileges. The account is used by a legacy application that does not support modern authentication protocols. Which of the following is the MOST secure approach to manage this account?

Accepted Answer

Decommission the legacy application and migrate to a modern alternative that supports secure authentication. The most secure long-term approach is to eliminate the risky legacy dependency entirely by decommissioning the application and migrating to a modern alternative that supports secure authentication such as Kerberos, OAuth, or certificate-based auth. This removes the need for a standing domain-admin service account with a five-year-old password, which is a severe lateral-movement and credential-theft risk. Until the application is retired, no compensating control fully neutralizes the exposure of a privileged, stale credential.

Answer

Convert the account to a group Managed Service Account (gMSA)

Answer

Set a very long, complex password and store it in a password manager

Answer

Disable the account and create a new service account with limited privileges

Question 9

A security analyst is reviewing access controls for a financial application. Which TWO of the following are considered best practices for preventing fraud? (Select TWO.)

Accepted Answer

Two-person control. Two-person control (D) is a best practice for preventing fraud because it requires two authorized individuals to perform a critical action, such as approving a high-value transaction or accessing a sensitive system. This ensures collusion is needed to commit fraud, as no single person can complete the action alone. In a financial application, this might involve dual approval for wire transfers over a threshold, directly mitigating insider threats.

Answer

Password complexity

Answer

Single sign-on

Answer

Least privilege

Question 10

A security engineer is troubleshooting an authentication failure for a Windows domain user. The user receives 'Access denied' when trying to access a file server. The Kerberos ticket-granting ticket was successfully obtained. What is the most likely issue?

Accepted Answer

The user does not have permission to the file server resource. Since the Kerberos ticket-granting ticket (TGT) was successfully obtained, the user has authenticated to the domain and the Kerberos authentication process is functioning correctly. The 'Access denied' error at the file server indicates that the user lacks the necessary permissions on the specific resource (share or NTFS), which is a separate authorization step after successful authentication.

Answer

The file server is not trusted for delegation

Answer

The user account is locked out

Answer

Time skew between client and domain controller

Question 11

A network administrator is configuring a firewall that examines the source and destination IP addresses, port numbers, and protocol (TCP/UDP) of each packet without considering the state of the connection. Which type of firewall is being deployed?

Accepted Answer

Packet filter firewall. A packet filter firewall operates at Layer 3 (Network) and Layer 4 (Transport) of the OSI model, making decisions based solely on static header fields such as source/destination IP addresses, port numbers, and protocol type (TCP/UDP). It does not track connection state or session context, which matches the description of examining each packet independently. This is the defining characteristic of a stateless packet filter, as opposed to stateful or application-layer firewalls.

Answer

Next-generation firewall

Answer

Stateful inspection firewall

Answer

Application proxy firewall

Question 12

Which TWO of the following are mandatory secure coding practices to prevent injection attacks? (Select exactly two.)

Accepted Answer

Use parameterized queries or prepared statements. Option D is correct because parameterized queries or prepared statements ensure that user-supplied data is treated strictly as data, not executable code, which structurally prevents SQL injection and similar injection flaws by separating the query logic from the input values. Option E is correct because validating and sanitizing all user input enforces allow-list or expected-format checks and strips or neutralizes dangerous characters, reducing the attack surface for injection vectors such as SQL, command, and LDAP injection. Option A is not mandatory for preventing injection itself; output encoding primarily mitigates cross-site scripting (XSS) by rendering data inert in the browser context, which is a different vulnerability class. Option B is incorrect because encrypting sensitive input data protects confidentiality in transit or at rest but does nothing to stop malicious payloads from being interpreted as code by an interpreter. Option C is incorrect because detailed custom error messages can leak schema, stack traces, or query structure to attackers, aiding injection exploitation rather than preventing it; generic error handling is the safer practice.

Answer

Encode output to the browser

Answer

Encrypt sensitive input data

Answer

Use custom error messages that detail the failure

Question 13

Which TWO of the following are examples of administrative controls? (Select exactly 2)

Accepted Answer

Security awareness training. Administrative controls are management-driven policies, procedures, and practices that govern how people behave and how security is organized, rather than technical or physical mechanisms. Option B, security awareness training, is correct because it is a management-initiated program that educates users on policies and safe behavior, directly shaping human conduct. Option E, background checks for employees, is correct because it is a personnel screening procedure implemented through HR policy to reduce insider risk before granting access. Option A, firewall rules, is a technical (logical) control enforced by network devices, not an administrative one. Option C, security guards at entrances, is a physical control that deters and detects intrusion through human presence. Option D, encryption of data at rest, is a technical control that protects data confidentiality via cryptographic algorithms.

Answer

Firewall rules

Answer

Security guards at entrances

Answer

Encryption of data at rest

Question 14

In asset security, which of the following is a primary responsibility of a data owner?

Accepted Answer

Classifying data. The data owner is the senior-level manager who is ultimately accountable for a specific set of data. Their primary responsibility is to determine the data's sensitivity and business value, which directly drives the classification level (e.g., public, internal, confidential, restricted). Classification is the foundational step that dictates all subsequent protection requirements, making it a core duty of the data owner, not a technical implementer.

Answer

Monitoring access logs

Answer

Implementing security controls

Answer

Backing up data

Question 15

Under HIPAA, a covered entity must have a Business Associate Agreement (BAA) with which of the following?

Accepted Answer

A cloud service provider hosting ePHI. Under HIPAA, a covered entity must have a Business Associate Agreement (BAA) with a cloud service provider that hosts electronic protected health information (ePHI). This is because the cloud provider is a business associate, as it creates, receives, maintains, or transmits ePHI on behalf of the covered entity. The BAA ensures the business associate safeguards the ePHI and complies with HIPAA.

Answer

A janitorial service that cleans the office

Answer

A government regulator conducting an audit

Answer

A patient requesting their medical records