CISSP Practice Test 45 — 15 Questions

Question 1

An organization is implementing a new access control system. The security team wants to ensure that users cannot deny having performed an action. Which security principle is being addressed?

Accepted Answer

Non-repudiation. Non-repudiation is the security principle that ensures a party to a communication or transaction cannot later deny having performed that action. It is typically achieved through digital signatures, audit logs, and cryptographic proof of origin and delivery. The question directly describes the inability to deny an action, which is the textbook definition of non-repudiation.

Answer

Availability

Answer

Integrity

Answer

Confidentiality

Question 2

A company is designing secure boot for IoT devices to ensure only trusted firmware runs. The devices have limited resources. Which mechanism provides the highest assurance of boot integrity?

Accepted Answer

Use a TPM to measure boot components and compare to stored hashes.. A Trusted Platform Module (TPM) provides hardware-rooted trust by measuring each boot component (e.g., BIOS, bootloader, OS kernel) and storing the measurements in Platform Configuration Registers (PCRs). These measurements are compared against known-good hashes stored in the TPM, ensuring that any tampering with firmware is detected before execution. This offers the highest assurance for resource-constrained IoT devices as it relies on immutable hardware rather than software-based checks.

Answer

Use a software-based integrity check that runs after boot.

Answer

Set a BIOS password to prevent unauthorized changes.

Answer

Implement full disk encryption (FDE).

Question 3

An organization is implementing privacy by design for a new application that processes PII. Which practice BEST aligns with the data minimization principle?

Accepted Answer

Collecting only the PII required for the stated function.. Data minimization means collecting only the personal data that is necessary for the specified purpose. Collecting only the PII required for the stated function directly implements this principle by limiting the scope of data collection at the source, reducing privacy risk and compliance burden.

Answer

Anonymizing data after collection.

Answer

Obtaining explicit consent from users.

Answer

Collecting all possible PII in case it is needed later.

Question 4

An organization uses a data loss prevention (DLP) system to monitor outbound emails. Which data classification type would the DLP most likely use to detect sensitive information leaving the network?

Accepted Answer

Content-based classification. Content-based classification inspects the actual data within outbound emails—such as credit card numbers, social security numbers, or other regex-defined patterns—to detect sensitive information. DLP systems rely on content analysis (e.g., regular expressions, exact data matching, or fingerprinting) to identify and block policy violations, making this the correct classification type for detecting sensitive data leaving the network.

Answer

Context-based classification

Answer

User-based classification

Answer

Role-based classification

Question 5

Match each PKI component to its function.

Accepted Answer

Certificate Authority (CA): Issues and signs digital certificates. In PKI, the CA issues and signs certificates, the RA verifies identities, the repository stores certificates for retrieval, and the CRL tracks revoked certificates. Common confusions involve mixing the roles of CA and RA or CA and repository.

Answer

Certificate Authority (CA): Stores and distributes certificates

Answer

Registration Authority (RA): Issues and signs certificates

Question 6

A network engineer is configuring 802.1X authentication for wired network access. The authentication server supports EAP-TLS. What must be deployed to clients to support this authentication method?

Accepted Answer

Client certificate. EAP-TLS requires mutual authentication using digital certificates on both the client and the server. The client must present a certificate to prove its identity to the authentication server, which is validated against a trusted root CA. Without a client certificate, EAP-TLS cannot establish the TLS tunnel, as it relies on certificate-based client authentication per RFC 5216.

Answer

Server certificate

Answer

RADIUS server

Answer

Shared secret

Question 7

A financial institution must retain customer transaction records for 7 years. After that, what is the most appropriate action?

Accepted Answer

Securely delete using overwriting. After the 7-year retention period, the most appropriate action is to securely delete the records using overwriting. This ensures that the data is irrecoverable while maintaining compliance with data disposal policies. Overwriting with multiple passes (e.g., using the Gutmann method or DoD 5220.22-M standard) prevents data remanence, which is critical for financial records.

Answer

Degauss and physically destroy

Answer

Transfer to a third-party storage vendor

Answer

Archive to tape for additional redundancy

Question 8

Match each OSI layer to its function.

Accepted Answer

Transport: Provides reliable data transfer and flow control. The correct matches are: Transport with reliable data transfer, Network with routing and logical addressing, Data Link with frame transmission between nodes, and Physical with bit transmission. Common confusions involve swapping Transport and Network functions.

Answer

Transport: Routes packets using logical addressing

Answer

Network: Provides reliable data transfer

Question 9

A security architect is reviewing a software design that uses a third-party library for XML parsing. The library is known to be vulnerable to XML External Entity (XXE) attacks. The architect recommends replacing the library. What is the primary risk of XXE attacks that the architect wants to avoid?

Accepted Answer

Disclosure of sensitive files from the server. XXE attacks exploit XML parsers that process external entities, allowing an attacker to read sensitive files from the server (e.g., /etc/passwd) by referencing them in the entity definition. The primary risk is unauthorized data disclosure, as the parser may include the file content in the response or error message. This directly violates confidentiality, a core security objective.

Answer

Remote code execution by injecting malicious XML

Answer

Denial of service (DoS) from entity expansion

Answer

Cross-site scripting (XSS) delivered via XML response

Question 10

A security assessment reveals that a web application uses client-side input validation exclusively. What is the most likely security risk?

Accepted Answer

An attacker can submit malicious data directly to the server without client-side constraints.. Client-side validation (e.g., JavaScript in the browser) can be bypassed by intercepting and modifying HTTP requests using tools like Burp Suite or cURL. Since the server does not re-validate the input, an attacker can submit crafted payloads (e.g., SQL injection, command injection) directly to the server, leading to data breaches or code execution. This violates the principle of defense in depth, where validation must occur on the server side regardless of client-side checks.

Answer

Attacker can inject malicious scripts that execute on the client side.

Answer

The application will have poor user experience due to slow responses.

Answer

The client-side code can be obfuscated but not decrypted.

Question 11

A security analyst is reviewing the findings from a vulnerability scan of a web application. Which TWO actions are most appropriate to prioritize remediation?

Accepted Answer

Whether a known exploit exists. Option C is correct because the existence of a known, weaponized exploit (e.g., one listed in CISA's KEV catalog or available in Metasploit) dramatically raises the likelihood of active compromise, so it should drive remediation priority. Option E is correct because the CVSS score provides a standardized, quantitative measure of a vulnerability's severity (base, temporal, and environmental metrics), making it a primary input for ranking remediation efforts. Options A, B, and D are not the best answers here: asset value is a contextual factor that can influence prioritization but is not itself a vulnerability attribute used to rank scan findings, the number of times a scan was run is irrelevant to the severity of a finding, and the discovery date does not indicate exploitability or impact, though age may matter for SLA tracking.

Answer

The asset's value to the organization

Answer

The number of times the scan was run

Answer

The date the vulnerability was discovered

Question 12

A company is migrating its critical application to a cloud provider. Which disaster recovery strategy provides the shortest recovery time objective (RTO) and recovery point objective (RPO)?

Accepted Answer

Hot site. A hot site is a fully operational duplicate of the primary environment with real-time or near-real-time data replication, so it can take over almost immediately. This yields the shortest RTO (minutes) and RPO (near zero) of the options listed, at the highest cost.

Answer

Warm site

Answer

Cold site

Answer

Reciprocal agreement

Question 13

A company's compliance officer wants to ensure that the organization's security controls meet regulatory requirements for data protection. The officer requests a review of the controls against the regulation's specific clauses. Which type of assessment is most appropriate?

Accepted Answer

Compliance audit. A compliance audit is the correct assessment type because it systematically evaluates security controls against specific regulatory clauses (e.g., GDPR Article 32, HIPAA Security Rule §164.312). Unlike risk or vulnerability assessments, a compliance audit maps controls directly to legal requirements to verify adherence, often using checklists and evidence collection.

Answer

Risk assessment

Answer

Vulnerability assessment

Answer

Penetration test

Question 14

A financial institution must ensure that transactions are well-formed and enforce separation of duties to prevent fraud. Which security model best addresses these requirements?

Accepted Answer

Clark-Wilson. The Clark-Wilson model is specifically designed for commercial integrity and enforces well-formed transactions and separation of duties through its access control triple (subject, program, object). It ensures that data can only be modified through certified transformation procedures, which directly addresses the requirement for well-formed transactions and fraud prevention via separation of duties. This makes it the correct model for financial transaction integrity.

Answer

Biba

Answer

Brewer-Nash

Answer

Bell-LaPadula

Question 15

Which of the following is a key objective of a business impact analysis (BIA)?

Accepted Answer

Determine the maximum tolerable downtime for critical processes. A BIA is a foundational step in business continuity planning (BCP) that identifies critical business functions and quantifies the impact of their disruption over time. Its primary output is the maximum tolerable downtime (MTD), also called maximum allowable outage, along with recovery time objectives (RTO) and recovery point objectives (RPO) for each critical process. Determining MTD lets the organization prioritize recovery efforts and justify continuity investments.

Answer

Implement security controls

Answer

Identify vulnerabilities in the network

Answer

Test the disaster recovery plan