CISSP Practice Test 45 — 15 Questions

Question 1

A security team is reviewing firewall logs and sees many dropped packets from an external IP. What type of attack is most likely?

Accepted Answer

Port scanning. Port scanning is the most likely attack because it involves an external IP sending packets to multiple ports on a target system to identify open services. Firewalls log these as dropped packets when they block unsolicited inbound traffic to closed or filtered ports, which is a common signature of reconnaissance activity.

Answer

Man-in-the-middle

Answer

SQL injection

Answer

Phishing

Question 2

In asset security, which of the following is a primary responsibility of a data owner?

Accepted Answer

Classifying data. The data owner is the senior-level manager who is ultimately accountable for a specific set of data. Their primary responsibility is to determine the data's sensitivity and business value, which directly drives the classification level (e.g., public, internal, confidential, restricted). Classification is the foundational step that dictates all subsequent protection requirements, making it a core duty of the data owner, not a technical implementer.

Answer

Monitoring access logs

Answer

Implementing security controls

Answer

Backing up data

Question 3

A financial institution is required to comply with SOX. Which of the following is a key focus area for IT under SOX?

Accepted Answer

IT general controls for financial systems. SOX requires publicly traded companies to establish and maintain internal controls over financial reporting. IT general controls (ITGC) are critical for ensuring the integrity of financial systems.

Answer

Encryption of data at rest

Answer

Breach notification procedures

Answer

Privacy of customer data

Question 4

Which of the following is a secure protocol for transferring files that uses SSH for authentication and encryption?

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol) is the correct answer because it is a secure file transfer protocol that operates over the SSH (Secure Shell) protocol, typically on TCP port 22. It leverages SSH's strong authentication and encryption mechanisms to protect both the data in transit and the credentials, making it a secure alternative to FTP.

Answer

FTPS

Answer

SCP

Answer

TFTP

Question 5

During a web application security test, a tester attempts to inject JavaScript into a search field and observes that the script executes when the page is loaded. This indicates a vulnerability to:

Accepted Answer

Cross-site scripting (XSS). The observed behavior—JavaScript injected into a search field executing when the page loads—is the hallmark of stored (persistent) cross-site scripting (XSS). In this attack, the tester's input is stored on the server (e.g., in a database or log) and later served to other users without proper output encoding, causing the browser to interpret the injected script as part of the page's HTML DOM. This directly violates the same-origin policy and allows arbitrary script execution in the context of the victim's session.

Answer

SQL injection

Answer

Command injection

Answer

Cross-site request forgery (CSRF)

Question 6

Match each cryptographic algorithm to its type.

Accepted Answer

RSA: Asymmetric encryption algorithm. RSA is asymmetric, AES is symmetric, SHA-256 is a hash, and HMAC is a MAC. The distractors incorrectly label RSA and SHA-256 as symmetric encryption.

Answer

RSA: Symmetric encryption algorithm

Answer

SHA-256: Symmetric encryption algorithm

Question 7

A company is deploying a wireless network for guests. The security requirement is to provide internet access only, with no access to the internal corporate network. Which technology should be used?

Accepted Answer

A separate guest VLAN with ACLs restricting access to internal networks. A separate guest VLAN with ACLs restricting access to internal networks is the correct choice because it provides network segmentation at Layer 2 (VLAN) and Layer 3/4 (ACLs), ensuring guest traffic is isolated from the corporate network while allowing internet access. This approach aligns with the principle of least privilege and is a standard best practice for guest wireless deployments, as it does not rely on authentication or encryption alone to enforce access control.

Answer

WPA3-SAE

Answer

MAC address filtering

Answer

WPA2-Enterprise with 802.1X

Question 8

Which type of testing analyzes source code for security vulnerabilities without executing the program?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It operates by scanning the codebase for known patterns, such as SQL injection or buffer overflow, using techniques like data flow analysis and taint tracking. This white-box approach identifies issues early in the Software Development Life Cycle (SDLC), making it the correct answer for testing that does not require runtime execution.

Answer

Interactive Application Security Testing (IAST)

Answer

Penetration testing

Answer

Dynamic Application Security Testing (DAST)

Question 9

A company wants to ensure that data is properly classified before storage. Which control should be implemented?

Accepted Answer

Data Classification Policy. A Data Classification Policy is the foundational control that defines the categories (e.g., public, internal, confidential) and handling requirements for data before it is stored. Without a policy, technical controls like encryption or DLP lack the classification labels needed to apply the correct rules. The policy ensures that data owners and custodians consistently label data at creation or ingestion, enabling downstream security controls to function correctly.

Answer

Encryption

Answer

Data Loss Prevention (DLP)

Answer

Access Control Lists (ACLs)

Question 10

A healthcare organization recently experienced a data breach. The incident response team traced the breach to a compromised third-party vendor that had remote access to the organization's network. The vendor's credentials were stolen via a phishing attack. The organization's security policy requires that all third-party remote access be monitored and logged. During the investigation, it was discovered that the vendor's session traffic was not logged because the logging system was misconfigured. The security team needs to prevent similar incidents in the future. Which of the following is the MOST effective remediation?

Accepted Answer

Implement a privileged access management (PAM) solution with session recording.. A Privileged Access Management (PAM) solution with session recording directly addresses the root cause: the logging system was misconfigured and failed to capture third-party remote access traffic. PAM enforces centralized control, vaulting credentials, and recording all sessions (e.g., via RDP, SSH) in a tamper-proof audit trail, ensuring that even if credentials are stolen, every keystroke and screen activity is logged and monitored. This provides the forensic evidence needed to detect and investigate unauthorized actions, closing the gap left by the misconfigured logging system.

Answer

Require multi-factor authentication for all third-party access.

Answer

Conduct regular phishing simulations for third-party vendors.

Answer

Disable all third-party remote access until a new vendor vetting process is established.

Question 11

A company is implementing a risk management program. They have identified a critical server with an asset value of $50,000. The exposure factor due to a potential threat is 40%, and the annual rate of occurrence is 2. What is the Annualized Loss Expectancy (ALE)?

Accepted Answer

$40,000. ALE = ARO × SLE; SLE = AV × EF = $50,000 × 0.4 = $20,000; ALE = 2 × $20,000 = $40,000.

Answer

$50,000

Answer

$20,000

Answer

$100,000

Question 12

An organization is implementing network segmentation. They need to place publicly accessible servers (e.g., web and email) in a separate network that is isolated from the internal LAN but still allows controlled access from the internet. Which architecture should they use?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a network segment that sits between the internet and the internal LAN, hosting publicly accessible servers like web and email. It uses firewall rules to allow inbound traffic from the internet to the DMZ servers while blocking direct access to the internal network, and typically permits only specific outbound responses or updates from the DMZ to the internal LAN. This architecture provides the isolation and controlled access required by the scenario.

Answer

Micro-segmentation

Answer

VPN

Answer

VLAN

Question 13

During the requirements gathering phase of a software development project, which threat modeling methodology is most commonly used to identify threats such as spoofing, tampering, and elevation of privilege?

Accepted Answer

STRIDE. STRIDE is a threat modeling methodology developed by Microsoft that categorizes threats into six types: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. During the requirements gathering phase, STRIDE is commonly used to systematically identify and classify potential security threats against each system component, making it the correct choice for identifying threats like spoofing, tampering, and elevation of privilege.

Answer

CVSS

Answer

OCTAVE

Answer

PASTA

Question 14

A security analyst is selecting forensic tools for an investigation. Which TWO tools are best suited for memory forensics? (Select TWO.)

Accepted Answer

Volatility. Volatility is a dedicated memory forensics framework; FTK can also capture and analyze memory, though it's more general. EnCase is disk forensics, Wireshark network, Autopsy disk.

Answer

Wireshark

Answer

Autopsy

Answer

EnCase

Question 15

A SOC analyst at Tier 1 identifies a potential malware infection on a user workstation. What is the next step in the standard incident response process?

Accepted Answer

Escalate the incident to Tier 2 analyst for further investigation. Tier 1 analysts typically triage alerts and escalate if they cannot resolve them.

Answer

Update the SIEM correlation rule to ignore similar alerts

Answer

Disconnect the workstation from the network immediately

Answer

Perform a deep forensic analysis of the workstation