CISSP Practice Test 46 — 15 Questions

Question 1

Which TWO of the following are key indicators that a security awareness training program is effective? (Choose two.)

Accepted Answer

An increase in employees reporting suspicious emails to the security team.. A measurable increase in employees reporting suspicious emails directly indicates that the training has improved their ability to recognize phishing indicators (e.g., mismatched URLs, spoofed sender domains, urgent language) and has instilled the desired reporting behavior. This is a leading indicator of security awareness effectiveness, as it demonstrates proactive threat identification before a compromise occurs.

Answer

More instances of employees bypassing security controls to improve productivity.

Answer

An increase in help desk calls for password resets.

Answer

Fewer security policies are being issued.

Question 2

A security analyst runs a vulnerability scan against a web application and receives a report listing several critical vulnerabilities. However, the development team argues that many of these findings are false positives. Which of the following is the BEST next step for the analyst?

Accepted Answer

Manually verify a sample of the findings to confirm true vs. false positives.. Manual verification is the definitive method to distinguish true positives from false positives in vulnerability scanning. Automated scanners can produce false positives due to factors like incomplete service fingerprinting or reliance on banner grabbing, which may not reflect actual exploitability. The analyst must validate a representative sample of findings against the actual application behavior and configuration before taking further action.

Answer

Re-scan the application with the same settings to confirm the results.

Answer

Escalate all critical findings to management immediately.

Answer

Retune the vulnerability scanner to reduce false positives and re-scan.

Question 3

An organization is implementing network segmentation to enhance security. They create a DMZ to host public-facing servers and want to ensure that if a server is compromised, the attacker cannot pivot to the internal network. Which firewall placement best achieves this?

Accepted Answer

Implement a screened subnet with two firewalls: one between internet and DMZ, and one between DMZ and internal network. A screened subnet architecture uses two firewalls to create a DMZ that is logically isolated from both the internet and the internal network. The first firewall (internet-facing) controls inbound traffic to the DMZ, while the second firewall (internal-facing) strictly controls outbound traffic from the DMZ to the internal network, typically allowing only specific return traffic. This prevents an attacker who compromises a DMZ server from directly initiating connections to internal hosts, as the internal firewall would block such traffic unless explicitly permitted.

Answer

Place the DMZ on the internal network side with a strong host-based firewall on each server

Answer

Place a single firewall between the internet and the DMZ, and allow traffic from DMZ to internal network

Answer

Use a stateful firewall that only allows return traffic from internal to DMZ

Question 4

An organization is implementing DNSSEC to protect against DNS spoofing attacks. Which of the following best describes the primary security function provided by DNSSEC?

Accepted Answer

Authenticating the origin and ensuring integrity of DNS responses. DNSSEC (Domain Name System Security Extensions) provides data origin authentication and data integrity for DNS responses using digital signatures based on public-key cryptography. It does not encrypt DNS data or provide anonymity; instead, it allows a resolver to verify that a DNS response has not been modified in transit and that it originates from the authoritative source. This directly counters DNS spoofing attacks by ensuring the response is authentic and untampered.

Answer

Providing anonymous DNS resolution

Answer

Encrypting DNS queries to prevent eavesdropping

Answer

Blocking malicious DNS queries at the resolver

Question 5

You are the security manager for a manufacturing company with a large facility that houses production servers and sensitive intellectual property. The facility has a single physical entrance that uses a card reader for access control. During a routine audit, you find that the door prop alarm has been bypassed by taping a magnet to the sensor, allowing the door to stay open without triggering an alert. The security guard station is located 200 feet away and does not have a direct line of sight to the door. Which control should you implement FIRST to prevent unauthorized physical access?

Accepted Answer

Implement a mantrap with two interlocking doors at the entrance.. Implement a mantrap with two interlocking doors. A mantrap is a preventive physical control that effectively prevents tailgating and door propping by requiring one person to authenticate before the second door opens. This directly addresses the bypassed door prop alarm. Option A (biometric scanner) improves authentication but does not prevent door propping. Option B (patrols) is a detective/reactive control and may not catch the propping in time. Option D (video surveillance) is detective, not preventive.

Answer

Replace the card reader with a biometric fingerprint scanner.

Answer

Increase the frequency of security patrols around the entrance.

Answer

Install a video surveillance camera to monitor the entrance.

Question 6

A company is implementing TLS 1.3 to secure web communications. Which of the following features is unique to TLS 1.3 compared to earlier versions?

Accepted Answer

Mandatory forward secrecy using ephemeral Diffie-Hellman. TLS 1.3 (RFC 8446) mandates forward secrecy by requiring ephemeral Diffie-Hellman (DHE or ECDHE) key exchange for all handshakes. This ensures that session keys are never derived from long-term static keys, so compromising the server's private key does not compromise past session keys. Earlier TLS versions allowed static RSA key exchange, which lacks forward secrecy.

Answer

Support for RSA key exchange

Answer

Only server-side authentication

Answer

Use of RC4 for encryption

Question 7

A security engineer is recommending a VPN protocol for remote access. The requirements are: strong encryption, perfect forward secrecy, use of elliptic curve cryptography, and minimal overhead. Which VPN protocol best meets these requirements?

Accepted Answer

WireGuard. WireGuard is the correct choice because it uses modern elliptic curve cryptography (Curve25519) for key exchange, provides perfect forward secrecy by default through ephemeral session keys, and has minimal overhead due to its streamlined codebase (roughly 4,000 lines of code) and lack of stateful configuration. It operates over UDP with a simple cryptographic design that meets all specified requirements without the complexity of IPsec or SSL/TLS.

Answer

L2TP/IPsec

Answer

IPsec with ESP in tunnel mode

Answer

SSL/TLS VPN

Question 8

A development team is implementing a new feature that processes sensitive user data. Which of the following is the most secure approach to prevent data leakage during processing?

Accepted Answer

Use memory encryption for all user data.. Memory encryption protects sensitive user data while it resides in RAM, preventing unauthorized access through memory dumps, cold boot attacks, or other memory-scraping techniques. This is the most secure approach because it safeguards data during the entire processing lifecycle, unlike other options that leave data exposed in memory or rely on post-processing cleanup.

Answer

Use a separate virtual machine for each request.

Answer

Store all data in a temporary file and delete it after processing.

Answer

Log all data access for auditing.

Question 9

Which THREE of the following are examples of asymmetric cryptographic algorithms? (Select THREE.)

Accepted Answer

Elliptic Curve Cryptography (ECC). Elliptic Curve Cryptography (ECC) is an asymmetric cryptographic algorithm that uses the algebraic structure of elliptic curves over finite fields to provide security with smaller key sizes compared to RSA. It relies on the Elliptic Curve Discrete Logarithm Problem (ECDLP) for its security, making it computationally infeasible to derive the private key from the public key. ECC is widely used in modern protocols such as TLS, SSH, and Bitcoin for key exchange and digital signatures.

Answer

AES

Answer

Blowfish

Question 10

Which of the following BEST describes the difference between a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP)?

Accepted Answer

BCP ensures business functions continue, DRP restores IT operations. D is correct because the Business Continuity Plan (BCP) focuses on maintaining critical business functions during and after a disruption, ensuring minimal impact on operations, while the Disaster Recovery Plan (DRP) is a subset of BCP that specifically addresses the restoration of IT infrastructure, systems, and data after a disaster. The BCP encompasses broader organizational resilience, including manual workarounds and alternate sites, whereas the DRP targets technical recovery procedures such as system rebuilds, data restoration from backups, and failover to redundant systems.

Answer

BCP deals with natural disasters, DRP deals with cyberattacks

Answer

BCP is for IT systems, DRP is for business processes

Answer

BCP is a subset of DRP

Question 11

An organization implements a security model where users can only read objects at or below their security clearance, and can only write to objects at or above their clearance. This model primarily ensures:

Accepted Answer

Confidentiality. The described model is the Bell-LaPadula model, which enforces confidentiality. In Bell-LaPadula, subjects can read objects at or below their security level (read down) and write to objects at or above their level (write up). This prevents unauthorized access to higher classified information, ensuring confidentiality.

Answer

Integrity

Answer

Accountability

Answer

Availability

Question 12

Which governance framework provides guidance specifically for aligning IT services with business needs and includes a service lifecycle?

Accepted Answer

ITIL. ITIL (Information Technology Infrastructure Library) is a set of practices for IT service management that focuses on aligning IT services with business needs.

Answer

ISO/IEC 27001

Answer

NIST Cybersecurity Framework

Answer

COBIT 2019

Question 13

A security team implements a Data Loss Prevention (DLP) solution to monitor email attachments for sensitive data. Which type of DLP is being used?

Accepted Answer

Network DLP. Network DLP monitors data in motion by inspecting network traffic, such as email attachments, as they traverse the network perimeter. This is the correct type because the scenario explicitly describes monitoring email attachments, which are transmitted over the network, and Network DLP is designed to inspect SMTP, HTTP, FTP, and other protocols for sensitive content at the network layer.

Answer

Classification-based controls

Answer

Cloud DLP

Answer

Endpoint DLP

Question 14

A data warehouse contains anonymized customer transaction data used for analytics. The anonymization process removed direct identifiers and applied k-anonymity with k=10. An attacker obtains the dataset and attempts to re-identify individuals using auxiliary information. Which of the following best describes the residual privacy risk?

Accepted Answer

Moderate risk because k-anonymity does not protect against attribute disclosure if the group is homogeneous. k-anonymity means each record is indistinguishable from at least k-1 other records, but attacks like homogeneity or background knowledge can still lead to re-identification, especially if auxiliary data is available.

Answer

No risk because anonymization eliminates all PII

Answer

High risk because k=10 is too small to provide meaningful privacy

Answer

Low risk because k=10 ensures a group of at least 10 individuals

Question 15

Which of the following best describes the primary purpose of an incident response plan?

Accepted Answer

To provide a structured approach for managing and resolving security incidents. An incident response plan provides a structured approach to manage and resolve security incidents, minimizing impact.

Answer

To replace the need for a disaster recovery plan

Answer

To assign blame after an incident occurs

Answer

To document all security controls in place