CISSP Practice Test 47 — 15 Questions

Question 1

In Kerberos authentication, which component issues a Ticket Granting Ticket (TGT) after verifying the user's credentials?

Accepted Answer

Authentication Server (AS). In Kerberos, the Authentication Server (AS) is the component that verifies the user's credentials (typically by decrypting a timestamp with the user's long-term key) and issues the Ticket Granting Ticket (TGT). The AS is part of the Key Distribution Center (KDC), but it is specifically the AS that performs authentication and returns the TGT. This makes Authentication Server the correct answer.

Answer

Domain Controller

Answer

Ticket Granting Server (TGS)

Answer

Key Distribution Center (KDC)

Question 2

A financial application uses a third-party library for PDF generation. A security review finds that the library is no longer maintained and has known vulnerabilities. What is the BEST course of action?

Accepted Answer

Replace the library with a maintained alternative.. Replacing the unmaintained library with a maintained alternative is the best action because it eliminates the root cause: known vulnerabilities in code you cannot patch. A maintained library receives security updates, so the risk is removed rather than mitigated. Compensating controls like network restrictions or WAFs do not fix the underlying vulnerable code.

Answer

Restrict network access to the PDF server.

Answer

Encrypt all PDF files after generation.

Answer

Implement a web application firewall to block attacks targeting the library.

Question 3

A security team is implementing data loss prevention (DLP) to protect sensitive information. Which DLP type is best suited to monitor and block sensitive data leaving the corporate network via email or web traffic?

Accepted Answer

Network DLP. Network DLP is designed to monitor and control data in transit across network boundaries, including email and web traffic. It inspects packets leaving the corporate network to detect and block sensitive data exfiltration. Therefore, it is best suited for monitoring and blocking sensitive data leaving via email or web traffic.

Answer

Cloud DLP

Answer

Endpoint DLP

Answer

Classification-based controls

Question 4

A financial institution stores customer PII, including Social Security numbers (SSNs). Under privacy regulations, SSNs are considered sensitive PII. Which of the following techniques would best reduce the risk of re-identification while preserving the utility of the data for statistical analysis?

Accepted Answer

Differential privacy by adding calibrated noise to the dataset. Differential privacy adds mathematically calibrated noise to query results or dataset statistics so that the presence or absence of any single individual cannot be inferred, while aggregate statistical properties remain accurate. This directly addresses re-identification risk — even with auxiliary data, an attacker cannot confidently determine whether a specific person is in the dataset. It preserves utility for statistical analysis because the noise is bounded and unbiased across large populations.

Answer

Anonymization by removing all direct identifiers

Answer

Encrypting the entire dataset at rest

Answer

Pseudonymization by replacing names with random identifiers

Question 5

An organization's security policy requires that all data at rest must be encrypted. Which security principle is primarily being addressed?

Accepted Answer

Confidentiality. Encryption of data at rest protects data from unauthorized disclosure by rendering it unreadable without the decryption key. This directly addresses the confidentiality principle of the CIA triad, ensuring only authorized parties can access the data. Integrity concerns unauthorized modification, availability concerns uptime, and non-repudiation concerns proving an action occurred.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 6

Under the Sarbanes-Oxley Act (SOX), which of the following is an example of an IT general control that supports financial reporting?

Accepted Answer

Change management process for the financial system. Under SOX, IT general controls (ITGCs) are the foundational controls that ensure the reliability, integrity, and security of the IT environment supporting financial reporting. A change management process for the financial system is a classic ITGC because it ensures that modifications to applications affecting financial data are authorized, tested, approved, and documented — directly protecting the accuracy and completeness of financial statements. SOX Section 404 requires management to assess and auditors to attest to the effectiveness of these internal controls over financial reporting (ICFR), and ITGCs like change management are a core part of that assessment.

Answer

Data encryption for customer PII

Answer

Firewall rule to block unauthorized traffic

Answer

Automated calculation of interest on loans

Question 7

A company is decommissioning a data center and needs to dispose of hard drives that contained highly confidential financial data. Which of the following methods provides the HIGHEST assurance that data cannot be recovered?

Accepted Answer

Shredding the drives into small pieces. Shredding the drives into small pieces physically destroys the platters, making data recovery impossible regardless of the storage technology (e.g., HDD vs. SSD). This method provides the highest assurance because it eliminates any possibility of reading residual magnetic or solid-state data, even with advanced forensic tools like electron microscopy.

Answer

Overwriting the drives with multiple passes of random data

Answer

Degaussing the drives

Answer

Overwriting the drives with a single pass of zeros

Question 8

Which phase of the data lifecycle involves the removal of data from active storage and placement into long-term storage for potential future use?

Accepted Answer

Archive. The Archive phase of the data lifecycle is specifically defined as the stage where data is moved out of active, frequently accessed storage and placed into long-term retention for potential future reference or compliance needs. Unlike Destroy, which permanently eliminates data, Archive preserves the data in a lower-cost, less accessible tier. This aligns with lifecycle models (e.g., ISACA/ISO 27001 data lifecycle) where Archive follows Use and precedes eventual Destroy.

Answer

Use

Answer

Destroy

Answer

Store

Question 9

A company's disaster recovery plan includes an agreement with another company to provide backup computing facilities in case of a disaster. The agreement allows the second company to use the facilities for its own operations if needed. This arrangement is best described as:

Accepted Answer

Reciprocal agreement. A reciprocal agreement is a mutual arrangement where two organizations agree to provide backup computing facilities to each other in the event of a disaster. Because the second company can also use the facilities for its own operations, the arrangement is explicitly reciprocal rather than a one-way commercial contract. Hot, warm, and cold sites are unilateral facility types owned or leased by the primary organization, not mutual sharing agreements.

Answer

Hot site

Answer

Warm site

Answer

Cold site

Question 10

A company is evaluating a third-party software library for use in their application. Which document provides a detailed inventory of the library's components and dependencies to help assess supply chain risk?

Accepted Answer

Software Bill of Materials (SBOM). A Software Bill of Materials (SBOM) is a machine-readable inventory of all components, libraries, and dependencies in a software artifact, including versions and suppliers. It is the primary document for assessing supply chain risk because it reveals transitive dependencies that may contain known vulnerabilities.

Answer

Service Level Agreement (SLA)

Answer

Data processing agreement

Answer

Vulnerability disclosure report

Question 11

A security analyst is evaluating the impact of upgrading web servers from TLS 1.2 to TLS 1.3. Which advantage does TLS 1.3 offer in terms of handshake efficiency?

Accepted Answer

Fewer round trips during handshake. TLS 1.3 reduces the handshake from two round trips (2-RTT) in TLS 1.2 to one round trip (1-RTT) for a full handshake, and offers 0-RTT for resumed sessions. This is achieved by combining the ClientHello and ServerHello with key exchange parameters, eliminating the separate round trip for the ServerHello and Certificate exchange. The result is lower latency and faster connection establishment, which is critical for performance-sensitive applications.

Answer

It supports the same cipher suites as TLS 1.2

Answer

More round trips during handshake

Answer

It eliminates the need for asymmetric encryption

Question 12

An organization has identified a risk with a high likelihood and high impact. Management decides to implement controls to reduce the likelihood. After controls, the risk is reassessed as medium likelihood and medium impact. What is the residual risk?

Accepted Answer

Medium likelihood, medium impact. Residual risk is the risk that remains after controls have been implemented. In this scenario, the original risk was high likelihood and high impact; after controls, it is reassessed as medium likelihood and medium impact. Therefore, the residual risk is medium likelihood and medium impact.

Answer

Low likelihood, low impact

Answer

High likelihood, high impact

Answer

Control risk is not a defined term

Question 13

During a penetration test, the tester gains initial access to a server and then attempts to pivot to other systems. Which phase of the penetration testing process does this represent?

Accepted Answer

Post-exploitation/lateral movement. After gaining initial access, the penetration tester attempts to pivot to other systems, which is part of post-exploitation and specifically lateral movement. This phase involves expanding access, escalating privileges, and moving laterally within the network to compromise additional targets.

Answer

Reconnaissance

Answer

Exploitation

Answer

Reporting

Question 14

A security architect is designing a cryptographic system for a high-security environment where data must be encrypted both at rest and in transit, with granular access control. The system must be efficient for large volumes of data. Which approach is most appropriate?

Accepted Answer

Use asymmetric encryption for key exchange and symmetric encryption for data (hybrid cryptosystem).. A hybrid cryptosystem combines the efficiency of symmetric encryption (e.g., AES-256) for bulk data encryption with the secure key distribution of asymmetric encryption (e.g., RSA or ECDH). This approach ensures strong confidentiality for large volumes of data at rest and in transit, while enabling granular access control through per-user or per-session key management.

Answer

Use symmetric encryption (e.g., AES-256) for all data and share keys out-of-band.

Answer

Use only asymmetric encryption (e.g., RSA) for all data.

Answer

Use hash functions (e.g., SHA-256) to ensure confidentiality.

Question 15

A company is deploying a new application that processes personally identifiable information (PII) in a hybrid cloud environment. The security architect needs to ensure that encryption keys are never exposed to the cloud provider. Which solution should be recommended?

Accepted Answer

Client-side encryption with keys stored on-premises. Client-side encryption ensures that encryption keys are generated and managed on-premises, never transmitted to the cloud provider. This directly meets the requirement that keys are never exposed to the cloud provider, as all cryptographic operations occur before data leaves the customer's controlled environment.

Answer

Envelope encryption with a key management service

Answer

Server-side encryption with cloud provider managed keys

Answer

Server-side encryption with customer-provided keys