CISSP Practice Test 47 — 15 Questions

Question 1

An organization has a maximum tolerable downtime (MTD) of 8 hours for a critical application. The recovery time objective (RTO) is set to 4 hours. Which of the following best describes the purpose of the RTO?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The time within which IT systems must be restored. RTO defines the maximum time allowed to restore IT services after a disaster, ensuring the MTD is not exceeded.

Answer

The total downtime the organization can tolerate

Answer

The maximum amount of data loss acceptable

Answer

The time required to repair a failed component

Question 2

A developer is implementing cryptographic storage for sensitive user data. Which of the following is a cryptographic best practice?

Accepted Answer

Using AES-256 in Galois/Counter Mode (GCM) for authenticated encryption. Industry-standard algorithms like AES-256 and SHA-256 are recommended, while MD5 and SHA-1 are deprecated due to weaknesses. Authenticated encryption (e.g., GCM) provides both confidentiality and integrity.

Answer

Using a static initialization vector (IV) for all encryption operations

Answer

Encrypting data with a hardcoded key in source code

Answer

Hashing passwords with MD5 for performance

Question 3

Which of the following is a key requirement under the GDPR regarding personal data breaches?

Accepted Answer

Notify the supervisory authority within 72 hours. GDPR Article 33 requires data controllers to notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to rights and freedoms.

Answer

Conduct a privacy impact assessment within 30 days

Answer

Report the breach to law enforcement immediately

Answer

Notify affected individuals within 24 hours

Question 4

A company is merging with another and must integrate security policies. What is the first step?

Accepted Answer

Conduct a gap analysis. The first step in integrating security policies during a merger is to conduct a gap analysis. This systematically compares the existing policies, controls, and compliance requirements of both organizations against each other and against relevant standards (e.g., ISO 27001, NIST SP 800-53). Without understanding the current state and discrepancies, any subsequent policy creation, training, or adoption of a stricter policy would be uninformed and likely ineffective.

Answer

Train all employees

Answer

Create a new policy

Answer

Adopt the stricter policy

Question 5

A security team is planning a social engineering test for their organization. Which of the following scenarios would BEST assess the effectiveness of security awareness training?

Accepted Answer

Sending a phishing email that mimics a common internal communication.. Sending a phishing email that mimics a common internal communication directly tests whether employees can recognize and report a realistic social engineering attempt, which is the primary goal of security awareness training. This scenario evaluates the human firewall by simulating the most prevalent attack vector—email-based phishing—and measures the effectiveness of training in reducing click-through rates and increasing reporting behavior.

Answer

Calling employees and pretending to be IT support to obtain passwords.

Answer

Attempting to tailgate into a secure facility.

Answer

Searching through trash bins for sensitive documents.

Question 6

Which TWO of the following are examples of administrative controls? (Select exactly 2)

Accepted Answer

Security awareness training. Security awareness training (B) is an administrative control because it involves policies, procedures, and human behavior management to reduce risk. Background checks (E) are also administrative controls, as they are part of personnel security policies that vet employees before granting access. Both are documented in the organization's security policy framework and are not technical or physical mechanisms.

Answer

Firewall rules

Answer

Security guards at entrances

Answer

Encryption of data at rest

Question 7

Which authentication factor type is a smart card?

Accepted Answer

Type 2 (something you have). A smart card is a Type 2 authentication factor because it falls under the 'something you have' category. The card itself is a physical device that stores a digital certificate or cryptographic key, which the user must possess to authenticate. Unlike knowledge-based or biometric factors, possession of the smart card is the core authentication mechanism, often combined with a PIN (Type 1) for two-factor authentication.

Answer

Somewhere you are

Answer

Type 3 (something you are)

Answer

Type 1 (something you know)

Question 8

A security team is performing a quantitative risk analysis for a server valued at $100,000. The exposure factor is 0.4 and the annual rate of occurrence is 2. What is the annualized loss expectancy (ALE)?

Accepted Answer

$80,000. SLE = AV × EF = $100,000 × 0.4 = $40,000. ALE = SLE × ARO = $40,000 × 2 = $80,000.

Answer

$40,000

Answer

$200,000

Answer

$160,000

Question 9

A company is implementing PCI DSS compliance. Which requirement is related to protecting cardholder data at rest?

Accepted Answer

Protect stored cardholder data. PCI DSS Requirement 3 is to protect stored cardholder data, often through encryption or tokenization.

Answer

Restrict physical access to cardholder data

Answer

Encrypt transmission of cardholder data over open networks

Answer

Install and maintain a firewall configuration

Question 10

Which THREE of the following are key components of a disaster recovery plan for a hot site? (Select three)

Accepted Answer

Pre-installed servers and workstations. A hot site is fully equipped and ready to take over operations quickly, requiring real-time data synchronization, pre-installed hardware, and network connectivity.

Answer

Empty space with power and cooling only

Answer

Long lead time to activate (e.g., weeks)

Question 11

Under the ISC2 Code of Ethics, which canon takes precedence over all others?

Accepted Answer

Protect society, the common good, and the infrastructure. The first canon is to protect society, the common good, and the public trust. It is the highest priority.

Answer

Provide diligent and competent service to principals

Answer

Act honorably, honestly, justly, responsibly, and legally

Answer

Advance and protect the profession

Question 12

In a quantitative risk analysis, if the single loss expectancy (SLE) is $15,000 and the annual rate of occurrence (ARO) is 0.5, what is the annualized loss expectancy (ALE)?

Accepted Answer

$7,500. ALE = SLE * ARO = $15,000 * 0.5 = $7,500.

Answer

$30,000

Answer

$15,000

Answer

$75,000

Question 13

A security professional is tasked with sanitizing a set of hard drives that contain sensitive corporate data. The organization wants to ensure that data cannot be recovered, even by advanced forensic methods. According to NIST SP 800-88, which THREE methods are considered appropriate for sanitization? (Select THREE.)

Accepted Answer

Physically shredding the drive into small pieces. NIST SP 800-88 defines clearing, purging, and destroying as sanitization methods. Overwriting is a form of clearing/purging, degaussing is purging for magnetic media, and physical destruction is destroying. Cryptographic erasure is effective for encrypted media but is not a separate category in the standard.

Answer

Deleting all files and emptying the recycle bin

Answer

Reformatting the drive and reinstalling the operating system

Question 14

An organization is implementing privacy by design in a new application that collects user location data. Which practice best aligns with the data minimization principle?

Accepted Answer

Collecting location data only when the app is actively in use. Data minimization requires collecting only the data necessary for the specified purpose. Collecting location data only when the app is actively in use reduces unnecessary data collection.

Answer

Encrypting location data both at rest and in transit

Answer

Anonymizing location data after collection

Answer

Obtaining explicit consent from users before collection

Question 15

Which term describes the process of modifying data so that it cannot be attributed to a specific individual without additional information that is kept separately?

Accepted Answer

Pseudonymisation. Pseudonymisation replaces identifying information with pseudonyms, allowing re-identification with additional data kept separately.

Answer

Anonymisation

Answer

Differential privacy

Answer

Encryption