CISSP Practice Test 48 — 15 Questions

Question 1

A security team is implementing a zero trust architecture. Which component is essential to enforce access decisions based on user identity, device posture, and context before granting access to resources?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Software-defined perimeter (SDP). A software-defined perimeter (SDP) is the essential component for enforcing access decisions based on user identity, device posture, and context in a zero trust architecture. SDP creates a dynamic, encrypted micro-perimeter around each resource, requiring authentication and authorization before any connection is established, effectively hiding the resource from unauthorized users. This aligns with the zero trust principle of 'never trust, always verify' by evaluating identity, device health, and contextual factors (e.g., location, time) before granting access.

Answer

Virtual private network (VPN)

Answer

Network Access Control (NAC)

Answer

Next-generation firewall (NGFW)

Question 2

Your organization is a medium-sized e-commerce company with a hybrid infrastructure: on-premises datacenter and AWS cloud. The security team recently conducted an internal vulnerability scan of the on-premises network and discovered multiple critical vulnerabilities in a legacy ERP system that cannot be patched because the vendor no longer supports it. The ERP system is essential for order processing and cannot be decommissioned. The team also ran a penetration test against the cloud environment and found that an attacker with network access could leverage misconfigured security groups to move laterally between instances. The company has a risk appetite that allows for limited risk acceptance with compensating controls. As the senior security analyst, what is the BEST course of action?

Accepted Answer

Apply virtual patching via an intrusion prevention system (IPS) for the ERP vulnerabilities and implement stricter security group rules in the cloud to restrict lateral movement.. The best course of action is to apply compensating controls: virtual patching via IPS for the legacy ERP vulnerabilities and stricter security group rules to restrict lateral movement in the cloud. This aligns with the company's risk appetite for limited risk acceptance with compensating controls, and addresses both findings without disrupting essential operations. Isolating or decommissioning the ERP would disrupt order processing, and accepting risk without controls is not acceptable.

Answer

Immediately isolate the legacy ERP system from the network and implement a manual workaround for order processing.

Answer

Decommission the legacy ERP system and migrate to a modern alternative, accepting a temporary disruption in operations.

Answer

Accept the risk for both findings and document them in the risk register without additional controls.

Question 3

An organization uses a role-based access control (RBAC) model. After an audit, it was discovered that users have accumulated excessive permissions due to role proliferation. The security architect proposes migrating to an attribute-based access control (ABAC) model. Which challenge is MOST likely to be encountered during this migration?

Accepted Answer

Increased complexity in defining and managing attributes.. Migrating from RBAC to ABAC requires defining a comprehensive set of attributes (subject, resource, environment) and the policies that combine them, which is inherently more complex than managing static role assignments. Role proliferation in RBAC often results from an attempt to mimic attribute-based decisions, but ABAC shifts the complexity from role engineering to attribute governance and policy logic, making attribute definition and management the primary challenge.

Answer

Difficulty in assigning roles to users.

Answer

Reduced performance due to policy evaluation overhead.

Answer

Lack of support for ABAC in legacy applications.

Question 4

An organization wants to provide just-in-time administrative access to servers, with session recording and password vaulting. Which solution is best suited?

Accepted Answer

Privileged Access Management (PAM). PAM (Privileged Access Management) solutions are purpose-built to broker, vault, and record privileged sessions — providing just-in-time elevation, credential checkout, and full session recording for administrative access to servers. Tools like CyberArk, BeyondTrust, and Delinea implement these controls natively, matching every requirement in the scenario. The other options address authentication or authorization but lack session recording and password vaulting capabilities.

Answer

Identity as a Service (IDaaS)

Answer

Single Sign-On (SSO)

Answer

Role-Based Access Control (RBAC)

Question 5

During a penetration test, the tester gains access to a server and finds sensitive customer data. What should the tester do next?

Accepted Answer

Report the finding immediately and secure the data. The tester's primary responsibility is to protect sensitive data and minimize risk. Upon discovering PII or other regulated data, the tester must immediately report the finding to the client and secure the data (e.g., by isolating the server or encrypting the data in place) to prevent unauthorized access or exposure. This aligns with the ethical hacking code of conduct and the CISSP principle of 'do no harm'.

Answer

Exfiltrate the data to demonstrate the risk

Answer

Delete the data to prevent exposure

Answer

Continue testing to find more vulnerabilities

Question 6

An organization's data retention policy requires that financial records be kept for seven years. After that period, the records must be destroyed in a manner that prevents reconstruction. Which of the following is the best sanitization method for paper records containing sensitive financial data?

Accepted Answer

Cross-cut shredding. Cross-cut shredding is the best sanitization method for paper records because it physically destroys the paper into small, unreadable pieces, making reconstruction extremely difficult. It is a widely accepted method for destroying sensitive paper documents. Option A is correct as it meets the requirement to prevent reconstruction.

Answer

Overwriting with random patterns multiple times

Answer

Cryptographic erasure

Answer

Degaussing with a strong magnetic field

Question 7

A company is designing a network segmentation strategy to isolate a public-facing web server from the internal corporate network. Which of the following is the most appropriate architecture?

Accepted Answer

DMZ (screened subnet). A DMZ (screened subnet) is the most appropriate architecture because it places the public-facing web server in a separate, isolated network segment that sits between the internal corporate network and the untrusted internet. Traffic from the internet is allowed only to the DMZ (typically via stateful firewall rules permitting HTTP/HTTPS on TCP ports 80/443), and traffic from the DMZ to the internal network is strictly controlled or proxied, preventing direct lateral movement. This aligns with the principle of defense in depth and is a standard CISSP-recommended design for securing publicly accessible services.

Answer

Micro-segmentation using SDN

Answer

VLAN with no firewall

Answer

Direct connection to internet without segmentation

Question 8

During a security audit, it is discovered that the database server is also accepting connections from the web server. Which of the following is the most likely misconfiguration?

Accepted Answer

The network segmentation is not enforcing strict controls. The database server accepting connections from the web server indicates a lack of proper network segmentation. In a secure architecture, the web server should be in a DMZ and the database server in a private network segment, with strict access controls enforced by a firewall or router ACLs. The misconfiguration is that the network segmentation is not enforcing strict controls, allowing traffic that should be blocked.

Answer

The application server is not properly authenticated

Answer

The TLS configuration is incorrect

Answer

The firewall on the database server allows all traffic from the DMZ

Question 9

A company uses WPA2-Enterprise with EAP-TLS for wireless access. An employee reports that a new laptop cannot connect to the wireless network, while older laptops work fine. The employee has installed the correct client certificate. What is the most likely cause?

Accepted Answer

The RADIUS server's certificate is not trusted by the new laptop.. In WPA2-Enterprise with EAP-TLS, mutual authentication requires the client to validate the RADIUS server's certificate. If the new laptop does not trust the RADIUS server's certificate (e.g., its CA root certificate is missing or expired), the EAP-TLS handshake will fail, preventing connection. Older laptops likely have the necessary root CA installed, while the new laptop does not.

Answer

The wireless network uses WPA2-PSK instead of WPA2-Enterprise.

Answer

The client certificate is not correctly associated with the user account.

Answer

The laptop does not support MSCHAPv2.

Question 10

A company is implementing a risk management program. They have identified a critical server with an asset value of $50,000. The exposure factor due to a potential threat is 40%, and the annual rate of occurrence is 2. What is the Annualized Loss Expectancy (ALE)?

Accepted Answer

$40,000. ALE = SLE × ARO, where SLE = Asset Value × Exposure Factor. Here SLE = $50,000 × 0.40 = $20,000, and ARO = 2, so ALE = $20,000 × 2 = $40,000. This quantifies the expected annual monetary loss from the threat, which is used to justify security controls whose cost is less than the ALE.

Answer

$50,000

Answer

$20,000

Answer

$100,000

Question 11

In a public key infrastructure (PKI), which component is responsible for issuing and revoking digital certificates?

Accepted Answer

Certificate Authority (CA). The Certificate Authority (CA) is the trusted entity in a PKI that issues digital certificates by signing them with its private key, and it also revokes certificates by publishing Certificate Revocation Lists (CRLs) or using the Online Certificate Status Protocol (OCSP). The CA is the authoritative source for certificate lifecycle management, including issuance, renewal, and revocation.

Answer

Registration Authority (RA)

Answer

Certificate Revocation List (CRL)

Answer

Validation Authority (VA)

Question 12

A multinational bank must enforce least privilege across 4,000 roles that change frequently as employees move between trading, compliance, and IT functions. Auditors found that access reviews are performed manually and that role definitions drift from actual job duties. The identity team proposes a role mining and management program. Which approach best aligns with identity and access management governance objectives while reducing role explosion?

Accepted Answer

Perform bottom-up role mining to derive candidate roles from existing entitlement data, then normalize and approve them through a role governance board.. Bottom-up role mining derives roles from observed entitlement patterns, which exposes drift between documented and actual access and produces a smaller, business-relevant role set. Normalizing and approving candidates through a governance board keeps roles controlled and auditable, reducing role explosion while supporting least privilege and repeatable access reviews across the bank's diverse functions.

Answer

Create a unique role for every employee based on their current entitlements and assign it during onboarding.

Answer

Eliminate all roles and assign entitlements directly to each user through workflow-based access requests.

Answer

Adopt a top-down role engineering approach that defines roles solely from the organizational chart and job descriptions.

Question 13

An organization is implementing federated identity to allow partners to access its web application. The solution must support single logout and attribute exchange. Which protocol is most appropriate?

Accepted Answer

SAML 2.0. SAML 2.0 is the most appropriate protocol because it natively supports both single logout (SLO) and attribute exchange as core features. It uses XML-based assertions to transfer identity and attribute data between an identity provider (IdP) and a service provider (SP), and its SLO mechanism ensures that when a user logs out from one application, all sessions across participating services are terminated simultaneously.

Answer

OpenID Connect

Answer

LDAP

Answer

OAuth 2.0

Question 14

During a penetration test, a security analyst discovers that a web application allows an attacker to bypass authorization and view another user's private messages by simply changing a numeric ID in the URL. Which vulnerability is being exploited?

Accepted Answer

Insecure direct object reference (IDOR). B is correct because the vulnerability allows an attacker to access another user's private messages by simply changing a numeric ID in the URL, which is a classic example of Insecure Direct Object Reference (IDOR). This occurs when the application exposes a direct reference to an internal object (e.g., a database key) without proper access control checks, enabling unauthorized access to resources belonging to other users.

Answer

Broken authentication

Answer

Server-side request forgery (SSRF)

Answer

Security misconfiguration

Question 15

A small business wants to implement a security policy that balances protection with usability. Which of the following is the MOST important factor when developing the policy?

Accepted Answer

Aligning the policy with business objectives and risk appetite.. A security policy must be aligned with the organization's business objectives and risk appetite to ensure it supports operations without imposing unnecessary restrictions. For a small business, this balance is critical—overly strict controls can hinder productivity, while weak controls increase risk. The policy should reflect the specific threats and tolerances of the business, not generic templates or compliance-only checklists.

Answer

Adopting a template from a similar organization to save time.

Answer

Ensuring the policy is enforceable with technical controls.

Answer

Basing the policy solely on regulatory compliance requirements.