CISSP Practice Test 48 — 15 Questions

Question 1

Which access control model allows the data owner to determine who can access their resources, typically using Access Control Lists (ACLs)?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) gives owners discretion over access permissions, often via ACLs.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Question 2

A security policy requires that a user cannot have both the ability to create purchase orders and approve invoices. This is an example of:

Accepted Answer

Separation of duties. Separation of Duties (SoD) is a control that prevents a single individual from performing conflicting duties, reducing the risk of fraud.

Answer

Need-to-know

Answer

Least privilege

Answer

Job rotation

Question 3

A developer is implementing OAuth 2.0 for a mobile app (public client) that needs to access a user's data from a third-party API. To mitigate the authorization code interception attack, which OAuth 2.0 extension should be used?

Accepted Answer

PKCE. PKCE (Proof Key for Code Exchange) is designed for public clients to prevent interception of the authorization code.

Answer

Device code grant

Answer

Client credentials grant

Answer

Implicit grant

Question 4

Which of the following is an example of a Type 1 authentication factor?

Accepted Answer

Password. A Type 1 factor is something you know, such as a password, PIN, or security question.

Answer

OTP token

Answer

Fingerprint

Answer

Smart card

Question 5

An attacker has obtained a Kerberos TGT and uses it to request service tickets for any resource in the domain. Which type of attack is this?

Accepted Answer

Pass-the-ticket attack. A golden ticket attack involves forging a TGT, but pass-the-ticket uses a legitimate TGT obtained illegally.

Answer

Replay attack

Answer

Golden ticket attack

Answer

Kerberos cracking

Question 6

Which THREE of the following are common key performance indicators (KPIs) used in security assessment and testing?

Accepted Answer

Mean time to remediate critical vulnerabilities. Common security KPIs include patch compliance percentage, mean time to remediate critical vulnerabilities, and open vulnerability count by severity.

Answer

Number of employees trained on security awareness

Answer

Number of help desk tickets

Question 7

What is the PRIMARY purpose of a chain of custody in digital forensics?

Accepted Answer

To maintain evidence integrity and admissibility in court. Chain of custody ensures evidence integrity through documentation of handling.

Answer

To document the tools used during investigation

Answer

To identify the perpetrator of a cybercrime

Answer

To speed up the forensic analysis process

Question 8

A user reports that they cannot access a file share after being moved to a different department. The file share is secured with NTFS permissions and share permissions. The user is a member of the 'Marketing' group, but the file share is only accessible by 'Sales' group. What is the most likely reason?

Accepted Answer

The user is not a member of the Sales group. The user is unable to access the file share because the share is explicitly configured to allow access only to the 'Sales' group. Since the user has been moved to a different department and is now a member of 'Marketing' rather than 'Sales', they lack the necessary group membership. Even if share permissions were permissive, NTFS permissions would still need to grant access; however, the core issue is that the user is not in the required group. This is the most direct and likely reason for the access failure.

Answer

The share permissions deny access to Marketing

Answer

The user's account is disabled

Answer

The NTFS permissions deny access

Question 9

A security architect is reviewing a web application's design and identifies several potential vulnerabilities. Which TWO of the following are effective mitigations for cross-site scripting (XSS) attacks?

Accepted Answer

Enabling Content Security Policy (CSP). Output encoding ensures user input is treated as data, and Content Security Policy (CSP) restricts sources of executable scripts. Input validation can help but is not as effective alone; whitelist validation is emphasized, but output encoding and CSP are primary defenses.

Answer

Using CSRF tokens

Answer

Disabling client-side scripts entirely

Answer

Implementing parameterized queries

Question 10

During a security assessment, a penetration tester discovers that a web application exposes internal IP addresses in error messages. Which vulnerability category does this represent?

Accepted Answer

Security misconfiguration. Exposing internal IP addresses in error messages is a classic example of a security misconfiguration (C). The web application is likely configured to output detailed error messages (e.g., stack traces or debug information) that include internal network details, which should be suppressed in production environments. This violates the principle of least information disclosure and is categorized under security misconfiguration because it stems from improper default or runtime settings.

Answer

Broken access control

Answer

Sensitive data exposure

Answer

Insecure deserialization

Question 11

During an internal security assessment, a tester uses a tool to attempt to crack password hashes extracted from a domain controller. Which phase of the penetration testing process does this represent?

Accepted Answer

Post-exploitation. C is correct because cracking password hashes extracted from a domain controller occurs after the tester has already gained access to the system. This activity is part of the post-exploitation phase, where the tester escalates privileges, extracts credentials, and moves laterally. In this context, the tester is using a tool like John the Ripper or Hashcat to crack NTLM hashes, which is a classic post-exploitation step to obtain plaintext passwords for further access.

Answer

Reconnaissance

Answer

Reporting

Answer

Exploitation

Question 12

A security administrator is configuring a stateful firewall to allow HTTP traffic from the internet to a web server. The firewall uses a default-deny policy. What is the correct rule placement?

Accepted Answer

Place the allow rule before the deny all rule. In a stateful firewall with a default-deny policy, rules are processed in sequential order from top to bottom. Placing the allow rule before the deny all rule ensures that HTTP traffic (TCP port 80) is explicitly permitted before the catch-all deny rule drops all unmatched packets. If the deny all rule were placed first, all traffic would be dropped, including the intended HTTP traffic, making the allow rule unreachable.

Answer

Place the allow rule after the deny all rule

Answer

Use a stateless firewall instead

Answer

Use an implicit deny rule

Question 13

A security architect is evaluating security models for a multilevel secure system. Which model enforces the * property (no write down) and is typically used for confidentiality?

Accepted Answer

Bell-LaPadula. The Bell-LaPadula model enforces the * (star) property, which prohibits subjects from writing to objects at a lower classification level (no write down). This property, combined with the simple security property (no read up), ensures that information cannot flow from higher to lower security levels, making it the standard model for enforcing confidentiality in multilevel secure systems.

Answer

Clark-Wilson

Answer

Brewer-Nash

Answer

Biba

Question 14

A security architect is designing an authentication system for a healthcare application that requires strong security. The system will use a password and a one-time passcode sent via SMS. How many authentication factor types are being used?

Accepted Answer

Two. Password is Type 1 (something you know), SMS OTP is Type 2 (something you have, as the phone is possessed). Only two factor types are used.

Answer

Three

Answer

Four

Answer

One

Question 15

Which of the following is the primary purpose of a security assessment?

Accepted Answer

To identify and evaluate security risks. A security assessment's primary purpose is to systematically identify and evaluate security risks by analyzing assets, threats, vulnerabilities, and existing controls. This aligns with the NIST SP 800-115 framework, which defines assessment as the process of determining how effectively an entity is meeting specific security objectives, not as a remediation or enforcement activity.

Answer

To fix all vulnerabilities

Answer

To achieve compliance with regulations

Answer

To punish non-compliant employees