CISSP Practice Test 49 — 15 Questions

Question 1

A network engineer is configuring an IPsec VPN in tunnel mode. Which IPsec protocol provides both authentication and encryption of the entire IP packet?

Accepted Answer

ESP (Encapsulating Security Payload). ESP (Encapsulating Security Payload) in tunnel mode provides both authentication and encryption for the entire original IP packet, including the original header and payload. It encapsulates the packet with a new IP header and ESP trailer, ensuring confidentiality via encryption and integrity via authentication. This makes it the correct choice for a VPN requiring both security services.

Answer

IKE (Internet Key Exchange)

Answer

ISAKMP

Answer

AH (Authentication Header)

Question 2

Which access control model allows the owner of a resource to determine who can access it and what permissions they have?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) allows the resource owner to control access at their discretion.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Question 3

A government contractor handles classified information up to the Secret level. The company's data classification policy recently changed, requiring that all documents marked as 'Confidential' be reclassified as 'Secret' after review. Who is ultimately accountable for ensuring that reclassification is performed correctly?

Accepted Answer

Data owner. The data owner is the senior-level manager accountable for data classification and protection. They have the authority and responsibility to assign classification levels and ensure data is properly classified.

Answer

Data custodian

Answer

Data subject

Answer

Data steward

Question 4

An organization is required to retain audit logs for seven years due to regulatory compliance. The logs are currently stored on a file server that is approaching capacity. What is the BEST way to manage log storage?

Accepted Answer

Compress logs and move them to low-cost archival storage.. It balances the seven-year retention requirement with storage constraints by compressing logs (reducing size) and moving them to low-cost archival storage (e.g., cold storage or tape). This preserves data integrity and accessibility for compliance audits while freeing up space on the primary file server.

Answer

Reduce the logging level to generate less data.

Answer

Delete logs older than one year.

Answer

Increase the frequency of log rotation.

Question 5

A company has multiple offices connected via a WAN. They want to ensure that all traffic between offices is encrypted and authenticated. Which technology is most appropriate?

Accepted Answer

IPsec VPN. IPsec VPN is the most appropriate technology because it operates at the network layer (Layer 3) and provides both encryption and authentication for all IP traffic between sites over an untrusted WAN. It uses protocols such as ESP (Encapsulating Security Payload) for confidentiality and AH (Authentication Header) or ESP for integrity and authentication, ensuring that all inter-office traffic is protected in transit.

Answer

MPLS

Answer

DMVPN

Answer

SSL VPN

Question 6

A developer is tasked with securely storing user passwords in a database. Which of the following is the most secure approach?

Accepted Answer

Hash the password with bcrypt using a unique salt per user. Bcrypt is a computationally expensive, adaptive hashing algorithm designed specifically for password storage. It incorporates a unique salt per user to prevent rainbow table attacks and its work factor can be increased over time to counter faster hardware, making it the most secure option among those listed.

Answer

Do not store passwords; use federated identity

Answer

Encrypt the password using AES and store the ciphertext

Answer

Hash the password with MD5 and store the hash

Question 7

A security analyst is conducting a vulnerability scan of a web application. The scan identifies several vulnerabilities, but the analyst wants to minimize false positives. Which type of vulnerability scan would be most appropriate?

Accepted Answer

Authenticated scan. An authenticated scan uses valid credentials to log into the target system, allowing the scanner to access deeper configuration details and patch levels. This reduces false positives by distinguishing between vulnerabilities that are actually present and those that appear due to incomplete visibility, such as missing patches that are actually applied but not visible to an unauthenticated scanner.

Answer

External scan

Answer

Passive scan

Answer

Unauthenticated scan

Question 8

A security team is evaluating a new endpoint detection and response (EDR) solution. Which of the following capabilities is MOST important for detecting fileless malware?

Accepted Answer

Behavioral analysis and process monitoring.. Behavioral analysis and process monitoring detect anomalous behavior typical of fileless malware. Signature-based detection is ineffective against fileless variants.

Answer

Static malware analysis.

Answer

Signature-based detection.

Answer

Network traffic inspection.

Question 9

Which THREE of the following are common methods used in security assessment and testing? (Select exactly 3.)

Accepted Answer

Penetration testing. Penetration testing is a common method in security assessment and testing that simulates real-world attacks to identify exploitable vulnerabilities. Unlike vulnerability scanning, which only identifies potential weaknesses, penetration testing actively exploits them to validate security controls and measure the impact of a breach.

Answer

Risk analysis

Answer

Forensic analysis

Question 10

Which THREE of the following are recognized roles in asset security?

Accepted Answer

Data custodian. The data custodian (A) is responsible for implementing and maintaining security controls according to the data owner's directives, such as applying encryption, managing backups, and enforcing access controls. This role is recognized in asset security because it bridges policy and operational execution, ensuring the CIA triad is maintained on the stored or processed data.

Answer

Data subject

Answer

Data auditor

Question 11

An organization wants to provide just-in-time administrative access to servers, with session recording and password vaulting. Which solution is best suited?

Accepted Answer

Privileged Access Management (PAM). Privileged Access Management (PAM) provides just-in-time access, session recording, password vaulting, and break-glass accounts.

Answer

Identity as a Service (IDaaS)

Answer

Single Sign-On (SSO)

Answer

Role-Based Access Control (RBAC)

Question 12

An organization is required to retain security logs for a minimum of one year to meet compliance regulations. Which practice is most directly related to this requirement?

Accepted Answer

Log retention requirements. The requirement to retain security logs for a minimum of one year is directly about the duration logs must be stored. Option D, 'Log retention requirements,' is the practice that defines this storage duration, ensuring compliance with regulations such as PCI DSS or SOX. This is a policy-driven specification of how long logs are kept, not how they are reviewed, formatted, or collected.

Answer

Log review frequency

Answer

Log format standardization

Answer

Centralized log management

Question 13

A software development company uses a continuous integration/continuous deployment (CI/CD) pipeline that automatically builds and deploys code to production after passing automated tests. The code repository contains proprietary algorithms and customer data. A recent incident was traced to an attacker who injected malicious code into a library that was pulled from a public package repository during the build process. The company wants to prevent similar supply chain attacks without significantly slowing development. Which of the following is the BEST course of action?

Accepted Answer

Implement a private repository that mirrors approved open-source libraries and enforces signature verification and hash checks before allowing use. Implementing a private repository that mirrors only approved, vetted open-source libraries with enforced signature verification and hash checks directly addresses supply chain attacks by ensuring that only trusted, integrity-verified code enters the build pipeline. This approach prevents malicious code from public repositories from being pulled automatically, without requiring manual review of every library (which would slow development) or relying on post-build scanning that cannot prevent the initial injection. It aligns with the principle of secure software supply chain management by establishing a trusted source of components.

Answer

Require all developers to perform manual code review of every third-party library before inclusion

Answer

Perform static application security testing (SAST) on the entire codebase including libraries

Answer

Increase the frequency of vulnerability scanning on the production environment and delay deployment of any library that has a deprecation notice

Question 14

A security engineer is configuring a firewall that makes decisions based on source/destination IP addresses and port numbers without tracking the state of connections. Which type of firewall is this?

Accepted Answer

Packet filter firewall. A packet filter firewall operates at Layers 3 and 4 of the OSI model, making forwarding decisions solely based on static fields such as source/destination IP addresses and port numbers. It does not maintain any connection state table, meaning each packet is evaluated independently without reference to previous packets. This stateless behavior is the defining characteristic that distinguishes it from stateful inspection firewalls.

Answer

Stateful inspection firewall

Answer

Application proxy firewall

Answer

Next-generation firewall

Question 15

Which VPN technology operates at Layer 2 of the OSI model and is often used in combination with IPsec to provide encryption?

Accepted Answer

L2TP. L2TP (Layer 2 Tunneling Protocol) operates at Layer 2 of the OSI model, encapsulating PPP frames to create a virtual point-to-point link. It is commonly combined with IPsec (specifically ESP in tunnel mode) to provide encryption, authentication, and integrity, as L2TP itself offers no confidentiality. This combination is defined in RFC 3193 and is widely used for remote-access VPNs.

Answer

WireGuard

Answer

IPsec

Answer

PPTP