CISSP Practice Test 49 — 15 Questions

Question 1

A large financial institution is finalizing its annual risk treatment plan based on a recent enterprise risk assessment. The risk appetite statement approved by the board specifies that the organization will accept only low residual risks for financial loss, but is willing to accept moderate risks for reputational damage if cost-benefit justifies. The risk register includes the following findings: 1) A critical SQL injection vulnerability in the online banking portal with high likelihood and critical impact; current controls include a web application firewall (WAF) that is not fully tuned. 2) Use of outdated TLS 1.0 encryption on internal communications between data centers; likelihood is medium, impact is low. 3) Lack of background checks for third-party vendors with access to sensitive data; likelihood is low, impact is moderate. 4) A single point of failure in the primary data center's power supply; likelihood is low, impact is critical. 5) An incident response plan that has not been tested in two years; likelihood is medium, impact is moderate. The CISO must prioritize actions for the upcoming quarter. What is the most appropriate first step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Immediately remediate the SQL injection vulnerability by tuning the WAF and applying vendor patches.. The SQL injection vulnerability in the online banking portal represents the highest-priority risk because it combines high likelihood with critical impact on a customer-facing financial system, directly violating the board's stated risk appetite of accepting only low residual risk for financial loss. Tuning the WAF and applying vendor patches directly reduces the likelihood and impact of exploitation, addressing the risk at its source. Under CISSP risk management principles, treatment priority is driven by risk exposure (likelihood × impact) relative to the organization's risk appetite, and this finding clearly exceeds the acceptable threshold.

Answer

Transfer the single point of failure risk by purchasing business interruption insurance.

Answer

Outsource incident response to a managed security service provider (MSSP) to compensate for the untested plan.

Answer

Accept the risk of outdated TLS 1.0 encryption because impact is low.

Question 2

Which of the following is the primary purpose of a configuration management database (CMDB) in asset management?

Accepted Answer

Store information about hardware and software components and their relationships. A CMDB's primary purpose is to store information about configuration items (CIs) — hardware, software, and other assets — and the relationships between them. This relationship mapping supports impact analysis, incident management, and change management by showing how components depend on each other.

Answer

Track software licenses and compliance

Answer

Perform vulnerability scanning

Answer

Monitor network performance

Question 3

A financial institution is required to perform regular penetration tests on its online banking platform. The testing must be as realistic as possible while minimizing risk to production data. Which of the following approaches BEST meets these requirements?

Accepted Answer

Build a replica of the production environment and test against it with realistic attack scenarios.. Building a replica (staging) environment allows the penetration test to simulate realistic attack scenarios without any risk to production data or system availability. This approach ensures the test can include destructive or disruptive techniques (e.g., SQL injection, privilege escalation) that would be unsafe on a live system, while still accurately reflecting the production architecture and configurations.

Answer

Conduct the test on the production environment using anonymized production data.

Answer

Use an automated vulnerability scanner on the production environment.

Answer

Perform the test during off-peak hours on the production system with read-only access.

Question 4

A small business owner stores customer payment card information (PCI) in a legacy database that is not compliant with PCI DSS. The business is migrating to a new cloud-based point-of-sale (POS) system that uses tokenization. The owner wants to ensure that the legacy data is handled securely during the transition. Which of the following is the BEST approach?

Accepted Answer

Tokenize the payment data in the legacy database, then securely purge the original cardholder data and verify the purge. Tokenization replaces sensitive cardholder data with a non-sensitive token, rendering the original data useless for attackers. After tokenizing the legacy database, securely purging the original cardholder data (e.g., using NIST SP 800-88 compliant methods like overwriting or degaussing) and verifying the purge ensures compliance with PCI DSS requirement 3.1 (minimize stored cardholder data) and eliminates the risk of data breach from the legacy system.

Answer

Migrate the legacy data into the new POS system and have the tokenization service replace it

Answer

Encrypt the legacy database using AES-256 and store the encryption key on a separate server

Answer

Archive the legacy database to a tape backup and store it in a secure offsite vault

Question 5

A large e-commerce company operates a multi-tier application in a public cloud. The environment includes a web tier, application tier, and database tier. The security team recently deployed a host-based intrusion detection system (HIDS) on all servers. During a routine review, the HIDS alerts show repeated failed login attempts from a single external IP address to several web servers, but no successful logins from that IP. The team also notices that the database servers have been sending outbound traffic to an unknown IP address on port 443, which is unusual because the database servers typically communicate only with the application servers on port 3306 (MySQL). The application team confirms no changes were made recently. The CISO wants an immediate investigation. What should the security team do first?

Accepted Answer

Isolate the database servers from the network and perform forensic analysis on system logs and memory dumps.. The outbound port 443 traffic from database servers to an unknown IP is a strong indicator of active compromise (e.g., C2 beaconing or data exfiltration), so the first priority is containment via network isolation to stop further damage while preserving volatile evidence. Forensic analysis of logs and memory dumps must follow immediately to determine scope, persistence, and lateral movement before any remediation.

Answer

Immediately restart all database servers to stop any malicious processes.

Answer

Add a firewall rule to deny outbound traffic from the database tier to the unknown IP.

Answer

Block the external IP that is attempting to log in to the web servers and continue monitoring.

Question 6

A security analyst is evaluating the risk of a data breach in a healthcare organization. The asset value of the patient database is $500,000, and the exposure factor is 0.2. The annual rate of occurrence is estimated at 0.1. What is the annualized loss expectancy (ALE)?

Accepted Answer

$10,000. The Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO). SLE = Asset Value × Exposure Factor = $500,000 × 0.2 = $100,000. ALE = SLE × ARO = $100,000 × 0.1 = $10,000. Therefore, the ALE is $10,000.

Answer

$5,000

Answer

$50,000

Answer

$100,000

Question 7

An organization is implementing OpenID Connect (OIDC) for authentication. Which THREE of the following are components of OIDC? (Choose three.)

Accepted Answer

Authorization code flow. OIDC defines the Authorization Code Flow (option A) as one of its core authentication flows, where the client exchanges an authorization code at the token endpoint for an ID token and access token, making it a standard OIDC component. The UserInfo endpoint (option C) is a defined OIDC endpoint that returns claims about the authenticated end-user when presented with a valid access token, so it is part of the OIDC specification. The ID token (option E) is the central OIDC artifact—a signed JWT containing authentication claims such as iss, sub, aud, exp, and iat—that proves the user's identity to the client. Kerberos ticket granting tickets (option B) belong to the Kerberos protocol, not OIDC, and SAML assertions (option D) are part of the SAML 2.0 standard, which is a separate federation protocol from OIDC.

Answer

Kerberos ticket granting ticket

Answer

SAML assertion

Question 8

Which TWO principles are fundamental to a defense-in-depth security architecture?

Accepted Answer

Diversity of defense. Diversity of defense (A) is fundamental because using different vendors, technologies, or mechanisms across layers prevents a single exploit or vulnerability from compromising the entire architecture, so an attacker who defeats one control faces dissimilar controls elsewhere. Layered security controls (D) are equally fundamental because defense-in-depth deliberately stacks multiple independent controls (network, host, application, data) so that if one layer fails, others still protect the asset. Centralized logging (B) is a valuable detective and monitoring practice, but it is a supporting capability rather than a defining principle of defense-in-depth. A single point of failure (C) directly contradicts defense-in-depth, which seeks to eliminate such dependencies. Minimal user training (E) is not a principle of defense-in-depth; user awareness and training are actually important complementary controls that strengthen the human layer.

Answer

Centralized logging

Answer

Single point of failure

Answer

Minimal user training

Question 9

A security engineer is evaluating a new third-party software component for use in a critical application. Which document is most important to review to understand the component's supply chain security?

Accepted Answer

Software Bill of Materials (SBOM). The Software Bill of Materials (SBOM) is the most important document because it provides a complete inventory of all components, libraries, and dependencies in the software, including their versions and supply chain relationships. This transparency is essential for identifying vulnerabilities, assessing third-party risk, and meeting supply chain security requirements. EULA, SLA, and DPA address legal, service, and data privacy terms, not supply chain security.

Answer

End User License Agreement (EULA)

Answer

Service Level Agreement (SLA)

Answer

Data Processing Agreement (DPA)

Question 10

A company plans to implement a disaster recovery site that can be operational within 2 hours of a failure. Which type of DR site best meets this requirement?

Accepted Answer

Hot site. A hot site is a fully equipped, mirrored facility with hardware, software, data replication, and network connectivity already in place, allowing operations to resume within minutes to a couple of hours. Because everything is pre-provisioned and continuously synchronized, it is the only DR site type that reliably meets a 2-hour RTO. Warm and cold sites require additional setup time that exceeds this window.

Answer

Warm site

Answer

Cold site

Answer

Reciprocal agreement

Question 11

Which type of risk remains after management has implemented controls to mitigate the identified risks?

Accepted Answer

Residual risk. Residual risk is the risk that remains after controls have been implemented to mitigate the identified risks. It is the difference between inherent risk (risk before controls) and the effect of the controls. Management must decide whether the residual risk is within the organization's risk appetite or requires further treatment.

Answer

Acceptable risk

Answer

Control risk

Answer

Inherent risk

Question 12

An organization is developing an incident response plan. Which component is responsible for defining the specific conditions that constitute an incident?

Accepted Answer

Incident categories. Incident categories define the classification scheme that specifies what types of events constitute an incident and how they are grouped (e.g., malware, DoS, unauthorized access). This component establishes the conditions and thresholds that trigger incident declaration, making it the correct answer for 'defining the specific conditions that constitute an incident.' Categories also drive escalation paths and response procedures.

Answer

Communication plan

Answer

Recovery procedures

Answer

Legal notification requirements

Question 13

Which of the following is a key element of the rules of engagement for a penetration test?

Accepted Answer

Emergency stop criteria. Emergency stop criteria is correct because rules of engagement (RoE) must define the conditions under which testing halts immediately — for example, discovery of a live production outage, unintended data exfiltration, or a critical system failure — so the client can protect business continuity and the tester has legal cover to stop. RoE is a governance document that scopes authorization, timing, targets, and abort conditions, and the stop criteria are its most safety-critical clause. Without explicit halt conditions, a tester could inadvertently cause an outage with no agreed protocol for disengagement.

Answer

The tester's compensation

Answer

The tester's background check

Answer

The number of vulnerabilities to find

Question 14

A healthcare organization covered by HIPAA wants to share protected health information (PHI) with a third-party billing service. What must be in place to comply with HIPAA?

Accepted Answer

A business associate agreement (BAA). Under HIPAA, a covered entity sharing PHI with a third-party vendor that performs a function involving PHI must have a Business Associate Agreement (BAA) in place. The BAA contractually obligates the business associate to safeguard PHI and comply with HIPAA Privacy and Security Rules. This is a legal requirement, not optional.

Answer

A memorandum of understanding (MOU)

Answer

A data processing agreement under GDPR

Answer

A consent form from each patient

Question 15

An organization requires a commercial integrity model where users cannot modify data in higher integrity levels and cannot read data from lower integrity levels. Which model should they implement?

Accepted Answer

Biba. The Biba integrity model is the classic commercial integrity model that enforces 'no write up, no read down' — users cannot modify data at a higher integrity level and cannot read data at a lower integrity level. This exactly matches the scenario described, making Biba the correct choice.

Answer

Bell-LaPadula

Answer

Clark-Wilson

Answer

Take-Grant