CISSP Practice Test 5 — 10 Questions

Question 1

Which type of security testing involves analyzing source code for vulnerabilities without executing the code?

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It operates by scanning the codebase for patterns known to be insecure (e.g., SQL injection via string concatenation) using techniques like data flow analysis, taint tracking, and pattern matching, all performed at rest.

Answer

Penetration testing

Answer

IAST

Answer

DAST

Question 2

During a penetration test, an ethical hacker sets up a rogue access point with the same SSID as the corporate network and broadcasts a stronger signal. Users inadvertently connect to the rogue AP, allowing the hacker to capture credentials. What is this attack called?

Accepted Answer

Evil twin attack. Evil twin attack. This attack involves setting up a rogue access point that broadcasts the same SSID as a legitimate corporate network but with a stronger signal, causing users to connect to it instead. Once connected, the attacker can capture credentials or other sensitive data through man-in-the-middle techniques, exploiting the lack of mutual authentication in many Wi-Fi implementations.

Answer

Deauthentication attack

Answer

ARP spoofing

Answer

Karma attack

Question 3

A company's security team discovers that an employee inadvertently shared sensitive customer data via a public cloud storage link. The incident response team contains the breach and notifies affected customers. Which of the following risk management strategies would BEST prevent recurrence?

Accepted Answer

Deploy a Data Loss Prevention (DLP) solution that monitors and controls sharing of sensitive data.. A Data Loss Prevention (DLP) solution provides automated, policy-based monitoring and control of sensitive data being shared via public cloud storage links. Unlike awareness training (which relies on human behavior) or blanket blocking (which hinders productivity), DLP can inspect content in real time using pattern matching, fingerprinting, or exact data matching to prevent unauthorized sharing before it occurs, directly addressing the root cause of inadvertent exposure.

Answer

Block all access to public cloud storage services from corporate devices.

Answer

Implement mandatory security awareness training focusing on data handling procedures.

Answer

Encrypt all sensitive data at rest and in transit to render shared data useless.

Question 4

A multinational corporation with a hybrid cloud infrastructure has recently experienced a series of security incidents involving unauthorized access to sensitive customer data. The incidents were traced to compromised credentials of privileged users. The company has implemented multi-factor authentication (MFA) for all privileged accounts, but the attacks persisted. A security assessment team is brought in to evaluate the environment. During the assessment, they discover that some privileged accounts do not require MFA when accessing systems via API calls, and that session tokens for these APIs have a long expiration time of 24 hours. Additionally, the team finds that the logging and monitoring system does not capture API calls from privileged accounts, making it difficult to detect anomalous behavior. The company wants to remediate these issues effectively. Which of the following is the BEST course of action to address the root cause of the incidents?

Accepted Answer

Require MFA for all privileged access methods, including APIs, and reduce session token expiration to 15 minutes.. The root cause is that privileged accounts can bypass MFA when accessing systems via API calls, and long-lived session tokens (24 hours) provide a wide window for attackers to reuse stolen tokens. Requiring MFA for all privileged access methods, including APIs, closes the authentication gap, and reducing session token expiration to 15 minutes minimizes the impact of token theft by limiting the reuse window. This directly addresses the two key vulnerabilities identified in the assessment.

Answer

Implement a SIEM system to analyze logs from all sources and create alerts for anomalous API activity.

Answer

Conduct a full audit of privileged account usage and revoke access for any accounts with suspicious activity.

Answer

Replace API tokens with certificate-based authentication for all privileged accounts.

Question 5

In a microservices architecture with a service mesh, what is the most effective approach to secure inter-service communication?

Accepted Answer

Implement mutual TLS (mTLS) and identity-based access policies. In a service mesh, mutual TLS (mTLS) provides both encryption and identity verification for every inter-service call, ensuring that only authenticated services with the correct identity can communicate. Identity-based access policies (e.g., using SPIFFE IDs) then enforce fine-grained authorization, which is essential in dynamic microservices environments where IP addresses are ephemeral. This combination directly addresses the core security requirements of confidentiality, integrity, and authentication in zero-trust architectures.

Answer

Segment services into separate VLANs without encryption

Answer

Use TLS only for all communication

Answer

Rely on API keys in the request headers

Question 6

A security architect is designing a secure enclave for processing highly sensitive data. The architecture must ensure that even if the operating system is compromised, the enclave's memory contents remain confidential and integrity-protected. Which technology should be used?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel Software Guard Extensions (SGX) is the correct choice because it provides hardware-enforced isolation of memory regions (enclaves) that remain confidential and integrity-protected even if the operating system or hypervisor is compromised. SGX encrypts enclave memory on-die and decrypts it only within the CPU, preventing any privileged software from reading or tampering with the data.

Answer

Full disk encryption (FDE) with a strong passphrase

Answer

Trusted Platform Module (TPM)

Answer

Hypervisor-based isolation

Question 7

A security engineer is reviewing the architecture of a system that uses the Bell-LaPadula model. The system has subjects with security clearances and objects with classifications. To prevent covert timing channels, which additional control should be implemented?

Accepted Answer

Disable concurrent access to shared resources. Covert timing channels exploit the ability of a subject to modulate the timing of its access to a shared resource, thereby leaking information to another subject at a different security level. The Bell-LaPadula model enforces mandatory access control (MAC) but does not inherently prevent these channels. Disabling concurrent access to shared resources (option C) eliminates the ability to use timing variations as a signaling mechanism, directly addressing the covert channel at the resource scheduling level.

Answer

Enforce strict data labeling

Answer

Implement audit logging

Answer

Use encryption for data at rest

Question 8

A multinational corporation must comply with GDPR and CCPA. Which data protection strategy should they prioritize?

Accepted Answer

Data minimization. Data minimization is the correct priority because both GDPR (Article 5(1)(c)) and CCPA (Cal. Civ. Code §1798.100) require organizations to limit the collection and processing of personal data to what is directly relevant and necessary for the stated purpose. By minimizing the data held, the corporation reduces its legal exposure, simplifies compliance obligations, and inherently lowers the risk of a data breach impacting sensitive information. This principle is foundational to privacy-by-design and directly addresses the regulatory mandates, whereas the other options are secondary controls that do not address the core requirement of limiting data collection.

Answer

Data masking

Answer

Data retention

Answer

Data encryption

Question 9

A company uses SSH for remote administration. To enhance security, they want to implement public-key authentication. Which statement about SSH public-key authentication is true?

Accepted Answer

The private key must be kept secret by the user. In SSH public-key authentication, the private key is the secret half of the asymmetric key pair and must be kept confidential by the user. The server stores only the public key, and authentication is proven by the client signing a challenge with the private key, which the server verifies using the stored public key. This ensures that even if the server is compromised, the private key remains safe on the client side.

Answer

The public key is used to decrypt the session

Answer

Public-key authentication does not require a passphrase

Answer

The private key is stored on the server

Question 10

A security tester needs to test a new application for vulnerabilities but is concerned about contaminating the production database with test data. What is the best practice for conducting such tests?

Accepted Answer

Create a separate test environment with anonymized production data. Creating a separate test environment with anonymized production data ensures that testing does not affect the integrity or availability of the production database while still using realistic data to uncover vulnerabilities. Anonymization techniques, such as data masking or tokenization, remove personally identifiable information (PII) while preserving referential integrity and data distribution, allowing for accurate security testing without contaminating production systems.

Answer

Perform the test on the production environment during off-hours

Answer

Test only from the network perimeter to avoid data exposure

Answer

Use synthetic data that mimics production but is not real