CISSP Practice Test 50 — 15 Questions

Question 1

Which vulnerability scoring system provides a standardized severity rating for vulnerabilities based on exploitability and impact metrics?

Accepted Answer

CVSS. The Common Vulnerability Scoring System (CVSS) provides a standardized, quantitative framework for rating the severity of security vulnerabilities. It calculates a score from 0.0 to 10.0 based on exploitability metrics (e.g., attack vector, complexity, privileges required) and impact metrics (e.g., confidentiality, integrity, availability), enabling organizations to prioritize remediation efforts consistently.

Answer

NVD

Answer

CVE

Answer

CWE

Question 2

An organization wants to implement single sign-on (SSO) for multiple cloud applications. Which of the following is the most secure and scalable approach?

Accepted Answer

Implement SAML-based federation. SAML-based federation (Option A) is the most secure and scalable approach for SSO across multiple cloud applications because it is specifically designed for identity federation and cross-domain authentication. It allows organizations to centralize authentication and enforce policies without sharing passwords. Option B (OAuth) is an authorization framework, not an authentication protocol, and is less secure for SSO when used alone. Option C (same password) is insecure and not scalable. Option D (LDAP) is a directory service protocol that lacks native support for web SSO and does not scale well across cloud applications.

Answer

Use OAuth for authentication

Answer

Use the same password for all applications

Answer

Implement LDAP directory

Question 3

You are the chief information security officer (CISO) of a large healthcare organization that handles protected health information (PHI). The organization has recently been acquired by a larger conglomerate, and the new parent company mandates that all subsidiaries adopt a single, unified risk management framework based on NIST SP 800-39. Your current framework is ISO 27005-based and has been effective for years. During the transition, you discover that the parent company's framework requires quantitative risk analysis for all critical assets, while your team has been primarily using qualitative analysis due to lack of accurate financial data. Moreover, the parent company expects all risk assessments to be completed within 30 days, a timeframe your team considers unrealistic given the number of assets. Several key stakeholders are concerned about the additional resource burden and potential disruption to operations. You need to propose a course of action that balances compliance with the parent company's mandate while maintaining operational effectiveness and minimizing risk to patient data.

Accepted Answer

Conduct a gap analysis between ISO 27005 and NIST SP 800-39, then develop a phased transition plan with a longer timeline, presenting it to the parent company's board for approval.. The best course of action because it respects both the parent company's mandate and the organization's operational reality. A gap analysis between ISO 27005 and NIST SP 800-39 identifies specific differences and allows a phased transition plan with a longer timeline, which can be presented to the parent company for approval. This approach balances compliance with operational effectiveness, addresses stakeholder concerns about resource burden and disruption, and minimizes risk to patient data. Option B is non-compliant and may lead to conflict with the parent company. Option C provides a short-term fix but does not address the long-term requirement to adopt the unified framework. Option D is too aggressive and unrealistic, risking operational disruption and potential compromise of patient data.

Answer

Continue using ISO 27005 and argue that it is equally valid, citing the principle of risk management flexibility and the disruption that a transition would cause.

Answer

Hire external consultants to perform the quantitative assessments, allowing the internal team to focus on existing operations, and accept the cost as a business necessity.

Answer

Immediately adopt the NIST framework and begin quantitative assessments, using industry-standard cost estimates to expedite the process within 30 days.

Question 4

A large financial institution is finalizing its annual risk treatment plan based on a recent enterprise risk assessment. The risk appetite statement approved by the board specifies that the organization will accept only low residual risks for financial loss, but is willing to accept moderate risks for reputational damage if cost-benefit justifies. The risk register includes the following findings: 1) A critical SQL injection vulnerability in the online banking portal with high likelihood and critical impact; current controls include a web application firewall (WAF) that is not fully tuned. 2) Use of outdated TLS 1.0 encryption on internal communications between data centers; likelihood is medium, impact is low. 3) Lack of background checks for third-party vendors with access to sensitive data; likelihood is low, impact is moderate. 4) A single point of failure in the primary data center's power supply; likelihood is low, impact is critical. 5) An incident response plan that has not been tested in two years; likelihood is medium, impact is moderate. The CISO must prioritize actions for the upcoming quarter. What is the most appropriate first step?

Accepted Answer

Immediately remediate the SQL injection vulnerability by tuning the WAF and applying vendor patches.. The SQL injection vulnerability has high likelihood and critical impact, resulting in a high risk level that exceeds the risk appetite for financial loss. Immediate remediation (tuning the WAF and applying vendor patches) is necessary to reduce the risk to an acceptable level and is the highest priority. Option A (transferring power supply risk via insurance) addresses a low-likelihood risk and is less urgent. Option C (outsourcing incident response) does not directly address the untested plan and is not as critical. Option D (accepting outdated TLS) may be acceptable given low impact, but it is not the first step.

Answer

Transfer the single point of failure risk by purchasing business interruption insurance.

Answer

Outsource incident response to a managed security service provider (MSSP) to compensate for the untested plan.

Answer

Accept the risk of outdated TLS 1.0 encryption because impact is low.

Question 5

What type of DLP system monitors data in motion across the network?

Accepted Answer

Network DLP. Network DLP inspects network traffic for sensitive data leaving the organization.

Answer

Storage DLP

Answer

Endpoint DLP

Answer

Cloud DLP

Question 6

During a penetration test, the tester has obtained initial access and is now trying to move laterally to other systems. Which phase of the penetration testing process does this represent?

Accepted Answer

Post-exploitation/lateral movement. The post-exploitation/lateral movement phase occurs after initial access is gained, where the tester uses compromised systems as pivot points to access other network segments, often leveraging tools like PsExec, WMI, or SMB relay to move across hosts. This phase is distinct from exploitation, which focuses on gaining the initial foothold, and reconnaissance, which occurs before any access is obtained.

Answer

Reconnaissance

Answer

Reporting

Answer

Exploitation

Question 7

An organization has implemented a new SIEM system. What is the most critical factor for its effectiveness?

Accepted Answer

The ability to correlate events. The most critical factor for a SIEM's effectiveness is its ability to correlate events across diverse log sources to detect complex attack patterns, such as a lateral movement chain or a multi-stage exploit. Without correlation, a SIEM is merely a log aggregator, unable to distinguish a true security incident from isolated benign events. Correlation engines apply rule-based or statistical analysis (e.g., using Sigma rules or machine learning) to identify relationships between seemingly unrelated log entries, which is the core value proposition of a SIEM.

Answer

The cost of the solution

Answer

The speed of data ingestion

Answer

The number of log sources integrated

Question 8

During a code review, a developer encounters the following code snippet in a Java web application used to authenticate users:

String query = "SELECT * FROM users WHERE username = '" + request.getParameter("user") + "' AND password = '" + request.getParameter("pass") + "'";

Which of the following is the MOST effective remediation?

Accepted Answer

Replace the concatenated query with a prepared statement and bind parameters. Prepared statements with parameterized queries separate SQL logic from user input, preventing SQL injection entirely. In Java, using PreparedStatement with bind variables (e.g., `ps.setString(1, user)`) ensures the database treats input as data, not executable code, which is the only reliable defense against SQL injection attacks.

Answer

Use regular expressions to validate the username and password inputs

Answer

Encode the input using HTML entity encoding before inclusion in the query

Answer

Escape single quotes in the input parameters

Question 9

During an internal audit, an organization discovers that a critical application has not been patched for six months. The application is business-critical and cannot be taken offline during business hours. Which of the following is the best course of action?

Accepted Answer

Implement compensating controls and schedule patching at the next available maintenance window. Compensating controls (e.g., network segmentation, WAF rules, or host-based IPS) reduce the immediate risk while the critical application remains online. Scheduling patching for the next maintenance window aligns with change management and ensures the patch is tested and applied without disrupting business operations. This balances security needs with operational continuity, a core principle of risk management.

Answer

Accept the risk and continue operations

Answer

Apply the patch immediately during off-hours even if it risks downtime

Answer

Disconnect the application until it is patched

Question 10

During a security assessment, a penetration tester successfully performs an ARP spoofing attack, redirecting traffic through their machine. This attack exploits which protocol vulnerability?

Accepted Answer

Stateless nature of ARP with no authentication. ARP spoofing succeeds because ARP is a stateless protocol that does not authenticate or verify the legitimacy of ARP replies. Any host on a local network can send an unsolicited ARP reply (gratuitous ARP) to associate any IP address with any MAC address, allowing an attacker to redirect traffic without any validation mechanism.

Answer

Lack of encryption in ARP packets

Answer

Weakness in the IP address resolution algorithm

Answer

Use of broadcast frames for all requests

Question 11

An organization is planning to acquire a new SaaS application for customer relationship management. Which THREE of the following should be included in the vendor security assessment?

Accepted Answer

Reviewing the vendor's security certifications (e.g., SOC 2, ISO 27001). Reviewing the vendor's security certifications (e.g., SOC 2), assessing their incident response process, and requesting a Software Bill of Materials (SBOM) are key steps. License compliance is important but not directly security, and employee training is internal to the vendor but less critical than the others.

Answer

Checking license compliance for open source components

Answer

Requiring employee security training records

Question 12

A network engineer is troubleshooting a slow VPN connection between two sites. The link is symmetric 100 Mbps, but throughput tests show only 20 Mbps. The VPN uses AES-256 encryption. What is the most likely cause?

Accepted Answer

CPU bottleneck on the VPN endpoints. AES-256 encryption is computationally intensive, and the throughput of a VPN is often limited by the cryptographic processing capacity of the endpoint CPUs rather than the link bandwidth. A symmetric 100 Mbps link with only 20 Mbps throughput strongly indicates that the VPN endpoints cannot encrypt/decrypt fast enough, creating a CPU bottleneck.

Answer

Packet loss due to link congestion

Answer

MTU mismatch causing fragmentation

Answer

Incorrect TCP window scaling

Question 13

A health records system requires that doctors can write new records but cannot modify existing ones, and integrity is maintained through separation of duties. Which security model best fits this requirement?

Accepted Answer

Clark-Wilson. The Clark-Wilson model enforces integrity through well-formed transactions and separation of duties, which directly matches the requirement that doctors can write new records but cannot modify existing ones. It uses constrained data items (CDIs), transformation procedures (TPs), and integrity verification procedures (IVPs) to ensure that only authorized users can perform specific operations, preventing unauthorized modifications.

Answer

Brewer-Nash

Answer

Biba

Answer

Bell-LaPadula

Question 14

A development team heavily uses third-party libraries. What is the most effective way to manage vulnerabilities in these libraries?

Accepted Answer

Use a Software Composition Analysis (SCA) tool and monitor CVE databases. Software Composition Analysis (SCA) tools automate the identification of third-party libraries and their versions, cross-referencing them against known vulnerability databases such as the National Vulnerability Database (NVD) and Common Vulnerabilities and Exposures (CVE) lists. This provides continuous monitoring and alerting for newly disclosed vulnerabilities, which is the most effective and scalable approach for managing the large number of dependencies in modern development. Manual review or ignoring vulnerabilities is impractical and insecure, while relying on 'no known vulnerabilities' is a false premise.

Answer

Only use libraries from sources with no known vulnerabilities

Answer

Ignore vulnerabilities unless a known exploit exists

Answer

Manually review each library's source code for flaws

Question 15

A network administrator is configuring SNMPv3 for monitoring network devices. The organization requires both authentication and encryption of SNMP traffic. Which combination of protocols should be used to meet this requirement?

Accepted Answer

SHA for authentication, AES for privacy. SNMPv3 supports both authentication and encryption via separate User-based Security Model (USM) parameters. To meet the requirement for both, you must select an authentication protocol (e.g., SHA) and a privacy (encryption) protocol (e.g., AES). Option C correctly pairs SHA for authentication with AES for privacy, providing integrity verification and confidentiality of SNMP messages.

Answer

MD5 for authentication, no privacy

Answer

SHA for authentication, no privacy

Answer

MD5 for authentication, DES for privacy