CISSP Practice Test 50 — 15 Questions

Question 1

A company decides to purchase cyber insurance to cover potential losses from data breaches. Which risk response strategy does this represent?

Accepted Answer

Transfer. Purchasing cyber insurance shifts the financial impact of a breach to a third party (the insurer), which is the definition of risk transfer. The organization still owns the risk event but transfers the financial consequence. Accept, Avoid, and Mitigate describe retaining, eliminating, or reducing risk, respectively.

Answer

Accept

Answer

Avoid

Answer

Mitigate

Question 2

A development team is designing a new application and wants to ensure that if a failure occurs, the system remains secure by default. Which design principle should they apply?

Accepted Answer

Fail-secure. Fail-secure is the design principle that dictates a system should default to a secure state when it fails — for example, denying access, locking doors, or dropping connections rather than allowing them. It directly addresses the requirement that 'if a failure occurs, the system remains secure by default.' The other principles address access scope, layered controls, and fraud prevention, not failure behavior.

Answer

Least privilege

Answer

Defense in depth

Answer

Separation of duties

Question 3

Which of the following is a key component of the rules of engagement for a penetration test?

Accepted Answer

Emergency stop criteria. Emergency stop criteria are a core element of the rules of engagement (RoE) for a penetration test because they define the conditions under which testing must immediately halt — for example, if production availability is threatened or a critical system is destabilized. RoE documents scope, timing, authorized techniques, communication channels, and stop conditions agreed upon by the client and tester.

Answer

Exploitation techniques to use

Answer

CVSS score of vulnerabilities

Answer

Number of vulnerabilities found

Question 4

An organization wants to test its web application for vulnerabilities by running the application and probing it with malicious inputs. Which tool is BEST suited for this purpose?

Accepted Answer

OWASP ZAP. OWASP ZAP (Zed Attack Proxy) is a dynamic application security testing (DAST) tool that runs the application and actively probes it with malicious inputs, making it the correct choice for runtime vulnerability testing. It intercepts and modifies HTTP/S traffic, performs active scanning for injection, XSS, and misconfigurations, and is specifically designed for testing running web applications.

Answer

Checkmarx

Answer

SonarQube

Answer

Veracode

Question 5

A company is implementing an access control system where permissions are granted based on attributes such as user role, department, time of day, and device trust score. This approach allows for fine-grained policies that can adapt to context. Which access control model is being used?

Accepted Answer

ABAC (Attribute-Based Access Control). ABAC grants or denies access based on attributes of the subject (role, department), the resource, the action, and the environment (time of day, device trust score). The scenario explicitly lists multiple contextual attributes combined into fine-grained, adaptive policies, which is the defining characteristic of ABAC. RBAC only uses roles, MAC uses labels/clearances, and DAC uses owner discretion.

Answer

MAC (Mandatory Access Control)

Answer

DAC (Discretionary Access Control)

Answer

RBAC (Role-Based Access Control)

Question 6

Under the GDPR, which role is responsible for determining the purposes and means of processing personal data?

Accepted Answer

Data controller. Under the GDPR, the data controller is the entity (natural or legal person, public authority, agency, or other body) that alone or jointly with others determines the purposes and means of processing personal data. This role carries primary accountability for GDPR compliance, including lawful basis, data subject rights, and breach notification. The controller decides 'why' and 'how' data is processed, which is the defining characteristic of the role.

Answer

Data processor

Answer

Data subject

Answer

Data protection officer

Question 7

A company uses Docker containers for microservices. What is the most important security measure for container images?

Accepted Answer

Use minimal base images and scan them for vulnerabilities. The most important security measure for container images is to use minimal base images and scan them for vulnerabilities. Minimal images reduce the attack surface by including only necessary components, and regular scanning identifies known vulnerabilities in dependencies. This aligns with the principle of least functionality and helps prevent exploitation.

Answer

Use the latest version of base image to ensure patches

Answer

Hardcode secrets into the image

Answer

Run containers as root for easier privilege management

Question 8

Which of the following is an example of an Insecure Direct Object Reference (IDOR) vulnerability?

Accepted Answer

An attacker changes the user ID parameter in a URL to view another user's profile. IDOR occurs when an application exposes an internal object reference, such as a user ID in a URL, and fails to verify that the requester is authorized to access that object. Changing the user ID parameter to view another user's profile is the textbook example of this broken access control flaw.

Answer

An attacker intercepts session cookies to impersonate a user

Answer

An attacker uses a SQL injection to retrieve data from the database

Answer

An attacker submits a cross-site request forgery (CSRF) token to perform actions

Question 9

Which type of digital forensics involves capturing and analyzing network traffic to investigate a security incident?

Accepted Answer

Network forensics. Network forensics involves capturing, recording, and analyzing network traffic to investigate security incidents, identify intrusions, and gather evidence. It focuses on data in transit, such as packet captures, flow records, and network logs. This distinguishes it from host-based forensics.

Answer

Media analysis

Answer

Log analysis

Answer

Memory forensics

Question 10

A security manager is calculating the annual loss expectancy (ALE) for a server valued at $50,000. The exposure factor (EF) is 40%, and the annual rate of occurrence (ARO) is 0.5. What is the ALE?

Accepted Answer

$10,000. ALE is calculated as SLE × ARO, where SLE = Asset Value × Exposure Factor. Here, SLE = $50,000 × 0.40 = $20,000, and ALE = $20,000 × 0.5 = $10,000. This quantifies the expected yearly monetary loss from the risk, which is the standard CISSP quantitative risk analysis formula.

Answer

$100,000

Answer

$25,000

Answer

$20,000

Question 11

Under the PCI DSS, which of the following best describes a 'cardholder data environment' (CDE)?

Accepted Answer

Systems that store, process, or transmit cardholder data. The cardholder data environment (CDE) is defined by PCI DSS as the people, processes, and technologies that store, process, or transmit cardholder data or sensitive authentication data, plus any systems that connect to or could impact the security of that environment. Option C captures the core definition accurately. This scope determines which systems must comply with PCI DSS requirements.

Answer

A physical room where payment cards are stored

Answer

Any system that connects to the internet

Answer

A network segment that contains only point-of-sale devices

Question 12

In LDAP, which attribute uniquely identifies an entry within the directory information tree?

Accepted Answer

Distinguished Name (DN). The Distinguished Name (DN) is the full path from the root of the directory information tree to the entry, uniquely identifying it across the entire directory. It includes the RDN plus all superior entries, ensuring global uniqueness.

Answer

Relative Distinguished Name (RDN)

Answer

Organizational Unit (OU)

Answer

Common Name (CN)

Question 13

A security analyst is reviewing the error handling of an application. The application currently displays detailed stack traces to users when an exception occurs. Which of the following is the best practice for error handling in production?

Accepted Answer

Display generic error messages to users and log detailed errors for admins. Displaying generic error messages to users prevents attackers from learning internal details such as stack traces, file paths, database schema, or library versions that could be used to craft further attacks. Logging the detailed error information for administrators preserves the ability to troubleshoot and monitor without exposing sensitive data to end users. This separation of user-facing and admin-facing error detail is a fundamental secure coding practice.

Answer

Display detailed errors to users for troubleshooting

Answer

Disable all error reporting to eliminate information leakage

Answer

Encrypt error messages before displaying to users

Question 14

In Kerberos authentication, what is the purpose of the Ticket Granting Ticket (TGT)?

Accepted Answer

To prove the user's identity to the Ticket Granting Service (TGS). The TGT is issued by the Authentication Service (AS) after initial authentication and is used to prove the user's identity to the Ticket Granting Service (TGS) when requesting service tickets. It is encrypted with the TGS's secret key and contains the user's identity and session key.

Answer

To store the user's password hash

Answer

To encrypt all communication between client and server

Answer

To authenticate the user to the resource server directly

Question 15

Which physical security concept uses natural surveillance, territorial reinforcement, and access control to deter crime in built environments?

Accepted Answer

CPTED. CPTED (Crime Prevention Through Environmental Design) is the discipline that applies natural surveillance, territorial reinforcement, and access control to the built environment to reduce crime and fear of crime. These three principles, along with maintenance and activity support, form the core CPTED framework used by security architects and urban planners. The question's three named elements map directly to CPTED's foundational principles.

Answer

TEMPEST

Answer

Faraday cage

Answer

Defense in depth