CISSP Practice Questions 2 — 50 Questions

Question 1

A company is considering outsourcing its customer support operations to a third-party vendor. Which of the following should be the PRIMARY risk management activity before finalizing the contract?

Accepted Answer

Conduct a thorough vendor risk assessment including security audits.. Before outsourcing critical operations, the primary risk management activity is to conduct a thorough vendor risk assessment, including security audits. This evaluates the vendor's security posture, compliance with standards (e.g., ISO 27001), and ability to protect sensitive customer data, directly addressing risks like data breaches or service disruptions before contractual obligations are locked in.

Answer

Negotiate a lower price to offset potential security investments.

Answer

Purchase cyber liability insurance to cover potential breaches.

Answer

Require the vendor to sign a non-disclosure agreement (NDA).

Question 2

A multinational corporation must ensure that data leaving the organization's network is classified and labeled appropriately. Which of the following is the MOST effective method to enforce consistent labeling across all data types?

Accepted Answer

Implement automated data classification tools that scan for sensitive content and apply labels. Automated data classification tools (e.g., Microsoft Purview, Symantec DLP) use content inspection, pattern matching, and machine learning to scan data at rest, in use, and in transit. They apply consistent labels based on predefined policies (e.g., regex for PII, fingerprinting for IP), ensuring uniform labeling across all data types without relying on human consistency or manual effort.

Answer

Appoint data stewards in each department to manually review and label data

Answer

Require all employees to complete annual training on data classification

Answer

Encrypt all data in transit and at rest to prevent unauthorized access

Question 3

A security manager is conducting a risk assessment for a new cloud application. The manager needs to estimate the potential financial loss from a data breach. Which approach should be used?

Accepted Answer

Quantitative risk analysis using annualized loss expectancy (ALE). Quantitative risk analysis using Annualized Loss Expectancy (ALE) provides a specific monetary estimate of potential financial loss, which is exactly what the security manager needs for a data breach scenario. ALE is calculated as Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO), enabling data-driven budgeting and cost-benefit analysis for cloud application security controls.

Answer

Scenario-based risk analysis with ordinal scales

Answer

Qualitative risk analysis using high/medium/low ratings

Answer

Benchmarking against industry standards

Question 4

During a forensic investigation, the team needs to preserve evidence from a running server. What is the FIRST step the team should take?

Accepted Answer

Capture a memory dump.. The first step in a forensic investigation of a running server is to capture a memory dump because volatile data (RAM) contains critical evidence such as running processes, network connections, encryption keys, and malware that would be lost if the system is powered off or altered. Preserving this volatile state before any other action ensures that the most transient evidence is secured, following the order of volatility principle. Capturing memory first prevents irreversible loss of data that cannot be recovered from disk or network captures.

Answer

Create a disk image.

Answer

Shut down the server normally.

Answer

Unplug the network cable.

Question 5

An organization wants to identify vulnerabilities in their network without attempting to exploit them. Which type of security assessment should they perform?

Accepted Answer

Vulnerability assessment. A vulnerability assessment is the correct choice because it is a systematic review of security weaknesses in a network or system that identifies vulnerabilities without actively exploiting them. This assessment typically uses automated scanning tools (e.g., Nessus, OpenVAS) to compare system configurations against known vulnerability databases (e.g., CVE, NVD) and reports potential issues, but does not attempt to gain unauthorized access or cause disruption.

Answer

Penetration test

Answer

Security audit

Answer

Security review

Question 6

A healthcare organization must decommission an old server containing patient health information (PHI) stored on solid-state drives (SSDs). Standard overwriting techniques are ineffective for SSDs due to wear-leveling and bad block mapping. Which sanitization method is most appropriate for these drives?

Accepted Answer

Physical destruction such as shredding or pulverizing. Physical destruction (e.g., shredding or pulverizing) is recommended for SSDs because overwriting may not reach all cells, and degaussing does not affect flash memory.

Answer

Cryptographic erasure by deleting the encryption key

Answer

Degaussing with a high-coercivity degausser

Answer

Overwriting with the DoD 5220.22-M 7-pass standard

Question 7

A company is migrating its critical application to a cloud provider. Which disaster recovery strategy provides the shortest recovery time objective (RTO) and recovery point objective (RPO)?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and real-time data synchronization, minimizing RTO and RPO.

Answer

Warm site

Answer

Cold site

Answer

Reciprocal agreement

Question 8

Which of the following is an example of a security policy?

Accepted Answer

All employees must use multi-factor authentication. A policy is a high-level mandatory statement that reflects management's intent. 'All employees must use multi-factor authentication' is a mandatory directive.

Answer

Step 1: Log in, Step 2: Enter code, Step 3: Access system

Answer

It is recommended to change passwords every 90 days

Answer

Use passwords of at least 12 characters with mixed case and numbers

Question 9

A company is recovering from a ransomware attack. Which THREE of the following are key considerations when restoring data from backups to ensure integrity and minimal downtime?

Accepted Answer

Isolate the restored data from the production network until verified. Isolating the restored data from production prevents reinfection. Validating backup integrity ensures clean data. Testing the restoration process ensures the backups work. Encrypted backups require decryption keys.

Answer

Ensure encryption keys for backups are available

Answer

Restore data directly to production servers to save time

Question 10

Which of the following is a key objective of a business impact analysis (BIA)?

Accepted Answer

Determine the maximum tolerable downtime for critical processes. BIA identifies critical business processes and their recovery requirements such as RTO, RPO, and maximum tolerable downtime.

Answer

Implement security controls

Answer

Identify vulnerabilities in the network

Answer

Test the disaster recovery plan

Question 11

Which component of a trusted computing base (TCB) implements the reference monitor concept by enforcing access control decisions for all subjects and objects in the system?

Accepted Answer

Security kernel. The security kernel is the part of the TCB that implements the reference monitor, mediating all access requests.

Answer

Trusted platform module

Answer

Trusted computing base

Answer

Reference monitor

Question 12

A financial institution must ensure that transactions are well-formed and enforce separation of duties to prevent fraud. Which security model best addresses these requirements?

Accepted Answer

Clark-Wilson. Clark-Wilson model defines well-formed transactions and separation of duties to maintain commercial integrity.

Answer

Biba

Answer

Brewer-Nash

Answer

Bell-LaPadula

Question 13

A security auditor is reviewing the results of a recently completed internal vulnerability scan. The scan report shows several hosts with the same vulnerability. Which of the following actions should the auditor take FIRST?

Accepted Answer

Manually verify the vulnerability on a sample of affected hosts.. The auditor must first manually verify the vulnerability on a sample of affected hosts because automated vulnerability scans can produce false positives due to factors like incomplete banner grabbing, outdated plugin signatures, or network-level interference. Confirming the finding ensures that subsequent remediation efforts are based on accurate, validated data, preventing wasted resources on non-existent issues.

Answer

Immediately apply patches to all affected hosts.

Answer

Remove the hosts from the network until the vulnerability is resolved.

Answer

Re-run the scan with a different scanner.

Question 14

A security engineer is investigating a covert channel in a system. Which TWO types of covert channels could be used to leak information from a high-security to a low-security process?

Accepted Answer

Covert timing channel. Covert timing channels modulate the timing of events to signal information. Covert storage channels write data to a shared resource that the other process can read.

Answer

TOCTOU

Answer

Emanations

Answer

Side-channel

Question 15

A company collects PII from European customers for order processing. Under GDPR, they engage a third-party logistics provider to handle shipping. Which role does the logistics provider typically assume in this scenario?

Accepted Answer

Data processor. A data processor processes personal data on behalf of the data controller (the company). The logistics provider handles data for shipping but does not determine purposes or means.

Answer

Data controller

Answer

Data custodian

Answer

Data subject

Question 16

During a security audit, a vulnerability scanner reports a buffer overflow vulnerability in a legacy application. The application runs on a system with Data Execution Prevention (DEP/NX) enabled and Address Space Layout Randomization (ASLR) active. Which of the following is the most likely impact of these mitigations on a typical stack-based buffer overflow exploit?

Accepted Answer

They make it harder to execute arbitrary code via injected shellcode. DEP prevents code execution in data segments like the stack. ASLR randomizes memory addresses, making it harder for an attacker to redirect execution to injected code. Combined, they significantly raise the bar.

Answer

They only protect heap-based overflows, not stack-based

Answer

They completely prevent any exploitation of buffer overflows

Answer

They have no effect on buffer overflow exploits

Question 17

Which of the following is the primary purpose of a configuration management database (CMDB) in asset management?

Accepted Answer

Store information about hardware and software components and their relationships. A CMDB stores information about configuration items (CIs) and their relationships, aiding in change and incident management.

Answer

Track software licenses and compliance

Answer

Perform vulnerability scanning

Answer

Monitor network performance

Question 18

An organization is implementing privacy by design for a new application that processes PII. Which practice BEST aligns with the data minimization principle?

Accepted Answer

Collecting only the PII required for the stated function.. Data minimization means collecting only the personal data that is directly necessary for the specified purpose.

Answer

Anonymizing data after collection.

Answer

Obtaining explicit consent from users.

Answer

Collecting all possible PII in case it is needed later.

Question 19

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. A Type 2 factor is something you have, such as a smart card or OTP token.

Answer

Security question

Answer

Password

Answer

Fingerprint

Question 20

A security analyst discovers that an attacker has gained domain admin privileges by forging a Kerberos TGT using the KRBTGT account hash. Which attack has occurred?

Accepted Answer

Golden ticket attack. A Golden Ticket attack involves forging a TGT with the KRBTGT hash, granting unrestricted access.

Answer

Pass-the-ticket attack

Answer

Silver ticket attack

Answer

Kerberos brute force attack