CISSP Practice Questions 2 — 50 Questions

Question 1

A security manager is conducting a risk assessment for a new cloud application. The manager needs to estimate the potential financial loss from a data breach. Which approach should be used?

Accepted Answer

Quantitative risk analysis using annualized loss expectancy (ALE). Quantitative risk analysis using Annualized Loss Expectancy (ALE) provides a specific monetary estimate of potential financial loss, which is exactly what the security manager needs for a data breach scenario. ALE is calculated as Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO), enabling data-driven budgeting and cost-benefit analysis for cloud application security controls.

Answer

Scenario-based risk analysis with ordinal scales

Answer

Qualitative risk analysis using high/medium/low ratings

Answer

Benchmarking against industry standards

Question 2

During a forensic investigation, the team needs to preserve evidence from a running server. What is the FIRST step the team should take?

Accepted Answer

Capture a memory dump.. The first step in a forensic investigation of a running server is to capture a memory dump because volatile data (RAM) contains critical evidence such as running processes, network connections, encryption keys, and malware that would be lost if the system is powered off or altered. Preserving this volatile state before any other action ensures that the most transient evidence is secured, following the order of volatility principle. Capturing memory first prevents irreversible loss of data that cannot be recovered from disk or network captures.

Answer

Create a disk image.

Answer

Shut down the server normally.

Answer

Unplug the network cable.

Question 3

An organization uses full disk encryption on all laptops containing sensitive data. A laptop is to be decommissioned, and the data must be sanitized. The laptop's SSD cannot be overwritten reliably due to wear-leveling. Which method is most appropriate?

Accepted Answer

Cryptographic erasure by destroying the encryption key. Cryptographic erasure by destroying the encryption key is the most appropriate method because the data is already encrypted with full disk encryption; destroying the key renders the data unrecoverable without needing to overwrite the SSD, which is unreliable due to wear-leveling. This approach is efficient and secure for decommissioning.

Answer

Degaussing

Answer

DoD 5220.22-M 7-pass overwrite

Answer

Physical destruction (shredding)

Question 4

A security architect is selecting a cryptographic algorithm for encrypting data at rest in a backup system. The system requires strong security with a block cipher, and the organization mandates using a NIST-approved algorithm with key sizes of 128, 192, or 256 bits. Which algorithm should be selected?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a NIST-approved symmetric block cipher defined in FIPS 197, supporting key sizes of 128, 192, and 256 bits. It is the standard choice for encrypting data at rest and satisfies all stated requirements.

Answer

RC4

Answer

RSA

Answer

3DES

Question 5

During a business impact analysis (BIA), which metric represents the maximum amount of time a business process can be disrupted before causing significant harm to the organization?

Accepted Answer

Maximum Tolerable Period of Disruption (MTPD). The Maximum Tolerable Period of Disruption (MTPD) is the metric defined during a BIA that captures the absolute upper bound of time a business process can be unavailable before the organization suffers unacceptable or significant harm. It is derived from business-side impact analysis (financial, regulatory, reputational) rather than technical recovery capabilities, and it serves as the ceiling from which RTO is derived. Because MTPD represents the business's tolerance limit, it is the correct answer for the maximum disruption time before significant harm.

Answer

Work Recovery Time (WRT)

Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Question 6

A security architect is deploying a public key infrastructure (PKI) and wants to ensure that certificate revocation status is verified efficiently without relying on a centralized CRL distribution point. Which technique should be used?

Accepted Answer

OCSP Stapling. OCSP Stapling allows the server to obtain a signed, time-stamped OCSP response from the CA and present it to clients during the TLS handshake, so clients do not need to contact the OCSP responder directly. This eliminates the latency and privacy concerns of real-time OCSP lookups and avoids reliance on a centralized CRL distribution point. It is the standard technique for efficient, decentralized revocation checking.

Answer

Certificate Transparency Logs

Answer

Certificate Pinning

Answer

Self-Signed Certificates

Question 7

A company's vulnerability management program requires that all critical vulnerabilities be remediated within 30 days. A critical vulnerability is discovered in a legacy system that cannot be patched because the vendor no longer supports it. Which of the following is the best compensating control?

Accepted Answer

Segment the system from the rest of the network. Segmenting the legacy system from the rest of the network is the best compensating control because it limits the blast radius if the unpatched vulnerability is exploited. By isolating the system, lateral movement to other critical assets is prevented, reducing overall risk. This is a classic network segmentation control that directly addresses the inability to patch.

Answer

Deploy a host-based intrusion detection system (HIDS)

Answer

Increase logging and monitoring

Answer

Encrypt all data at rest on the system

Question 8

Which role in an incident response team is primarily responsible for coordinating communication with external parties, such as the media and regulators?

Accepted Answer

Communications lead. The communications lead is the incident response team role specifically tasked with managing all external and internal communications, including press releases, media inquiries, and regulator notifications. This role ensures a single, consistent message and prevents unauthorized disclosures. Legal counsel, the incident manager, and forensic investigators have different primary responsibilities that do not center on external communications.

Answer

Legal counsel

Answer

Incident manager

Answer

Forensic investigator

Question 9

During a security review of a web application, testers discover that the application discloses detailed error messages to users, including stack traces. Which secure coding best practice is being violated?

Accepted Answer

Error handling. Detailed error messages with stack traces expose sensitive implementation details, which is a failure of proper error handling. Secure error handling requires generic user-facing messages while logging details internally. This prevents attackers from learning about the system's internals.

Answer

Input validation

Answer

Secure logging

Answer

Output encoding

Question 10

During a Kerberos authentication process, the client receives a Ticket Granting Ticket (TGT) from the Authentication Server (AS). Later, the client presents the TGT to the Ticket Granting Server (TGS) to request a service ticket. Which of the following best describes the purpose of the TGT?

Accepted Answer

It allows the client to request additional service tickets without re-authentication.. The TGT is correct because it is issued once by the Authentication Server after the client proves its identity (typically via password-derived pre-authentication), and it is then presented to the TGS to obtain service tickets for specific resources — enabling single sign-on without re-entering credentials. The TGT is encrypted with the krbtgt account's secret key, so only the KDC can decrypt and validate it, and it carries the client's identity and a session key for securing subsequent TGS exchanges. This design is what makes Kerberos efficient: authenticate once, then request many service tickets.

Answer

It verifies the client's IP address to prevent replay attacks.

Answer

It encrypts the session key between the client and the target service.

Answer

It authenticates the user to the target service directly.

Question 11

A security analyst is reviewing a web application and notices that it includes a feature that allows users to view their own profile by providing a user ID in the URL (e.g., /profile?userid=123). The application does not verify that the logged-in user owns that profile. Which vulnerability is present?

Accepted Answer

Insecure direct object reference (IDOR). The application exposes an internal object reference (the userid parameter) and fails to perform an authorization check that the logged-in user owns that object. This is the textbook definition of an Insecure Direct Object Reference (IDOR), classified under OWASP as Broken Access Control (A01:2021). Because the URL directly maps to a backend record without an ownership check, an attacker can simply increment the userid value to view other users' profiles.

Answer

Security misconfiguration

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Question 12

Which metric defines the maximum amount of data loss an organization can tolerate during a disaster?

Accepted Answer

RPO. Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time — for example, an RPO of 4 hours means the organization can tolerate losing up to 4 hours of data. It directly drives backup frequency and replication strategy. RTO, by contrast, defines how long recovery can take, not how much data can be lost.

Answer

MTD

Answer

MTTR

Answer

RTO

Question 13

What is the primary purpose of a configuration management database (CMDB) in asset management?

Accepted Answer

Provide a repository of configuration items and their relationships. The primary purpose of a configuration management database (CMDB) is to provide a repository of configuration items (CIs) and their relationships, enabling IT service management processes like change management, incident management, and asset management. It tracks the components of an IT environment and how they interconnect.

Answer

Monitor network traffic for anomalies

Answer

Store and manage data classification labels

Answer

Track software licenses and compliance

Question 14

An organization is implementing a Public Key Infrastructure (PKI) to support secure email and web communications. The PKI includes a root CA, intermediate CAs, and end-entity certificates. Which of the following best describes the role of the root CA in this hierarchy?

Accepted Answer

It is self-signed and forms the trust anchor. The root CA is the top of the PKI hierarchy and is self-signed, meaning its certificate is signed by its own private key. It serves as the ultimate trust anchor: all trust in the chain derives from it, and its public key is distributed out-of-band to relying parties. In a well-designed hierarchy, the root CA issues certificates only to intermediate CAs, not directly to end entities, to protect its private key.

Answer

It performs key escrow for all users

Answer

It issues certificates directly to end users

Answer

It validates certificate revocation lists (CRLs)

Question 15

Which of the following is the most important factor when prioritizing vulnerability remediation in a vulnerability management program?

Accepted Answer

Exploitability and business impact. Prioritizing vulnerability remediation should be driven by exploitability (is there a known exploit, is it weaponized, is it reachable) combined with business impact (what asset is affected, what data or process is at risk). This risk-based approach ensures limited remediation resources are directed at the vulnerabilities that pose the greatest actual threat to the organization. CVSS alone does not capture business context.

Answer

CVSS base score

Answer

Number of systems affected

Answer

Time since discovery

Question 16

A financial application requires strict integrity controls to prevent unauthorized modifications. The security team implements a model where users cannot write data to higher integrity levels (no write up) and cannot read data from lower integrity levels (no read down). Which model is being applied?

Accepted Answer

Biba. The Biba integrity model is defined by the 'no write up' and 'no read down' rules, which prevent subjects at a lower integrity level from writing to higher levels and prevent subjects at a higher level from reading lower-level (potentially tainted) data. This directly matches the scenario's requirement to prevent unauthorized modifications by preserving integrity across levels. Biba is the integrity counterpart to Bell-LaPadula, which focuses on confidentiality.

Answer

Bell-LaPadula

Answer

Graham-Denning

Answer

Clark-Wilson

Question 17

During a forensic investigation, an analyst must collect volatile data in the correct order. Which of the following sequences correctly follows the order of volatility?

Accepted Answer

CPU registers → cache → RAM → swap → disk. The order of volatility (RFC 3227) dictates that the most ephemeral data must be captured first because it disappears fastest. CPU registers and cache lose their contents within nanoseconds to milliseconds, RAM persists only while powered, swap holds paged memory on disk, and the disk itself is the most persistent. Therefore CPU registers → cache → RAM → swap → disk is the correct forensic collection sequence.

Answer

Disk → RAM → CPU registers → cache → swap

Answer

RAM → CPU registers → swap → disk → remote logging

Answer

Swap → RAM → cache → CPU registers → disk

Question 18

An organization wants to implement single sign-on across multiple web applications using an XML-based protocol that supports identity provider (IdP) and service provider (SP) initiated flows. Which technology should they choose?

Accepted Answer

SAML 2.0. SAML 2.0 is the XML-based federation standard that defines both IdP-initiated and SP-initiated SSO flows using assertions, AuthnRequests, and Response messages. It is the classic choice for browser-based SSO across multiple web applications where the identity provider and service provider exchange XML over HTTP POST or redirect bindings. OpenID Connect and OAuth 2.0 are JSON/REST-based, and Kerberos is a ticket-based network authentication protocol, not a web SSO federation standard.

Answer

OpenID Connect

Answer

OAuth 2.0

Answer

Kerberos

Question 19

An organization deploys a hypervisor to host multiple virtual machines. To mitigate the risk of VM escape attacks, which of the following is the most effective security measure?

Accepted Answer

Disabling all unnecessary hypervisor services and applying security patches. Disabling unnecessary hypervisor services reduces the attack surface available to a guest attempting VM escape, and applying hypervisor security patches closes known vulnerabilities (e.g., VENOM, CVE-2015-3456) that allow guest-to-host breakout. Since the hypervisor is the isolation boundary between VMs and the host, hardening and patching it directly addresses the escape vector. This is the most effective preventive control because it targets the root cause rather than the symptoms.

Answer

Using Type 2 hypervisor only

Answer

Using VLANs to isolate VM traffic

Answer

Enabling VM snapshots for quick recovery

Question 20

A government agency requires a security model that prevents users from reading documents classified above their clearance level and from writing classified information to lower-level systems. Which model enforces these constraints?

Accepted Answer

Bell-LaPadula. Bell-LaPadula is the mandatory access control model focused on confidentiality, enforcing 'no read up' (simple security property) and 'no write down' (star property). These two rules exactly match the requirement: users cannot read above their clearance and cannot write classified data to lower levels. Biba, Brewer-Nash, and Clark-Wilson address integrity or conflict-of-interest, not confidentiality.

Answer

Biba

Answer

Brewer-Nash

Answer

Clark-Wilson