CISSP Practice Questions 2 — 50 Questions

Question 1

A company's security team discovers that an employee inadvertently shared sensitive customer data via a public cloud storage link. The incident response team contains the breach and notifies affected customers. Which of the following risk management strategies would BEST prevent recurrence?

Accepted Answer

Deploy a Data Loss Prevention (DLP) solution that monitors and controls sharing of sensitive data.. Option C is correct because a Data Loss Prevention (DLP) solution provides automated, policy-based monitoring and control of sensitive data being shared via public cloud storage links. Unlike awareness training (which relies on human behavior) or blanket blocking (which hinders productivity), DLP can inspect content in real time using pattern matching, fingerprinting, or exact data matching to prevent unauthorized sharing before it occurs, directly addressing the root cause of inadvertent exposure.

Answer

Block all access to public cloud storage services from corporate devices.

Answer

Implement mandatory security awareness training focusing on data handling procedures.

Answer

Encrypt all sensitive data at rest and in transit to render shared data useless.

Question 2

An organization is developing a business continuity plan (BCP) for its critical IT systems. Which of the following is the FIRST step in the BCP process?

Accepted Answer

Conduct a business impact analysis (BIA) to prioritize critical business functions.. The first step in the BCP process is to conduct a Business Impact Analysis (BIA) to identify and prioritize critical business functions and their dependencies. Without the BIA, you cannot determine which systems require recovery strategies or what recovery time objectives (RTOs) and recovery point objectives (RPOs) are needed. The BIA provides the quantitative and qualitative basis for all subsequent BCP decisions.

Answer

Identify recovery strategies for critical systems.

Answer

Develop a testing schedule for the BCP.

Answer

Perform a risk assessment to identify potential threats.

Question 3

A company is decommissioning a data center and needs to dispose of hard drives that contained highly confidential financial data. Which of the following methods provides the HIGHEST assurance that data cannot be recovered?

Accepted Answer

Shredding the drives into small pieces. Shredding the drives into small pieces physically destroys the platters, making data recovery impossible regardless of the storage technology (e.g., HDD vs. SSD). This method provides the highest assurance because it eliminates any possibility of reading residual magnetic or solid-state data, even with advanced forensic tools like electron microscopy.

Answer

Overwriting the drives with multiple passes of random data

Answer

Degaussing the drives

Answer

Overwriting the drives with a single pass of zeros

Question 4

Which TWO of the following are key components of an Information Security Governance framework? (Select exactly 2)

Accepted Answer

Risk management processes. Risk management processes are a core component of an Information Security Governance framework because they provide the structured methodology for identifying, assessing, and mitigating risks to the organization's information assets. This aligns with the ISO/IEC 27001 standard, which mandates a risk-based approach to establishing, implementing, and maintaining an information security management system (ISMS). Without formal risk management, governance lacks the data-driven foundation to prioritize security investments and controls.

Answer

Incident response team structure

Answer

Penetration testing schedule

Answer

Vendor contract negotiation

Question 5

A company is considering outsourcing its customer support operations to a third-party vendor. Which of the following should be the PRIMARY risk management activity before finalizing the contract?

Accepted Answer

Conduct a thorough vendor risk assessment including security audits.. Before outsourcing critical operations, the primary risk management activity is to conduct a thorough vendor risk assessment, including security audits. This evaluates the vendor's security posture, compliance with standards (e.g., ISO 27001), and ability to protect sensitive customer data, directly addressing risks like data breaches or service disruptions before contractual obligations are locked in.

Answer

Negotiate a lower price to offset potential security investments.

Answer

Purchase cyber liability insurance to cover potential breaches.

Answer

Require the vendor to sign a non-disclosure agreement (NDA).

Question 6

During a risk assessment, a company identifies that its primary data center is located in a flood-prone area. The estimated annual loss expectancy (ALE) for a flood event is $500,000. Installing flood barriers costs $200,000 and reduces the ALE to $50,000. What is the net benefit of implementing the flood barriers?

Accepted Answer

$250,000. The net benefit is calculated as the reduction in ALE minus the cost of the control. The original ALE is $500,000, and after implementing flood barriers the ALE drops to $50,000, a reduction of $450,000. Subtracting the $200,000 cost of the barriers yields a net benefit of $250,000. This aligns with the CISSP risk management formula: Net Benefit = (ALE_old - ALE_new) - Cost_of_control.

Answer

$300,000

Answer

$450,000

Answer

$200,000

Question 7

A small business wants to implement a security policy that balances protection with usability. Which of the following is the MOST important factor when developing the policy?

Accepted Answer

Aligning the policy with business objectives and risk appetite.. Option B is correct because a security policy must be aligned with the organization's business objectives and risk appetite to ensure it supports operations without imposing unnecessary restrictions. For a small business, this balance is critical—overly strict controls can hinder productivity, while weak controls increase risk. The policy should reflect the specific threats and tolerances of the business, not generic templates or compliance-only checklists.

Answer

Adopting a template from a similar organization to save time.

Answer

Ensuring the policy is enforceable with technical controls.

Answer

Basing the policy solely on regulatory compliance requirements.

Question 8

During a security audit, it is discovered that a company's data classification labels are inconsistently applied across different departments. Which of the following is the BEST long-term solution to ensure consistent data classification?

Accepted Answer

Implement automated data classification tools that apply labels based on content and context. Automated data classification tools use content inspection (e.g., regex patterns, keyword matching) and contextual analysis (e.g., file location, creator, metadata) to consistently apply labels across the enterprise. This eliminates human error and variability between departments, ensuring uniform enforcement of the classification policy without relying on manual interpretation or periodic training.

Answer

Conduct annual retraining on data classification policies

Answer

Adopt a single classification level for all data to eliminate confusion

Answer

Assign a data owner in each department to manually review and classify data

Question 9

A security engineer reviews the S3 bucket policy in the exhibit. What is the most significant security issue with this configuration?

Accepted Answer

The bucket allows public read access to all objects. The S3 bucket policy in the exhibit grants "Effect": "Allow" with "Principal": "*" and "Action": "s3:GetObject" on the bucket ARN. This configuration effectively makes all objects in the bucket publicly readable over the internet, which is a severe data exposure risk. Option C correctly identifies this as the most significant security issue because it violates the principle of least privilege and can lead to unauthorized access to sensitive data.

Answer

The resource ARN does not specify a version ID

Answer

The policy does not enforce encryption in transit

Answer

The policy lacks an explicit deny statement

Question 10

A data classification policy is shown. A database contains a field labeled 'SSN' that matches the pattern for 'employee_id'. What action should be applied to the SSN field?

Accepted Answer

Mask. The SSN field matches the pattern for 'employee_id', indicating it contains sensitive personally identifiable information (PII). Masking is the appropriate action because it preserves the data format for operational use (e.g., testing, analytics) while irreversibly obscuring the actual values, reducing exposure risk without breaking referential integrity. Encryption would still allow authorized decryption, which is unnecessary for fields that only need pattern matching, and blocking would prevent legitimate access to the field entirely.

Answer

None

Answer

Encrypt

Answer

Block

Question 11

A security manager is tasked with classifying data based on its sensitivity. Which of the following is the PRIMARY reason for data classification?

Accepted Answer

To ensure appropriate protection measures are applied to data based on its value and sensitivity.. Data classification is the foundational process of assigning a sensitivity label (e.g., Public, Internal, Confidential, Restricted) to information assets. The primary reason is to ensure that appropriate security controls—such as encryption, access control lists (ACLs), and data loss prevention (DLP) policies—are applied proportionally to the data's value and sensitivity, aligning with the principle of defense in depth and risk management.

Answer

To satisfy regulatory requirements for data retention.

Answer

To facilitate data sharing across departments without restrictions.

Answer

To simplify the process of granting access to users.

Question 12

A healthcare organization is moving patient records to a cloud storage service. Which of the following is the MOST important requirement to ensure data security and compliance with HIPAA?

Accepted Answer

A signed Business Associate Agreement (BAA) with the cloud provider. Under HIPAA, a covered entity must have a signed Business Associate Agreement (BAA) with any cloud service provider that creates, receives, maintains, or transmits protected health information (PHI). Without a BAA, the provider is not contractually bound to safeguard PHI, making the organization non-compliant regardless of technical controls. While encryption and MFA are important security measures, they cannot substitute for the legal and regulatory requirement of a BAA.

Answer

Multi-factor authentication for all cloud access

Answer

Encryption of data in transit using TLS 1.2

Answer

Encryption of data at rest using AES-256

Question 13

Which THREE of the following are valid risk treatment options according to ISO 31000? (Select exactly 3)

Accepted Answer

Risk reduction. ISO 31000 defines risk treatment options as risk avoidance, risk reduction, risk transfer, and risk retention. Risk reduction (option C) is a valid treatment that involves implementing controls to lower the likelihood or impact of a risk, such as deploying firewalls or encryption to mitigate a security threat.

Answer

Risk retention

Answer

Risk review

Question 14

A financial institution is implementing a data retention policy to comply with regulatory requirements. The policy must ensure that transaction records are retained for 7 years and then securely destroyed. Which of the following is the BEST approach to implement this policy?

Accepted Answer

Automatically purge records using a data management tool that overwrites data after the retention period. Option B is correct because automated purging using a data management tool that overwrites data ensures that the records are securely destroyed at the end of the retention period, meeting both regulatory compliance and data sanitization requirements. Overwriting (e.g., using DoD 5220.22-M or NIST SP 800-88 standards) prevents data recovery by replacing the storage media's bits with patterns, making it a reliable method for secure destruction in a financial institution's automated environment.

Answer

Encrypt all records and destroy the encryption keys after 7 years

Answer

Move records to a separate archive and delete the directory pointers

Answer

Manually review and delete records after 7 years

Question 15

An analyst reviews the exhibit showing Windows security event logs. What activity should be investigated as a potential data exfiltration attempt?

Accepted Answer

The user deleting the PII file at 09:25:00 using cmd.exe. Option C is correct because deleting a PII file via cmd.exe (command-line interface) shortly after reading and writing to it is a classic indicator of data exfiltration. The attacker likely read the sensitive data, wrote a copy or staged it, then used cmd.exe to delete the original file to cover tracks and avoid detection by file access audits. This sequence—read, write, delete via command line—is anomalous for normal user behavior and strongly suggests intentional removal of evidence after data theft.

Answer

The user reading the PII file at 09:23:45

Answer

The sequence of events on the same file by the same user

Answer

The user writing to the PII file at 09:24:10

Question 16

An organization is designing a disaster recovery site. The primary data center is located in a region prone to earthquakes. The recovery site must be far enough away to avoid the same seismic zone but close enough to minimize latency. Which site selection criteria is most important?

Accepted Answer

Geographical diversity to avoid the same seismic zone. Geographical diversity (Option B) is the most important criterion because the primary data center is in an earthquake-prone region, and the recovery site must be located outside the same seismic zone to ensure that a single seismic event does not destroy both sites. This directly addresses the core requirement of disaster recovery: maintaining availability during a regional catastrophe. While latency and connectivity are important, they are secondary to ensuring the recovery site survives the same disaster.

Answer

Access to diverse power grids

Answer

High-speed network connectivity between sites

Answer

Availability of skilled personnel near the recovery site

Question 17

Which TWO of the following are examples of physical security controls?

Accepted Answer

Biometric door locks. Biometric door locks are physical security controls because they restrict physical access to a facility or room by verifying a unique biological trait (e.g., fingerprint, iris pattern). This falls under the domain of physical access control, which is a core component of physical security, not logical or administrative controls.

Answer

Firewall rules

Answer

Security awareness training

Answer

Intrusion detection system (IDS)

Question 18

An organization is implementing a bring-your-own-device (BYOD) policy. The security architect must ensure that corporate data on the device is protected from unauthorized access if the device is lost or stolen, while minimizing impact on user privacy. Which solution is most appropriate?

Accepted Answer

Use mobile device management (MDM) to create a secure container for corporate apps and data. A secure container (often implemented via MDM with app wrapping or per-app VPN) creates an encrypted, isolated partition on the device for corporate apps and data. This ensures that if the device is lost or stolen, the corporate data remains encrypted and inaccessible without the container's authentication, while personal apps and data outside the container remain untouched, thus minimizing privacy impact.

Answer

Require employees to use company-issued devices only

Answer

Disable camera and microphone on the device

Answer

Full device encryption with remote wipe capability

Question 19

An organization is implementing a hardware security module (HSM) to manage cryptographic keys. The security architect requires that keys be backed up securely and that the backup process ensures the same level of protection as the primary key storage. Which backup method best meets this requirement?

Accepted Answer

Use the HSM's key-wrapping function to encrypt the key and store the wrapped key in a secure offsite facility. Option C is correct because key-wrapping (also known as key encryption) uses a dedicated wrapping key within the HSM to encrypt the target key, ensuring the key never leaves the HSM in plaintext. The wrapped key can be safely stored offsite and later unwrapped only by an authorized HSM, preserving the same cryptographic protection as the primary storage. This method aligns with NIST SP 800-57 guidelines for secure key backup and escrow.

Answer

Export the key in plaintext and store it in a safe

Answer

Replicate the HSM configuration to another HSM in a different location

Answer

Store an encrypted copy on a local server in the same data center

Question 20

A security architect is reviewing a system that uses a microkernel operating system. The architect is concerned about potential side-channel attacks between processes. Which mitigation is most effective at the architecture level?

Accepted Answer

Use cache partitioning or cache coloring to isolate process caches. D is correct because cache partitioning or cache coloring directly addresses the root cause of side-channel attacks in a microkernel environment: shared CPU caches. By isolating each process's cache footprint, an attacker cannot infer sensitive data (e.g., cryptographic keys) through timing variations or cache occupancy measurements, which is a fundamental architectural mitigation.

Answer

Randomize the address space layout (ASLR)

Answer

Implement stack canaries in all user-space applications

Answer

Reduce the number of system calls and IPC mechanisms