CISSP Practice Exam 51 — 20 Questions

Question 1

Which TWO of the following are differences between OAuth 2.0 and OpenID Connect (OIDC)?

Accepted Answer

OAuth 2.0 is for authorization, while OIDC is for authentication. OAuth 2.0 is fundamentally an authorization framework (RFC 6749) that grants delegated access to resources, while OpenID Connect (OIDC) is an authentication layer built on top of OAuth 2.0 (specified in OpenID Connect Core 1.0) that verifies the end-user's identity. OIDC extends OAuth 2.0 by adding an ID token (a JWT) that contains claims about the authenticated user, whereas OAuth 2.0 alone does not provide identity information.

Answer

OAuth 2.0 supports device code grant, OIDC does not

Answer

OIDC is XML-based, while OAuth 2.0 is JSON-based

Answer

OAuth 2.0 requires a client secret, OIDC does not

Question 2

A security analyst is reviewing access controls for a financial application. Which TWO of the following are considered best practices for preventing fraud? (Select TWO.)

Accepted Answer

Two-person control. Two-person control (D) is a best practice for preventing fraud because it requires two authorized individuals to perform a critical action, such as approving a high-value transaction or accessing a sensitive system. This ensures collusion is needed to commit fraud, as no single person can complete the action alone. In a financial application, this might involve dual approval for wire transfers over a threshold, directly mitigating insider threats.

Answer

Password complexity

Answer

Single sign-on

Answer

Least privilege

Question 3

A security engineer is troubleshooting an authentication failure for a Windows domain user. The user receives 'Access denied' when trying to access a file server. The Kerberos ticket-granting ticket was successfully obtained. What is the most likely issue?

Accepted Answer

The user does not have permission to the file server resource. Since the Kerberos ticket-granting ticket (TGT) was successfully obtained, the user has authenticated to the domain and the Kerberos authentication process is functioning correctly. The 'Access denied' error at the file server indicates that the user lacks the necessary permissions on the specific resource (share or NTFS), which is a separate authorization step after successful authentication.

Answer

The file server is not trusted for delegation

Answer

The user account is locked out

Answer

Time skew between client and domain controller

Question 4

A network administrator is configuring a firewall that examines the source and destination IP addresses, port numbers, and protocol (TCP/UDP) of each packet without considering the state of the connection. Which type of firewall is being deployed?

Accepted Answer

Packet filter firewall. A packet filter firewall operates at Layer 3 (Network) and Layer 4 (Transport) of the OSI model, making decisions based solely on static header fields such as source/destination IP addresses, port numbers, and protocol type (TCP/UDP). It does not track connection state or session context, which matches the description of examining each packet independently. This is the defining characteristic of a stateless packet filter, as opposed to stateful or application-layer firewalls.

Answer

Next-generation firewall

Answer

Stateful inspection firewall

Answer

Application proxy firewall

Question 5

According to the ISC2 Code of Ethics, which of the following canons has the highest priority when resolving an ethical dilemma?

Accepted Answer

Protect society, the common good, and the public trust. The ISC2 Code of Ethics canons are in order of priority: 1. Protect society, the common good, and the public trust; 2. Act honorably and lawfully; 3. Provide diligent and competent service; 4. Advance and protect the profession. Therefore, option D is the highest priority canon.

Answer

Act honorably and lawfully

Answer

Provide diligent and competent service

Answer

Advance and protect the profession

Question 6

A company's compliance officer wants to ensure that the organization's security controls meet regulatory requirements for data protection. The officer requests a review of the controls against the regulation's specific clauses. Which type of assessment is most appropriate?

Accepted Answer

Compliance audit. A compliance audit is the correct assessment type because it systematically evaluates security controls against specific regulatory clauses (e.g., GDPR Article 32, HIPAA Security Rule §164.312). Unlike risk or vulnerability assessments, a compliance audit maps controls directly to legal requirements to verify adherence, often using checklists and evidence collection.

Answer

Risk assessment

Answer

Vulnerability assessment

Answer

Penetration test

Question 7

A multinational corporation is implementing a data classification policy for commercial data. Which TWO labels are commonly used in commercial classification schemes? (Select TWO.)

Accepted Answer

Public. Commercial classification often includes 'Public' for non-sensitive data and 'Private' for internal data. 'Top Secret' and 'Unclassified' are government labels.

Answer

Secret

Answer

Unclassified

Answer

Top Secret

Question 8

A user calls the help desk because they cannot log in. The help desk technician confirms the user's identity by asking for their employee ID and mother's maiden name. Which of the following is the MOST significant security issue with this practice?

Accepted Answer

The technician is using shared secrets that are not effective for strong authentication.. Using shared secrets like employee ID and mother's maiden name for identity verification is a weak form of authentication. These are not truly secret and can be easily guessed, observed, or obtained through social engineering. Option A is incorrect; the main issue is not whether the information is stored but that it is a weak secret. Option C is incorrect; while MFA would improve security, the most significant issue here is the reliance on weak shared secrets. Option D is incorrect; the information may be unique to the user, but uniqueness does not equate to security—the secret is not strong.

Answer

The user's mother's maiden name is not stored in the HR system.

Answer

The help desk should be using multi-factor authentication.

Answer

The user's identity is being verified using information that is not unique to the user.

Question 9

A company is designing secure boot for IoT devices to ensure only trusted firmware runs. The devices have limited resources. Which mechanism provides the highest assurance of boot integrity?

Accepted Answer

Use a TPM to measure boot components and compare to stored hashes.. A Trusted Platform Module (TPM) provides hardware-rooted trust by measuring each boot component (e.g., BIOS, bootloader, OS kernel) and storing the measurements in Platform Configuration Registers (PCRs). These measurements are compared against known-good hashes stored in the TPM, ensuring that any tampering with firmware is detected before execution. This offers the highest assurance for resource-constrained IoT devices as it relies on immutable hardware rather than software-based checks.

Answer

Use a software-based integrity check that runs after boot.

Answer

Set a BIOS password to prevent unauthorized changes.

Answer

Implement full disk encryption (FDE).

Question 10

A company develops a web application using microservices architecture deployed on Kubernetes. The security team identifies that the application is vulnerable to injection attacks because user input is concatenated into SQL queries. The development team wants to implement a fix quickly. They propose using parameterized queries, but the database access layer currently uses stored procedures. The team considers modifying the stored procedures to accept parameters and using prepared statements in the code. However, the operations team is concerned about performance impact. Which of the following is the BEST course of action?

Accepted Answer

Implement both parameterized queries and modify stored procedures to use parameters, and then monitor performance.. The best because it implements a defense-in-depth approach: parameterized queries in the application code combined with parameterized stored procedures provide robust protection against SQL injection, and monitoring performance addresses the operations team's concern. Option A is incorrect because parameterized queries alone do not protect if the stored procedures still concatenate input. Option C is incorrect because dynamic SQL within stored procedures, even with input validation, can still be vulnerable to injection (e.g., via second-order attacks). Option D is incorrect because input validation alone is insufficient, and stored procedures without parameterization can still be vulnerable to injection.

Answer

Use parameterized queries immediately without modifying stored procedures.

Answer

Modify stored procedures to use dynamic SQL with input validation.

Answer

Use input validation only, as stored procedures inherently prevent injection.

Question 11

An organization uses a data loss prevention (DLP) system to monitor outbound emails. Which data classification type would the DLP most likely use to detect sensitive information leaving the network?

Accepted Answer

Content-based classification. Content-based classification inspects the actual data within outbound emails—such as credit card numbers, social security numbers, or other regex-defined patterns—to detect sensitive information. DLP systems rely on content analysis (e.g., regular expressions, exact data matching, or fingerprinting) to identify and block policy violations, making this the correct classification type for detecting sensitive data leaving the network.

Answer

Context-based classification

Answer

User-based classification

Answer

Role-based classification

Question 12

Match each PKI component to its function.

Accepted Answer

Certificate Authority (CA): Issues and signs digital certificates. In PKI, the CA issues and signs certificates, the RA verifies identities, the repository stores certificates for retrieval, and the CRL tracks revoked certificates. Common confusions involve mixing the roles of CA and RA or CA and repository.

Answer

Certificate Authority (CA): Stores and distributes certificates

Answer

Registration Authority (RA): Issues and signs certificates

Question 13

Refer to the exhibit. An organization has a lawsuit requiring preservation of all records related to a customer dispute from 2018. Which data set must be preserved beyond its scheduled retention?

Accepted Answer

All of the above. A legal hold overrides any scheduled retention policy. The lawsuit requires preservation of all records related to the 2018 customer dispute, which includes email logs (for communication evidence), payment card data (for transaction records), and customer records (for account details). Under eDiscovery rules (FRCP Rule 26), any data set that may contain relevant information must be preserved, even if its normal retention period has expired.

Answer

Email logs from 2018

Answer

Payment card data from 2018 transactions

Answer

Customer records from 2018 accounts that are still open

Question 14

A network engineer is configuring 802.1X authentication for wired network access. The authentication server supports EAP-TLS. What must be deployed to clients to support this authentication method?

Accepted Answer

Client certificate. EAP-TLS requires mutual authentication using digital certificates on both the client and the server. The client must present a certificate to prove its identity to the authentication server, which is validated against a trusted root CA. Without a client certificate, EAP-TLS cannot establish the TLS tunnel, as it relies on certificate-based client authentication per RFC 5216.

Answer

Server certificate

Answer

RADIUS server

Answer

Shared secret

Question 15

A financial institution must retain customer transaction records for 7 years. After that, what is the most appropriate action?

Accepted Answer

Securely delete using overwriting. After the 7-year retention period, the most appropriate action is to securely delete the records using overwriting. This ensures that the data is irrecoverable while maintaining compliance with data disposal policies. Overwriting with multiple passes (e.g., using the Gutmann method or DoD 5220.22-M standard) prevents data remanence, which is critical for financial records.

Answer

Degauss and physically destroy

Answer

Transfer to a third-party storage vendor

Answer

Archive to tape for additional redundancy

Question 16

Match each OSI layer to its function.

Accepted Answer

Transport: Provides reliable data transfer and flow control. The correct matches are: Transport with reliable data transfer, Network with routing and logical addressing, Data Link with frame transmission between nodes, and Physical with bit transmission. Common confusions involve swapping Transport and Network functions.

Answer

Transport: Routes packets using logical addressing

Answer

Network: Provides reliable data transfer

Question 17

Refer to the exhibit. What is a potential security weakness in this policy?

Accepted Answer

It grants access to a private IP range which is not routable over the internet. The policy grants access to a private IP range (e.g., 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) which is not routable over the internet. This means the condition is ineffective for controlling access from external sources, as private IP addresses are only meaningful within a local network and cannot be used to authenticate or authorize remote users. An attacker could spoof such an IP address from within the same network or bypass the restriction entirely if the policy is intended to restrict internet-based access.

Answer

It does not specify a principal

Answer

It allows all actions on the resource

Answer

It uses a condition that can be bypassed

Question 18

A security architect is reviewing a software design that uses a third-party library for XML parsing. The library is known to be vulnerable to XML External Entity (XXE) attacks. The architect recommends replacing the library. What is the primary risk of XXE attacks that the architect wants to avoid?

Accepted Answer

Disclosure of sensitive files from the server. XXE attacks exploit XML parsers that process external entities, allowing an attacker to read sensitive files from the server (e.g., /etc/passwd) by referencing them in the entity definition. The primary risk is unauthorized data disclosure, as the parser may include the file content in the response or error message. This directly violates confidentiality, a core security objective.

Answer

Remote code execution by injecting malicious XML

Answer

Denial of service (DoS) from entity expansion

Answer

Cross-site scripting (XSS) delivered via XML response

Question 19

A security assessment reveals that a web application uses client-side input validation exclusively. What is the most likely security risk?

Accepted Answer

An attacker can submit malicious data directly to the server without client-side constraints.. Client-side validation (e.g., JavaScript in the browser) can be bypassed by intercepting and modifying HTTP requests using tools like Burp Suite or cURL. Since the server does not re-validate the input, an attacker can submit crafted payloads (e.g., SQL injection, command injection) directly to the server, leading to data breaches or code execution. This violates the principle of defense in depth, where validation must occur on the server side regardless of client-side checks.

Answer

Attacker can inject malicious scripts that execute on the client side.

Answer

The application will have poor user experience due to slow responses.

Answer

The client-side code can be obfuscated but not decrypted.

Question 20

An organization's backup strategy includes daily full backups and hourly incremental backups. The system suffers a ransomware attack that encrypts all data. Which backup set is essential to restore the most recent clean state?

Accepted Answer

The last full backup plus all incremental backups after that. To restore the most recent clean state after a ransomware attack, you need the last full backup as the base and all subsequent incremental backups to apply every change made up to the moment before the attack. Incremental backups capture only data changed since the last backup (full or incremental), so skipping any breaks the chain and results in data loss. Option A correctly includes the full backup and every incremental backup after it, ensuring a complete restoration to the latest point before encryption.

Answer

The last full backup plus the last incremental backup

Answer

The last full backup only

Answer

The last incremental backup only