CISSP Practice Exam 52 — 20 Questions

Question 1

A data custodian is responsible for implementing controls to protect data. Which TWO of the following are typical responsibilities of a data custodian? (Select 2)

Accepted Answer

Performing regular backups of data. The data custodian handles the day-to-day operational, technical execution of data protection controls, and running scheduled backups is a classic custodial task that enforces the protection decisions made by data owners. Option D (Restoring data from backups when needed) is also correct because recovery operations—retrieving and restoring data from backup media during an incident or data loss event—fall within the custodian's operational remit for maintaining data availability and integrity. By contrast, Option A (Classifying data according to sensitivity), Option B (Defining data usage policies), and Option E (Determining data retention periods) are strategic governance responsibilities belonging to the data owner (or steward), who sets classification, policy, and retention rules that the custodian then implements.

Answer

Classifying data according to sensitivity

Answer

Defining data usage policies

Answer

Determining data retention periods

Question 2

During a security audit, a vulnerability scanner reports a buffer overflow vulnerability in a legacy application. The application runs on a system with Data Execution Prevention (DEP/NX) enabled and Address Space Layout Randomization (ASLR) active. Which of the following is the most likely impact of these mitigations on a typical stack-based buffer overflow exploit?

Accepted Answer

They make it harder to execute arbitrary code via injected shellcode. DEP/NX marks memory pages as non-executable, so injected shellcode on the stack cannot be executed directly. ASLR randomizes the memory layout, making it difficult for an attacker to reliably jump to existing code (like a ROP gadget or system function). Together they significantly raise the bar for a typical stack-based buffer overflow exploit, though they do not make exploitation impossible.

Answer

They only protect heap-based overflows, not stack-based

Answer

They completely prevent any exploitation of buffer overflows

Answer

They have no effect on buffer overflow exploits

Question 3

A company wants to measure the effectiveness of its vulnerability management program. Which metric would best indicate the organization's ability to respond quickly to critical vulnerabilities?

Accepted Answer

Mean time to remediate critical vulnerabilities. Mean time to remediate (MTTR) critical vulnerabilities directly measures how quickly the organization closes its highest-risk exposures, which is the clearest indicator of response speed and program effectiveness. It captures both detection-to-triage and triage-to-fix intervals, so a shrinking MTTR demonstrates improving operational capability. CISSP exam objectives emphasize metrics that reflect responsiveness and risk reduction, not just volume or compliance.

Answer

Patch compliance percentage

Answer

ROI of security controls

Answer

Number of open vulnerabilities by severity

Question 4

A user calls the help desk because they cannot log in. The help desk technician confirms the user's identity by asking for their employee ID and mother's maiden name. Which of the following is the MOST significant security issue with this practice?

Accepted Answer

The technician is using shared secrets that are not effective for strong authentication.. The most significant issue is that the help desk is using shared secrets (employee ID and mother's maiden name) for identity verification. These are static, often easily obtainable pieces of information that do not provide strong authentication. They can be compromised through social engineering or data breaches. While multi-factor authentication (C) is a good practice, the core problem is the reliance on weak shared secrets. Option D is also a concern but less significant than the use of ineffective secrets.

Answer

The user's mother's maiden name is not stored in the HR system.

Answer

The help desk should be using multi-factor authentication.

Answer

The user's identity is being verified using information that is not unique to the user.

Question 5

An organization is developing a privacy program. Which THREE of the following are core principles of privacy by design? (Select 3)

Accepted Answer

Data minimization. Data minimization (B) is a core privacy-by-design principle because it requires collecting only the personal data that is adequate, relevant, and necessary for the specified purpose, reducing exposure and risk. Purpose limitation (C) is correct because personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a way incompatible with those purposes. Storage limitation (E) is correct because data should be kept only as long as necessary for the stated purpose, after which it must be deleted or anonymized. Open data sharing (A) is not a privacy-by-design principle, as unrestricted sharing conflicts with confidentiality and purpose controls, and maximum data retention (D) is the opposite of storage limitation and increases privacy risk.

Answer

Open data sharing

Answer

Maximum data retention

Question 6

In the context of identity management, which TWO of the following are risks associated with orphaned accounts? (Choose two.)

Accepted Answer

Compliance violations. Option A (Compliance violations) is correct because orphaned accounts—accounts with no valid owner or associated active user—violate regulatory requirements such as SOX, HIPAA, and GDPR, which mandate that access be attributable to a known, authorized individual and that accounts be reviewed and revoked promptly; auditors treat unowned accounts as a control failure. Option C (Unauthorized access by former employees) is correct because orphaned accounts often persist after an employee leaves or changes roles, and since the credentials may still be valid and unmonitored, a former employee (or anyone who obtains those credentials) can use them to access systems without authorization. Option B (Reduced system performance) is not a typical identity-management risk of orphaned accounts; performance impact is not the concern here. Option D (Enhanced audit logging) is the opposite of a risk—orphaned accounts actually degrade auditability rather than enhance it. Option E (Increased help desk calls) is not a recognized risk category for orphaned accounts; it is unrelated to the access-control and compliance issues at stake.

Answer

Reduced system performance

Answer

Enhanced audit logging

Answer

Increased help desk calls

Question 7

A security team is evaluating a new endpoint detection and response (EDR) solution. Which of the following capabilities is MOST important for detecting fileless malware?

Accepted Answer

Behavioral analysis and process monitoring.. Behavioral analysis and process monitoring is the most important capability for detecting fileless malware because fileless attacks execute in memory using legitimate system tools (e.g., PowerShell, WMI, .NET) and leave no files on disk for static or signature-based tools to detect. EDR solutions with behavioral analytics monitor process execution chains, API calls, and anomalous activity patterns to identify malicious behavior regardless of file artifacts.

Answer

Static malware analysis.

Answer

Signature-based detection.

Answer

Network traffic inspection.

Question 8

Which TWO of the following are principles of the zero trust security model? (Select TWO.)

Accepted Answer

Never trust, always verify. Option B, "Never trust, always verify," is a core zero trust principle: every access request must be explicitly authenticated and authorized based on identity, device posture, and context, regardless of where it originates. Option D, "Assume all networks are hostile," is also correct because zero trust treats both internal and external networks as untrusted, eliminating the implicit trust traditionally granted to traffic inside a corporate perimeter. In contrast, option A ("Trust but verify") reflects the older perimeter-based model where internal entities are trusted by default, which zero trust explicitly rejects. Option C is wrong because zero trust assumes no user is inherently trustworthy; trust must be continuously evaluated. Option E is wrong because zero trust moves away from relying on perimeter defenses like firewalls alone, instead enforcing microsegmentation and per-request policy checks.

Answer

Trust but verify

Answer

Users are inherently trustworthy

Answer

Perimeter defenses are sufficient

Question 9

Which THREE are components of a privileged access management (PAM) solution?

Accepted Answer

Credential vaulting. Credential vaulting (A) is a core PAM component because it stores privileged account credentials in an encrypted repository, allowing checkout, rotation, and brokering so administrators never need to know the underlying passwords. Just-in-time privilege elevation (D) is correct because PAM solutions grant elevated rights only for the specific task and time window needed, then automatically revoke them, reducing standing privileged access. Session recording and monitoring (E) is also correct because PAM platforms proxy and record privileged sessions (e.g., SSH, RDP) to provide audit trails, keystroke logging, and real-time threat detection. Password complexity rules (B) are a general identity/password-policy control, not a defining PAM component, and multi-factor authentication for all users (C) is broader than PAM—MFA may integrate with PAM, but applying it to every user is an enterprise-wide authentication requirement rather than a PAM component itself.

Answer

Password complexity rules

Answer

Multi-factor authentication for all users

Question 10

Which TWO principles are essential for implementing least privilege in identity and access management?

Accepted Answer

Minimum necessary permissions. Minimum necessary permissions (A) is a core least-privilege principle: identities should be granted only the specific permissions required to perform their job function, and no broader access, so the potential blast radius of a compromised or misused account is minimized. Need-to-know (B) is the complementary principle that access to information or resources should be granted only when a user has a legitimate, job-related requirement to know or use that data, which directly limits unnecessary exposure. Together, A and B define least privilege by restricting both the scope of permissions and the justification for accessing resources. Segregation of duties (C) is a fraud- and error-prevention control that splits critical tasks among different people, but it is not itself a least-privilege principle. User awareness training (D) and password complexity requirements (E) are supporting security controls that improve human behavior and credential strength, but they do not define or implement least privilege.

Answer

Segregation of duties

Answer

User awareness training

Answer

Password complexity requirements

Question 11

An organization plans to allow employees to access third-party SaaS applications using their corporate credentials. Which THREE are necessary components for implementing SAML-based identity federation?

Accepted Answer

Service Provider (SP). SAML-based identity federation requires a Service Provider (SP), which is the third-party SaaS application that receives and validates SAML assertions to grant access, so option A is correct. It also requires an Identity Provider (IdP), the corporate system that authenticates employees and issues signed SAML assertions containing identity and attribute claims, making option C correct. XML digital signatures are essential because SAML assertions and responses must be cryptographically signed (typically with XML Signature, using the IdP's private key and validated with its public certificate) to ensure integrity and authenticity, so option E is correct. Bcrypt password hashing (B) is a local credential-storage technique and is not a SAML federation component, since the IdP handles authentication and the SP does not need to hash the user's corporate password. A RADIUS server (D) provides network access authentication via the RADIUS protocol and is unrelated to SAML web-based identity federation.

Answer

Bcrypt password hashing

Answer

RADIUS server

Question 12

A network administrator is configuring switches to prevent VLAN hopping attacks. Which TWO of the following measures should be implemented?

Accepted Answer

Set the native VLAN to an unused VLAN.. Option B is correct because the native VLAN on 802.1Q trunk ports is untagged, so an attacker can craft double-tagged frames that get forwarded onto the native VLAN; changing the native VLAN to an unused, dedicated VLAN removes that attack path. Option D is correct because DTP allows a switch port to negotiate a trunk automatically, so an attacker can send DTP frames to turn an access port into a trunk and gain access to all VLANs; disabling DTP (for example with 'switchport nonegotiate' on trunk ports) prevents this negotiation. Option A is not appropriate because private VLANs are used for Layer 2 isolation within a VLAN, not as a general trunk-port hardening measure against VLAN hopping. Option C is not correct because BPDU guard protects against rogue switches sending BPDUs on access ports (STP attacks), not VLAN hopping. Option E is not correct because port security limits MAC addresses on access ports and does not stop VLAN hopping via trunk negotiation or double tagging.

Answer

Use private VLANs on all trunk ports.

Answer

Enable BPDU guard on all access ports.

Answer

Implement port security on all access ports.

Question 13

Which three are network-layer security controls in a defense-in-depth strategy? (Choose THREE.)

Accepted Answer

Access control lists (ACLs). Access control lists (ACLs) (B) are correct because they are enforced on routers and layer-3 switches to filter packets by source/destination IP address, protocol, and port, directly controlling traffic at the network layer. Firewall (D) is correct because firewalls operate at layers 3 and 4 (and beyond), inspecting and permitting or denying packets based on IP addresses, ports, and connection state, which is a core network-layer defense-in-depth control. Intrusion Detection System (IDS) (E) is correct because network-based IDS sensors monitor layer-3 traffic for malicious patterns and anomalies, providing detection at the network layer. Antivirus (A) is not a network-layer control; it is a host-based endpoint control that scans files and processes at the application/host level. Data encryption at rest (C) is not a network-layer control; it protects stored data on disks or databases at the data/presentation layer rather than filtering network traffic.

Answer

Antivirus

Answer

Data encryption at rest

Question 14

Which THREE of the following are common indicators of a privilege escalation attack? (Choose three.)

Accepted Answer

Creation of new user accounts with administrative privileges. Option A is correct because attackers who achieve privilege escalation often create new local or domain accounts and add them to administrative groups (e.g., Administrators, Domain Admins, or sudoers) to establish persistent, high-privilege access. Option D is correct because privilege escalation commonly involves tampering with system files or registry keys—such as modifying HKLM\SYSTEM or service binaries—to weaken security controls, disable protections like UAC, or enable persistence. Option E is correct because processes running under SYSTEM, root, or other elevated contexts that are unexpected (e.g., cmd.exe spawned by a service, or unusual binaries with high integrity levels) are a classic sign that an attacker has escalated privileges. Option B is not specific to privilege escalation, since higher-than-normal network traffic more often indicates data exfiltration, scanning, or DoS activity rather than elevation itself. Option C is likewise a generic symptom that can result from malware, resource exhaustion, or many other causes, so it is not a reliable indicator of privilege escalation specifically.

Answer

Higher-than-normal network traffic

Answer

System performance degradation

Question 15

Which THREE of the following are commonly used metrics for measuring the effectiveness of a vulnerability management program?

Accepted Answer

Patch coverage percentage. Patch coverage percentage (A) is a core effectiveness metric because it quantifies the proportion of assets that have received required patches, directly reflecting how well the program closes known vulnerabilities. Mean time to remediate (C) measures the average elapsed time from vulnerability discovery to fix, showing how quickly the program reduces exposure window. Number of vulnerabilities per scan (D) tracks the volume of findings over successive scans, indicating whether the program is reducing the overall vulnerability backlog. Mean time to detect (B) is a detection/incident-response metric rather than a vulnerability management effectiveness measure, and number of security incidents (E) reflects overall security posture or incident response outcomes, not the performance of the vulnerability management process itself.

Answer

Mean time to detect (MTTD)

Answer

Number of security incidents

Question 16

During a security assessment, an organization wants to ensure that its web application is resistant to common attacks. Which THREE testing types should be included?

Accepted Answer

Input validation testing. Input validation testing (A) is correct because it verifies that the application properly sanitizes and validates user-supplied data, directly defending against injection attacks such as SQL injection, XSS, and command injection, which are among the most common web application attacks. Authentication testing (D) is correct because it assesses the login mechanisms, credential handling, password policies, and resistance to brute-force or credential-stuffing attacks, ensuring only legitimate users gain access. Session management testing (E) is correct because it examines how session tokens are generated, transmitted, and invalidated, protecting against session hijacking, fixation, and replay attacks that are common in web applications. Network segmentation testing (B) is not included because it focuses on infrastructure-level isolation between network zones rather than the web application's own attack surface. Load testing (C) is not included because it measures performance and scalability under traffic, not resistance to security attacks.

Answer

Network segmentation testing

Answer

Load testing

Question 17

Which TWO of the following are common techniques used in dynamic application security testing (DAST)?

Accepted Answer

Fuzzing. Fuzzing (A) is a core DAST technique because it sends malformed, unexpected, or random inputs to a running application to trigger crashes, exceptions, or unexpected behavior that reveal vulnerabilities such as buffer overflows or injection flaws. Spidering (C) is also fundamental to DAST, as crawlers map the application's reachable URLs, forms, and parameters so the scanner can exercise the live attack surface during testing. Static analysis (B) is incorrect because it examines source code or bytecode without executing the application, which is SAST rather than DAST. String search (D) is a code-inspection technique, not a dynamic runtime testing method. Code review (E) is a manual or tool-assisted examination of source code, making it a static, not dynamic, practice.

Answer

Static analysis

Answer

String search

Answer

Code review

Question 18

Which THREE are key components of a business continuity plan (BCP)?

Accepted Answer

Backup strategies. Backup strategies (B) are a core BCP component because they define how data and systems are preserved and restored so critical operations can resume after disruption. Recovery time objectives (C) are essential because they set the maximum acceptable downtime for each business function, driving recovery priorities and resource allocation. Emergency response procedures (E) belong in a BCP because they specify the immediate actions, roles, and communications needed to protect people and stabilize operations during an incident. Vendor risk assessments (A) are more closely tied to third-party risk management, and system hardening standards (D) are technical security controls, so neither is one of the three key BCP components in this scenario.

Answer

Vendor risk assessments

Answer

System hardening standards

Question 19

A security analyst is tasked with identifying vulnerabilities in a network without exploiting them. Which type of assessment is most appropriate?

Accepted Answer

Vulnerability assessment. A vulnerability assessment is designed to identify and enumerate vulnerabilities in a system or network without exploiting them. It typically uses automated scanners and manual techniques to produce a report of potential weaknesses. This matches the requirement of identifying vulnerabilities without exploitation.

Answer

Security audit

Answer

Penetration test

Answer

Security review

Question 20

A security analyst is investigating a potential covert timing channel in a system. Which of the following characteristics best describes this type of channel?

Accepted Answer

It modulates the time between events to encode information. A covert timing channel encodes information by varying the timing of observable events—such as packet inter-arrival times, CPU scheduling delays, or response latencies—rather than by writing to a shared storage location. The receiver measures these timing variations to reconstruct the hidden message. This is the defining characteristic that distinguishes timing channels from storage channels.

Answer

It requires high bandwidth to be effective

Answer

It uses storage locations not normally accessible to the sender and receiver

Answer

It uses encryption to hide the content of the communication