CISSP Practice Exam 52 — 20 Questions

Question 1

Which type of firewall can inspect the contents of application-layer traffic, such as HTTP requests, and block malicious payloads?

Accepted Answer

Application proxy firewall. An application proxy firewall (also known as an application-level gateway) operates at Layer 7 of the OSI model and can fully inspect the content of application-layer protocols such as HTTP, FTP, and SMTP. By terminating the client connection and establishing a separate connection to the server, it can parse and validate the payload—for example, examining HTTP request bodies for SQL injection strings or malicious scripts—and block them before they reach the internal server. This deep inspection capability distinguishes it from lower-layer firewalls that only examine headers or connection states.

Answer

Packet filter firewall

Answer

Circuit-level gateway

Answer

Stateful inspection firewall

Question 2

An organization with 500 employees operates a hybrid infrastructure with on-premises Active Directory and cloud-based services (Office 365, Azure). The security team receives an alert from the SIEM showing a high number of failed login attempts for a service account named 'svc_backup' from an external IP address. The account has delegated permissions to back up all domain controllers. The attempts are ongoing and fall below the lockout threshold to avoid detection. The team suspects a targeted password spraying attack. The helpdesk reports no recent password changes for this account. The incident response plan requires containment within 15 minutes. The cloud services are integrated with AD via Azure AD Connect. Which of the following actions BEST contains the attack while minimizing operational impact?

Accepted Answer

Disable the svc_backup account in Active Directory and notify the backup team to use an alternate account.. Disabling the compromised service account in Active Directory immediately stops the ongoing password spraying attack, preventing further unauthorized access attempts. This action contains the threat within the 15-minute containment window while minimizing operational impact, as the backup team can switch to an alternate account without disrupting critical backup operations. Disabling the account is faster and more reliable than changing the password, which might not propagate immediately to all domain controllers and cloud services via Azure AD Connect.

Answer

Block the external IP address at the firewall.

Answer

Configure Azure AD Conditional Access to require MFA for the account.

Answer

Immediately change the password of the svc_backup account.

Question 3

A company wants to secure its wireless network. Which approach provides the strongest authentication and encryption?

Accepted Answer

WPA2-Enterprise with RADIUS. WPA2-Enterprise with RADIUS provides the strongest authentication and encryption for wireless networks because it uses 802.1X/EAP for per-user authentication against a central RADIUS server, and AES-CCMP for encryption. This eliminates the shared passphrase vulnerability of PSK modes and supports dynamic, unique encryption keys per session, making it resistant to offline dictionary attacks and key reuse.

Answer

WEP

Answer

Disabling SSID broadcast

Answer

WPA2-PSK with a strong passphrase

Question 4

A company uses WPA2-Enterprise with EAP-TLS for wireless access. An employee reports that a new laptop cannot connect to the wireless network, while older laptops work fine. The employee has installed the correct client certificate. What is the most likely cause?

Accepted Answer

The RADIUS server's certificate is not trusted by the new laptop.. In WPA2-Enterprise with EAP-TLS, mutual authentication requires the client to validate the RADIUS server's certificate. If the new laptop does not trust the RADIUS server's certificate (e.g., its CA root certificate is missing or expired), the EAP-TLS handshake will fail, preventing connection. Older laptops likely have the necessary root CA installed, while the new laptop does not.

Answer

The wireless network uses WPA2-PSK instead of WPA2-Enterprise.

Answer

The client certificate is not correctly associated with the user account.

Answer

The laptop does not support MSCHAPv2.

Question 5

A company is decommissioning a data center and needs to dispose of hard drives that contained highly confidential financial data. Which of the following methods provides the HIGHEST assurance that data cannot be recovered?

Accepted Answer

Shredding the drives into small pieces. Shredding the drives into small pieces physically destroys the platters, making data recovery impossible regardless of the storage technology (e.g., HDD vs. SSD). This method provides the highest assurance because it eliminates any possibility of reading residual magnetic or solid-state data, even with advanced forensic tools like electron microscopy.

Answer

Overwriting the drives with multiple passes of random data

Answer

Degaussing the drives

Answer

Overwriting the drives with a single pass of zeros

Question 6

A security analyst is evaluating the impact of upgrading web servers from TLS 1.2 to TLS 1.3. Which advantage does TLS 1.3 offer in terms of handshake efficiency?

Accepted Answer

Fewer round trips during handshake. TLS 1.3 reduces the handshake from two round trips (2-RTT) in TLS 1.2 to one round trip (1-RTT) for a full handshake, and offers 0-RTT for resumed sessions. This is achieved by combining the ClientHello and ServerHello with key exchange parameters, eliminating the separate round trip for the ServerHello and Certificate exchange. The result is lower latency and faster connection establishment, which is critical for performance-sensitive applications.

Answer

It supports the same cipher suites as TLS 1.2

Answer

More round trips during handshake

Answer

It eliminates the need for asymmetric encryption

Question 7

A security architect is designing a cryptographic system for a high-security environment where data must be encrypted both at rest and in transit, with granular access control. The system must be efficient for large volumes of data. Which approach is most appropriate?

Accepted Answer

Use asymmetric encryption for key exchange and symmetric encryption for data (hybrid cryptosystem).. A hybrid cryptosystem combines the efficiency of symmetric encryption (e.g., AES-256) for bulk data encryption with the secure key distribution of asymmetric encryption (e.g., RSA or ECDH). This approach ensures strong confidentiality for large volumes of data at rest and in transit, while enabling granular access control through per-user or per-session key management.

Answer

Use symmetric encryption (e.g., AES-256) for all data and share keys out-of-band.

Answer

Use only asymmetric encryption (e.g., RSA) for all data.

Answer

Use hash functions (e.g., SHA-256) to ensure confidentiality.

Question 8

A company is deploying a new application that processes personally identifiable information (PII) in a hybrid cloud environment. The security architect needs to ensure that encryption keys are never exposed to the cloud provider. Which solution should be recommended?

Accepted Answer

Client-side encryption with keys stored on-premises. Client-side encryption ensures that encryption keys are generated and managed on-premises, never transmitted to the cloud provider. This directly meets the requirement that keys are never exposed to the cloud provider, as all cryptographic operations occur before data leaves the customer's controlled environment.

Answer

Envelope encryption with a key management service

Answer

Server-side encryption with cloud provider managed keys

Answer

Server-side encryption with customer-provided keys

Question 9

A security team is implementing a zero trust architecture. Which component is essential to enforce access decisions based on user identity, device posture, and context before granting access to resources?

Accepted Answer

Software-defined perimeter (SDP). A software-defined perimeter (SDP) is the essential component for enforcing access decisions based on user identity, device posture, and context in a zero trust architecture. SDP creates a dynamic, encrypted micro-perimeter around each resource, requiring authentication and authorization before any connection is established, effectively hiding the resource from unauthorized users. This aligns with the zero trust principle of 'never trust, always verify' by evaluating identity, device health, and contextual factors (e.g., location, time) before granting access.

Answer

Virtual private network (VPN)

Answer

Network Access Control (NAC)

Answer

Next-generation firewall (NGFW)

Question 10

An organization uses a role-based access control (RBAC) model. After an audit, it was discovered that users have accumulated excessive permissions due to role proliferation. The security architect proposes migrating to an attribute-based access control (ABAC) model. Which challenge is MOST likely to be encountered during this migration?

Accepted Answer

Increased complexity in defining and managing attributes.. Migrating from RBAC to ABAC requires defining a comprehensive set of attributes (subject, resource, environment) and the policies that combine them, which is inherently more complex than managing static role assignments. Role proliferation in RBAC often results from an attempt to mimic attribute-based decisions, but ABAC shifts the complexity from role engineering to attribute governance and policy logic, making attribute definition and management the primary challenge.

Answer

Difficulty in assigning roles to users.

Answer

Reduced performance due to policy evaluation overhead.

Answer

Lack of support for ABAC in legacy applications.

Question 11

During a penetration test, the tester gains access to a server and finds sensitive customer data. What should the tester do next?

Accepted Answer

Report the finding immediately and secure the data. The tester's primary responsibility is to protect sensitive data and minimize risk. Upon discovering PII or other regulated data, the tester must immediately report the finding to the client and secure the data (e.g., by isolating the server or encrypting the data in place) to prevent unauthorized access or exposure. This aligns with the ethical hacking code of conduct and the CISSP principle of 'do no harm'.

Answer

Exfiltrate the data to demonstrate the risk

Answer

Delete the data to prevent exposure

Answer

Continue testing to find more vulnerabilities

Question 12

A company is designing a network segmentation strategy to isolate a public-facing web server from the internal corporate network. Which of the following is the most appropriate architecture?

Accepted Answer

DMZ (screened subnet). A DMZ (screened subnet) is the most appropriate architecture because it places the public-facing web server in a separate, isolated network segment that sits between the internal corporate network and the untrusted internet. Traffic from the internet is allowed only to the DMZ (typically via stateful firewall rules permitting HTTP/HTTPS on TCP ports 80/443), and traffic from the DMZ to the internal network is strictly controlled or proxied, preventing direct lateral movement. This aligns with the principle of defense in depth and is a standard CISSP-recommended design for securing publicly accessible services.

Answer

Micro-segmentation using SDN

Answer

VLAN with no firewall

Answer

Direct connection to internet without segmentation

Question 13

During a security audit, it is discovered that the database server is also accepting connections from the web server. Which of the following is the most likely misconfiguration?

Accepted Answer

The network segmentation is not enforcing strict controls. The database server accepting connections from the web server indicates a lack of proper network segmentation. In a secure architecture, the web server should be in a DMZ and the database server in a private network segment, with strict access controls enforced by a firewall or router ACLs. The misconfiguration is that the network segmentation is not enforcing strict controls, allowing traffic that should be blocked.

Answer

The application server is not properly authenticated

Answer

The TLS configuration is incorrect

Answer

The firewall on the database server allows all traffic from the DMZ

Question 14

An organization is implementing federated identity to allow partners to access its web application. The solution must support single logout and attribute exchange. Which protocol is most appropriate?

Accepted Answer

SAML 2.0. SAML 2.0 is the most appropriate protocol because it natively supports both single logout (SLO) and attribute exchange as core features. It uses XML-based assertions to transfer identity and attribute data between an identity provider (IdP) and a service provider (SP), and its SLO mechanism ensures that when a user logs out from one application, all sessions across participating services are terminated simultaneously.

Answer

OpenID Connect

Answer

LDAP

Answer

OAuth 2.0

Question 15

During a penetration test, a security analyst discovers that a web application allows an attacker to bypass authorization and view another user's private messages by simply changing a numeric ID in the URL. Which vulnerability is being exploited?

Accepted Answer

Insecure direct object reference (IDOR). B is correct because the vulnerability allows an attacker to access another user's private messages by simply changing a numeric ID in the URL, which is a classic example of Insecure Direct Object Reference (IDOR). This occurs when the application exposes a direct reference to an internal object (e.g., a database key) without proper access control checks, enabling unauthorized access to resources belonging to other users.

Answer

Broken authentication

Answer

Server-side request forgery (SSRF)

Answer

Security misconfiguration

Question 16

A small business wants to implement a security policy that balances protection with usability. Which of the following is the MOST important factor when developing the policy?

Accepted Answer

Aligning the policy with business objectives and risk appetite.. A security policy must be aligned with the organization's business objectives and risk appetite to ensure it supports operations without imposing unnecessary restrictions. For a small business, this balance is critical—overly strict controls can hinder productivity, while weak controls increase risk. The policy should reflect the specific threats and tolerances of the business, not generic templates or compliance-only checklists.

Answer

Adopting a template from a similar organization to save time.

Answer

Ensuring the policy is enforceable with technical controls.

Answer

Basing the policy solely on regulatory compliance requirements.

Question 17

Which type of covert channel uses the timing of events or operations to transmit information?

Accepted Answer

Timing channel. Timing channels manipulate the timing of events to encode data, while storage channels use shared resources.

Answer

Emanations channel

Answer

Side channel

Answer

Storage channel

Question 18

Which TWO of the following are best practices for securing containerized applications? (Select exactly 2.)

Accepted Answer

Running the container process as a non-root user. Running the container process as a non-root user is a fundamental security best practice because containers share the host kernel; if an attacker compromises a container running as root, they may escape to the host with root privileges. By using a non-root user (e.g., via the USER directive in a Dockerfile), you enforce the principle of least privilege and reduce the attack surface significantly.

Answer

Mounting the host filesystem to persist logs

Answer

Cleaning the certificate store to prevent MITM

Answer

Exposing port 22 for SSH debugging in production

Question 19

A financial institution is required to perform regular penetration tests on its online banking platform. The testing must be as realistic as possible while minimizing risk to production data. Which of the following approaches BEST meets these requirements?

Accepted Answer

Build a replica of the production environment and test against it with realistic attack scenarios.. Building a replica (staging) environment allows the penetration test to simulate realistic attack scenarios without any risk to production data or system availability. This approach ensures the test can include destructive or disruptive techniques (e.g., SQL injection, privilege escalation) that would be unsafe on a live system, while still accurately reflecting the production architecture and configurations.

Answer

Conduct the test on the production environment using anonymized production data.

Answer

Use an automated vulnerability scanner on the production environment.

Answer

Perform the test during off-peak hours on the production system with read-only access.

Question 20

A small business owner stores customer payment card information (PCI) in a legacy database that is not compliant with PCI DSS. The business is migrating to a new cloud-based point-of-sale (POS) system that uses tokenization. The owner wants to ensure that the legacy data is handled securely during the transition. Which of the following is the BEST approach?

Accepted Answer

Tokenize the payment data in the legacy database, then securely purge the original cardholder data and verify the purge. Tokenization replaces sensitive cardholder data with a non-sensitive token, rendering the original data useless for attackers. After tokenizing the legacy database, securely purging the original cardholder data (e.g., using NIST SP 800-88 compliant methods like overwriting or degaussing) and verifying the purge ensures compliance with PCI DSS requirement 3.1 (minimize stored cardholder data) and eliminates the risk of data breach from the legacy system.

Answer

Migrate the legacy data into the new POS system and have the tokenization service replace it

Answer

Encrypt the legacy database using AES-256 and store the encryption key on a separate server

Answer

Archive the legacy database to a tape backup and store it in a secure offsite vault