CISSP Practice Exam 53 — 20 Questions

Question 1

During a digital forensics investigation, which of the following data sources has the highest order of volatility?

Accepted Answer

CPU registers. CPU registers have the highest order of volatility because they hold the most transient data — values change with every instruction cycle and are lost when power is removed or the process is context-switched. In digital forensics, the order of volatility (RFC 3227) dictates that you collect the most volatile data first, starting with CPU registers and cache, then memory, then network state, then disk.

Answer

Remote logging server

Answer

Network packets in transit

Answer

Hard disk drive

Question 2

Which TWO of the following are best practices for securing containerized applications? (Select exactly 2.)

Accepted Answer

Running the container process as a non-root user. Option B is correct because running the container process as a non-root user (e.g., via the USER directive in a Dockerfile or runAsNonRoot in Kubernetes) enforces least privilege, so a container escape or compromised process cannot gain root-level access to the host or other resources. Option E is correct because minimal base images such as Alpine or scratch drastically reduce the attack surface by eliminating unnecessary packages, shells, and libraries that could contain exploitable vulnerabilities. Option A is wrong because mounting the host filesystem into a container breaks isolation and can expose sensitive host data to compromise. Option C is wrong because 'cleaning the certificate store' is not a recognized container security practice and would actually break TLS trust, not prevent MITM. Option D is wrong because exposing port 22 for SSH debugging in production increases the attack surface and is discouraged in favor of exec-based debugging or ephemeral containers.

Answer

Mounting the host filesystem to persist logs

Answer

Cleaning the certificate store to prevent MITM

Answer

Exposing port 22 for SSH debugging in production

Question 3

During a forensic investigation, which TWO of the following are essential steps to maintain chain of custody?

Accepted Answer

Labeling evidence with date, time, and collector's name. Option C is correct because labeling evidence with the date, time, and collector's name creates an auditable record of when and by whom the evidence was first obtained, which is a foundational element of chain of custody. Option E is correct because documenting every person who handled the evidence establishes an unbroken, traceable custody trail that shows who had control of the evidence at all times and prevents tampering claims. Options A, B, and D do not belong: storing evidence on a shared network drive (A) compromises integrity and access control rather than preserving custody, encrypting the evidence file to prevent viewing (B) is a confidentiality measure that can hinder forensic examination and is not a chain-of-custody step, and although hashing (D) is essential for proving integrity, it is an evidence-integrity technique rather than a chain-of-custody documentation step.

Answer

Storing evidence on a shared network drive

Answer

Encrypting the evidence file to prevent viewing

Answer

Performing a hash of the evidence immediately

Question 4

A security analyst is reviewing a web application that handles financial transactions. Which TWO of the following are effective controls against Cross-Site Request Forgery (CSRF)?

Accepted Answer

Setting cookies with the SameSite attribute to Strict. Option A is correct because setting cookies with the SameSite attribute to Strict prevents the browser from sending the session cookie on cross-site requests, which blocks the CSRF attack vector since the attacker's forged request lacks the victim's authentication cookie. Option B is correct because anti-CSRF tokens (synchronizer tokens) are unique, unpredictable values embedded in forms and validated server-side, ensuring that a request originates from the legitimate application page rather than a forged cross-site request. Option C is not correct because HTTPS only encrypts data in transit and does not prevent a browser from automatically attaching credentials to a forged request. Option D is not correct because strong password policies address credential guessing and brute-force attacks, not the abuse of an already-authenticated session. Option E is not correct because input validation mitigates injection flaws like XSS or SQLi, but does not stop a forged request that contains valid, expected input.

Answer

Using HTTPS for all pages

Answer

Enforcing strong password policies

Answer

Implementing input validation on all user inputs

Question 5

A security architect is evaluating access control models for a healthcare system where users have specific roles (e.g., doctor, nurse, admin) and permissions are assigned based on those roles. However, the architect also wants to incorporate attributes such as time of day, patient consent status, and device type. Which TWO models should be combined to meet these requirements?

Accepted Answer

ABAC. Option D (RBAC) is correct because the scenario explicitly states that users have specific roles such as doctor, nurse, and admin, and permissions are assigned based on those roles — this is the defining characteristic of Role-Based Access Control, where access rights are grouped into roles and users are assigned to roles. Option C (ABAC) is correct because the architect additionally wants to enforce dynamic, fine-grained conditions such as time of day, patient consent status, and device type, which are attributes evaluated at request time — exactly what Attribute-Based Access Control provides through policies combining subject, resource, action, and environmental attributes. Combining RBAC and ABAC (often called a hybrid or role-and-attribute model) lets roles provide coarse-grained baseline permissions while attributes refine decisions for context-sensitive healthcare access. Option A (Clark-Wilson) is not selected because it is an integrity model focused on well-formed transactions and separation of duties, not on role- or attribute-driven access decisions. Option B (MAC) is not selected because it relies on mandatory labels and clearances rather than the role and contextual attribute inputs described. Option E (DAC) is not selected because it grants resource owners discretionary control via ACLs, which does not satisfy the role-based and attribute-based requirements stated.

Answer

Clark-Wilson

Answer

MAC

Answer

DAC

Question 6

In the context of business continuity planning, which THREE of the following are typically identified during a business impact analysis (BIA)? (Select THREE.)

Accepted Answer

Critical business processes. A BIA identifies critical business processes (A) because it must determine which functions are essential to the organization's survival and prioritize them for recovery. It also establishes the maximum tolerable downtime (B), the longest time a process can be unavailable before causing unacceptable harm, which drives recovery strategies. The recovery point objective (D) is likewise derived during the BIA, defining the maximum acceptable data loss measured in time and setting backup frequency requirements. Preferred vendor contracts (C) are procurement/legal artifacts addressed during recovery planning or supply-chain review, not core BIA outputs. Employee performance metrics (E) belong to HR performance management and are unrelated to continuity impact analysis.

Answer

Preferred vendor contracts

Answer

Employee performance metrics

Question 7

Which TWO of the following are characteristics of a SOC 2 Type II report?

Accepted Answer

Covers the design and operating effectiveness of controls over a period of time. Option A is correct because a SOC 2 Type II report specifically tests both the design and the operating effectiveness of controls throughout a defined review period (typically 3–12 months), unlike a Type I report which only assesses design at a point in time. Option C is correct because SOC 2 engagements are structured around the AICPA Trust Services Criteria, which include security (required) plus availability, processing integrity, confidentiality, and privacy as optional categories. Option B is incorrect because SOC 2 reports are restricted-use reports distributed under NDA to management, customers, and auditors—not public documents (that role belongs to SOC 3). Option D is incorrect because financial reporting controls are the focus of SOC 1 (SSAE 18/ISAE 3402), not SOC 2. Option E is incorrect because point-in-time evaluation describes a SOC 2 Type I report, whereas Type II covers a period.

Answer

Is a public summary report available to anyone

Answer

Focuses only on financial reporting controls

Answer

Evaluates controls at a single point in time

Question 8

Which TWO of the following are examples of security metrics that can be used as key performance indicators (KPIs)?

Accepted Answer

Mean time to remediate critical vulnerabilities. Option A (Mean time to remediate critical vulnerabilities) is correct because it is a quantifiable security metric that measures how quickly the organization responds to and fixes critical vulnerabilities, directly reflecting the effectiveness of its vulnerability management process and serving as a meaningful KPI for security operations. Option D (Patch compliance percentage) is correct because it measures the proportion of systems that have required patches applied within policy timeframes, providing a measurable indicator of the organization's exposure to known exploits and the health of its patch management program. In contrast, option B (Number of servers in the data center) is an inventory or capacity figure that does not measure security performance or risk reduction. Option C (Total IT budget) is a financial metric reflecting spending, not security effectiveness. Option E (Number of employees in the security department) is a staffing or headcount measure that indicates resource allocation but does not itself quantify security posture or outcomes.

Answer

Number of servers in the data center

Answer

Total IT budget

Answer

Number of employees in the security department

Question 9

A SOC manager is designing a tiered incident response team. Which THREE of the following are standard roles in an incident response team according to industry best practices?

Accepted Answer

Forensic Investigator. The Forensic Investigator (A) is a standard IR team role responsible for collecting, preserving, and analyzing digital evidence using forensically sound methods such as write blockers and chain-of-custody documentation. The Incident Response Manager (C) is standard because this role coordinates the overall response, triages incidents, allocates resources, and serves as the decision-making authority during an incident. The Communications Lead (E) is also standard, handling internal and external messaging, stakeholder updates, and coordination with legal, PR, and regulatory bodies to maintain accurate and timely communications. Human Resources Representative (B) and Chief Financial Officer (D) are not standard core IR team roles; while HR or finance may be consulted for employee-related or cost-impacting incidents, they are not part of the recognized baseline incident response team structure.

Answer

Human Resources Representative

Answer

Chief Financial Officer

Question 10

A security architect is designing a network segmentation strategy for a financial institution. Which TWO techniques are best suited for implementing micro-segmentation in a data center environment? (Select two.)

Accepted Answer

Software-Defined Networking (SDN). Software-Defined Networking (SDN) is correct because it centralizes control-plane policy and lets the architect program granular, workload-level segmentation rules (e.g., via OpenFlow or APIs) that can be applied dynamically across the data center fabric, which is essential for micro-segmentation. Hypervisor-based firewalls are correct because they enforce Layer 2–4 (and often Layer 7) policy directly at the virtual NIC of each VM, enabling per-workload isolation and east-west traffic control without relying on physical topology. VLANs are not the best fit because they provide coarse Layer 2 broadcast-domain separation (limited to ~4094 IDs) rather than fine-grained per-workload policy. Physical network firewalls are too coarse and chokepoint-oriented for micro-segmentation, as they cannot practically enforce policy between every workload pair. A DMZ (screened subnet) is a perimeter segmentation pattern for exposing services to untrusted networks, not an east-west micro-segmentation technique inside the data center.

Answer

VLANs (Virtual Local Area Networks)

Answer

Physical network firewalls

Answer

DMZ (screened subnet)

Question 11

An incident responder is analyzing a network compromise that involved ICMP attacks. Which THREE types of ICMP attacks could have been used to disrupt network operations? (Select three.)

Accepted Answer

Smurf attack. The Smurf attack (A) is correct because it spoofs the victim's source IP and sends ICMP echo requests to a network's broadcast address, causing every host to reply to the victim and amplifying traffic to disrupt operations. The ICMP redirect attack (B) is correct because forged ICMP Type 5 redirect messages can alter a host's routing table, sending traffic through an attacker-controlled path and disrupting or intercepting network communications. The Ping of Death (E) is correct because it sends malformed or oversized ICMP echo request packets (historically exceeding the 65,535-byte IP packet limit) that can crash or destabilize vulnerable systems. ARP poisoning (C) is not an ICMP attack; it manipulates ARP cache entries at Layer 2. SYN flood (D) is a TCP-based attack abusing the three-way handshake, not ICMP.

Answer

ARP poisoning

Answer

SYN flood

Question 12

An organization is reviewing its log management practices. Which THREE of the following are key considerations for effective log review?

Accepted Answer

Log retention policies that comply with legal and regulatory requirements. Option B is correct because log retention policies must satisfy legal, regulatory, and contractual requirements (e.g., GDPR, HIPAA, PCI DSS, SOX), ensuring logs are kept for the mandated period and disposed of securely afterward. Option D is correct because effective log review requires regularly scheduled reviews, not just reactive ones, so that anomalies, trends, and indicators of compromise can be detected proactively before they escalate. Option E is correct because centralized log management (e.g., via a SIEM or syslog server) aggregates logs from disparate sources, enabling correlation across systems and time synchronization for accurate event reconstruction. Option A is not appropriate because reviewing logs only after an incident is reactive and misses ongoing threats, while option C is wrong because storing logs in plaintext without access controls exposes sensitive data and violates integrity and confidentiality requirements.

Answer

Reviewing logs only after a security incident

Answer

Storing logs in plaintext without access controls

Question 13

A security administrator is evaluating secure file transfer protocols. Which THREE of the following protocols provide encryption for data in transit? (Select THREE.)

Accepted Answer

SFTP. SFTP (B) is correct because it runs over SSH (typically TCP port 22) and encrypts all data and commands in transit. SCP (D) is correct because it also operates over SSH, providing encrypted file transfer using the SSH transport layer. FTPS (E) is correct because it wraps FTP in TLS/SSL, encrypting the control and data channels. FTP (A) is not marked correct because it transmits credentials and data in cleartext, and TFTP (C) is not marked correct because it uses UDP with no encryption or authentication.

Answer

FTP

Answer

TFTP

Question 14

A company is migrating from WPA2 to WPA3 to improve wireless security. Which THREE of the following are features of WPA3 compared to WPA2?

Accepted Answer

Protected Management Frames (PMF). Option B is correct because WPA3 mandates Protected Management Frames (PMF, defined in 802.11w), which cryptographically protect management frames such as deauthentication and disassociation, preventing forgery and denial-of-service attacks that were possible under WPA2. Option C is correct because WPA3 replaces the WPA2 Pre-Shared Key (PSK) four-way handshake with Simultaneous Authentication of Equals (SAE), a Dragonfly-based password-authenticated key exchange that resists offline dictionary attacks. Option D is correct because SAE provides forward secrecy, meaning a compromised session key or password cannot be used to decrypt previously captured traffic, a property WPA2-PSK lacks. Option A is not correct as stated because WPA3's backward-compatible WPA3-Personal transition mode allows WPA2 clients to connect only by operating in a mixed mode that can be downgraded, so it does not preserve full WPA3 security without reduction. Option E is not correct because WPA3 does not mandate TKIP; TKIP is a deprecated WPA cipher, and WPA3 requires CCMP-128 (and optionally GCMP-256) with AES.

Answer

Backward compatibility with WPA2 clients without security reduction

Answer

Mandatory use of TKIP for encryption

Question 15

A security engineer is hardening a web server before deploying a new application. Which TWO of the following are examples of security misconfiguration vulnerabilities that should be addressed?

Accepted Answer

Default administrator credentials remain unchanged. Option B is correct because leaving default administrator credentials unchanged is a classic security misconfiguration: the system is deployed with vendor-supplied accounts (e.g., admin/admin) that attackers can trivially guess, and hardening requires changing or disabling them. Option C is correct because verbose error messages that expose stack traces, framework versions, or file paths are a misconfiguration of error handling and debug settings (e.g., ASP.NET customErrors=Off or Django DEBUG=True), leaking information useful for further attacks. Option A does not belong because using an outdated JavaScript library with known CVEs is a vulnerable component/software supply chain issue, not a configuration error. Option D does not belong because missing CSRF tokens is a code-level application flaw (broken access/request forgery protection), not a misconfiguration. Option E does not belong because a weak password policy is an authentication/identity policy weakness rather than a system or server misconfiguration.

Answer

Use of an outdated version of a JavaScript library with known vulnerabilities

Answer

Lack of CSRF tokens in forms

Answer

Weak password policy allowing short passwords

Question 16

A company is selecting a disaster recovery strategy for a mission-critical application. Which TWO of the following strategies provide the shortest recovery time objective (RTO)?

Accepted Answer

Hot site. A hot site (A) is correct because it is a fully operational duplicate of the primary data center with hardware, software, and near-real-time replicated data already in place, so failover can occur in minutes or even seconds, yielding the shortest RTO. Cloud DR with pre-configured instances (D) is also correct because pre-provisioned, ready-to-launch compute instances and replicated data in the cloud allow rapid failover, typically within minutes, matching the low RTO requirement. By contrast, a reciprocal agreement (B) depends on another organization's spare capacity that may not be available or compatible during a widespread disaster, and a warm site (C) requires some configuration and data restoration before going live, while a cold site (E) provides only basic facilities with no pre-installed systems or data, resulting in the longest RTO of all options.

Answer

Reciprocal agreement

Answer

Warm site

Answer

Cold site

Question 17

During a code review, a developer identifies that the application uses a custom encryption algorithm for storing sensitive data. Which THREE of the following are secure cryptographic practices that should be recommended instead?

Accepted Answer

Using industry-standard algorithms (e.g., AES-256). Option A is correct because industry-standard, peer-reviewed algorithms such as AES-256 have undergone extensive cryptanalysis and are the accepted baseline for symmetric encryption, unlike custom algorithms that typically contain undiscovered weaknesses. Option B is correct because even a strong algorithm like AES is useless if keys are hardcoded, reused, or stored insecurely; proper key management (secure generation, rotation, storage in HSMs/KMS, and separation of duties) is essential to protect sensitive data. Option C is correct because authenticated encryption such as AES-GCM provides both confidentiality and integrity/authenticity, preventing tampering and padding-oracle style attacks that unauthenticated modes like AES-CBC are vulnerable to. Option D is not recommended because MD5 is a broken hash (collisions demonstrated) and hashing is not encryption—it is unsuitable for protecting data that must be retrieved. Option E is not recommended because a static IV causes identical plaintexts to produce identical ciphertexts, leaking patterns and enabling replay or chosen-plaintext attacks; IVs must be unique/random per encryption operation.

Answer

Hashing the data with MD5 for faster performance

Answer

Using a static IV for simplicity

Question 18

Which TWO of the following are best practices for conducting a penetration test?

Accepted Answer

Define scope and rules of engagement. Option A (Define scope and rules of engagement) is correct because a penetration test must have a clearly documented scope specifying in-scope IP ranges, domains, applications, and testing windows, plus rules of engagement covering allowed techniques, escalation contacts, and handling of sensitive data, so testers avoid unintended impact and legal exposure. Option B (Obtain written authorization from the organization) is correct because explicit, signed permission from an authorized representative of the target organization is the legal and ethical prerequisite for any penetration testing activity; without it, testing can constitute unauthorized access under laws such as the CFAA. Option C is wrong because installing backdoors creates persistent unauthorized access and is not a legitimate testing practice. Option D is wrong because law enforcement is not normally notified in advance of a penetration test; authorization comes from the asset owner. Option E is wrong because relying only on automated tools misses logic flaws and complex vulnerabilities that require manual testing and human analysis.

Answer

Install backdoors for future access

Answer

Notify law enforcement before testing

Answer

Use only automated tools

Question 19

Which TWO of the following are secure coding practices to prevent buffer overflow vulnerabilities?

Accepted Answer

Input validation.. Input validation (B) is a core secure coding practice because it ensures that data entering a program is checked for type, length, format, and range before being processed, so oversized or malformed input cannot be written past the boundaries of a fixed-size buffer. Use of compilers with stack protection (E) is also correct because mechanisms such as stack canaries (e.g., -fstack-protector in GCC/Clang) detect and abort execution when a return address or saved frame pointer has been overwritten, mitigating classic stack-based buffer overflows. The other options do not belong: code obfuscation (A) only makes code harder to read and provides no memory-safety benefit, dynamic memory allocation without bounds (C) actually increases overflow risk by failing to limit how much data is written, and unsafe functions like strcpy (D) perform no length checking and are a well-known cause of buffer overflows.

Answer

Code obfuscation.

Answer

Dynamic memory allocation without bounds.

Answer

Use of unsafe functions like strcpy.

Question 20

An access control policy grants Read and Write permissions on a specific target object and includes a network source condition restricting access to a trusted IP range. Which TWO statements about this policy are true?

Accepted Answer

The policy implicitly denies access to subjects outside the specified IP range.. Option B is correct because an access control policy that includes a network source condition restricting access to a trusted IP range will not match requests originating from outside that range, so those subjects are implicitly denied access under the default-deny model of access control. Option E is correct because the policy explicitly grants Read and Write permissions on the specific target object, meaning read and write operations on that object are allowed for subjects that also satisfy the network source condition. Option A is incorrect because Read and Write permissions do not constitute full administrative access, which would require broader privileges such as ownership, permission management, or delete rights. Option C is incorrect because the policy only grants Read and Write, not all possible actions on the object. Option D is incorrect because the policy targets a specific object rather than all resources in the organization.

Answer

The policy grants full administrative access to the target object.

Answer

The policy allows all actions on the target object.

Answer

The policy applies to all resources in the organization.