CISSP Practice Exam 54 — 20 Questions

Question 1

A security analyst is reviewing logs from multiple systems in a centralized log management platform. Which TWO of the following are primary benefits of centralized log management?

Accepted Answer

Simplifies compliance with log retention requirements. Option A is correct because a centralized log management platform applies uniform retention settings and storage policies across all ingested sources, which directly simplifies demonstrating compliance with regulatory log retention requirements (e.g., PCI DSS 10.7, HIPAA, SOX). Option B is correct because aggregating logs from multiple systems into one platform allows the SIEM/log manager to correlate events across hosts, applications, and network devices, enabling detection of multi-stage or distributed attacks that would be invisible in isolated logs. Option C is wrong because centralization does not remove the need for retention policies; it actually requires well-defined retention rules to manage storage and compliance. Option D is wrong because centralization aggregates and stores logs, typically increasing rather than reducing total log volume, though it may improve analysis efficiency. Option E is wrong because log management platforms collect and analyze logs; they do not automatically patch vulnerabilities, which is the role of patch management or vulnerability management tools.

Answer

Eliminates the need for log retention policies

Answer

Reduces the volume of logs generated

Answer

Automatically patches vulnerabilities

Question 2

An organization is developing a new application that collects and processes European customers' personal data. To comply with the privacy by design principles under GDPR, which THREE measures should be implemented? (Select THREE.)

Accepted Answer

Retain the data only as long as necessary to fulfill the purpose (storage limitation). Option A is correct because GDPR's storage limitation principle (Article 5(1)(e)) requires that personal data be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the data are processed, making retention limits a core privacy-by-design measure. Option C is correct because the purpose limitation principle (Article 5(1)(b)) requires data to be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes, so restricting use to the original purpose is essential. Option E is correct because the data minimization principle (Article 5(1)(c)) requires processing to be adequate, relevant, and limited to what is necessary in relation to the purposes, so collecting only the minimum data needed directly implements privacy by design. Option B is not marked correct because, while encryption is a valuable security safeguard under Article 32, it is not one of the core privacy-by-design data principles tested here and GDPR does not mandate encryption of all personal data in every case. Option D is not marked correct because explicit consent is only one of several lawful bases under Article 6 and is not always required, so it is not a universal privacy-by-design measure.

Answer

Encrypt all personal data at rest and in transit

Answer

Obtain explicit consent from users before data collection

Question 3

Which TWO of the following are lawful bases for processing personal data under the GDPR? (Select two)

Accepted Answer

Consent of the data subject. Option C (Consent of the data subject) is correct because Article 6(1)(a) of the GDPR expressly lists the data subject's consent as a lawful basis for processing personal data, provided it is freely given, specific, informed, and unambiguous. Option D (Legitimate interests of the controller) is correct because Article 6(1)(f) recognizes the legitimate interests pursued by the controller or a third party as a lawful basis, subject to a balancing test against the data subject's rights and freedoms. Options A (employment status) and B (nationality) are not lawful bases; they are merely categories of personal data, and nationality can even constitute special category data under Article 9. Option E (profit maximization) is not a lawful basis; it is a business objective that must still be grounded in one of the Article 6(1) legal grounds, such as legitimate interests, to be lawful.

Answer

Data subject's employment status

Answer

Data subject's nationality

Answer

Profit maximization

Question 4

A security team is planning to integrate security testing into the software development lifecycle. They want to identify vulnerabilities early and often. Which TWO of the following testing methods should be implemented during the development phase (before deployment) to catch code-level vulnerabilities?

Accepted Answer

Interactive Application Security Testing (IAST). Option A, Interactive Application Security Testing (IAST), is correct because it instruments the running application (often via agents during automated tests) to analyze code execution in real time, detecting code-level vulnerabilities such as injection flaws early in the development phase before deployment. Option D, Static Application Security Testing (SAST), is correct because it performs white-box analysis of source code, bytecode, or binaries without executing the program, allowing developers to find flaws like SQL injection or hardcoded secrets directly in the code during development. Penetration testing (B) is typically conducted against a deployed, running system and simulates real-world attacks, so it occurs later than the development phase. Vulnerability scanning (C) identifies known weaknesses in deployed hosts, services, and configurations rather than code-level defects during development. Dynamic Application Security Testing (E) tests a running application from the outside (black-box) and is generally performed after deployment or in a staging environment, not as an early code-level check.

Answer

Penetration testing

Answer

Vulnerability scanning

Answer

Dynamic Application Security Testing (DAST)

Question 5

A company is evaluating disaster recovery strategies and wants to minimize both RTO and RPO. Which THREE options provide the best combination of low RTO and low RPO? (Select THREE)

Accepted Answer

Cloud DR with replication. Option B (Cloud DR with replication) is correct because continuously replicating workloads and data to a cloud region keeps a near-current copy of the environment, allowing rapid failover for a low RTO and minimal data loss for a low RPO. Option C (Synchronous replication to a secondary site) is correct because synchronous replication only acknowledges writes once they are committed at both sites, giving an RPO of essentially zero, and the mirrored secondary site can be activated quickly for a low RTO. Option D (Hot site) is correct because a hot site is a fully operational duplicate facility with current data and ready-to-run systems, enabling failover in minutes or hours (low RTO) with little to no data loss (low RPO). Option A (Reciprocal agreement) does not belong because it relies on another organization's idle capacity that may not be available or current during a disaster, yielding high RTO and RPO. Option E (Cold site) does not belong because it provides only basic space and power with no pre-installed systems or data, requiring lengthy setup and restoration, which produces the highest RTO and RPO.

Answer

Reciprocal agreement

Answer

Cold site

Question 6

An organization is implementing a defense-in-depth strategy for a data center. Which THREE of the following are examples of physical security controls that align with layered defense?

Accepted Answer

Card reader at building entrance. Option C (card reader at building entrance) is correct because it is a physical access control that authenticates individuals before they can enter the facility, forming an outer layer of defense. Option D (server cage locks) is correct because locking cages around server racks physically restrict access to the most sensitive hardware, adding an inner layer of protection even after someone has entered the building. Option E (perimeter fencing) is correct because fencing establishes the outermost physical boundary of the data center, deterring and delaying unauthorized entry. Options A (antivirus software) and B (network intrusion detection system) are logical/technical controls, not physical security controls, so they do not belong in this layered physical defense scenario.

Answer

Antivirus software

Answer

Intrusion detection system on the network

Question 7

Which TWO of the following are benefits of authenticated vulnerability scanning compared to unauthenticated scanning?

Accepted Answer

Can detect vulnerabilities that require valid credentials to be seen. Option A is correct because authenticated scanning logs into the target host with valid credentials, allowing the scanner to inspect local files, registry keys, installed packages, and configuration settings that are invisible to an unauthenticated scan, thereby detecting vulnerabilities that require credentials to be seen. Option D is correct because credentialed access lets the scanner read exact software versions, patch levels, and update history directly from the host, yielding more accurate patch-level information than remote banner grabbing or version inference. Option B is not correct because authenticated scans typically generate more traffic, not less, since they perform deeper enumeration and local checks. Option C is not correct because no scanning method eliminates false positives entirely; authentication reduces but does not remove them. Option E is not correct because authenticated scans still require network access to reach and log into the target host.

Answer

Reduces network traffic

Answer

Eliminates false positives entirely

Answer

Does not require network access

Question 8

Which TWO of the following are essential elements of a secure software development lifecycle (SSDLC)? (Select exactly 2.)

Accepted Answer

Security testing during the verification phase. Option A is correct because security testing during the verification phase is an essential SSDLC element: it validates that security requirements and controls are actually implemented in the code, typically via SAST, DAST, and security-focused test cases, so defects are found before release rather than in production. Option B is correct because threat modeling during the design phase is a core SSDLC practice: it identifies assets, trust boundaries, data flows, and potential threats (e.g., using STRIDE) early, when architectural changes are cheapest and most effective. Option C is not essential to an SSDLC because code obfuscation after compilation is only a defense-in-depth technique to hinder reverse engineering, not a lifecycle security activity, and it does not address vulnerabilities. Option D is not essential to an SSDLC because penetration testing after deployment is a late, point-in-time assessment; while valuable, it is not a foundational lifecycle element and cannot replace earlier design and verification controls. Option E is not essential to an SSDLC because user acceptance testing before release focuses on functional fitness for business use, not on identifying or mitigating security weaknesses.

Answer

Code obfuscation after compilation

Answer

Penetration testing after deployment

Answer

User acceptance testing before release

Question 9

Which TWO of the following are examples of risk response strategies?

Accepted Answer

Risk acceptance. Risk acceptance (A) is a valid risk response strategy because the organization consciously decides to acknowledge a risk and take no proactive action to mitigate it, often documenting the decision and setting aside contingency reserves. Risk avoidance (D) is also a valid risk response strategy because it involves eliminating the risk entirely by changing plans, such as discontinuing a risky activity, technology, or process. These two belong to the standard risk response categories (avoid, transfer, mitigate, accept), so they directly answer the question. In contrast, risk analysis (B) and risk identification (C) are earlier risk management process steps used to discover and evaluate risks, not strategies for responding to them, and risk communication (E) is an ongoing activity for sharing risk information among stakeholders rather than a response strategy itself.

Answer

Risk analysis

Answer

Risk identification

Answer

Risk communication

Question 10

A security manager is choosing a risk response for a high-impact, high-likelihood risk. Which TWO responses are most appropriate? (Select TWO)

Accepted Answer

Risk mitigation. Risk mitigation (A) is correct because for a high-impact, high-likelihood risk the organization should implement controls (e.g., firewalls, encryption, MFA, patching) to reduce the probability and/or impact to an acceptable level. Risk avoidance (C) is also correct because eliminating the activity or asset that generates the risk removes the exposure entirely, which is appropriate when the risk is too severe to tolerate. Risk research (B) is not a standard risk response in the mitigation/avoidance/transference/acceptance taxonomy and does not by itself reduce a high/high risk. Risk acceptance (D) is inappropriate because accepting a high-impact, high-likelihood risk leaves the organization exposed beyond tolerable levels. Risk deferral (E) is not a valid risk response; postponing action does not reduce the risk and is essentially a form of acceptance.

Answer

Risk research

Answer

Risk acceptance

Answer

Risk deferral

Question 11

Which of the following are characteristics of a Trusted Execution Environment (TEE)? (Choose TWO)

Accepted Answer

It provides hardware-enforced isolation from the main OS. Option D is correct because a TEE, such as Intel SGX enclaves or ARM TrustZone secure world, relies on CPU hardware mechanisms to create an isolated execution context that is separated from the rich operating system, so the main OS cannot access the enclave's memory. Option E is correct because the whole purpose of a TEE is to keep code and data confidential and integrity-protected even against a compromised or malicious host OS, hypervisor, or other privileged software, using hardware-based memory encryption and access control. Option A is incorrect because TEEs are available on client devices, mobile phones, and embedded systems, not only in cloud environments. Option B is incorrect because a TEE is not a separate virtual machine; it is a hardware-isolated execution environment within a processor, distinct from VM-based isolation. Option C is incorrect because a TEE does not require a discrete TPM chip; it uses CPU-level features, and a TPM is a separate component for key storage and attestation, not a prerequisite for a TEE.

Answer

It is only available in cloud environments

Answer

It runs as a separate virtual machine

Answer

It requires a TPM chip

Question 12

An organization is planning its disaster recovery strategy. Which THREE options are considered recovery site types? (Select THREE.)

Accepted Answer

Hot site. The three recognized recovery site types are the hot site (B), cold site (C), and warm site (D), which differ by readiness and cost: a hot site is a fully equipped, mirrored facility with near-zero RTO, a warm site has hardware and connectivity but requires data restoration and configuration (moderate RTO), and a cold site provides only basic space and power with no pre-installed systems (longest RTO). These three form the standard tiered continuum of alternate processing sites in disaster recovery planning. Cloud DR (A) is a recovery strategy or deployment approach rather than a site type in the classic tiered model, and a reciprocal agreement (E) is a mutual aid arrangement between organizations to share resources, not a dedicated recovery site type.

Answer

Cloud DR

Answer

Reciprocal agreement

Question 13

An organization is updating its incident response plan. According to best practices, which THREE components should be included in the plan?

Accepted Answer

Roles and responsibilities. Option A (Roles and responsibilities) is correct because an incident response plan must define who does what during an incident, assigning clear ownership of tasks such as detection, triage, containment, eradication, and recovery so that actions are not duplicated or missed. Option D (Communication plan) is correct because it specifies internal and external notification paths, escalation thresholds, contact trees, and stakeholder/customer/regulator messaging, which is essential for coordinated response and meeting breach-notification obligations. Option E (Recovery procedures) is correct because the plan must document the steps to restore affected systems and services to normal operation, including validation, prioritization, and return-to-production criteria. Option B (Vendor product list) is not a required component; while asset and vendor inventories can support response, a mere product list is not part of the core plan structure. Option C (Employee performance reviews) is unrelated to incident response and belongs to HR performance management, not the IR plan.

Answer

Vendor product list

Answer

Employee performance reviews

Question 14

A security analyst is evaluating access control models for a healthcare organization that needs to enforce both confidentiality and integrity. Which TWO models should be considered? Select two.

Accepted Answer

Bell-LaPadula. Bell-LaPadula (B) is correct because it is the classic mandatory access control model designed to enforce confidentiality through the no-read-up and no-write-down rules, which fits the healthcare requirement to protect sensitive patient data from unauthorized disclosure. Biba (C) is correct because it is the complementary integrity model that enforces no-read-down and no-write-up, preventing untrusted or lower-integrity data from corrupting higher-integrity records, which addresses the stated need to enforce integrity. Together these two models directly map to the scenario's dual requirement for confidentiality and integrity. Take-Grant (A) is not the best fit because it focuses on modeling how rights can be transferred or granted in a graph-based access control system rather than enforcing confidentiality or integrity policies. Clark-Wilson (D) is an integrity model based on well-formed transactions and separation of duties, but it does not enforce confidentiality, so it does not satisfy both requirements. Brewer-Nash (E) is the Chinese Wall model, which addresses conflict-of-interest access control rather than the general confidentiality and integrity enforcement described here.

Answer

Take-Grant

Answer

Clark-Wilson

Answer

Brewer-Nash

Question 15

A security architect is designing a system that must ensure integrity of commercial transactions. Which of the following models are specifically focused on integrity? (Choose TWO)

Accepted Answer

Biba. Biba (C) is an integrity model that enforces the no-read-down and no-write-up rules to prevent data at a lower integrity level from contaminating higher-integrity data, directly protecting transaction integrity. Clark-Wilson (D) is also an integrity model, using well-formed transactions and separation of duties to ensure that commercial data remains consistent and can only be modified through authorized transformation procedures. Take-Grant (A) is a model for analyzing access rights and information flow, not specifically an integrity model. Brewer-Nash (B) is the Chinese Wall model, which addresses conflict-of-interest and confidentiality, not integrity. Bell-LaPadula (E) is a confidentiality model based on no-read-up and no-write-down, so it does not focus on integrity.

Answer

Take-Grant

Answer

Brewer-Nash

Answer

Bell-LaPadula

Question 16

A security engineer is hardening a system against buffer overflow attacks. Which of the following are effective mitigations? (Choose THREE)

Accepted Answer

Address Space Layout Randomization (ASLR). ASLR (A) is correct because it randomizes the memory locations of key process areas such as the stack, heap, and libraries, making it much harder for an attacker to reliably redirect execution to injected shellcode. DEP/NX (B) is correct because it marks memory pages (e.g., the stack and heap) as non-executable, so injected code cannot run even if a buffer overflow succeeds in writing to those regions. Stack canaries (D) are correct because a canary value placed between local buffers and the saved return address is checked before a function returns, detecting and aborting the overwrite that a classic stack-based buffer overflow would perform. Option C (using unpatched software) is wrong because unpatched software retains known vulnerabilities, including buffer overflows, increasing rather than mitigating risk. Option E (disabling ASLR) is wrong because removing ASLR eliminates a key randomization defense and makes exploitation of memory-corruption bugs easier.

Answer

Using unpatched software

Answer

Disabling ASLR

Question 17

A security analyst reviews the following logs from a Linux server:
May 10 03:12:15 server sshd[1234]: Failed password for root from 203.0.113.7 port 51234 ssh2
May 10 03:12:17 server sshd[1234]: Failed password for admin from 203.0.113.7 port 51235 ssh2
May 10 03:12:19 server sshd[1234]: Failed password for user from 203.0.113.7 port 51236 ssh2
May 10 03:12:21 server sshd[1234]: Failed password for root from 203.0.113.7 port 51237 ssh2

What is the most likely cause of these events?

Accepted Answer

A brute-force attack is in progress. The logs show repeated SSH authentication failures from the same source IP address with different usernames, including root, admin, and user. This pattern of multiple failed login attempts in rapid succession is characteristic of a brute-force attack against the SSH service. The fact that attempts continue across different usernames indicates an automated tool is systematically trying credentials, not a single misconfiguration or network issue.

Answer

The root account is disabled

Answer

The firewall is blocking port 22

Answer

The SSH service is not running

Question 18

An organization is conducting a security assessment of a new web application. Which testing technique would best identify cross-site scripting (XSS) vulnerabilities?

Accepted Answer

Dynamic application security testing (DAST). Dynamic Application Security Testing (DAST) is a black-box testing methodology that inspects a running application from the outside in. Because the assessment is conducted without access to the source code (black-box), DAST is the primary method used to find vulnerabilities like XSS and SQL injection by actively injecting payloads into input fields and analyzing the application's runtime responses.

Answer

Manual code review

Answer

Static application security testing (SAST)

Answer

Interactive application security testing (IAST)

Question 19

During a penetration test, a tester discovers that the target web application responds to HTTP requests with a "200 OK" status for both valid and invalid session tokens on a particular API endpoint. The application uses JSON Web Tokens (JWT) for authentication. Which of the following vulnerabilities is MOST likely present?

Accepted Answer

Missing authentication. If an API endpoint returns a '200 OK' status regardless of whether the session token is valid or invalid, it indicates that the endpoint does not actually enforce authentication. Therefore, 'Missing authentication' is the most likely vulnerability. If the issue were a weak JWT signing algorithm, the server would still reject tokens that do not conform to its expected validation rules (such as completely malformed or random invalid tokens). Accepting any invalid token means authentication is entirely bypassed or missing on this endpoint.

Answer

Weak JWT signing algorithm

Answer

Session fixation

Answer

Insecure direct object reference

Question 20

According to the ISC2 Code of Ethics, which of the following canons has the highest priority when resolving an ethical dilemma?

Accepted Answer

Protect society, the common good, and the public trust. The ISC2 Code of Ethics canons are in order of priority: 1. Protect society, the common good, and the public trust; 2. Act honorably and lawfully; 3. Provide diligent and competent service; 4. Advance and protect the profession. Therefore, option D is the highest priority canon.

Answer

Act honorably and lawfully

Answer

Provide diligent and competent service

Answer

Advance and protect the profession