CISSP Practice Exam 55 — 20 Questions

Question 1

A security team is planning to conduct a social engineering test as part of an organization's security assessment. Which THREE of the following should be included in the test plan to ensure ethical and legal compliance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Obtain explicit written consent from management. Option A is correct because obtaining explicit written consent from management establishes documented authorization, which is legally required before conducting any social engineering test and protects the testers from liability. Option C is correct because a prearranged stop word or abort mechanism lets targets halt the test immediately if it causes distress or escalates beyond acceptable limits, preserving participant welfare and ethical conduct. Option D is correct because defining clear scope and boundaries specifies which departments, techniques, and timeframes are permitted, preventing unauthorized actions and keeping the assessment within legal and contractual limits. Options B and E are incorrect: using real personal information of targets violates privacy principles and data protection regulations, and including all employees without exceptions ignores the need for scoping, consent, and exclusion of sensitive roles.

Answer

Use real personal information of targets

Answer

Include all employees without exceptions

Question 2

Which THREE of the following are key components of a disaster recovery plan for a hot site? (Select three)

Accepted Answer

Pre-installed servers and workstations. A hot site is a fully equipped alternate facility that is ready to operate almost immediately, so pre-installed servers and workstations (A) are essential components because they eliminate procurement and build time during failover. Real-time data replication from the primary site (C) is also required so the hot site holds current, usable data with minimal RPO, typically achieved through synchronous or asynchronous replication. Network connectivity with sufficient bandwidth to support operations (D) is likewise critical, since the hot site must carry production traffic and connect users, systems, and replicated data without performance degradation. Option B describes a cold site, which provides only space, power, and cooling with no pre-installed equipment, and option E describes a cold or warm site characteristic, since a hot site is designed for rapid activation, often within minutes or hours, not weeks.

Answer

Empty space with power and cooling only

Answer

Long lead time to activate (e.g., weeks)

Question 3

Which THREE of the following are common key performance indicators (KPIs) used in security assessment and testing?

Accepted Answer

Mean time to remediate critical vulnerabilities. Mean time to remediate critical vulnerabilities (A) is a core security-assessment KPI because it measures how quickly the organization closes high-risk findings, directly reflecting the effectiveness of its vulnerability management process. Patch compliance percentage (B) is also a standard KPI, quantifying the proportion of systems that have current patches applied and thus indicating exposure to known exploits. Open vulnerability count by severity (D) is a common KPI that tracks the outstanding backlog of vulnerabilities grouped by critical, high, medium, and low, giving a snapshot of residual risk and remediation workload. The other options are not typical security-assessment KPIs: the number of employees trained on security awareness (C) is a training/awareness metric rather than a measure of assessment or testing outcomes, and the number of help desk tickets (E) is an IT service management volume metric unrelated to security testing performance.

Answer

Number of employees trained on security awareness

Answer

Number of help desk tickets

Question 4

A company is implementing a digital signature system to ensure non-repudiation. The security architect must select a hash function that meets the required security properties. Which THREE of the following are necessary properties for the hash function?

Accepted Answer

Preimage resistance. Option A (Preimage resistance) is correct because a secure hash function must make it computationally infeasible to reverse the process and find any input that produces a given hash output, which is essential for non-repudiation since an attacker cannot forge a message matching a known digest. Option C (Collision resistance) is correct because it must be infeasible to find any two distinct inputs that produce the same hash value, preventing an attacker from substituting a fraudulent message for a legitimately signed one. Option D (Second preimage resistance) is correct because given a specific input and its hash, it must be infeasible to find a different input with the same hash, which protects the integrity of the original signed message. Option B (Reversibility) is incorrect because hash functions are by design one-way and must not be reversible; reversibility would destroy their security. Option E (Determinism) is incorrect because while determinism is a functional characteristic of hash functions (same input always yields the same output), it is not one of the three cryptographic security properties required for non-repudiation in this context.

Answer

Reversibility

Answer

Determinism

Question 5

A security administrator is reviewing potential risks associated with orphaned accounts. Which TWO of the following are risks of orphaned accounts?

Accepted Answer

Attackers can use orphaned accounts to gain unauthorized access. Option D is correct because orphaned accounts remain valid credentials that are no longer tied to an active owner, so an attacker who compromises or guesses those credentials can authenticate and move laterally without triggering account-owner scrutiny. Option E is correct because orphaned accounts often belong to former employees, contractors, or vendors whose access was never revoked, allowing those individuals to retain system access after their relationship with the organization ends. These two risks are the core security concerns of orphaned accounts: unauthorized access by external attackers and lingering access by terminated insiders. Option A is not the primary risk here because password-policy compliance is a control weakness rather than a direct orphaned-account risk, and orphaned accounts may still technically meet password complexity or rotation rules. Option B is incorrect because authentication-server performance is a capacity/scalability issue, not a consequence of accounts lacking an owner. Option C is incorrect because increased logging overhead is an operational side effect, not a distinct risk of orphaned accounts.

Answer

Compliance with password policies is weakened

Answer

Performance degradation of authentication servers

Answer

Increased logging overhead

Question 6

A security architect is evaluating physical security controls for a facility handling sensitive data. Which of the following are examples of layered physical security controls? (Choose THREE)

Accepted Answer

Perimeter fence. The question asks for layered physical security controls, meaning multiple defensive measures at different depths. Option A, a perimeter fence, is correct because it establishes the outermost physical boundary and deters or delays unauthorized access before an intruder reaches the building. Option B, server rack locks, is correct because it provides an inner layer of protection directly at the asset, restricting access to the servers even after someone has entered the facility. Option C, a mantrap at the entrance to the secure area, is correct because it is a physical access control vestibule that allows only one person through at a time and prevents tailgating, adding a controlled transition layer between zones. Option D, single-factor authentication for all doors, is not a layered physical control; single-factor authentication is weak and does not add defense in depth, and authentication is more of an access control mechanism than a physical barrier. Option E, unsecured windows on the ground floor, is not a control at all but a vulnerability, since unlocked or unprotected windows provide an easy bypass of other physical defenses.

Answer

Single-factor authentication for all doors

Answer

Unsecured windows on ground floor

Question 7

A security analyst is performing an access review. Which THREE of the following are best practices for user access recertification? (Choose three.)

Accepted Answer

Managers confirm that employees still need their current access. Option A is correct because the core of user access recertification is having managers (or resource owners) explicitly attest that each user still requires their current entitlements; this human validation catches stale or excessive privileges that automated tools cannot infer. Option C is correct because recertification must occur on a defined, recurring schedule—at least annually, and more frequently for privileged, sensitive, or high-risk access—so that access does not drift out of policy over time. Option D is correct because reviews must compare each user's granted access against their current job role and responsibilities, ensuring the principle of least privilege and separation of duties are maintained. Option B is not a best practice because removing all access and re-provisioning from scratch is disruptive, error-prone, and unnecessary when targeted review can revoke only inappropriate entitlements. Option E is not a best practice because auto-approving access when a reviewer does not respond defeats the purpose of recertification and allows unjustified access to persist; non-response should trigger escalation or revocation, not approval.

Answer

Remove all access and re-provision as needed

Answer

Automatically approve access if no response

Question 8

Which TWO of the following are essential components of a disaster recovery plan? (Choose two.)

Accepted Answer

Recovery Point Objective (RPO). Option A, Recovery Point Objective (RPO), is correct because it defines the maximum acceptable amount of data loss measured in time, which directly determines backup frequency and replication strategy within a disaster recovery plan. Option C, Recovery Time Objective (RTO), is correct because it specifies the maximum tolerable downtime for restoring systems and services after a disruption, driving the recovery architecture and resource prioritization. Together, RPO and RTO are the two foundational metrics that every DR plan must define to set recovery expectations and design appropriate solutions. Option B, a business continuity plan, is broader and encompasses the DR plan rather than being a component of it. Option D, a Service Level Agreement, is a contractual document defining service expectations and is not itself a DR component. Option E, a cold site configuration, is only one possible recovery site strategy and is not essential to every DR plan.

Answer

Business continuity plan

Answer

Service Level Agreement (SLA)

Answer

Cold site configuration

Question 9

An organization is planning to acquire a new SaaS application for customer relationship management. Which THREE of the following should be included in the vendor security assessment?

Accepted Answer

Reviewing the vendor's security certifications (e.g., SOC 2, ISO 27001). Option B is correct because reviewing the vendor's security certifications such as SOC 2 and ISO 27001 provides independent attestation that the SaaS provider has implemented and audited controls for security, availability, and confidentiality, which is essential when entrusting customer data to a third party. Option C is correct because requesting a Software Bill of Materials (SBOM) gives visibility into the open source and third-party components in the SaaS application, enabling the organization to assess supply chain risk and quickly identify exposure to known vulnerabilities such as those tracked in CVE databases. Option D is correct because assessing the vendor's incident response process verifies that the provider has defined detection, notification, containment, and recovery procedures, which is critical for meeting the organization's own breach notification and business continuity obligations. Option A is not included because license compliance for open source components is a legal and procurement concern rather than a core vendor security control assessment. Option E is not included because requiring employee security training records is an internal personnel control and does not directly evaluate the security posture of the SaaS vendor's service.

Answer

Checking license compliance for open source components

Answer

Requiring employee security training records

Question 10

During an internal audit, an organization discovers that a critical application has not been patched for six months. The application is business-critical and cannot be taken offline during business hours. Which of the following is the best course of action?

Accepted Answer

Implement compensating controls and schedule patching at the next available maintenance window. Compensating controls (e.g., network segmentation, WAF rules, or host-based IPS) reduce the immediate risk while the critical application remains online. Scheduling patching for the next maintenance window aligns with change management and ensures the patch is tested and applied without disrupting business operations. This balances security needs with operational continuity, a core principle of risk management.

Answer

Accept the risk and continue operations

Answer

Apply the patch immediately during off-hours even if it risks downtime

Answer

Disconnect the application until it is patched

Question 11

Which THREE of the following are essential components of a software supply chain security program? (Select exactly three.)

Accepted Answer

Using signed and verified software artifacts. Option A is correct because using signed and verified software artifacts ensures integrity and authenticity through cryptographic signatures (e.g., GPG, Sigstore), preventing tampering or substitution of components within the supply chain. Option B is correct because maintaining a software bill of materials (SBOM) for all dependencies provides the inventory and transparency needed to identify and respond to vulnerabilities such as Log4Shell across transitive dependencies. Option E is correct because performing security assessments on third-party vendors addresses the risk introduced by external suppliers, a core element of supply chain risk management. Option C is not essential to a supply chain security program because penetration testing the production environment tests deployed infrastructure and applications rather than the provenance, integrity, or composition of software components. Option D is not essential because static analysis on in-house code improves code quality and finds coding flaws but does not address the third-party dependencies, artifact integrity, or vendor risks that define supply chain security.

Answer

Running penetration tests on the production environment

Answer

Conducting static analysis on all in-house code

Question 12

During a risk assessment, a company identifies that its primary data center is located in a flood-prone area. The estimated annual loss expectancy (ALE) for a flood event is $500,000. Installing flood barriers costs $200,000 and reduces the ALE to $50,000. What is the net benefit of implementing the flood barriers?

Accepted Answer

$250,000. The net benefit is calculated as the reduction in ALE minus the cost of the control. The original ALE is $500,000, and after implementing flood barriers the ALE drops to $50,000, a reduction of $450,000. Subtracting the $200,000 cost of the barriers yields a net benefit of $250,000. This aligns with the CISSP risk management formula: Net Benefit = (ALE_old - ALE_new) - Cost_of_control.

Answer

$300,000

Answer

$450,000

Answer

$200,000

Question 13

A security analyst runs a vulnerability scan against a web application and receives a report listing several critical vulnerabilities. However, the development team argues that many of these findings are false positives. Which of the following is the BEST next step for the analyst?

Accepted Answer

Manually verify a sample of the findings to confirm true vs. false positives.. Manual verification is the definitive method to distinguish true positives from false positives in vulnerability scanning. Automated scanners can produce false positives due to factors like incomplete service fingerprinting or reliance on banner grabbing, which may not reflect actual exploitability. The analyst must validate a representative sample of findings against the actual application behavior and configuration before taking further action.

Answer

Re-scan the application with the same settings to confirm the results.

Answer

Escalate all critical findings to management immediately.

Answer

Retune the vulnerability scanner to reduce false positives and re-scan.

Question 14

Which access control model allows the data owner to determine who can access their resources, typically using Access Control Lists (ACLs)?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is defined by the property that the owner of a resource decides who can access it and with what permissions, typically by configuring Access Control Lists (ACLs) on the object. This owner-controlled discretion is the defining characteristic that separates DAC from MAC, RBAC, and ABAC. In DAC systems like Windows NTFS or Unix file permissions, the resource owner can grant or revoke access at will.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Question 15

A security team implements a Data Loss Prevention (DLP) solution to monitor email attachments for sensitive data. Which type of DLP is being used?

Accepted Answer

Network DLP. Network DLP monitors data in motion by inspecting network traffic, such as email attachments, as they traverse the network perimeter. This is the correct type because the scenario explicitly describes monitoring email attachments, which are transmitted over the network, and Network DLP is designed to inspect SMTP, HTTP, FTP, and other protocols for sensitive content at the network layer.

Answer

Classification-based controls

Answer

Cloud DLP

Answer

Endpoint DLP

Question 16

A multinational corporation is implementing a data classification program. The information security manager must ensure that data is handled appropriately based on its classification level. The company operates in multiple jurisdictions, including the European Union and the United States. Which two of the following are key considerations when developing the data classification policy? (Choose two.)

Accepted Answer

Defining clear criteria for each classification level based on data sensitivity and business impact. Aligning classification with legal requirements and defining clear criteria are essential for a multinational data classification policy. Legal alignment ensures compliance across jurisdictions, while clear criteria promote consistent application. Other options are flawed: overclassification is inefficient, delegating solely to IT ignores business ownership, and a rigid global scheme fails to address local legal nuances.

Answer

Delegating classification decisions solely to the IT department

Answer

Ensuring that all data is classified as 'Confidential' by default to maximize protection

Answer

Implementing a single global classification scheme without considering local variations

Question 17

An organization's security team wants to validate that its incident response plan works as documented before a real breach occurs. The team needs to exercise communication paths, decision-making, and coordination among technical staff, legal, and public relations without touching production systems. Which of the following is the MOST appropriate exercise type?

Accepted Answer

A tabletop exercise where participants discuss their roles and responses to a simulated scenario. A tabletop exercise is discussion-based and designed to validate plans, roles, and coordination among diverse stakeholders without impacting production. It exercises communication and decision-making with legal and public relations participants, matching the stated goal. Full-scale simulations, vulnerability scans, and penetration tests address different objectives and either disrupt production or fail to exercise the plan.

Answer

A vulnerability scan of the production environment to identify weaknesses the plan should address

Answer

A penetration test conducted by an external firm to simulate a real attacker

Answer

A full-scale simulation that disables production systems to test real recovery capabilities

Question 18

A hospital's security operations center receives an alert that a nurse's workstation is communicating with a known command-and-control IP address. The analyst confirms the workstation is infected with malware that is beaconing every sixty seconds. Following the incident response process, which action should the analyst take FIRST?

Accepted Answer

Isolate the workstation from the network while preserving its state for investigation.. With an active beacon to attacker infrastructure, the immediate priority in the incident response lifecycle is containment. Isolating the workstation at the network layer halts command-and-control and limits lateral movement while preserving volatile and non-volatile evidence. Powering off, deleting files, or relying on user cooperation all either destroy evidence or leave the compromised host communicating with the adversary.

Answer

Power off the workstation immediately to stop the malware from spreading.

Answer

Run a full antivirus scan and delete any detected files before escalating.

Answer

Notify the affected nurse and ask them to stop using the workstation until further notice.

Question 19

A security manager is conducting a risk assessment and needs to categorize the following risk responses: risk avoidance, risk transfer, risk mitigation, and risk acceptance. Which TWO of the following actions are examples of risk transfer? (Choose two.)

Accepted Answer

Outsourcing a critical business function to a third-party provider with a service-level agreement (SLA).. The correct answers are purchasing cyber insurance and outsourcing a critical function with an SLA. Both actions shift the financial or operational impact of a risk to another party. Insurance transfers financial risk, while outsourcing transfers operational risk through contractual agreements, making them valid examples of risk transfer.

Answer

Accepting the risk of a minor vulnerability because the cost of fixing it exceeds the potential loss.

Answer

Implementing a firewall to block unauthorized access to the network.

Answer

Deciding not to deploy a new application because it introduces unacceptable vulnerabilities.

Question 20

A security architect is designing a trusted recovery capability for a high-assurance system that must continue operating during a failure without violating its security policy. The system must be able to recover from a failure while maintaining the security of the data it processes, and must not enter an insecure state during recovery. Which two recovery strategies best satisfy the requirement to maintain security during failure and recovery? (Choose two.)

Accepted Answer

Fail-secure operation, where the system denies access to resources and defaults to a secure state when a failure is detected.. Fail-soft and fail-secure operations are the two recovery strategies that maintain security during failure. Fail-soft keeps the system running in a degraded but secure mode, isolating the failed component, while fail-secure defaults to denying access and protecting data. Both prevent the system from entering an insecure state, which is essential for trusted recovery in high-assurance systems. Fail-open, cold restart, and manual intervention either compromise security or fail to guarantee continuous protection during recovery.

Answer

Fail-open operation, where the system allows all access to maintain availability during a failure.

Answer

Cold restart, where the system reboots and reloads all software from scratch after a failure.

Answer

Manual intervention, where an administrator restores the system from backups after a failure.