CISSP Practice Test 6 — 10 Questions

Question 1

A company is considering outsourcing its customer support operations to a third-party vendor. Which of the following should be the PRIMARY risk management activity before finalizing the contract?

Accepted Answer

Conduct a thorough vendor risk assessment including security audits.. Before outsourcing critical operations, the primary risk management activity is to conduct a thorough vendor risk assessment, including security audits. This evaluates the vendor's security posture, compliance with standards (e.g., ISO 27001), and ability to protect sensitive customer data, directly addressing risks like data breaches or service disruptions before contractual obligations are locked in.

Answer

Negotiate a lower price to offset potential security investments.

Answer

Purchase cyber liability insurance to cover potential breaches.

Answer

Require the vendor to sign a non-disclosure agreement (NDA).

Question 2

A multinational corporation must ensure that data leaving the organization's network is classified and labeled appropriately. Which of the following is the MOST effective method to enforce consistent labeling across all data types?

Accepted Answer

Implement automated data classification tools that scan for sensitive content and apply labels. Automated data classification tools (e.g., Microsoft Purview, Symantec DLP) use content inspection, pattern matching, and machine learning to scan data at rest, in use, and in transit. They apply consistent labels based on predefined policies (e.g., regex for PII, fingerprinting for IP), ensuring uniform labeling across all data types without relying on human consistency or manual effort.

Answer

Appoint data stewards in each department to manually review and label data

Answer

Require all employees to complete annual training on data classification

Answer

Encrypt all data in transit and at rest to prevent unauthorized access

Question 3

A security manager is conducting a risk assessment for a new cloud application. The manager needs to estimate the potential financial loss from a data breach. Which approach should be used?

Accepted Answer

Quantitative risk analysis using annualized loss expectancy (ALE). Quantitative risk analysis using Annualized Loss Expectancy (ALE) provides a specific monetary estimate of potential financial loss, which is exactly what the security manager needs for a data breach scenario. ALE is calculated as Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO), enabling data-driven budgeting and cost-benefit analysis for cloud application security controls.

Answer

Scenario-based risk analysis with ordinal scales

Answer

Qualitative risk analysis using high/medium/low ratings

Answer

Benchmarking against industry standards

Question 4

During a forensic investigation, the team needs to preserve evidence from a running server. What is the FIRST step the team should take?

Accepted Answer

Capture a memory dump.. The first step in a forensic investigation of a running server is to capture a memory dump because volatile data (RAM) contains critical evidence such as running processes, network connections, encryption keys, and malware that would be lost if the system is powered off or altered. Preserving this volatile state before any other action ensures that the most transient evidence is secured, following the order of volatility principle. Capturing memory first prevents irreversible loss of data that cannot be recovered from disk or network captures.

Answer

Create a disk image.

Answer

Shut down the server normally.

Answer

Unplug the network cable.

Question 5

An organization wants to identify vulnerabilities in their network without attempting to exploit them. Which type of security assessment should they perform?

Accepted Answer

Vulnerability assessment. A vulnerability assessment is the correct choice because it is a systematic review of security weaknesses in a network or system that identifies vulnerabilities without actively exploiting them. This assessment typically uses automated scanning tools (e.g., Nessus, OpenVAS) to compare system configurations against known vulnerability databases (e.g., CVE, NVD) and reports potential issues, but does not attempt to gain unauthorized access or cause disruption.

Answer

Penetration test

Answer

Security audit

Answer

Security review

Question 6

A healthcare organization must decommission an old server containing patient health information (PHI) stored on solid-state drives (SSDs). Standard overwriting techniques are ineffective for SSDs due to wear-leveling and bad block mapping. Which sanitization method is most appropriate for these drives?

Accepted Answer

Physical destruction such as shredding or pulverizing. Physical destruction (e.g., shredding or pulverizing) is recommended for SSDs because overwriting may not reach all cells, and degaussing does not affect flash memory.

Answer

Cryptographic erasure by deleting the encryption key

Answer

Degaussing with a high-coercivity degausser

Answer

Overwriting with the DoD 5220.22-M 7-pass standard

Question 7

A company is migrating its critical application to a cloud provider. Which disaster recovery strategy provides the shortest recovery time objective (RTO) and recovery point objective (RPO)?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and real-time data synchronization, minimizing RTO and RPO.

Answer

Warm site

Answer

Cold site

Answer

Reciprocal agreement

Question 8

Which of the following is an example of a security policy?

Accepted Answer

All employees must use multi-factor authentication. A policy is a high-level mandatory statement that reflects management's intent. 'All employees must use multi-factor authentication' is a mandatory directive.

Answer

Step 1: Log in, Step 2: Enter code, Step 3: Access system

Answer

It is recommended to change passwords every 90 days

Answer

Use passwords of at least 12 characters with mixed case and numbers

Question 9

A company is recovering from a ransomware attack. Which THREE of the following are key considerations when restoring data from backups to ensure integrity and minimal downtime?

Accepted Answer

Isolate the restored data from the production network until verified. Isolating the restored data from production prevents reinfection. Validating backup integrity ensures clean data. Testing the restoration process ensures the backups work. Encrypted backups require decryption keys.

Answer

Ensure encryption keys for backups are available

Answer

Restore data directly to production servers to save time

Question 10

Which of the following is a key objective of a business impact analysis (BIA)?

Accepted Answer

Determine the maximum tolerable downtime for critical processes. BIA identifies critical business processes and their recovery requirements such as RTO, RPO, and maximum tolerable downtime.

Answer

Implement security controls

Answer

Identify vulnerabilities in the network

Answer

Test the disaster recovery plan