CISSP Practice Test 6 — 10 Questions

Question 1

A security manager is conducting a risk assessment for a new cloud application. The manager needs to estimate the potential financial loss from a data breach. Which approach should be used?

Accepted Answer

Quantitative risk analysis using annualized loss expectancy (ALE). Quantitative risk analysis using Annualized Loss Expectancy (ALE) provides a specific monetary estimate of potential financial loss, which is exactly what the security manager needs for a data breach scenario. ALE is calculated as Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO), enabling data-driven budgeting and cost-benefit analysis for cloud application security controls.

Answer

Scenario-based risk analysis with ordinal scales

Answer

Qualitative risk analysis using high/medium/low ratings

Answer

Benchmarking against industry standards

Question 2

During a forensic investigation, the team needs to preserve evidence from a running server. What is the FIRST step the team should take?

Accepted Answer

Capture a memory dump.. The first step in a forensic investigation of a running server is to capture a memory dump because volatile data (RAM) contains critical evidence such as running processes, network connections, encryption keys, and malware that would be lost if the system is powered off or altered. Preserving this volatile state before any other action ensures that the most transient evidence is secured, following the order of volatility principle. Capturing memory first prevents irreversible loss of data that cannot be recovered from disk or network captures.

Answer

Create a disk image.

Answer

Shut down the server normally.

Answer

Unplug the network cable.

Question 3

An organization uses full disk encryption on all laptops containing sensitive data. A laptop is to be decommissioned, and the data must be sanitized. The laptop's SSD cannot be overwritten reliably due to wear-leveling. Which method is most appropriate?

Accepted Answer

Cryptographic erasure by destroying the encryption key. Cryptographic erasure by destroying the encryption key is the most appropriate method because the data is already encrypted with full disk encryption; destroying the key renders the data unrecoverable without needing to overwrite the SSD, which is unreliable due to wear-leveling. This approach is efficient and secure for decommissioning.

Answer

Degaussing

Answer

DoD 5220.22-M 7-pass overwrite

Answer

Physical destruction (shredding)

Question 4

A security architect is selecting a cryptographic algorithm for encrypting data at rest in a backup system. The system requires strong security with a block cipher, and the organization mandates using a NIST-approved algorithm with key sizes of 128, 192, or 256 bits. Which algorithm should be selected?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a NIST-approved symmetric block cipher defined in FIPS 197, supporting key sizes of 128, 192, and 256 bits. It is the standard choice for encrypting data at rest and satisfies all stated requirements.

Answer

RC4

Answer

RSA

Answer

3DES

Question 5

During a business impact analysis (BIA), which metric represents the maximum amount of time a business process can be disrupted before causing significant harm to the organization?

Accepted Answer

Maximum Tolerable Period of Disruption (MTPD). The Maximum Tolerable Period of Disruption (MTPD) is the metric defined during a BIA that captures the absolute upper bound of time a business process can be unavailable before the organization suffers unacceptable or significant harm. It is derived from business-side impact analysis (financial, regulatory, reputational) rather than technical recovery capabilities, and it serves as the ceiling from which RTO is derived. Because MTPD represents the business's tolerance limit, it is the correct answer for the maximum disruption time before significant harm.

Answer

Work Recovery Time (WRT)

Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Question 6

A security architect is deploying a public key infrastructure (PKI) and wants to ensure that certificate revocation status is verified efficiently without relying on a centralized CRL distribution point. Which technique should be used?

Accepted Answer

OCSP Stapling. OCSP Stapling allows the server to obtain a signed, time-stamped OCSP response from the CA and present it to clients during the TLS handshake, so clients do not need to contact the OCSP responder directly. This eliminates the latency and privacy concerns of real-time OCSP lookups and avoids reliance on a centralized CRL distribution point. It is the standard technique for efficient, decentralized revocation checking.

Answer

Certificate Transparency Logs

Answer

Certificate Pinning

Answer

Self-Signed Certificates

Question 7

A company's vulnerability management program requires that all critical vulnerabilities be remediated within 30 days. A critical vulnerability is discovered in a legacy system that cannot be patched because the vendor no longer supports it. Which of the following is the best compensating control?

Accepted Answer

Segment the system from the rest of the network. Segmenting the legacy system from the rest of the network is the best compensating control because it limits the blast radius if the unpatched vulnerability is exploited. By isolating the system, lateral movement to other critical assets is prevented, reducing overall risk. This is a classic network segmentation control that directly addresses the inability to patch.

Answer

Deploy a host-based intrusion detection system (HIDS)

Answer

Increase logging and monitoring

Answer

Encrypt all data at rest on the system

Question 8

Which role in an incident response team is primarily responsible for coordinating communication with external parties, such as the media and regulators?

Accepted Answer

Communications lead. The communications lead is the incident response team role specifically tasked with managing all external and internal communications, including press releases, media inquiries, and regulator notifications. This role ensures a single, consistent message and prevents unauthorized disclosures. Legal counsel, the incident manager, and forensic investigators have different primary responsibilities that do not center on external communications.

Answer

Legal counsel

Answer

Incident manager

Answer

Forensic investigator

Question 9

During a security review of a web application, testers discover that the application discloses detailed error messages to users, including stack traces. Which secure coding best practice is being violated?

Accepted Answer

Error handling. Detailed error messages with stack traces expose sensitive implementation details, which is a failure of proper error handling. Secure error handling requires generic user-facing messages while logging details internally. This prevents attackers from learning about the system's internals.

Answer

Input validation

Answer

Secure logging

Answer

Output encoding

Question 10

During a Kerberos authentication process, the client receives a Ticket Granting Ticket (TGT) from the Authentication Server (AS). Later, the client presents the TGT to the Ticket Granting Server (TGS) to request a service ticket. Which of the following best describes the purpose of the TGT?

Accepted Answer

It allows the client to request additional service tickets without re-authentication.. The TGT is correct because it is issued once by the Authentication Server after the client proves its identity (typically via password-derived pre-authentication), and it is then presented to the TGS to obtain service tickets for specific resources — enabling single sign-on without re-entering credentials. The TGT is encrypted with the krbtgt account's secret key, so only the KDC can decrypt and validate it, and it carries the client's identity and a session key for securing subsequent TGS exchanges. This design is what makes Kerberos efficient: authenticate once, then request many service tickets.

Answer

It verifies the client's IP address to prevent replay attacks.

Answer

It encrypts the session key between the client and the target service.

Answer

It authenticates the user to the target service directly.