CISSP Practice Test 7 — 10 Questions

Question 1

Which component of a trusted computing base (TCB) implements the reference monitor concept by enforcing access control decisions for all subjects and objects in the system?

Accepted Answer

Security kernel. The security kernel is the part of the TCB that implements the reference monitor, mediating all access requests.

Answer

Trusted platform module

Answer

Trusted computing base

Answer

Reference monitor

Question 2

A financial institution must ensure that transactions are well-formed and enforce separation of duties to prevent fraud. Which security model best addresses these requirements?

Accepted Answer

Clark-Wilson. Clark-Wilson model defines well-formed transactions and separation of duties to maintain commercial integrity.

Answer

Biba

Answer

Brewer-Nash

Answer

Bell-LaPadula

Question 3

A security auditor is reviewing the results of a recently completed internal vulnerability scan. The scan report shows several hosts with the same vulnerability. Which of the following actions should the auditor take FIRST?

Accepted Answer

Manually verify the vulnerability on a sample of affected hosts.. The auditor must first manually verify the vulnerability on a sample of affected hosts because automated vulnerability scans can produce false positives due to factors like incomplete banner grabbing, outdated plugin signatures, or network-level interference. Confirming the finding ensures that subsequent remediation efforts are based on accurate, validated data, preventing wasted resources on non-existent issues.

Answer

Immediately apply patches to all affected hosts.

Answer

Remove the hosts from the network until the vulnerability is resolved.

Answer

Re-run the scan with a different scanner.

Question 4

A security engineer is investigating a covert channel in a system. Which TWO types of covert channels could be used to leak information from a high-security to a low-security process?

Accepted Answer

Covert timing channel. Covert timing channels modulate the timing of events to signal information. Covert storage channels write data to a shared resource that the other process can read.

Answer

TOCTOU

Answer

Emanations

Answer

Side-channel

Question 5

A company collects PII from European customers for order processing. Under GDPR, they engage a third-party logistics provider to handle shipping. Which role does the logistics provider typically assume in this scenario?

Accepted Answer

Data processor. A data processor processes personal data on behalf of the data controller (the company). The logistics provider handles data for shipping but does not determine purposes or means.

Answer

Data controller

Answer

Data custodian

Answer

Data subject

Question 6

During a security audit, a vulnerability scanner reports a buffer overflow vulnerability in a legacy application. The application runs on a system with Data Execution Prevention (DEP/NX) enabled and Address Space Layout Randomization (ASLR) active. Which of the following is the most likely impact of these mitigations on a typical stack-based buffer overflow exploit?

Accepted Answer

They make it harder to execute arbitrary code via injected shellcode. DEP prevents code execution in data segments like the stack. ASLR randomizes memory addresses, making it harder for an attacker to redirect execution to injected code. Combined, they significantly raise the bar.

Answer

They only protect heap-based overflows, not stack-based

Answer

They completely prevent any exploitation of buffer overflows

Answer

They have no effect on buffer overflow exploits

Question 7

Which of the following is the primary purpose of a configuration management database (CMDB) in asset management?

Accepted Answer

Store information about hardware and software components and their relationships. A CMDB stores information about configuration items (CIs) and their relationships, aiding in change and incident management.

Answer

Track software licenses and compliance

Answer

Perform vulnerability scanning

Answer

Monitor network performance

Question 8

An organization is implementing privacy by design for a new application that processes PII. Which practice BEST aligns with the data minimization principle?

Accepted Answer

Collecting only the PII required for the stated function.. Data minimization means collecting only the personal data that is directly necessary for the specified purpose.

Answer

Anonymizing data after collection.

Answer

Obtaining explicit consent from users.

Answer

Collecting all possible PII in case it is needed later.

Question 9

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. A Type 2 factor is something you have, such as a smart card or OTP token.

Answer

Security question

Answer

Password

Answer

Fingerprint

Question 10

A security analyst discovers that an attacker has gained domain admin privileges by forging a Kerberos TGT using the KRBTGT account hash. Which attack has occurred?

Accepted Answer

Golden ticket attack. A Golden Ticket attack involves forging a TGT with the KRBTGT hash, granting unrestricted access.

Answer

Pass-the-ticket attack

Answer

Silver ticket attack

Answer

Kerberos brute force attack