CISSP Practice Test 7 — 10 Questions

Question 1

A security analyst is reviewing a web application and notices that it includes a feature that allows users to view their own profile by providing a user ID in the URL (e.g., /profile?userid=123). The application does not verify that the logged-in user owns that profile. Which vulnerability is present?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Insecure direct object reference (IDOR). The application exposes an internal object reference (the userid parameter) and fails to perform an authorization check that the logged-in user owns that object. This is the textbook definition of an Insecure Direct Object Reference (IDOR), classified under OWASP as Broken Access Control (A01:2021). Because the URL directly maps to a backend record without an ownership check, an attacker can simply increment the userid value to view other users' profiles.

Answer

Security misconfiguration

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Question 2

Which metric defines the maximum amount of data loss an organization can tolerate during a disaster?

Accepted Answer

RPO. Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time — for example, an RPO of 4 hours means the organization can tolerate losing up to 4 hours of data. It directly drives backup frequency and replication strategy. RTO, by contrast, defines how long recovery can take, not how much data can be lost.

Answer

MTD

Answer

MTTR

Answer

RTO

Question 3

What is the primary purpose of a configuration management database (CMDB) in asset management?

Accepted Answer

Provide a repository of configuration items and their relationships. The primary purpose of a configuration management database (CMDB) is to provide a repository of configuration items (CIs) and their relationships, enabling IT service management processes like change management, incident management, and asset management. It tracks the components of an IT environment and how they interconnect.

Answer

Monitor network traffic for anomalies

Answer

Store and manage data classification labels

Answer

Track software licenses and compliance

Question 4

An organization is implementing a Public Key Infrastructure (PKI) to support secure email and web communications. The PKI includes a root CA, intermediate CAs, and end-entity certificates. Which of the following best describes the role of the root CA in this hierarchy?

Accepted Answer

It is self-signed and forms the trust anchor. The root CA is the top of the PKI hierarchy and is self-signed, meaning its certificate is signed by its own private key. It serves as the ultimate trust anchor: all trust in the chain derives from it, and its public key is distributed out-of-band to relying parties. In a well-designed hierarchy, the root CA issues certificates only to intermediate CAs, not directly to end entities, to protect its private key.

Answer

It performs key escrow for all users

Answer

It issues certificates directly to end users

Answer

It validates certificate revocation lists (CRLs)

Question 5

Which of the following is the most important factor when prioritizing vulnerability remediation in a vulnerability management program?

Accepted Answer

Exploitability and business impact. Prioritizing vulnerability remediation should be driven by exploitability (is there a known exploit, is it weaponized, is it reachable) combined with business impact (what asset is affected, what data or process is at risk). This risk-based approach ensures limited remediation resources are directed at the vulnerabilities that pose the greatest actual threat to the organization. CVSS alone does not capture business context.

Answer

CVSS base score

Answer

Number of systems affected

Answer

Time since discovery

Question 6

A financial application requires strict integrity controls to prevent unauthorized modifications. The security team implements a model where users cannot write data to higher integrity levels (no write up) and cannot read data from lower integrity levels (no read down). Which model is being applied?

Accepted Answer

Biba. The Biba integrity model is defined by the 'no write up' and 'no read down' rules, which prevent subjects at a lower integrity level from writing to higher levels and prevent subjects at a higher level from reading lower-level (potentially tainted) data. This directly matches the scenario's requirement to prevent unauthorized modifications by preserving integrity across levels. Biba is the integrity counterpart to Bell-LaPadula, which focuses on confidentiality.

Answer

Bell-LaPadula

Answer

Graham-Denning

Answer

Clark-Wilson

Question 7

During a forensic investigation, an analyst must collect volatile data in the correct order. Which of the following sequences correctly follows the order of volatility?

Accepted Answer

CPU registers → cache → RAM → swap → disk. The order of volatility (RFC 3227) dictates that the most ephemeral data must be captured first because it disappears fastest. CPU registers and cache lose their contents within nanoseconds to milliseconds, RAM persists only while powered, swap holds paged memory on disk, and the disk itself is the most persistent. Therefore CPU registers → cache → RAM → swap → disk is the correct forensic collection sequence.

Answer

Disk → RAM → CPU registers → cache → swap

Answer

RAM → CPU registers → swap → disk → remote logging

Answer

Swap → RAM → cache → CPU registers → disk

Question 8

An organization wants to implement single sign-on across multiple web applications using an XML-based protocol that supports identity provider (IdP) and service provider (SP) initiated flows. Which technology should they choose?

Accepted Answer

SAML 2.0. SAML 2.0 is the XML-based federation standard that defines both IdP-initiated and SP-initiated SSO flows using assertions, AuthnRequests, and Response messages. It is the classic choice for browser-based SSO across multiple web applications where the identity provider and service provider exchange XML over HTTP POST or redirect bindings. OpenID Connect and OAuth 2.0 are JSON/REST-based, and Kerberos is a ticket-based network authentication protocol, not a web SSO federation standard.

Answer

OpenID Connect

Answer

OAuth 2.0

Answer

Kerberos

Question 9

An organization deploys a hypervisor to host multiple virtual machines. To mitigate the risk of VM escape attacks, which of the following is the most effective security measure?

Accepted Answer

Disabling all unnecessary hypervisor services and applying security patches. Disabling unnecessary hypervisor services reduces the attack surface available to a guest attempting VM escape, and applying hypervisor security patches closes known vulnerabilities (e.g., VENOM, CVE-2015-3456) that allow guest-to-host breakout. Since the hypervisor is the isolation boundary between VMs and the host, hardening and patching it directly addresses the escape vector. This is the most effective preventive control because it targets the root cause rather than the symptoms.

Answer

Using Type 2 hypervisor only

Answer

Using VLANs to isolate VM traffic

Answer

Enabling VM snapshots for quick recovery

Question 10

A government agency requires a security model that prevents users from reading documents classified above their clearance level and from writing classified information to lower-level systems. Which model enforces these constraints?

Accepted Answer

Bell-LaPadula. Bell-LaPadula is the mandatory access control model focused on confidentiality, enforcing 'no read up' (simple security property) and 'no write down' (star property). These two rules exactly match the requirement: users cannot read above their clearance and cannot write classified data to lower levels. Biba, Brewer-Nash, and Clark-Wilson address integrity or conflict-of-interest, not confidentiality.

Answer

Biba

Answer

Brewer-Nash

Answer

Clark-Wilson