CISSP Practice Test 8 — 10 Questions

Question 1

A security analyst is reviewing network logs and sees repeated failed connection attempts from an external IP to the company's SSH server (port 22). The firewall has a rule allowing SSH from anywhere. What is the best immediate action to reduce risk?

Accepted Answer

Change the SSH port to a high-numbered port and restrict source IPs if possible.. Option C is correct because changing the SSH port to a non-standard, high-numbered port reduces automated scanning and brute-force attacks by evading default port 22 scans, while restricting source IPs adds a layer of access control. This balances security with operational continuity, as SSH remains available for legitimate administrative use. The immediate risk reduction comes from making the service less discoverable and limiting the attack surface without fully disabling remote access.

Answer

Remove the firewall rule allowing SSH.

Answer

Disable SSH access entirely.

Answer

Block the offending IP address in the firewall.

Question 2

Which TWO of the following are principles of the Bell-LaPadula security model?

Accepted Answer

No read up. The Bell-LaPadula model enforces mandatory access control (MAC) to protect confidentiality. Option D (No read up) is correct because a subject cannot read an object at a higher classification level, preventing unauthorized access to sensitive information. Option E (No write down) is correct because a subject cannot write to an object at a lower classification level, preventing the downgrading of classified data.

Answer

Separation of duty

Answer

No write up

Answer

No read down

Question 3

A security engineer is troubleshooting a network where internal users can access internet websites but cannot reach the company's external VPN server (IP 203.0.113.50, UDP port 500). The firewall rule for VPN traffic is correctly configured. What is the most likely cause?

Accepted Answer

The VPN server is not listening on UDP port 500.. Option D is correct because the symptom—internal users can reach internet websites but cannot reach the external VPN server—indicates a host-level issue rather than a network or firewall problem. Since the firewall rule for VPN traffic is correctly configured and other traffic flows normally, the most likely cause is that the VPN server itself is not listening on UDP port 500, which is the standard port for IPsec IKE (Internet Key Exchange) traffic. This could be due to a misconfiguration, service failure, or the server being configured to use a different port or protocol.

Answer

The VPN server is using TCP port 443 instead of UDP 500.

Answer

The firewall rule is applied to the wrong interface.

Answer

The firewall is stateful and blocking the return traffic.

Question 4

Which THREE of the following are valid countermeasures against buffer overflow attacks?

Accepted Answer

Stack canaries. Stack canaries are correct because they place a known value (canary) between the buffer and control data on the stack. Before a function returns, the canary is checked; if it has been overwritten (indicating a buffer overflow), the program terminates, preventing code execution. This directly detects stack-based buffer overflows before they can hijack the return address.

Answer

Full disk encryption

Answer

Input validation using allowlists

Question 5

Which TWO of the following are valid reasons to implement network segmentation?

Accepted Answer

To isolate sensitive data and systems from the rest of the network.. Network segmentation isolates sensitive data and systems by creating separate broadcast domains or VLANs, restricting unauthorized access and lateral movement. This is a core security principle for protecting critical assets, as it limits the attack surface and enforces access controls between segments.

Answer

To eliminate single points of failure.

Answer

To reduce network latency.

Answer

To simplify routing tables.

Question 6

Which THREE of the following are characteristics of a federated identity management system?

Accepted Answer

It relies on standard protocols such as SAML or OpenID Connect. Option A is correct because federated identity management systems rely on standard protocols like SAML (Security Assertion Markup Language) or OpenID Connect to exchange authentication and authorization data between identity providers (IdPs) and service providers (SPs). These protocols enable trust relationships across different security domains without requiring shared directories or a single IdP.

Answer

It operates with a single identity provider for all organizations

Answer

It requires all participating organizations to use the same user directory

Question 7

A company uses WPA2-Enterprise with EAP-TLS for wireless access. An employee reports that a new laptop cannot connect to the wireless network, while older laptops work fine. The employee has installed the correct client certificate. What is the most likely cause?

Accepted Answer

The RADIUS server's certificate is not trusted by the new laptop.. In WPA2-Enterprise with EAP-TLS, mutual authentication requires the client to validate the RADIUS server's certificate. If the new laptop does not trust the RADIUS server's certificate (e.g., its CA root certificate is missing or expired), the EAP-TLS handshake will fail, preventing connection. Older laptops likely have the necessary root CA installed, while the new laptop does not.

Answer

The wireless network uses WPA2-PSK instead of WPA2-Enterprise.

Answer

The client certificate is not correctly associated with the user account.

Answer

The laptop does not support MSCHAPv2.

Question 8

An organization wants to implement a password policy that balances security and usability. Which of the following is the BEST practice according to current NIST guidelines?

Accepted Answer

Compare new passwords against a list of known compromised passwords. NIST SP 800-63B explicitly recommends checking passwords against a list of known compromised passwords (e.g., from previous breaches) rather than enforcing arbitrary complexity rules. This approach directly mitigates credential stuffing and dictionary attacks by rejecting passwords that have already been exposed, while avoiding user frustration from frequent changes or complex composition requirements.

Answer

Set maximum password length to 8 characters

Answer

Require password changes every 30 days

Answer

Enforce a minimum of one uppercase, one lowercase, one digit, and one special character

Question 9

A network administrator notices that users in the accounting department can access the internet but are unable to access the internal payroll server (10.10.10.50). The firewall rule allows traffic from the accounting subnet (10.10.20.0/24) to the payroll server. What is the most likely issue?

Accepted Answer

The payroll server's default gateway does not have a route back to 10.10.20.0/24.. The most likely issue is that the payroll server's default gateway does not have a route back to the accounting subnet (10.10.20.0/24). Even if the firewall permits outbound traffic from the accounting subnet to the payroll server, the return traffic from the server must be routed back through the firewall or a router that knows how to reach 10.10.20.0/24. Without a return route, the server's response packets are dropped, causing a one-way communication failure.

Answer

DNS is not resolving the payroll server's IP address.

Answer

The firewall rule is applied to the outbound interface only.

Answer

The accounting subnet is blocked by an implicit deny rule.

Question 10

An organization wants to ensure that employees can securely access internal applications from home. They deploy a VPN solution. Which VPN type provides the strongest encryption and is most commonly used for remote access?

Accepted Answer

IPsec with IKEv2 and AES-256. IPsec with IKEv2 and AES-256 provides the strongest encryption for remote access VPNs. IKEv2 offers improved security features like mobility and multi-homing support, while AES-256 is a symmetric cipher with a 256-bit key that is currently considered unbreakable by brute force. This combination is widely deployed for secure client-to-site connections.

Answer

MPLS Layer 3 VPN

Answer

L2TP without encryption

Answer

PPTP