CISSP Practice Test 8 — 10 Questions

Question 1

During a security audit, it is discovered that a network firewall is allowing traffic based on source IP address only, without inspecting application-layer data. Which type of firewall is this?

Accepted Answer

Packet filter. A packet filter firewall operates at Layer 3 (Network) and Layer 4 (Transport) of the OSI model, making decisions solely based on source and destination IP addresses, ports, and protocols. It does not inspect application-layer data (Layer 7), which matches the scenario where traffic is allowed based on source IP address only. This is the simplest and fastest type of firewall, but it lacks the ability to block attacks embedded in application payloads.

Answer

Circuit-level gateway

Answer

Application gateway

Answer

Stateful inspection

Question 2

A security administrator is reviewing potential risks associated with orphaned accounts. Which TWO of the following are risks of orphaned accounts?

Accepted Answer

Attackers can use orphaned accounts to gain unauthorized access. Orphaned accounts are active accounts of former employees or unused accounts, which can be exploited to gain unauthorized access or persist undetected.

Answer

Compliance with password policies is weakened

Answer

Performance degradation of authentication servers

Answer

Increased logging overhead

Question 3

In Kerberos, which component issues ticket-granting tickets (TGTs) after verifying the user's credentials?

Accepted Answer

Authentication Server (AS). The Authentication Server (AS) is responsible for issuing TGTs after verifying the user's password or other credentials.

Answer

Domain Controller

Answer

Ticket Granting Server (TGS)

Answer

Key Distribution Center (KDC)

Question 4

Which type of scanning provides the most comprehensive view of an organization's vulnerabilities by allowing the scanner to log into systems and access detailed configuration information?

Accepted Answer

Authenticated scan. Authenticated scans use credentials to access system internals, providing deeper insight than unauthenticated scans.

Answer

External scan

Answer

Passive scan

Answer

Unauthenticated scan

Question 5

In a software-defined network (SDN) architecture, the control plane is separated from the data plane. A network administrator is troubleshooting packet forwarding delays. Which plane is directly responsible for forwarding packets?

Accepted Answer

Data plane. In SDN, the data plane (also called the forwarding plane) is directly responsible for forwarding packets based on flow table entries installed by the controller. It handles per-packet operations like looking up destination addresses, applying actions (e.g., output to port, drop, modify header), and forwarding at line rate. Packet forwarding delays are typically caused by data plane issues such as flow table misses, hardware forwarding pipeline congestion, or inefficient TCAM lookups.

Answer

Application plane

Answer

Control plane

Answer

Management plane

Question 6

A SOC has three tiers: Tier 1 triages alerts, Tier 2 investigates, and Tier 3 performs advanced analysis. An alert about a potential data exfiltration using DNS tunneling is escalated from Tier 1. Which tier is BEST suited to perform deep packet inspection and memory forensics to confirm the exfiltration?

Accepted Answer

Tier 3. Tier 3 handles advanced analysis including memory forensics.

Answer

Incident manager

Answer

Tier 2

Answer

Tier 1

Question 7

A security architect is designing a Single Sign-On (SSO) solution for a web application that needs to support authentication and authorization. Which TWO of the following protocols are best suited for this purpose? (Select TWO)

Accepted Answer

OpenID Connect (OIDC). SAML 2.0 and OpenID Connect (OIDC) are both SSO protocols that provide authentication and authorization. OAuth 2.0 alone provides only authorization.

Answer

Kerberos

Answer

LDAP

Answer

OAuth 2.0

Question 8

A company wants to measure the effectiveness of its vulnerability management program. Which metric would best indicate the organization's ability to respond quickly to critical vulnerabilities?

Accepted Answer

Mean time to remediate critical vulnerabilities. Mean time to remediate (MTTR) for critical vulnerabilities directly measures the speed of response, which is a key indicator of program effectiveness.

Answer

Patch compliance percentage

Answer

ROI of security controls

Answer

Number of open vulnerabilities by severity

Question 9

During an incident response, the team identifies that the attacker gained access through a compromised service account with domain admin privileges. Which of the following steps should be taken FIRST to contain the incident?

Accepted Answer

Disable the compromised account and revoke its tokens.. Disabling the compromised account and revoking its tokens (e.g., Kerberos TGTs via `Set-ADAccountControl -Disable` and clearing cached tickets) immediately stops the attacker's current authentication and lateral movement capabilities. This is the fastest containment step because the service account with Domain Admin privileges is the direct vector; isolating systems or resetting all passwords is slower and may not address active token reuse.

Answer

Isolate all affected systems from the network.

Answer

Reset all user passwords.

Answer

Perform a full forensic analysis before any action.

Question 10

A security analyst notices that the SIEM is generating an overwhelming number of low-priority alerts from a single application server. The server is critical to operations. What is the BEST approach to reduce noise without compromising security?

Accepted Answer

Create a suppression rule for known benign patterns.. Suppression rules allow the SIEM to filter out known benign patterns (e.g., routine service checks or scheduled scans) while still capturing genuine threats. This reduces alert fatigue without disabling monitoring for the critical server, preserving visibility into anomalous or malicious activity.

Answer

Increase the severity threshold for that server's alerts.

Answer

Disable all alerts from that server.

Answer

Exclude the server from SIEM monitoring.