CISSP Practice Test 8 — 10 Questions

Question 1

Which OAuth 2.0 grant type is recommended for a public client (e.g., single-page application) that cannot securely store a client secret?

Accepted Answer

Authorization code grant with PKCE. Authorization Code grant with PKCE (Proof Key for Code Exchange, RFC 7636) is the OAuth 2.0 best current practice for public clients like SPAs and mobile apps that cannot keep a client secret confidential. PKCE adds a dynamically generated code_verifier and its hashed code_challenge to the authorization request, so even if the authorization code is intercepted, it cannot be exchanged without the verifier. This mitigates authorization code interception attacks that plague public clients.

Answer

Resource owner password credentials grant

Answer

Implicit grant

Answer

Client credentials grant

Question 2

During a risk communication session, the security team needs to present risk analysis results to executive management. Which approach is most effective for this audience?

Accepted Answer

A high-level summary highlighting top risks and recommended actions. Executive management needs decision-oriented information, not technical detail, so a concise summary of the top risks with clear recommended actions and business impact enables them to prioritize funding and accept or mitigate risk. This aligns with the CISSP principle that risk communication must be tailored to the audience's role and decision-making authority. Presenting the highest-priority risks with actionable recommendations supports governance and informed risk acceptance.

Answer

Raw data from the risk assessment without interpretation

Answer

A comprehensive report with all risk register entries

Answer

Detailed technical explanations of each vulnerability

Question 3

An organization is required to report a personal data breach to the supervisory authority within 72 hours. Which regulation imposes this requirement?

Accepted Answer

GDPR. The GDPR (General Data Protection Regulation) Article 33 mandates that controllers notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to rights and freedoms. This 72-hour window is a signature GDPR requirement. No other listed regulation imposes this specific timeline for personal data breaches.

Answer

PCI DSS

Answer

SOX

Answer

HIPAA

Question 4

An organization wants to identify vulnerabilities in their network without attempting to exploit them. Which type of security assessment should they perform?

Accepted Answer

Vulnerability assessment. A vulnerability assessment is the correct choice because it is a systematic review of security weaknesses in a network or system that identifies vulnerabilities without actively exploiting them. This assessment typically uses automated scanning tools (e.g., Nessus, OpenVAS) to compare system configurations against known vulnerability databases (e.g., CVE, NVD) and reports potential issues, but does not attempt to gain unauthorized access or cause disruption.

Answer

Penetration test

Answer

Security audit

Answer

Security review

Question 5

During a vulnerability management lifecycle, after vulnerabilities are identified and prioritized, what is the NEXT step?

Accepted Answer

Remediation. The vulnerability management lifecycle is typically: identify → prioritize (assess/rank) → remediate → verify → report, with risk acceptance as an alternative outcome to remediation. After vulnerabilities are identified and prioritized, the next action is to remediate (patch, mitigate, or compensate), because prioritization exists to drive remediation decisions. Verification and reporting come after remediation to confirm the fix and communicate status.

Answer

Verification

Answer

Reporting

Answer

Risk acceptance

Question 6

Which of the following is a key requirement for an effective backup strategy to ensure data can be recovered after a ransomware attack?

Accepted Answer

Backups are encrypted and stored offline or air-gapped.. For ransomware resilience, backups must be isolated from the production environment so that malware cannot encrypt or delete them along with production data. Encrypting backups and storing them offline or air-gapped ensures that even if attackers compromise the network and credentials, the backup copies remain intact and recoverable. This directly addresses the ransomware threat model where attackers target connected backups first.

Answer

Incremental backups are performed monthly.

Answer

Backups use the same credentials as the production environment.

Answer

Backups are stored on the same network as production.

Question 7

Which type of data is considered sensitive PII and requires enhanced protection?

Accepted Answer

Social Security number. A Social Security number is a government-issued unique identifier that, if exposed, enables identity theft and fraud, so it is classified as sensitive PII requiring enhanced protection under regulations like GLBA, HIPAA, and state privacy laws. Names, email addresses, and phone numbers are PII but generally lower sensitivity, while job titles are typically not considered sensitive PII at all. The SSN is the classic example of high-sensitivity personal data.

Answer

Name and email address

Answer

Job title

Answer

Phone number

Question 8

An organization wants to ensure that data is protected throughout its lifecycle. Which step in the data lifecycle is most critical for enforcing data retention policies?

Accepted Answer

Archive. The Archive phase of the data lifecycle is where data retention policies are enforced, because this is the stage where data is moved to long-term storage and governed by retention schedules, legal holds, and disposition rules. Retention policies define how long data must be kept and when it must be securely destroyed, and these controls are applied at the archive stage. Without proper archival governance, data may be retained indefinitely or destroyed prematurely, violating regulatory requirements.

Answer

Use

Answer

Create/Collect

Answer

Share

Question 9

A healthcare organization must decommission an old server containing patient health information (PHI) stored on solid-state drives (SSDs). Standard overwriting techniques are ineffective for SSDs due to wear-leveling and bad block mapping. Which sanitization method is most appropriate for these drives?

Accepted Answer

Physical destruction such as shredding or pulverizing. Physical destruction (e.g., shredding or pulverizing) is recommended for SSDs because overwriting may not reach all cells, and degaussing does not affect flash memory.

Answer

Cryptographic erasure by deleting the encryption key

Answer

Degaussing with a high-coercivity degausser

Answer

Overwriting with the DoD 5220.22-M 7-pass standard

Question 10

In a Privileged Access Management (PAM) solution, which feature provides temporary elevation of privileges for specific tasks, reducing the risk of standing privileges?

Accepted Answer

Just-in-time (JIT) access. Just-in-time (JIT) access in a PAM solution provides temporary, on-demand elevation of privileges for specific tasks, eliminating standing privileges that attackers can exploit. It typically involves approval workflows, time-bound access, and automatic revocation. This reduces the attack surface and limits lateral movement.

Answer

Password vaulting

Answer

Break-glass account

Answer

Session recording