CISSP Practice Test 9 — 10 Questions

Question 1

You are the security architect for a global financial firm. The organization has recently deployed a new cloud-based application that requires low-latency connections between data centers in New York, London, and Tokyo. The existing WAN uses MPLS L3 VPNs with IPsec encryption. However, the application team reports excessive latency and packet loss during peak hours. The network team confirms that the MPLS links are underutilized, but the IPsec tunnels show high CPU usage on the edge routers. Additionally, the security policy mandates that all inter-data center traffic must be encrypted and authenticated. The firm has a budget for hardware upgrades but wants to minimize operational changes. Which of the following is the BEST course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Upgrade the edge routers to models that support hardware-accelerated IPsec encryption.. The high CPU usage on edge routers is a classic symptom of software-based IPsec encryption overwhelming the router's CPU. Hardware-accelerated IPsec offloads the cryptographic operations to dedicated ASICs or crypto engines, reducing CPU load and eliminating the latency and packet loss caused by processing bottlenecks. This directly addresses the root cause without changing the security policy or requiring major operational changes.

Answer

Reduce the IPsec encryption algorithm to AES-128 and the hash to SHA-1 to lower CPU usage.

Answer

Replace MPLS with dedicated point-to-point circuits and remove IPsec encryption.

Answer

Increase the MTU on the WAN interfaces to reduce packet fragmentation.

Question 2

A developer uses a tool that analyzes source code for potential security flaws without executing the program. This is an example of:

Accepted Answer

SAST. SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. This matches the description of a tool that inspects code statically, making D the correct answer.

Answer

DAST

Answer

IAST

Answer

RASP

Question 3

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. A smart card is a Type 2 authentication factor because it falls under the category of 'something you have.' Type 2 factors are possession-based, meaning the user must physically possess the token to authenticate. Smart cards store cryptographic keys or certificates and require a card reader to present the credential, making them a classic example of a possession factor.

Answer

Answer

Password

Answer

Fingerprint

Question 4

A company is deploying a new web application and needs to ensure that only HTTPS traffic is allowed. What is the MOST effective way to enforce this at the network perimeter?

Accepted Answer

Allow TCP port 443 only and block port 80.. Blocking TCP port 80 and allowing only TCP port 443 at the network perimeter ensures that only HTTPS traffic can enter or leave the network. This is the most effective method because it directly enforces the protocol restriction at the firewall, preventing any HTTP traffic from bypassing encryption. Allowing both ports would permit unencrypted HTTP, while using a proxy or blocking port 443 would either add unnecessary complexity or deny legitimate HTTPS traffic.

Answer

Configure the firewall to allow TCP port 80 and 443.

Answer

Use a proxy server to decrypt all traffic.

Answer

Block TCP port 443.

Question 5

Which of the following is the primary purpose of a hardware security module (HSM)?

Accepted Answer

Generating and storing cryptographic keys securely. A hardware security module (HSM) is a dedicated, tamper-resistant hardware appliance designed to securely generate, store, and manage cryptographic keys throughout their lifecycle. Its primary purpose is to protect the root of trust for encryption operations, ensuring that private keys never leave the secure boundary of the module. This is critical for high-assurance environments such as certificate authorities (CAs) and payment processing systems.

Answer

Filtering malicious traffic

Answer

Encrypting hard drives at rest

Answer

Accelerating network traffic

Question 6

During a risk assessment, a company identifies that its primary data center is located in a flood-prone area. The estimated annual loss expectancy (ALE) for a flood event is $500,000. Installing flood barriers costs $200,000 and reduces the ALE to $50,000. What is the net benefit of implementing the flood barriers?

Accepted Answer

$250,000. The net benefit is calculated as the reduction in ALE minus the cost of the control. The original ALE is $500,000, and after implementing flood barriers the ALE drops to $50,000, a reduction of $450,000. Subtracting the $200,000 cost of the barriers yields a net benefit of $250,000. This aligns with the CISSP risk management formula: Net Benefit = (ALE_old - ALE_new) - Cost_of_control.

Answer

$300,000

Answer

$450,000

Answer

$200,000

Question 7

An organization uses a custom application that stores user passwords using salted SHA-256 hashes. During a security audit, the auditor recommends migrating to a more secure password storage mechanism. Which of the following is the best recommendation?

Accepted Answer

Use bcrypt with a cost factor of 12. bcrypt is a deliberately slow, adaptive password hashing function that includes a built-in salt and a configurable cost factor. A cost factor of 12 makes each hash computation computationally expensive, effectively thwarting brute-force and GPU-based attacks. Unlike SHA-256, which is designed for speed and can be cracked rapidly with modern hardware, bcrypt's design inherently resists parallelization and ASIC/GPU acceleration.

Answer

Use plaintext with database encryption

Answer

Use AES-256 encryption for passwords

Answer

Use MD5 with a salt

Answer

Use PBKDF2 with 10,000 iterations

Question 8

A DevOps team implements a CI/CD pipeline that runs security scans automatically. The pipeline fails often due to false positives, causing delays. Which approach balances security and efficiency?

Accepted Answer

Tune scan rules to reduce false positives while retaining critical checks.. Tuning scan rules reduces false positives by adjusting thresholds or disabling low-severity checks while preserving critical security controls (e.g., SAST rules for OWASP Top 10). This maintains automated security validation in the CI/CD pipeline without blocking development velocity, aligning with the principle of 'secure enough' rather than 'perfect security'.

Answer

Turn off all security scans.

Answer

Manually review every false positive.

Answer

Only run scans on code that is deployed to production.

Question 9

Which THREE of the following are common security design principles? (Select THREE.)

Accepted Answer

Open design. Open design (A) is a fundamental security principle stating that the security of a system should not depend on the secrecy of its implementation; instead, it relies on the strength of its cryptographic keys and algorithms. This principle is embodied in Kerckhoffs's principle, which asserts that a cryptosystem should remain secure even if everything about the system, except the key, is public knowledge. Open design allows for public scrutiny and peer review, which helps identify vulnerabilities and build trust in the system's security.

Answer

Single point of failure

Answer

Security through obscurity

Question 10

An organization's data retention policy specifies that customer records must be retained for five years after the end of the business relationship. After that period, what should be done with the data according to best practices?

Accepted Answer

Securely destroy the data. Once the retention period expires, data should be securely destroyed to prevent unauthorized access and comply with privacy regulations.

Answer

Continue retaining the data indefinitely for future use

Answer

Archive the data to offline storage

Answer

Anonymize the data and keep it