CISSP Practice Test 9 — 10 Questions

Question 1

A company wants to ensure that only authorized software can run on its laptops. They decide to use a hardware component that validates the boot process by measuring each component before it loads. Which technology is being used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Trusted Platform Module (TPM). A Trusted Platform Module (TPM) is a dedicated hardware chip that performs cryptographic measurements of boot components — firmware, bootloader, and OS — storing hashes in Platform Configuration Registers (PCRs). These measurements enable a measured boot and, combined with secure boot, ensure only authorized, unmodified software loads. The question's emphasis on a hardware component validating the boot process by measuring each component maps directly to TPM's role.

Answer

Trusted Execution Environment (TEE)

Answer

Security Kernel

Answer

Hypervisor

Question 2

A hospital is subject to HIPAA. Which of the following is required when sharing protected health information (PHI) with a third-party billing company?

Accepted Answer

Business Associate Agreement. Under HIPAA, any third party that creates, receives, maintains, or transmits protected health information on behalf of a covered entity is a Business Associate, and a Business Associate Agreement (BAA) is legally required before PHI can be shared. The billing company qualifies as a business associate, so a BAA must be in place.

Answer

Annual audit report

Answer

Patient consent

Answer

Data Protection Impact Assessment

Question 3

Which role is ultimately accountable for the classification of data within an organization?

Accepted Answer

Data owner. The data owner is the senior manager or business leader ultimately accountable for the data's classification, protection, and use. They hold the authority and responsibility for deciding how data is categorized (e.g., public, internal, confidential, restricted) based on its sensitivity and business value. Accountability cannot be delegated to custodians or stewards, who execute the owner's decisions.

Answer

Data steward

Answer

Data custodian

Answer

Data processor

Question 4

Which of the following is a primary function of a Trusted Platform Module (TPM)?

Accepted Answer

Storing cryptographic keys securely. A Trusted Platform Module (TPM) is a hardware chip that securely stores cryptographic keys, certificates, and measurements used for platform integrity and encryption. Its primary function is secure key storage and cryptographic operations, such as protecting BitLocker keys and enabling measured boot. Option D correctly identifies this core capability.

Answer

Encrypting network traffic

Answer

Providing antivirus protection

Answer

Enforcing access control policies

Question 5

A security analyst discovers that an application allows a user to read a file they just wrote before the file's integrity is verified, due to a gap between the time of check and time of use. This is an example of which vulnerability?

Accepted Answer

TOCTOU. A Time-of-Check to Time-of-Use (TOCTOU) vulnerability occurs when a resource's state is verified (check) and then used (use) in separate operations, allowing an attacker to alter the resource between the two steps. The scenario — reading a file before integrity verification completes — is a textbook TOCTOU race condition.

Answer

Covert channel

Answer

Buffer overflow

Answer

Side-channel attack

Question 6

Under the GDPR, a data controller experiences a personal data breach that is likely to result in a risk to the rights and freedoms of individuals. What is the maximum time frame within which the controller must notify the supervisory authority?

Accepted Answer

72 hours. Article 33 of the GDPR requires that a controller notify the competent supervisory authority of a personal data breach likely to result in a risk to the rights and freedoms of natural persons without undue delay and, where feasible, no later than 72 hours after becoming aware of it. This 72-hour window is the regulatory maximum, and failure to meet it must be accompanied by reasons for the delay. The 72-hour clock starts when the controller becomes aware, not when the breach occurred.

Answer

24 hours

Answer

48 hours

Answer

7 days

Question 7

A development team is implementing cryptographic functions for a new application. They need to store passwords securely. Which of the following is the most appropriate approach?

Accepted Answer

Use a key derivation function (e.g., bcrypt) with a per-user salt. Passwords must be stored using a slow, salted, adaptive key derivation function such as bcrypt, scrypt, Argon2, or PBKDF2. A per-user salt prevents rainbow-table and precomputation attacks, and the deliberately slow work factor makes brute-force and GPU-accelerated cracking impractical. bcrypt with a per-user salt is the canonical correct answer for secure password storage.

Answer

Encrypt passwords using AES-256 with a static key

Answer

Store passwords in plaintext but in a protected database

Answer

Hash passwords with SHA-256 without salt

Question 8

A cloud service provider uses a Type 1 hypervisor to host multiple virtual machines (VMs) for different customers. Which of the following is a primary security concern specific to this architecture?

Accepted Answer

Virtual machine escape from one guest to the hypervisor or other guests. A Type 1 hypervisor runs directly on the host hardware, and a VM escape vulnerability allows an attacker in a guest VM to break out and access the hypervisor or other guests, compromising the entire host. This is a primary security concern because it breaks the isolation boundary that multi-tenancy relies on.

Answer

Inability to patch the hypervisor without downtime

Answer

Performance degradation due to resource sharing

Answer

Lack of support for legacy operating systems

Question 9

A company wants to ensure that data labeled 'Internal Use Only' is not inadvertently disclosed to unauthorized parties. What is the most effective way to communicate handling requirements to employees?

Accepted Answer

Implementing a data classification policy and training employees on labeling and handling procedures. A data classification policy defines the categories (e.g., Public, Internal Use Only, Confidential) and the required handling procedures for each, and employee training ensures that everyone who creates or handles data knows how to label and protect it. This is the most effective way to communicate handling requirements because it establishes both the rule and the human behavior needed to follow it. Technical controls alone cannot fully prevent inadvertent disclosure by authorized users.

Answer

Using data loss prevention (DLP) software

Answer

Encrypting all data at rest

Answer

Restricting access to the data through role-based access control

Question 10

What is the primary purpose of a Change Advisory Board (CAB) in change management?

Accepted Answer

To approve and oversee changes to IT systems. The CAB is a governance body whose core function is to review, evaluate, and formally approve or reject proposed changes to IT systems before they are implemented. It balances the need for change against risk and business impact, ensuring changes are authorized, prioritized, and scheduled appropriately. This approval/oversight role is distinct from actually performing the change or handling security operations.

Answer

To conduct vulnerability assessments

Answer

To implement changes in the IT environment

Answer

To respond to security incidents