CISSP Practice Test 9 — 10 Questions

Question 1

Refer to the exhibit. The ACL is applied inbound on the DMZ interface. What is the effect of this configuration?

Accepted Answer

The ACL allows HTTP requests to the web server and allows the web server to respond, but blocks it from initiating new connections to the inside.. The ACL is applied inbound on the DMZ interface, meaning it filters traffic entering the DMZ from the outside. The specific permit statement allows HTTP (TCP port 80) traffic from any source to the web server's IP address. Because the ACL is inbound, it only controls traffic arriving at the DMZ interface; return traffic from the web server to the inside is not subject to this ACL (it is evaluated by the outbound ACL on the inside interface or by stateful inspection). Thus, the web server can respond to HTTP requests (which are part of the same session), but it cannot initiate new connections to the inside because those would be outbound from the DMZ and not permitted by the inbound ACL on the DMZ interface.

Answer

The ACL permits all HTTP traffic to the web server and blocks all other traffic.

Answer

The ACL permits the web server to respond to HTTP requests but blocks all other outbound traffic.

Answer

The ACL allows the web server to initiate connections to the internal network.

Question 2

A healthcare organization implements a policy requiring all employees to use biometric fingerprint scanners to access patient records. Which of the following is the MOST significant risk associated with this authentication method?

Accepted Answer

Biometric data cannot be revoked or changed if compromised. Biometric data, such as fingerprint templates, is immutable and permanently tied to the individual. Once compromised, the user cannot simply 'reset' their fingerprint like a password, rendering the authentication factor permanently insecure for that user across all systems where it is used. This non-repudiation and revocation failure represents the most significant long-term risk to the organization's identity management infrastructure.

Answer

High false acceptance rate leading to unauthorized access

Answer

Low user acceptance due to privacy concerns

Answer

Increased login time compared to password authentication

Question 3

Which THREE of the following are best practices for securing a wireless network?

Accepted Answer

Disable SSID broadcast.. Disabling SSID broadcast prevents the access point from including the network name in beacon frames. While this does not hide the network from determined attackers using packet analyzers, it reduces casual discovery and is considered a basic security hardening step in defense-in-depth.

Answer

Enable WPS (Wi-Fi Protected Setup).

Answer

Use WEP encryption.

Question 4

A multinational corporation deploys a single sign-on (SSO) solution using SAML 2.0 across all subsidiaries. Recently, users in one subsidiary report being unable to access an internal application. The identity provider (IdP) logs show successful authentication, but the service provider (SP) logs indicate assertion validation failures. Which of the following is the MOST likely cause?

Accepted Answer

The system clocks on the IdP and SP are significantly out of sync. SAML 2.0 relies on timestamps (NotBefore and NotOnOrAfter) within the assertion for validity. If the system clocks on the identity provider (IdP) and service provider (SP) are significantly out of sync, the SP will reject the assertion as expired or not yet valid, even though the IdP logs show successful authentication. This is the most common cause of assertion validation failures in cross-domain SSO deployments.

Answer

The SP is configured to require a specific SAML attribute not present in the assertion

Answer

The IdP server for the subsidiary is temporarily unreachable

Answer

The SAML certificate used by the SP has expired

Question 5

A security auditor is reviewing the results of a recently completed internal vulnerability scan. The scan report shows several hosts with the same vulnerability. Which of the following actions should the auditor take FIRST?

Accepted Answer

Manually verify the vulnerability on a sample of affected hosts.. The auditor must first manually verify the vulnerability on a sample of affected hosts because automated vulnerability scans can produce false positives due to factors like incomplete banner grabbing, outdated plugin signatures, or network-level interference. Confirming the finding ensures that subsequent remediation efforts are based on accurate, validated data, preventing wasted resources on non-existent issues.

Answer

Immediately apply patches to all affected hosts.

Answer

Remove the hosts from the network until the vulnerability is resolved.

Answer

Re-run the scan with a different scanner.

Question 6

A company wants to implement multi-factor authentication (MFA) for remote access. Which combination of factors represents something you have and something you are?

Accepted Answer

Smart card and fingerprint. Option C is correct because a smart card is a physical device that you possess (something you have), and a fingerprint is a biometric characteristic unique to you (something you are). This combination satisfies the multi-factor authentication requirement by using two distinct factors from different categories, which is more secure than using two factors from the same category.

Answer

Password and PIN

Answer

Hardware token and mobile phone

Answer

Password and SMS code

Question 7

An organization uses OAuth 2.0 for delegated access to APIs. A developer creates a public client application that runs on mobile devices. Which OAuth 2.0 grant type is MOST appropriate for this scenario?

Accepted Answer

Authorization Code Grant with PKCE. The Authorization Code Grant with PKCE (Proof Key for Code Exchange) is the most appropriate for a public client on a mobile device because it prevents authorization code interception attacks. PKCE replaces the client secret with a dynamically generated code verifier and challenge, ensuring that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original verifier. This is the OAuth 2.0 Security Best Current Practice (BCP) recommendation for native and mobile apps.

Answer

Client Credentials Grant

Answer

Implicit Grant

Answer

Resource Owner Password Credentials Grant

Question 8

Which TWO of the following are valid methods to enforce separation of duties in an access control system?

Accepted Answer

Using time-based restrictions to prevent overlapping tasks. Time-based restrictions enforce separation of duties by preventing a single user from performing conflicting tasks during overlapping time periods. For example, a user authorized to initiate a payment transaction cannot also approve it within the same time window, ensuring that no single individual has end-to-end control over a sensitive process. This is a technical control that directly supports the principle of separation of duties in an access control system.

Answer

Requiring mandatory vacations for all employees

Answer

Performing job rotation every six months

Answer

Configuring shared accounts for each department

Question 9

A security analyst runs a vulnerability scan against a web application and receives a report listing several critical vulnerabilities. However, the development team argues that many of these findings are false positives. Which of the following is the BEST next step for the analyst?

Accepted Answer

Manually verify a sample of the findings to confirm true vs. false positives.. Option B is correct because manual verification is the definitive method to distinguish true positives from false positives in vulnerability scanning. Automated scanners can produce false positives due to factors like incomplete service fingerprinting or reliance on banner grabbing, which may not reflect actual exploitability. The analyst must validate a representative sample of findings against the actual application behavior and configuration before taking further action.

Answer

Re-scan the application with the same settings to confirm the results.

Answer

Escalate all critical findings to management immediately.

Answer

Retune the vulnerability scanner to reduce false positives and re-scan.

Question 10

Which TWO of the following are types of access control models?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is an access control model where the owner of a resource (e.g., a file or object) has the authority to grant or deny access to other subjects. This is typically implemented using Access Control Lists (ACLs) on objects, allowing the owner to set permissions (e.g., read, write, execute) for specific users or groups. DAC is defined in the Trusted Computer System Evaluation Criteria (TCSEC) as a fundamental model for controlling access based on the identity of subjects and/or the groups to which they belong.

Answer

SAML

Answer

Kerberos

Answer

LDAP

CISSP Practice Test 9 — 10 Questions

Exhibit

CISSP Practice Test 9 — 10 Questions

Exhibit