CISSP Security Architecture and Engineering — All Questions With Answers

Question 1

An organization is implementing a PKI for internal use. To ensure that certificate revocation status is checked in real-time without relying on periodic CRL downloads, which mechanism should be used?

Accepted Answer

OCSP stapling. The Online Certificate Status Protocol (OCSP) is a protocol used for obtaining the revocation status of an X.509 digital certificate in real-time. It was created as an alternative to Certificate Revocation Lists (CRLs), specifically addressing the overhead and latency issues of downloading large CRL files periodically.

Answer

CT logs

Answer

Certificate pinning

Answer

CRL distribution points

Question 2

A company is designing a secure application that requires hardware-based key storage and remote attestation. Which THREE technologies provide hardware root of trust? Select three.

Accepted Answer

Hardware Security Module (HSM). Option B (HSM) is correct because a Hardware Security Module is a dedicated physical cryptographic device that stores keys in tamper-resistant hardware and anchors trust for key generation, signing, and encryption operations. Option D (TEE) is correct because a Trusted Execution Environment is a hardware-isolated secure area within a processor (e.g., ARM TrustZone) that protects code and data and supports attestation of that isolated environment. Option E (TPM) is correct because a Trusted Platform Module is a discrete or firmware-based hardware chip that provides a hardware root of trust for secure key storage, measured boot, and remote attestation via Platform Configuration Registers (PCRs). Option A (vTPM) is not a hardware root of trust because it is a software-emulated TPM whose trust ultimately depends on the underlying hypervisor and host hardware. Option C (SGX) is not a root of trust in the same sense because it is a set of CPU instructions providing enclave isolation, not a standalone hardware trust anchor for key storage and attestation.

Answer

Virtual Trusted Platform Module (vTPM)

Answer

Software Guard Extensions (SGX)

Question 3

A financial institution is implementing a Clark-Wilson integrity model. Which THREE components are essential to this model?

Accepted Answer

Constrained Data Items (CDIs). The Clark-Wilson integrity model relies on three core internal components to maintain data integrity: Constrained Data Items (CDIs), which are the protected data objects; Transformation Procedures (TPs), which are well-formed transactions that modify CDIs; and Integrity Verification Procedures (IVPs), which verify that CDIs are in a valid state. Unconstrained Data Items (UDIs) represent external, untrusted data that is not subject to the model's integrity controls until it is processed by a TP. User roles/subjects are part of the access triple (Subject, TP, CDI) but are not themselves one of the core data/procedure components of the model.

Answer

User roles

Answer

Unconstrained Data Items (UDIs)

Question 4

In the context of the Clark-Wilson integrity model, which of the following are key elements? (Choose TWO)

Accepted Answer

Constrained Data Items (CDIs). The Clark-Wilson integrity model is designed for commercial applications and focuses on preventing unauthorized modification of data. Its key components include Constrained Data Items (CDIs) (data whose integrity is protected), Unconstrained Data Items (UDIs) (unprotected data), Transformation Procedures (TPs) (well-formed transactions that transition CDIs from one valid state to another), and Integrity Verification Procedures (IVPs) (which confirm that CDIs are in a valid state).

Answer

Simple Security Property

Answer

Lattice-based access control

Answer

No Write Up property

Question 5

A security architect is designing a system for a military intelligence agency where data classification labels (Top Secret, Secret, Confidential, Unclassified) are mandatory. Users are cleared to a specific level and must not read data above their clearance. Which security model enforces this type of access control?

Accepted Answer

Bell-LaPadula model. The Bell-LaPadula model is a mandatory access control (MAC) model built around data confidentiality, using security labels and clearances so that subjects cannot read data above their clearance (no read up) and cannot write data below their level (no write down). This exactly matches the military classification scenario where Top Secret, Secret, Confidential, and Unclassified labels are mandatory and users are cleared to a specific level.

Answer

Biba model

Answer

Brewer-Nash model

Answer

Clark-Wilson model

Question 6

A financial application requires strict integrity controls to prevent unauthorized modifications. The security team implements a model where users cannot write data to higher integrity levels (no write up) and cannot read data from lower integrity levels (no read down). Which model is being applied?

Accepted Answer

Biba. The Biba integrity model is defined by the 'no write up' and 'no read down' rules, which prevent subjects at a lower integrity level from writing to higher levels and prevent subjects at a higher level from reading lower-level (potentially tainted) data. This directly matches the scenario's requirement to prevent unauthorized modifications by preserving integrity across levels. Biba is the integrity counterpart to Bell-LaPadula, which focuses on confidentiality.

Answer

Bell-LaPadula

Answer

Graham-Denning

Answer

Clark-Wilson

Question 7

Which access control model allows data owners to grant or revoke access to resources they own, typically implemented using ACLs?

Accepted Answer

DAC. Discretionary Access Control (DAC) lets the owner of a resource decide who can access it and with what permissions, typically implemented through Access Control Lists (ACLs) on files and objects. Because the data owner grants or revokes access at their discretion, DAC matches the scenario exactly.

Answer

MAC

Answer

RBAC

Answer

ABAC

Question 8

A security architect is selecting a cryptographic algorithm for encrypting data at rest in a backup system. The system requires strong security with a block cipher, and the organization mandates using a NIST-approved algorithm with key sizes of 128, 192, or 256 bits. Which algorithm should be selected?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a NIST-approved symmetric block cipher defined in FIPS 197, supporting key sizes of 128, 192, and 256 bits. It is the standard choice for encrypting data at rest and satisfies all stated requirements.

Answer

RC4

Answer

RSA

Answer

3DES

Question 9

A security engineer is analyzing a vulnerability where an attacker can cause a buffer overflow on the stack. Which mitigation technique randomizes memory addresses to make it harder for the attacker to predict the location of shellcode or return addresses?

Accepted Answer

ASLR. ASLR (Address Space Layout Randomization) randomizes the memory locations of key areas such as the stack, heap, and libraries on each execution, making it difficult for an attacker to predict where shellcode or a return address resides. This directly counters buffer overflow exploitation that relies on fixed addresses. It is the mitigation specifically described as randomizing memory addresses.

Answer

SafeSEH

Answer

Stack canaries

Answer

DEP/NX bit

Question 10

Which of the following is a primary function of a Trusted Platform Module (TPM)?

Accepted Answer

Storing cryptographic keys securely. A Trusted Platform Module (TPM) is a hardware chip that securely stores cryptographic keys, certificates, and measurements used for platform integrity and encryption. Its primary function is secure key storage and cryptographic operations, such as protecting BitLocker keys and enabling measured boot. Option D correctly identifies this core capability.

Answer

Encrypting network traffic

Answer

Providing antivirus protection

Answer

Enforcing access control policies

Question 11

A security architect is evaluating hypervisor security for a multi-tenant cloud environment. Which type of hypervisor is considered more secure because it runs directly on the hardware without a host operating system, reducing the attack surface?

Accepted Answer

Type 1 hypervisor. A Type 1 hypervisor (also called a bare-metal hypervisor) runs directly on the host's physical hardware, with no intervening host operating system. Because there is no general-purpose OS layer to exploit, the attack surface is significantly smaller than a Type 2 hypervisor, which depends on a full host OS. This architectural reduction in exploitable code is why Type 1 hypervisors are preferred in multi-tenant cloud environments.

Answer

Virtual machine monitor

Answer

Containers

Answer

Type 2 hypervisor

Question 12

Which physical security design principle emphasizes that the physical environment should be designed to discourage criminal activity by using natural surveillance, access control, and territorial reinforcement?

Accepted Answer

CPTED. CPTED (Crime Prevention Through Environmental Design) is the discipline that uses natural surveillance (sightlines that make intruders visible), natural access control (directing flow through defined entry points), and territorial reinforcement (fences, signage, landscaping that signal private space) to deter criminal activity. It is a design philosophy applied to the physical environment itself, not a technology or a layered-defense strategy.

Answer

TEMPEST

Answer

Fail-safe

Answer

Layered defense

Question 13

A security analyst discovers that an application allows a user to read a file they just wrote before the file's integrity is verified, due to a gap between the time of check and time of use. This is an example of which vulnerability?

Accepted Answer

TOCTOU. A Time-of-Check to Time-of-Use (TOCTOU) vulnerability occurs when a resource's state is verified (check) and then used (use) in separate operations, allowing an attacker to alter the resource between the two steps. The scenario — reading a file before integrity verification completes — is a textbook TOCTOU race condition.

Answer

Covert channel

Answer

Buffer overflow

Answer

Side-channel attack

Question 14

A security architect is designing a system that must prevent conflicts of interest when a consultant works for two competing clients. Which security model ensures that the consultant cannot access data from one client if they have already accessed data from the other?

Accepted Answer

Brewer-Nash. Brewer-Nash, also known as the Chinese Wall model, is specifically designed to prevent conflicts of interest by dynamically restricting access based on a user's previous access history. Once a consultant accesses data from one client, the model blocks access to any data belonging to a competing client. This is implemented through dynamically changing access control lists that track what each user has already accessed, ensuring that no user can simultaneously hold data from two competing companies.

Answer

Clark-Wilson

Answer

Biba

Answer

Bell-LaPadula

Question 15

Which component of a trusted computing base (TCB) implements the reference monitor concept by enforcing access control decisions for all subjects and objects in the system?

Accepted Answer

Security kernel. The security kernel is the hardware, firmware, and software component of the TCB that implements the reference monitor concept by mediating all access requests between subjects and objects. It enforces the access control policy and is the only portion of the TCB that must be tamper-proof and always invoked. While the reference monitor is the abstract concept, the security kernel is its concrete implementation within the TCB.

Answer

Trusted platform module

Answer

Trusted computing base

Answer

Reference monitor

Question 16

A security architect is evaluating access control models for a healthcare system where users have specific roles (e.g., doctor, nurse, admin) and permissions are assigned based on those roles. However, the architect also wants to incorporate attributes such as time of day, patient consent status, and device type. Which TWO models should be combined to meet these requirements?

Accepted Answer

ABAC. Option D (RBAC) is correct because the scenario explicitly states that users have specific roles such as doctor, nurse, and admin, and permissions are assigned based on those roles — this is the defining characteristic of Role-Based Access Control, where access rights are grouped into roles and users are assigned to roles. Option C (ABAC) is correct because the architect additionally wants to enforce dynamic, fine-grained conditions such as time of day, patient consent status, and device type, which are attributes evaluated at request time — exactly what Attribute-Based Access Control provides through policies combining subject, resource, action, and environmental attributes. Combining RBAC and ABAC (often called a hybrid or role-and-attribute model) lets roles provide coarse-grained baseline permissions while attributes refine decisions for context-sensitive healthcare access. Option A (Clark-Wilson) is not selected because it is an integrity model focused on well-formed transactions and separation of duties, not on role- or attribute-driven access decisions. Option B (MAC) is not selected because it relies on mandatory labels and clearances rather than the role and contextual attribute inputs described. Option E (DAC) is not selected because it grants resource owners discretionary control via ACLs, which does not satisfy the role-based and attribute-based requirements stated.

Answer

Clark-Wilson

Answer

MAC

Answer

DAC

Question 17

A security engineer is investigating a covert channel in a system. Which TWO types of covert channels could be used to leak information from a high-security to a low-security process?

Accepted Answer

Covert timing channel. Option C, a covert timing channel, is correct because it leaks information by modulating the timing of events (e.g., CPU scheduling, packet delays, or response latencies) so that a high-security process signals bits to a low-security process without sharing a direct data object. Option E, a covert storage channel, is correct because it leaks information by writing to and reading from a shared storage resource (e.g., file locks, disk sectors, or memory locations) whose presence or value is observable across security levels. Option A, TOCTOU, is a race-condition vulnerability class, not a covert channel type, so it does not belong. Option B, emanations, refers to unintentional electromagnetic or acoustic leakage, which is a side-channel phenomenon rather than the intentional signaling mechanism of a covert channel. Option D, side-channel, is a broader category of information leakage (e.g., power, cache, or timing analysis) and is not one of the two standard covert channel types asked for here.

Answer

TOCTOU

Answer

Emanations

Answer

Side-channel

Question 18

An organization is implementing a defense-in-depth strategy for a data center. Which THREE of the following are examples of physical security controls that align with layered defense?

Accepted Answer

Card reader at building entrance. Option C (card reader at building entrance) is correct because it is a physical access control that authenticates individuals before they can enter the facility, forming an outer layer of defense. Option D (server cage locks) is correct because locking cages around server racks physically restrict access to the most sensitive hardware, adding an inner layer of protection even after someone has entered the building. Option E (perimeter fencing) is correct because fencing establishes the outermost physical boundary of the data center, deterring and delaying unauthorized entry. Options A (antivirus software) and B (network intrusion detection system) are logical/technical controls, not physical security controls, so they do not belong in this layered physical defense scenario.

Answer

Antivirus software

Answer

Intrusion detection system on the network

Question 19

A government agency requires a security model that prevents users from reading documents at a higher classification level and from writing to documents at a lower classification level. Which model enforces these constraints?

Accepted Answer

Bell-LaPadula. Bell-LaPadula is the mandatory access control model focused on confidentiality. Its two core rules are 'no read up' (a subject cannot read data at a higher classification) and 'no write down' (a subject cannot write to a lower classification), which exactly match the government agency's stated constraints. The simple security property and the *-property (star property) enforce these respectively.

Answer

Brewer-Nash

Answer

Clark-Wilson

Answer

Biba

Question 20

An organization implements a security model where users can only read objects at or below their security clearance, and can only write to objects at or above their clearance. This model primarily ensures:

Accepted Answer

Confidentiality. The described model is the Bell-LaPadula model: 'no read up' (subjects can only read at or below their clearance) and 'no write down' (subjects can only write at or above their clearance). Both rules exist to prevent sensitive information from leaking to lower classification levels, so the model primarily ensures confidentiality.

Answer

Integrity

Answer

Accountability

Answer

Availability

CISSP Security Architecture and Engineering — All Questions With Answers

An organization is implementing a PKI for internal use. To ensure that certificate revocation status is checked in real-time without relying on periodic CRL downloads, which mechanism should be used?

A company is designing a secure application that requires hardware-based key storage and remote attestation. Which THREE technologies provide hardware root of trust? Select three.

A financial institution is implementing a Clark-Wilson integrity model. Which THREE components are essential to this model?

In the context of the Clark-Wilson integrity model, which of the following are key elements? (Choose TWO)

Which access control model allows data owners to grant or revoke access to resources they own, typically implemented using ACLs?

A security engineer is analyzing a vulnerability where an attacker can cause a buffer overflow on the stack. Which mitigation technique randomizes memory addresses to make it harder for the attacker to predict the location of shellcode or return addresses?

Which of the following is a primary function of a Trusted Platform Module (TPM)?

A security architect is evaluating hypervisor security for a multi-tenant cloud environment. Which type of hypervisor is considered more secure because it runs directly on the hardware without a host operating system, reducing the attack surface?

Which physical security design principle emphasizes that the physical environment should be designed to discourage criminal activity by using natural surveillance, access control, and territorial reinforcement?

A security analyst discovers that an application allows a user to read a file they just wrote before the file's integrity is verified, due to a gap between the time of check and time of use. This is an example of which vulnerability?

A security architect is designing a system that must prevent conflicts of interest when a consultant works for two competing clients. Which security model ensures that the consultant cannot access data from one client if they have already accessed data from the other?

Which component of a trusted computing base (TCB) implements the reference monitor concept by enforcing access control decisions for all subjects and objects in the system?

A security engineer is investigating a covert channel in a system. Which TWO types of covert channels could be used to leak information from a high-security to a low-security process?

An organization is implementing a defense-in-depth strategy for a data center. Which THREE of the following are examples of physical security controls that align with layered defense?

A government agency requires a security model that prevents users from reading documents at a higher classification level and from writing to documents at a lower classification level. Which model enforces these constraints?

An organization implements a security model where users can only read objects at or below their security clearance, and can only write to objects at or above their clearance. This model primarily ensures:

A financial institution must ensure that transactions are well-formed and enforce separation of duties to prevent fraud. Which security model best addresses these requirements?

Which access control model allows the owner of a resource to grant or deny access to other users?

An organization uses a system where access decisions are based on user attributes (e.g., job title, clearance), resource attributes (e.g., classification), and environmental factors (e.g., time of day). This is an example of:

A security team is investigating a vulnerability where an attacker can intercept and modify data as it moves between processes within a CPU's secure enclave. Which technology is designed to protect against such attacks by creating a trusted execution environment?

Which cryptographic algorithm is a symmetric block cipher widely used for encrypting sensitive data, with key sizes of 128, 192, or 256 bits?

A security architect is deploying a public key infrastructure (PKI) and wants to ensure that certificate revocation status is verified efficiently without relying on a centralized CRL distribution point. Which technique should be used?

An organization deploys a hypervisor to host multiple virtual machines. To mitigate the risk of VM escape attacks, which of the following is the most effective security measure?

A software developer is concerned about buffer overflow vulnerabilities. Which combination of mitigations makes it most difficult for an attacker to exploit a stack-based buffer overflow?

Which type of covert channel uses the timing of events or operations to transmit information?

A security architect is designing a physical security system for a data center. Which of the following is an example of a layered physical control at the perimeter?

A security analyst is evaluating access control models for a healthcare organization that needs to enforce both confidentiality and integrity. Which TWO models should be considered? Select two.

A security engineer is hardening a system against side-channel attacks that exploit variations in execution time or power consumption. Which TWO mitigations are specifically designed to counter such attacks? Select two.

A government agency requires a security model that prevents users from reading documents classified above their clearance level and from writing classified information to lower-level systems. Which model enforces these constraints?

An organization requires a commercial integrity model where users cannot modify data in higher integrity levels and cannot read data from lower integrity levels. Which model should they implement?

Which access control model allows the data owner to determine who can access their resources, typically using Access Control Lists (ACLs)?

A security architect is implementing a system that must prevent conflicts of interest for a consulting firm serving competing clients. Which security model is best suited for this requirement?

A company is deploying a hypervisor to run multiple virtual servers. To minimize the risk of VM escape attacks, which type of hypervisor should they choose and what hardening measure is most effective?

An organization wants to implement a security mechanism that ensures all accesses are mediated and cannot be bypassed, is tamperproof, and is small enough to be verified. This describes which concept?

Which cryptographic algorithm is an example of a symmetric stream cipher?

A security analyst is investigating a potential data leak via covert channels. Which of the following is an example of a timing covert channel?

A software vulnerability allows an attacker to overwrite a return address on the stack to execute arbitrary code. What mitigation technique randomizes the memory layout to prevent the attacker from predicting target addresses?

A company wants to ensure that only authorized software can run on its laptops. They decide to use a hardware component that validates the boot process by measuring each component before it loads. Which technology is being used?

Which physical security concept uses natural surveillance, territorial reinforcement, and access control to deter crime in built environments?

In a PKI hierarchy, a relying party needs to verify a certificate's validity. To reduce latency and improve privacy, which mechanism allows the relying party to obtain the revocation status without contacting the CA directly for each verification?

A security architect is designing a system to protect against side-channel attacks that exploit electromagnetic emanations. Which TWO controls are most effective?

A security engineer is hardening a web application against race condition vulnerabilities. Which TWO techniques are effective mitigations?

A company is implementing an access control system where permissions are granted based on attributes such as user role, department, time of day, and device trust score. This approach allows for fine-grained policies that can adapt to context. Which access control model is being used?

A security engineer is evaluating a system that uses a Trusted Platform Module (TPM) for secure boot. The TPM measures the boot components and stores the measurements in Platform Configuration Registers (PCRs). Which of the following is a primary security goal achieved by this process?

An organization is implementing a Public Key Infrastructure (PKI) to support secure email and web communications. The PKI includes a root CA, intermediate CAs, and end-entity certificates. Which of the following best describes the role of the root CA in this hierarchy?

A security architect is designing a physical security perimeter for a data center. Which of the following is an example of Crime Prevention Through Environmental Design (CPTED) principle?

An organization is evaluating a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in a file access routine. The routine checks if a user has permission to open a file, then later opens the file. Which of the following best describes the potential exploitation?

A security analyst is investigating a potential covert timing channel in a system. Which of the following characteristics best describes this type of channel?

A cloud service provider uses a Type 1 hypervisor to host multiple virtual machines (VMs) for different customers. Which of the following is a primary security concern specific to this architecture?

A security architect is designing a system that must ensure integrity of commercial transactions. Which of the following models are specifically focused on integrity? (Choose TWO)

A security engineer is hardening a system against buffer overflow attacks. Which of the following are effective mitigations? (Choose THREE)

A company is implementing a PKI to support secure web browsing. Which of the following are commonly used to enhance the security of certificate validation? (Choose TWO)

Which of the following are characteristics of a Trusted Execution Environment (TEE)? (Choose TWO)

A security architect is evaluating physical security controls for a facility handling sensitive data. Which of the following are examples of layered physical security controls? (Choose THREE)

CISSP Security Architecture and Engineering — All Questions With Answers

An organization is implementing a PKI for internal use. To ensure that certificate revocation status is checked in real-time without relying on periodic CRL downloads, which mechanism should be used?

A company is designing a secure application that requires hardware-based key storage and remote attestation. Which THREE technologies provide hardware root of trust? Select three.

A financial institution is implementing a Clark-Wilson integrity model. Which THREE components are essential to this model?

In the context of the Clark-Wilson integrity model, which of the following are key elements? (Choose TWO)

Which access control model allows data owners to grant or revoke access to resources they own, typically implemented using ACLs?

A security engineer is analyzing a vulnerability where an attacker can cause a buffer overflow on the stack. Which mitigation technique randomizes memory addresses to make it harder for the attacker to predict the location of shellcode or return addresses?

Which of the following is a primary function of a Trusted Platform Module (TPM)?

A security architect is evaluating hypervisor security for a multi-tenant cloud environment. Which type of hypervisor is considered more secure because it runs directly on the hardware without a host operating system, reducing the attack surface?

Which physical security design principle emphasizes that the physical environment should be designed to discourage criminal activity by using natural surveillance, access control, and territorial reinforcement?

A security analyst discovers that an application allows a user to read a file they just wrote before the file's integrity is verified, due to a gap between the time of check and time of use. This is an example of which vulnerability?

A security architect is designing a system that must prevent conflicts of interest when a consultant works for two competing clients. Which security model ensures that the consultant cannot access data from one client if they have already accessed data from the other?

Which component of a trusted computing base (TCB) implements the reference monitor concept by enforcing access control decisions for all subjects and objects in the system?

A security engineer is investigating a covert channel in a system. Which TWO types of covert channels could be used to leak information from a high-security to a low-security process?

An organization is implementing a defense-in-depth strategy for a data center. Which THREE of the following are examples of physical security controls that align with layered defense?

A government agency requires a security model that prevents users from reading documents at a higher classification level and from writing to documents at a lower classification level. Which model enforces these constraints?

An organization implements a security model where users can only read objects at or below their security clearance, and can only write to objects at or above their clearance. This model primarily ensures:

A financial institution must ensure that transactions are well-formed and enforce separation of duties to prevent fraud. Which security model best addresses these requirements?

Which access control model allows the owner of a resource to grant or deny access to other users?

An organization uses a system where access decisions are based on user attributes (e.g., job title, clearance), resource attributes (e.g., classification), and environmental factors (e.g., time of day). This is an example of:

A security team is investigating a vulnerability where an attacker can intercept and modify data as it moves between processes within a CPU's secure enclave. Which technology is designed to protect against such attacks by creating a trusted execution environment?

Which cryptographic algorithm is a symmetric block cipher widely used for encrypting sensitive data, with key sizes of 128, 192, or 256 bits?

A security architect is deploying a public key infrastructure (PKI) and wants to ensure that certificate revocation status is verified efficiently without relying on a centralized CRL distribution point. Which technique should be used?

An organization deploys a hypervisor to host multiple virtual machines. To mitigate the risk of VM escape attacks, which of the following is the most effective security measure?

A software developer is concerned about buffer overflow vulnerabilities. Which combination of mitigations makes it most difficult for an attacker to exploit a stack-based buffer overflow?