CISSP Security Architecture and Engineering Practice Test 2 — 15 Questions

Question 1

A security architect is evaluating access control models for a healthcare system where users have specific roles (e.g., doctor, nurse, admin) and permissions are assigned based on those roles. However, the architect also wants to incorporate attributes such as time of day, patient consent status, and device type. Which TWO models should be combined to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ABAC. Option D (RBAC) is correct because the scenario explicitly states that users have specific roles such as doctor, nurse, and admin, and permissions are assigned based on those roles — this is the defining characteristic of Role-Based Access Control, where access rights are grouped into roles and users are assigned to roles. Option C (ABAC) is correct because the architect additionally wants to enforce dynamic, fine-grained conditions such as time of day, patient consent status, and device type, which are attributes evaluated at request time — exactly what Attribute-Based Access Control provides through policies combining subject, resource, action, and environmental attributes. Combining RBAC and ABAC (often called a hybrid or role-and-attribute model) lets roles provide coarse-grained baseline permissions while attributes refine decisions for context-sensitive healthcare access. Option A (Clark-Wilson) is not selected because it is an integrity model focused on well-formed transactions and separation of duties, not on role- or attribute-driven access decisions. Option B (MAC) is not selected because it relies on mandatory labels and clearances rather than the role and contextual attribute inputs described. Option E (DAC) is not selected because it grants resource owners discretionary control via ACLs, which does not satisfy the role-based and attribute-based requirements stated.

Answer

Clark-Wilson

Answer

MAC

Answer

DAC

Question 2

A security engineer is investigating a covert channel in a system. Which TWO types of covert channels could be used to leak information from a high-security to a low-security process?

Accepted Answer

Covert timing channel. Option C, a covert timing channel, is correct because it leaks information by modulating the timing of events (e.g., CPU scheduling, packet delays, or response latencies) so that a high-security process signals bits to a low-security process without sharing a direct data object. Option E, a covert storage channel, is correct because it leaks information by writing to and reading from a shared storage resource (e.g., file locks, disk sectors, or memory locations) whose presence or value is observable across security levels. Option A, TOCTOU, is a race-condition vulnerability class, not a covert channel type, so it does not belong. Option B, emanations, refers to unintentional electromagnetic or acoustic leakage, which is a side-channel phenomenon rather than the intentional signaling mechanism of a covert channel. Option D, side-channel, is a broader category of information leakage (e.g., power, cache, or timing analysis) and is not one of the two standard covert channel types asked for here.

Answer

TOCTOU

Answer

Emanations

Answer

Side-channel

Question 3

An organization is implementing a defense-in-depth strategy for a data center. Which THREE of the following are examples of physical security controls that align with layered defense?

Accepted Answer

Card reader at building entrance. Option C (card reader at building entrance) is correct because it is a physical access control that authenticates individuals before they can enter the facility, forming an outer layer of defense. Option D (server cage locks) is correct because locking cages around server racks physically restrict access to the most sensitive hardware, adding an inner layer of protection even after someone has entered the building. Option E (perimeter fencing) is correct because fencing establishes the outermost physical boundary of the data center, deterring and delaying unauthorized entry. Options A (antivirus software) and B (network intrusion detection system) are logical/technical controls, not physical security controls, so they do not belong in this layered physical defense scenario.

Answer

Antivirus software

Answer

Intrusion detection system on the network

Question 4

A government agency requires a security model that prevents users from reading documents at a higher classification level and from writing to documents at a lower classification level. Which model enforces these constraints?

Accepted Answer

Bell-LaPadula. Bell-LaPadula is the mandatory access control model focused on confidentiality. Its two core rules are 'no read up' (a subject cannot read data at a higher classification) and 'no write down' (a subject cannot write to a lower classification), which exactly match the government agency's stated constraints. The simple security property and the *-property (star property) enforce these respectively.

Answer

Brewer-Nash

Answer

Clark-Wilson

Answer

Biba

Question 5

An organization implements a security model where users can only read objects at or below their security clearance, and can only write to objects at or above their clearance. This model primarily ensures:

Accepted Answer

Confidentiality. The described model is the Bell-LaPadula model: 'no read up' (subjects can only read at or below their clearance) and 'no write down' (subjects can only write at or above their clearance). Both rules exist to prevent sensitive information from leaking to lower classification levels, so the model primarily ensures confidentiality.

Answer

Integrity

Answer

Accountability

Answer

Availability

Question 6

A financial institution must ensure that transactions are well-formed and enforce separation of duties to prevent fraud. Which security model best addresses these requirements?

Accepted Answer

Clark-Wilson. The Clark-Wilson model is specifically designed for commercial integrity and enforces well-formed transactions and separation of duties through its access control triple (subject, program, object). It ensures that data can only be modified through certified transformation procedures, which directly addresses the requirement for well-formed transactions and fraud prevention via separation of duties. This makes it the correct model for financial transaction integrity.

Answer

Biba

Answer

Brewer-Nash

Answer

Bell-LaPadula

Question 7

Which access control model allows the owner of a resource to grant or deny access to other users?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is defined by the property that the owner of a resource (its creator or designated owner) has discretion to grant or revoke access to other subjects, typically via ACLs or permission bits. This owner-controlled delegation is the defining characteristic that separates DAC from MAC, RBAC, and ABAC.

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 8

An organization uses a system where access decisions are based on user attributes (e.g., job title, clearance), resource attributes (e.g., classification), and environmental factors (e.g., time of day). This is an example of:

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) makes access decisions by evaluating attributes of the user (e.g., job title, clearance), the resource (e.g., classification), and the environment (e.g., time of day). This dynamic, policy-based approach is exactly what the question describes. ABAC is more granular than RBAC and allows for complex, context-aware rules.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 9

A security team is investigating a vulnerability where an attacker can intercept and modify data as it moves between processes within a CPU's secure enclave. Which technology is designed to protect against such attacks by creating a trusted execution environment?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel SGX creates a trusted execution environment (enclave) inside the CPU that isolates code and data from the rest of the system, including the OS and hypervisor, protecting against interception and modification of data in use. It encrypts enclave memory and enforces access controls at the hardware level, which directly addresses intra-CPU tampering between processes. This is why SGX is the correct answer for protecting data within a secure enclave.

Answer

Trusted Platform Module (TPM)

Answer

Measured Boot

Answer

Secure Boot

Question 10

Which cryptographic algorithm is a symmetric block cipher widely used for encrypting sensitive data, with key sizes of 128, 192, or 256 bits?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a symmetric block cipher standardized by NIST (FIPS 197) that operates on 128-bit blocks and supports key sizes of 128, 192, and 256 bits. It replaced DES/3DES for most data-at-rest and data-in-transit encryption. The question's key-size list (128/192/256) is the defining signature of AES.

Answer

RSA

Answer

RC4

Answer

ECC

Question 11

A security architect is deploying a public key infrastructure (PKI) and wants to ensure that certificate revocation status is verified efficiently without relying on a centralized CRL distribution point. Which technique should be used?

Accepted Answer

OCSP Stapling. OCSP Stapling allows the server to obtain a signed, time-stamped OCSP response from the CA and present it to clients during the TLS handshake, so clients do not need to contact the OCSP responder directly. This eliminates the latency and privacy concerns of real-time OCSP lookups and avoids reliance on a centralized CRL distribution point. It is the standard technique for efficient, decentralized revocation checking.

Answer

Certificate Transparency Logs

Answer

Certificate Pinning

Answer

Self-Signed Certificates

Question 12

An organization deploys a hypervisor to host multiple virtual machines. To mitigate the risk of VM escape attacks, which of the following is the most effective security measure?

Accepted Answer

Disabling all unnecessary hypervisor services and applying security patches. Disabling unnecessary hypervisor services reduces the attack surface available to a guest attempting VM escape, and applying hypervisor security patches closes known vulnerabilities (e.g., VENOM, CVE-2015-3456) that allow guest-to-host breakout. Since the hypervisor is the isolation boundary between VMs and the host, hardening and patching it directly addresses the escape vector. This is the most effective preventive control because it targets the root cause rather than the symptoms.

Answer

Using Type 2 hypervisor only

Answer

Using VLANs to isolate VM traffic

Answer

Enabling VM snapshots for quick recovery

Question 13

A software developer is concerned about buffer overflow vulnerabilities. Which combination of mitigations makes it most difficult for an attacker to exploit a stack-based buffer overflow?

Accepted Answer

Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). DEP marks memory pages as non-executable, so even if an attacker successfully overwrites the return address and injects shellcode onto the stack, the CPU will refuse to execute it. ASLR randomizes the base addresses of the stack, heap, and libraries, forcing the attacker to guess memory locations, which dramatically reduces the reliability of return-to-libc or ROP-style exploits. Together they block both code injection and reliable redirection, making exploitation far harder than either mitigation alone.

Answer

Using a privileged account to run the application

Answer

Disabling stack protection

Answer

Stack canaries and NOP sleds

Question 14

Which type of covert channel uses the timing of events or operations to transmit information?

Accepted Answer

Timing channel. A timing channel is a covert channel that conveys information by modulating the timing of events or operations — for example, varying the delay between packets or CPU bursts so a receiver can decode bits from the timing pattern. It is a type of side channel where the shared resource is time itself.

Answer

Emanations channel

Answer

Side channel

Answer

Storage channel

Question 15

A security architect is designing a physical security system for a data center. Which of the following is an example of a layered physical control at the perimeter?

Accepted Answer

Fencing around the property. Fencing around the property is a perimeter-layer physical control that provides a first line of defense by deterring and delaying intruders before they reach the building. In a layered defense-in-depth model, perimeter controls (fencing, bollards, lighting, gates) sit at the outermost ring, ahead of building entry controls and interior controls. This makes fencing the only option that operates at the perimeter layer.

Answer

Biometric access to server room

Answer

Locked server cabinets

Answer

CCTV in the lobby