CISSP Hard Questions — 25 Difficult Questions

Question 1

A financial services company with 5000 employees uses a hybrid identity model with on-premises Active Directory (AD) synchronized to Azure AD via Azure AD Connect. The company has recently deployed Microsoft 365 and uses it for email and file sharing. Users authenticate to Azure AD using password hash synchronization (PHS) with Seamless Single Sign-On (SSO). The security team has implemented Conditional Access policies to require multi-factor authentication (MFA) for all external access and for access to sensitive financial applications. Recently, the help desk has received numerous complaints from users working remotely that they are frequently prompted for MFA, even multiple times during a single work session, causing frustration and productivity loss. Additionally, some users report that they are unable to access certain financial applications despite being in the correct group membership. An investigation reveals that Azure AD Connect synchronization is occurring successfully and that MFA configurations appear correct. The security team suspects that the issue may be related to the Conditional Access session settings or token lifetimes. What is the BEST course of action to diagnose and resolve the primary issue of excessive MFA prompts while maintaining security?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the sign-in frequency and session timeout values in the Conditional Access policies for all users to 24 hours.. The issue of excessive MFA prompts is best resolved by adjusting the 'Sign-in frequency' and 'Persistent browser session' settings in Conditional Access session controls. Increasing sign-in frequency to 24 hours reduces how often users are re-prompted for MFA, directly addressing user frustration while maintaining security. Option C is incorrect because 'Use app enforced restrictions' does not control MFA re-prompt behavior; it relies on the application to enforce its own restrictions, which does not resolve the excessive prompts.

Answer

Implement a privileged identity management (PIM) solution to manage access to the financial applications.

Answer

Review the Conditional Access policy for the financial applications to ensure that the 'Session' controls are configured to 'Use app enforced restrictions' and adjust MFA trust settings.

Answer

Disable Seamless SSO and require users to enter passwords each time to ensure token freshness.

Question 2

A PAM configuration contains pam_tally2.so with deny=5 and unlock_time=300. What is the effect of this configuration?

Accepted Answer

Users are locked out after 5 failed login attempts, and automatically unlocked after 5 minutes. The PAM configuration shows pam_tally2.so with deny=5 and unlock_time=300. Pam_tally2.so with deny=5 locks the user account after 5 failed authentication attempts, and unlock_time=300 sets the automatic unlock period to 300 seconds (5 minutes). This is a standard PAM (Pluggable Authentication Modules) configuration for account lockout policies, commonly used on Linux systems to mitigate brute-force attacks.

Answer

The account is disabled after 5 successful logins

Answer

Passwords must be changed every 5 days

Answer

Users are locked out after 5 failed attempts until manually unlocked

Question 3

Your organization is a medium-sized e-commerce company with a hybrid infrastructure: on-premises datacenter and AWS cloud. The security team recently conducted an internal vulnerability scan of the on-premises network and discovered multiple critical vulnerabilities in a legacy ERP system that cannot be patched because the vendor no longer supports it. The ERP system is essential for order processing and cannot be decommissioned. The team also ran a penetration test against the cloud environment and found that an attacker with network access could leverage misconfigured security groups to move laterally between instances. The company has a risk appetite that allows for limited risk acceptance with compensating controls. As the senior security analyst, what is the BEST course of action?

Accepted Answer

Apply virtual patching via an intrusion prevention system (IPS) for the ERP vulnerabilities and implement stricter security group rules in the cloud to restrict lateral movement.. The best course of action because it applies compensating controls to reduce risk without disrupting operations. Virtual patching via an IPS mitigates the unpatched ERP vulnerabilities, while stricter security group rules limit lateral movement in the cloud. This aligns with the organization's risk appetite for limited risk acceptance with compensating controls. Option A is too disruptive, Option B would cause unacceptable operational disruption, and Option C fails to implement any controls.

Answer

Immediately isolate the legacy ERP system from the network and implement a manual workaround for order processing.

Answer

Decommission the legacy ERP system and migrate to a modern alternative, accepting a temporary disruption in operations.

Answer

Accept the risk for both findings and document them in the risk register without additional controls.

Question 4

A security administrator is evaluating secure file transfer protocols. Which THREE of the following protocols provide encryption for data in transit? (Select THREE.)

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol), SCP (Secure Copy Protocol), and FTPS (FTP Secure) all provide encryption for data in transit. SFTP and SCP both run over SSH (typically TCP port 22), encrypting both credentials and data. FTPS uses SSL/TLS to encrypt the control and data channels. FTP and TFTP transmit data in plaintext and do not provide encryption.

Answer

FTP

Answer

TFTP

Question 5

A network architect is designing a secure connection between two data centers across an untrusted WAN. The requirement is to encrypt all traffic and authenticate both endpoints. Which protocol should be used?

Accepted Answer

IPsec tunnel mode. IPsec tunnel mode is the correct choice because it encrypts the entire IP packet, including the original IP header, and encapsulates it within a new IP header for secure transport across an untrusted WAN. It also provides mutual authentication of both endpoints using IKE (Internet Key Exchange) with pre-shared keys or certificates, satisfying the requirement for encrypting all traffic and authenticating both data centers.

Answer

SSH

Answer

MPLS

Answer

SSL/TLS

Question 6

A company needs to protect data at rest in a cloud storage system. Which THREE encryption methods are appropriate for this purpose?

Accepted Answer

Client-side encryption with key management. To protect data at rest in a cloud storage system, robust encryption methods and architectures must be used:

- Client-side encryption with key management (B) ensures that data is encrypted before being uploaded to the cloud, preventing the cloud provider from accessing the plaintext or keys.
- AES-256 in GCM mode (D) is a symmetric encryption standard that provides both confidentiality and integrity (authenticated encryption), which is critical for protecting stored data against tampering.
- Envelope encryption (E) is a practice where data is encrypted with a unique data encryption key (DEK), and the DEK is then encrypted with a key encryption key (KEK). This is the standard architecture for cloud storage encryption.

Stream ciphers without authentication like RC4 (A) are insecure and vulnerable to bit-flipping attacks. MD5 (C) is a weak hashing algorithm, not an encryption method, and does not provide confidentiality.

Answer

Stream cipher without authentication (e.g., RC4)

Answer

MD5 hashing

Question 7

Which THREE of the following are valid considerations when implementing data loss prevention (DLP) controls to protect sensitive data? (Select three.)

Accepted Answer

User training to reduce false positives and increase acceptance. User training is a critical component of a successful DLP implementation. Without proper training, users may inadvertently trigger false positives by mishandling data or may attempt to bypass controls they perceive as overly restrictive. Training helps users understand classification labels and proper data handling procedures, reducing the operational burden on security teams and increasing overall acceptance of DLP policies.

Answer

Integration with all third-party applications

Answer

Blocking all data transfers to external devices

Question 8

Which THREE of the following are essential components of a software supply chain security program? (Select exactly three.)

Accepted Answer

Using signed and verified software artifacts. Using signed and verified software artifacts ensures integrity and authenticity throughout the software supply chain. By applying cryptographic signatures (e.g., GPG or Sigstore) to artifacts and verifying them before use, organizations can detect tampering and confirm the artifact originated from a trusted source. This is a foundational control to prevent malicious code injection during transit or storage.

Answer

Running penetration tests on the production environment

Answer

Conducting static analysis on all in-house code

Question 9

An organization is acquiring a third-party software product. Which THREE of the following should be included in the security assessment of the vendor?

Accepted Answer

Vulnerability scanning of dependencies. Reviewing the SBOM, vulnerability scanning of dependencies, and vendor security assessments are key elements of third-party security evaluation. Code signing is a deployment control, not assessment; license compliance is legal but not security-specific.

Answer

Verifying software license compliance

Answer

Ensuring code signing is used in the vendor's development process

Question 10

A multinational company must comply with the EU General Data Protection Regulation (GDPR) for processing personal data of EU citizens. The company's data protection officer (DPO) has been appointed but reports to the Chief Marketing Officer (CMO). Which compliance issue is most critical?

Accepted Answer

The DPO must report directly to the board of directors or CEO. Under the GDPR, the Data Protection Officer (DPO) must report directly to the highest level of management, typically the board of directors or CEO, to ensure independence and authority. Reporting to the Chief Marketing Officer (CMO) creates a conflict of interest because the CMO oversees marketing activities that often involve extensive personal data processing, compromising the DPO's ability to provide unbiased oversight. This structural subordination is the most critical compliance issue as it directly undermines the DPO's statutory role under Article 38(3) of the GDPR.

Answer

The DPO should not hold any other role within the organization

Answer

The DPO must be a lawyer certified in data protection

Answer

The DPO must be located in the EU

Question 11

Which THREE of the following are primary objectives of a risk management program?

Accepted Answer

Identify assets. Identifying assets (Option B) is a primary objective because a risk management program must first know what assets exist to assess their value, vulnerabilities, and threats. Without asset identification, subsequent risk analysis, prioritization, and control selection are impossible. This aligns with the NIST SP 800-39 risk management framework, which begins with framing risk through asset inventory.

Answer

Eliminate all risks

Answer

Ensure compliance

Question 12

An organization is reviewing its log management practices. Which THREE of the following are key considerations for effective log review?

Accepted Answer

Log retention policies that comply with legal and regulatory requirements. Effective log management and review require a proactive, structured, and secure approach:

- **Log retention policies (B)** ensure that logs are preserved long enough to satisfy legal, regulatory, and forensic requirements.
- **Regularly scheduled reviews (D)** allow organizations to detect anomalies and potential security incidents proactively, rather than just reacting after a breach.
- **Centralized log management (E)** is critical for aggregating logs from diverse sources and correlating events to identify complex attack patterns.

Conversely, reviewing logs only after an incident (A) is purely reactive and misses the opportunity for early detection. Storing logs in plaintext without access controls (C) exposes sensitive audit data to unauthorized modification or disclosure, compromising log integrity.

Answer

Reviewing logs only after a security incident

Answer

Storing logs in plaintext without access controls

Question 13

A forensic investigator arrives at a crime scene involving a compromised server. The server is still running. According to the order of volatility, which of the following should the investigator capture FIRST?

Accepted Answer

CPU registers. CPU registers are the most volatile and must be captured first to preserve critical evidence.

Answer

RAM contents

Answer

Hard disk contents

Answer

Network connections

Question 14

A large financial institution is migrating its core banking system to a private cloud. The architecture must protect against data leakage between different business units sharing the same physical infrastructure. The system uses a hypervisor and virtual machines. Each business unit has its own security classification. The security requirement is that no VM belonging to a lower classification should be able to read data from a higher classification VM, even if the hypervisor is compromised. The architect proposes using mandatory access control at the hypervisor level. However, the IT team notes that a hypervisor compromise could bypass MAC. Additionally, they need to ensure that data at rest is encrypted and keys are stored securely. Which of the following would BEST meet the requirement?

Accepted Answer

Use a hardware security module (HSM) to manage keys and implement full memory encryption using AES-256 with integrity protection, and use a trusted execution environment (TEE) for each VM, ensuring that even the hypervisor cannot access VM memory.. It addresses the core requirement: preventing data leakage even if the hypervisor is compromised. By using a hardware security module (HSM) for key management, full memory encryption with AES-256 and integrity protection, and a trusted execution environment (TEE) for each VM, the solution ensures that VM memory is encrypted and isolated at the hardware level. The hypervisor, even if compromised, cannot access the decrypted memory of a VM, thus enforcing the security classification separation regardless of hypervisor integrity.

Answer

Implement network segmentation with VLANs and IPsec encryption between VMs.

Answer

Deploy a data loss prevention (DLP) system to monitor data transfers between VMs.

Answer

Use a public key infrastructure (PKI) to issue certificates for each VM and enforce mutual TLS for all inter-VM communication.

Question 15

A company is designing a disaster recovery plan. They need to recover critical systems within 4 hours and lose no more than 15 minutes of data. Which combination of RTO and RPO should be specified?

Accepted Answer

RTO = 4 hours, RPO = 15 minutes. RTO (Recovery Time Objective) is the maximum acceptable downtime, here 4 hours. RPO (Recovery Point Objective) is the maximum acceptable data loss, here 15 minutes.

Answer

RTO = 15 minutes, RPO = 4 hours

Answer

RTO = 4 hours, RPO = 4 hours

Answer

RTO = 15 minutes, RPO = 15 minutes

Question 16

Refer to the exhibit. A security auditor is reviewing the network ACLs for a cloud VPC. Which of the following is the most significant security concern?

Accepted Answer

SSH (port 22) is allowed from a large IP range. A question referring to an exhibit cannot be answered or verified without the visual or textual representation of the network ACLs. The exhibit must be included, or the stem must be rewritten to describe the scenario directly (e.g., 'A security auditor is reviewing a network ACL that allows inbound TCP port 22 from 0.0.0.0/0...') without needing an exhibit.

Answer

The outbound rules allow all traffic

Answer

RDP (port 3389) is allowed from a trusted internal subnet

Answer

The VPC ID is exposed

Question 17

A security architect is designing a network for a high-security data center. The requirement is to ensure that even if an attacker compromises one server, they cannot easily move laterally to other servers in the same data center. Which network design principle should be applied?

Accepted Answer

Microsegmentation (e.g., using virtual firewalls on each hypervisor). Microsegmentation (D) is the correct network design principle because it enforces granular, per-workload firewall rules—often implemented via virtual firewalls on each hypervisor or using VXLAN/ACL policies—that restrict east-west traffic between servers. Even if an attacker compromises one server, microsegmentation prevents lateral movement by allowing only explicitly permitted inter-server communication, effectively isolating the breach to the compromised host.

Answer

Principle of least privilege

Answer

Defense in depth

Answer

Single point of failure elimination

Question 18

A company deploys DNSSEC to protect its DNS infrastructure. Which cryptographic operation does DNSSEC primarily use to ensure the authenticity and integrity of DNS data?

Accepted Answer

Digital signatures of DNS records. DNSSEC primarily uses digital signatures to ensure the authenticity and integrity of DNS data. Each DNS zone is signed with a private key, and resolvers verify the signatures using the corresponding public key, which is published as a DNSKEY record. This process allows the resolver to cryptographically confirm that the data has not been modified in transit and originates from the authoritative source.

Answer

Hashing of DNS responses without keys

Answer

Transport Layer Security for DNS

Answer

Symmetric encryption of DNS queries

Question 19

A company uses BGP to exchange routes with its ISP. To prevent prefix hijacking, which mechanism should be implemented?

Accepted Answer

RPKI. RPKI (Resource Public Key Infrastructure) is the correct mechanism because it cryptographically validates the origin AS of a BGP route announcement, preventing prefix hijacking by ensuring that only the legitimate owner of an IP prefix can announce it. Unlike other options, RPKI provides a trust anchor based on the IP address allocation hierarchy, making it the only solution that directly addresses the root cause of hijacking—unauthorized origin AS claims.

Answer

BGP MD5 authentication

Answer

BGP community values

Answer

AS-path filtering

Question 20

A company is migrating from WPA2 to WPA3 to enhance wireless security. Which of the following cryptographic changes does WPA3 introduce compared to WPA2?

Answer

WPA3 replaces PSK with SAE and uses GCMP-256 encryption.

Answer

WPA3 uses TKIP for backward compatibility.

Answer

WPA3 uses AES-CCMP as the mandatory encryption method.

Answer

WPA3 eliminates the need for 802.1X authentication.