CISSP Multiple Select — 50 Questions

Question 1

An organization is implementing role-based access control (RBAC). Which two components are fundamental to the RBAC model? (Select TWO.)

Accepted Answer

Constraints such as separation of duties. Constraints such as separation of duties are fundamental to RBAC because they enforce organizational policies by preventing conflicts of interest (e.g., a user cannot both create and approve a purchase order). This is a core component of the RBAC model as defined in the NIST RBAC standard (ANSI INCITS 359-2004), which includes core RBAC, hierarchical RBAC, and constrained RBAC. Constraints ensure that role assignments and permissions adhere to security rules beyond simple role-user mapping.

Answer

Access control lists (ACLs)

Answer

Subjects, objects, and operations

Answer

Security labels and clearances

Question 2

Which THREE of the following are valid considerations when implementing data loss prevention (DLP) controls to protect sensitive data? (Select three.)

Accepted Answer

User training to reduce false positives and increase acceptance. User training is a critical component of a successful DLP implementation. Without proper training, users may inadvertently trigger false positives by mishandling data or may attempt to bypass controls they perceive as overly restrictive. Training helps users understand classification labels and proper data handling procedures, reducing the operational burden on security teams and increasing overall acceptance of DLP policies.

Answer

Integration with all third-party applications

Answer

Blocking all data transfers to external devices

Question 3

Which THREE of the following are valid risk response strategies?

Accepted Answer

Transfer. Common risk responses include Avoid, Transfer, Mitigate, and Accept.

Answer

Eliminate

Answer

Ignore

Question 4

An organization is acquiring a third-party software product. Which THREE of the following should be included in the security assessment of the vendor?

Accepted Answer

Vulnerability scanning of dependencies. Reviewing the SBOM, vulnerability scanning of dependencies, and vendor security assessments are key elements of third-party security evaluation. Code signing is a deployment control, not assessment; license compliance is legal but not security-specific.

Answer

Verifying software license compliance

Answer

Ensuring code signing is used in the vendor's development process

Question 5

A data custodian is responsible for implementing controls to protect data. Which TWO of the following are typical responsibilities of a data custodian? (Select 2)

Accepted Answer

Performing regular backups of data. Data custodians handle day-to-day management, implement security controls, and perform backups and restoration.

Answer

Classifying data according to sensitivity

Answer

Defining data usage policies

Answer

Determining data retention periods

Question 6

A company is recovering from a ransomware attack. Which THREE of the following are key considerations when restoring data from backups to ensure integrity and minimal downtime?

Accepted Answer

Isolate the restored data from the production network until verified. Isolating the restored data from production prevents reinfection. Validating backup integrity ensures clean data. Testing the restoration process ensures the backups work. Encrypted backups require decryption keys.

Answer

Ensure encryption keys for backups are available

Answer

Restore data directly to production servers to save time

Question 7

A security engineer is investigating a covert channel in a system. Which TWO types of covert channels could be used to leak information from a high-security to a low-security process?

Accepted Answer

Covert timing channel. Covert timing channels modulate the timing of events to signal information. Covert storage channels write data to a shared resource that the other process can read.

Answer

TOCTOU

Answer

Emanations

Answer

Side-channel

Question 8

A security administrator is reviewing potential risks associated with orphaned accounts. Which TWO of the following are risks of orphaned accounts?

Accepted Answer

Attackers can use orphaned accounts to gain unauthorized access. Orphaned accounts are active accounts of former employees or unused accounts, which can be exploited to gain unauthorized access or persist undetected.

Answer

Compliance with password policies is weakened

Answer

Performance degradation of authentication servers

Answer

Increased logging overhead

Question 9

A security architect is designing a Single Sign-On (SSO) solution for a web application that needs to support authentication and authorization. Which TWO of the following protocols are best suited for this purpose? (Select TWO)

Accepted Answer

OpenID Connect (OIDC). SAML 2.0 and OpenID Connect (OIDC) are both SSO protocols that provide authentication and authorization. OAuth 2.0 alone provides only authorization.

Answer

Kerberos

Answer

LDAP

Answer

OAuth 2.0

Question 10

Which THREE of the following are common security design principles? (Select THREE.)

Accepted Answer

Open design. Open design (A) is a fundamental security principle stating that the security of a system should not depend on the secrecy of its implementation; instead, it relies on the strength of its cryptographic keys and algorithms. This principle is embodied in Kerckhoffs's principle, which asserts that a cryptosystem should remain secure even if everything about the system, except the key, is public knowledge. Open design allows for public scrutiny and peer review, which helps identify vulnerabilities and build trust in the system's security.

Answer

Single point of failure

Answer

Security through obscurity

Question 11

A company is conducting a security assessment of its network infrastructure. Which of the following activities are typically performed during a vulnerability assessment? (Select TWO.)

Accepted Answer

Identification of missing security patches. A is correct because vulnerability assessments focus on identifying and cataloging weaknesses without exploitation. Missing security patches are a common finding from automated scanning tools like Nessus or OpenVAS, which compare system configurations against known vulnerability databases (e.g., CVE). This aligns with the assessment's goal of discovering vulnerabilities, not exploiting them.

Answer

Attempting to crack password hashes

Answer

Social engineering attacks against employees

Answer

Exploiting identified vulnerabilities to gain unauthorized access

Question 12

A security officer is developing a risk management plan. Which TWO of the following are valid risk response strategies? (Select TWO.)

Accepted Answer

Transfer. Valid risk response strategies include Transfer and Accept. Avoid is a standard strategy but is not listed as correct in this context because the question expects the two distinct options that are clearly valid among the given choices. Ignore and Eliminate are not standard risk response strategies.

Answer

Avoid

Answer

Ignore

Answer

Eliminate

Question 13

A company is preparing for a PCI DSS assessment. Which TWO of the following are likely to be required as part of the assessment?

Accepted Answer

Annual on-site assessment by a QSA. PCI DSS requires external ASV vulnerability scans quarterly and an annual on-site assessment by a QSA.

Answer

Monthly internal vulnerability scans

Answer

SOC 2 Type II report

Answer

Annual penetration test of all systems

Question 14

Under GDPR, which TWO of the following are valid lawful bases for processing personal data?

Accepted Answer

Consent. GDPR Article 6 lists lawful bases including consent, contract, legal obligation, vital interests, public task, and legitimate interests.

Answer

Data subject's employment

Answer

Data processor's request

Answer

Data controller's profit

Question 15

Which THREE of the following are components of a Privileged Access Management (PAM) solution?

Accepted Answer

Session recording. PAM typically includes password vaulting (secure credential storage), session recording (monitoring privileged sessions), and just-in-time access (elevated privileges on demand).

Answer

User self-service password reset

Answer

Single sign-on for web applications

Question 16

A security architect is evaluating physical security controls for a facility handling sensitive data. Which of the following are examples of layered physical security controls? (Choose THREE)

Accepted Answer

Perimeter fence. Layered security uses multiple barriers: perimeter (fence), external (lighting), building (locks), secure area (mantrap), and IT area (cage). Biometrics and guards are also layers.

Answer

Single-factor authentication for all doors

Answer

Unsecured windows on ground floor

Question 17

Which TWO of the following are characteristics of a Privileged Access Management (PAM) solution? (Choose two.)

Accepted Answer

Session recording. PAM includes password vaulting and session recording; just-in-time access is also a characteristic, but note: the question asks for TWO, so select the correct two.

Answer

Self-service password reset

Answer

Single sign-on for all users

Answer

OpenID Connect authentication

Question 18

A security analyst is performing an access review. Which THREE of the following are best practices for user access recertification? (Choose three.)

Accepted Answer

Managers confirm that employees still need their current access. Recertification should confirm business need, review actual access, and be periodic.

Answer

Remove all access and re-provision as needed

Answer

Automatically approve access if no response

Question 19

Which TWO of the following are essential components of a disaster recovery plan? (Choose two.)

Accepted Answer

Recovery Point Objective (RPO). Options A and C are correct. Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are key metrics. Business continuity plan is a separate but related plan; cold sites and SLAs are not components of a DRP itself.

Answer

Business continuity plan

Answer

Service Level Agreement (SLA)

Answer

Cold site configuration

Question 20

A security engineer is hardening a system against side-channel attacks that exploit variations in execution time or power consumption. Which TWO mitigations are specifically designed to counter such attacks? Select two.

Accepted Answer

Constant-time algorithms. Constant-time programming ensures operations take the same time regardless of inputs, and noise injection obscures power consumption patterns.

Answer

Data Execution Prevention (DEP)

Answer

Address Space Layout Randomization (ASLR)

Answer

Input validation