CISSP Security Architecture and Engineering Practice Test 2 — 15 Questions

Question 1

An organization requires that all data stored in a cloud object storage service be encrypted at rest using customer-managed keys. Which encryption option should be implemented?

Accepted Answer

Server-side encryption with customer-provided keys (SSE-C). SSE-C (Server-Side Encryption with Customer-Provided Keys) allows the organization to encrypt objects at rest in cloud object storage using keys that are managed and supplied by the customer, not the cloud provider. This meets the requirement for customer-managed keys because the encryption key is provided in each API request and is never stored by the service, giving the customer full control over key lifecycle and access.

Answer

Server-side encryption with Amazon S3 managed keys (SSE-S3)

Answer

Transport Layer Security (TLS)

Answer

Client-side encryption

Question 2

In the context of physical security, which of the following is an example of a preventive control?

Accepted Answer

Mantrap door. A mantrap door is a preventive physical security control because it actively prevents unauthorized entry by requiring authentication and verification before allowing passage through a series of interlocking doors. Unlike monitoring or detection systems, a mantrap physically blocks access until the user is validated, thereby stopping a breach before it occurs.

Answer

Security guards monitoring

Answer

CCTV cameras

Answer

Intrusion detection system

Question 3

A company is implementing a secure software development lifecycle (SSDLC). Which of the following is a key activity during the design phase?

Accepted Answer

Threat modeling. Threat modeling is a key activity during the design phase of the SSDLC because it proactively identifies potential security threats, vulnerabilities, and attack vectors before any code is written. By analyzing the system's architecture, data flows, and trust boundaries (e.g., using STRIDE or PASTA methodologies), teams can design security controls directly into the system, reducing the cost and impact of fixes later. This aligns with the NIST SP 800-64 and Microsoft SDL frameworks, which mandate threat modeling as a core design-phase activity.

Answer

Static code analysis

Answer

Code signing

Answer

Penetration testing

Question 4

Which of the following describes the concept of 'least privilege' in the context of access control?

Accepted Answer

Users are granted only the permissions necessary to perform their job functions. Least privilege is a fundamental access control principle that mandates users be granted only the permissions necessary to perform their specific job functions. This minimizes the attack surface by reducing unnecessary access to sensitive resources, limiting potential damage from accidental or malicious actions. In practice, this is enforced through mechanisms like discretionary access control (DAC) or role-based access control (RBAC) with granular permission sets, ensuring no user has more rights than required.

Answer

Access is granted on a need-to-know basis but with maximum permissions

Answer

Access is based on roles and seniority

Answer

Users have access to all resources unless explicitly denied

Question 5

A security engineer is designing a cryptographic solution to ensure data integrity and non-repudiation. Which combination should be used?

Accepted Answer

Digital signature with hashing. Digital signature with hashing is the correct combination because hashing ensures data integrity by producing a fixed-size digest, and the digital signature encrypts that hash with the sender's private key, providing non-repudiation by proving the sender's identity and preventing denial of message origin. This satisfies both requirements without relying on a shared secret.

Answer

HMAC with a shared key

Answer

Asymmetric encryption with digital signature

Answer

Symmetric encryption with HMAC

Question 6

Which of the following is a primary advantage of using a hardware security module (HSM) over software-based key storage?

Accepted Answer

Tamper-resistant physical security. A hardware security module (HSM) provides tamper-resistant physical security by storing cryptographic keys in a dedicated, hardened appliance that resists physical tampering, probing, and extraction. Unlike software-based key storage, which relies on the operating system's file system or memory and is vulnerable to malware or direct memory access attacks, an HSM ensures that keys never leave the secure boundary in plaintext, even if the host system is compromised.

Answer

Easier key backup

Answer

Lower cost

Answer

Faster key generation

Question 7

A company is deploying a new application that processes personally identifiable information (PII) in a hybrid cloud environment. The security architect needs to ensure that encryption keys are never exposed to the cloud provider. Which solution should be recommended?

Accepted Answer

Client-side encryption with keys stored on-premises. Client-side encryption ensures that encryption keys are generated and managed on-premises, never transmitted to the cloud provider. This directly meets the requirement that keys are never exposed to the cloud provider, as all cryptographic operations occur before data leaves the customer's controlled environment.

Answer

Envelope encryption with a key management service

Answer

Server-side encryption with cloud provider managed keys

Answer

Server-side encryption with customer-provided keys

Question 8

A user reports that a VPN client cannot connect to the corporate gateway. The exhibit shows an excerpt from the client log. What does this indicate?

Accepted Answer

The client does not trust the CA that issued the server certificate. The client log indicates a certificate validation failure during the TLS handshake. The error 'unable to get local issuer certificate' or similar means the client cannot find a trusted root CA that issued the server's certificate. This is a classic PKI trust issue, not an expiration or missing client certificate problem.

Answer

The VPN server certificate is expired

Answer

The server is using a self-signed certificate

Answer

The client certificate is missing

Question 9

A security analyst is troubleshooting a web application that is incorrectly blocking valid login requests. The WAF rule in the exhibit is the only rule configured. What is the probable issue?

Accepted Answer

The rule is too generic and matches all login requests. Option C is correct because the WAF rule uses a broad pattern like `.*` or similar regex that matches all login request parameters, causing the WAF to block every login attempt. This occurs when the rule lacks specific constraints (e.g., matching only known attack patterns like SQL injection or XSS), so it incorrectly flags legitimate traffic as malicious.

Answer

The rule uses outdated syntax

Answer

The rule is in the wrong phase

Answer

The rule does not specify a status code

Question 10

During a security audit, it is discovered that the database server is also accepting connections from the web server. Which of the following is the most likely misconfiguration?

Accepted Answer

The network segmentation is not enforcing strict controls. The database server accepting connections from the web server indicates a lack of proper network segmentation. In a secure architecture, the web server should be in a DMZ and the database server in a private network segment, with strict access controls enforced by a firewall or router ACLs. The misconfiguration is that the network segmentation is not enforcing strict controls, allowing traffic that should be blocked.

Answer

The application server is not properly authenticated

Answer

The TLS configuration is incorrect

Answer

The firewall on the database server allows all traffic from the DMZ

Question 11

Which TWO of the following are principles of the zero trust security model? (Select TWO.)

Accepted Answer

Never trust, always verify. The zero trust security model is founded on the principle of 'never trust, always verify,' meaning no entity—inside or outside the network—is trusted by default. This requires continuous authentication and authorization for every access request, regardless of the user's location or network. Option B correctly captures this core tenet.

Answer

Trust but verify

Answer

Users are inherently trustworthy

Answer

Perimeter defenses are sufficient

Question 12

Which THREE of the following are common security design principles? (Select THREE.)

Accepted Answer

Open design. Open design (A) is a fundamental security principle stating that the security of a system should not depend on the secrecy of its implementation; instead, it relies on the strength of its cryptographic keys and algorithms. This principle is embodied in Kerckhoffs's principle, which asserts that a cryptosystem should remain secure even if everything about the system, except the key, is public knowledge. Open design allows for public scrutiny and peer review, which helps identify vulnerabilities and build trust in the system's security.

Answer

Single point of failure

Answer

Security through obscurity

Question 13

Which THREE of the following are examples of asymmetric cryptographic algorithms? (Select THREE.)

Accepted Answer

Elliptic Curve Cryptography (ECC). Elliptic Curve Cryptography (ECC) is an asymmetric cryptographic algorithm that uses the algebraic structure of elliptic curves over finite fields to provide security with smaller key sizes compared to RSA. It relies on the Elliptic Curve Discrete Logarithm Problem (ECDLP) for its security, making it computationally infeasible to derive the private key from the public key. ECC is widely used in modern protocols such as TLS, SSH, and Bitcoin for key exchange and digital signatures.

Answer

AES

Answer

Blowfish

Question 14

Which security model focuses on preventing unauthorized access by enforcing a 'no read up, no write down' rule?

Accepted Answer

Bell-LaPadula. The Bell-LaPadula model is a formal state machine model for enforcing access control in government and military systems. Its core rule, 'no read up' (simple security property) and 'no write down' (star property), prevents subjects from reading objects at a higher classification level and from writing to objects at a lower classification level, thereby preventing unauthorized disclosure of sensitive information.

Answer

Clark-Wilson

Answer

Biba

Answer

Brewer-Nash

Question 15

In a public key infrastructure (PKI), which component is responsible for issuing and revoking digital certificates?

Accepted Answer

Certificate Authority (CA). The Certificate Authority (CA) is the trusted entity in a PKI that issues digital certificates by signing them with its private key, and it also revokes certificates by publishing Certificate Revocation Lists (CRLs) or using the Online Certificate Status Protocol (OCSP). The CA is the authoritative source for certificate lifecycle management, including issuance, renewal, and revocation.

Answer

Registration Authority (RA)

Answer

Certificate Revocation List (CRL)

Answer

Validation Authority (VA)