CISSP Security Architecture and Engineering Practice Test 4 — 15 Questions

Question 1

A security architect is selecting an access control model for a system that must prevent users from reading objects at a higher classification level. Which model enforces this property?

Accepted Answer

Bell-LaPadula. The Bell-LaPadula model enforces mandatory access control (MAC) with the *-property (no write-down) and the simple security property (no read-up). The question specifically asks to prevent reading objects at a higher classification level, which is exactly the 'no read-up' rule of Bell-LaPadula. This model is designed for confidentiality-focused systems, such as military or government classified environments.

Answer

Clark-Wilson

Answer

Biba

Answer

Brewer-Nash

Question 2

A large organization needs to deploy a Public Key Infrastructure (PKI) for thousands of devices and users. A key requirement is the ability to revoke certificates in real time when a device is lost or compromised. Which solution is most appropriate?

Accepted Answer

Implement Online Certificate Status Protocol (OCSP) responders.. OCSP provides real-time certificate status checking by querying an OCSP responder directly, eliminating the delays inherent in CRL distribution. This meets the requirement for immediate revocation verification when a device is lost or compromised, as the responder can return a 'revoked' status instantly without waiting for a CRL refresh cycle.

Answer

Deploy multiple hierarchical CAs and distribute CRLs periodically.

Answer

Rely on certificate expiration only and do not implement revocation.

Answer

Use a single Certificate Authority (CA) with a large Certificate Revocation List (CRL).

Question 3

A company is designing secure boot for IoT devices to ensure only trusted firmware runs. The devices have limited resources. Which mechanism provides the highest assurance of boot integrity?

Accepted Answer

Use a TPM to measure boot components and compare to stored hashes.. Option C is correct because a Trusted Platform Module (TPM) provides hardware-rooted trust by measuring each boot component (e.g., BIOS, bootloader, OS kernel) and storing the measurements in Platform Configuration Registers (PCRs). These measurements are compared against known-good hashes stored in the TPM, ensuring that any tampering with firmware is detected before execution. This offers the highest assurance for resource-constrained IoT devices as it relies on immutable hardware rather than software-based checks.

Answer

Use a software-based integrity check that runs after boot.

Answer

Set a BIOS password to prevent unauthorized changes.

Answer

Implement full disk encryption (FDE).

Question 4

A health records system requires that doctors can write new records but cannot modify existing ones, and integrity is maintained through separation of duties. Which security model best fits this requirement?

Accepted Answer

Clark-Wilson. The Clark-Wilson model enforces integrity through well-formed transactions and separation of duties, which directly matches the requirement that doctors can write new records but cannot modify existing ones. It uses constrained data items (CDIs), transformation procedures (TPs), and integrity verification procedures (IVPs) to ensure that only authorized users can perform specific operations, preventing unauthorized modifications.

Answer

Brewer-Nash

Answer

Biba

Answer

Bell-LaPadula

Question 5

Which TWO principles are fundamental to a defense-in-depth security architecture?

Accepted Answer

Diversity of defense. Options A and C are correct: Defense in depth relies on layered security controls (A) and diversity of defense (C) to ensure that if one layer fails, others still protect. Option B is incorrect because a single point of failure contradicts defense in depth. Option D (centralized logging) is a good practice but not a foundational principle. Option E (minimal user training) is counterproductive.

Answer

Centralized logging

Answer

Single point of failure

Answer

Minimal user training

Question 6

A company needs to protect data at rest in a cloud storage system. Which THREE encryption methods are appropriate for this purpose?

Accepted Answer

Client-side encryption with key management. Client-side encryption with key management (B) ensures data is encrypted before it leaves the client device, so the cloud provider never has access to plaintext or the encryption keys. This is a fundamental control for protecting data at rest in untrusted environments, as it decouples key management from the storage provider.

Answer

Stream cipher without authentication (e.g., RC4)

Answer

MD5 hashing

Question 7

Which THREE are core principles of secure system design?

Accepted Answer

Least privilege. The principle of least privilege mandates that users, processes, or systems should be granted only the minimum permissions necessary to perform their function. This reduces the attack surface and limits potential damage from compromised accounts or software flaws. In secure system design, it is enforced through access control lists (ACLs), role-based access control (RBAC), and mandatory access control (MAC) models.

Answer

Complexity increases security

Answer

Security through obscurity

Question 8

A large financial institution is migrating its core banking system to a private cloud. The architecture must protect against data leakage between different business units sharing the same physical infrastructure. The system uses a hypervisor and virtual machines. Each business unit has its own security classification. The security requirement is that no VM belonging to a lower classification should be able to read data from a higher classification VM, even if the hypervisor is compromised. The architect proposes using mandatory access control at the hypervisor level. However, the IT team notes that a hypervisor compromise could bypass MAC. Additionally, they need to ensure that data at rest is encrypted and keys are stored securely. Which of the following would BEST meet the requirement?

Accepted Answer

Use a hardware security module (HSM) to manage keys and implement full memory encryption using AES-256 with integrity protection, and use a trusted execution environment (TEE) for each VM, ensuring that even the hypervisor cannot access VM memory.. Option D is correct because it addresses the core requirement: preventing data leakage even if the hypervisor is compromised. By using a hardware security module (HSM) for key management, full memory encryption with AES-256 and integrity protection, and a trusted execution environment (TEE) for each VM, the solution ensures that VM memory is encrypted and isolated at the hardware level. The hypervisor, even if compromised, cannot access the decrypted memory of a VM, thus enforcing the security classification separation regardless of hypervisor integrity.

Answer

Implement network segmentation with VLANs and IPsec encryption between VMs.

Answer

Deploy a data loss prevention (DLP) system to monitor data transfers between VMs.

Answer

Use a public key infrastructure (PKI) to issue certificates for each VM and enforce mutual TLS for all inter-VM communication.

Question 9

A government agency requires a new secure document management system that enforces mandatory access control with the properties that users cannot read documents at a higher classification and cannot write documents to a lower classification (to prevent data leaking). The system must also support different categories (compartments) within the same classification level, and a user with access to one compartment should not be able to access another compartment unless explicitly allowed. The architect is considering the Bell-LaPadula model. However, the Bell-LaPadula model's *-property (no write-down) addresses the write issue, but there is also a need to handle compartment isolation. Which additional model or mechanism should be incorporated to ensure compartment isolation?

Accepted Answer

Use a lattice-based access control (LBAC) that extends Bell-LaPadula by defining a security lattice that includes compartments and categories, ensuring that a subject's clearance must dominate the object's classification, including compartments.. Option C is correct because lattice-based access control (LBAC) extends the Bell-LaPadula model by defining a security lattice that includes both hierarchical classifications (e.g., Top Secret, Secret) and non-hierarchical categories (compartments). In this lattice, a subject's clearance must dominate an object's classification across both dimensions, ensuring that a user with access to one compartment cannot access another unless their clearance includes that specific category. This directly enforces the required compartment isolation while maintaining the *-property (no write-down) for data leakage prevention.

Answer

Apply the Brewer-Nash (Chinese Wall) model which enforces conflict of interest by preventing access to multiple compartments that conflict.

Answer

Implement Biba's integrity model which prevents write-up, thus complementing Bell-LaPadula.

Answer

Use role-based access control (RBAC) to define compartments.

Question 10

A small business wants to implement a secure wireless network for its office. They have a limited budget and want to ensure that data in transit is encrypted and that only authorized devices can connect. The office has 20 employees and a few guests. The business owner has heard about WPA2 and WPA3. They are concerned about security but also about compatibility with older devices. Which of the following is the BEST recommendation for a security architect?

Accepted Answer

Deploy WPA3-Enterprise with a RADIUS server and use TLS 1.3 for authentication, and for devices that do not support WPA3, use a separate SSID with WPA2-Enterprise and strong passphrase.. Option A is the best recommendation because it balances security, compatibility, and budget. WPA3-Enterprise with a RADIUS server and TLS 1.3 provides strong, per-user authentication and encryption for modern devices, while a separate SSID with WPA2-Enterprise (not PSK) allows older devices to connect securely without compromising the network's overall security posture. This dual-SSID approach ensures that all traffic is encrypted and only authorized devices can connect, addressing the business's core requirements.

Answer

Use WPA2-PSK with a long complex passphrase and change it monthly.

Answer

Use open network with MAC filtering to control access.

Answer

Deploy WPA3-Personal with SAE and disable all older protocols.

Question 11

A multinational corporation is developing a new cloud-based collaboration platform that handles sensitive intellectual property. The platform must ensure end-to-end encryption (E2EE) so that even the cloud provider cannot access the data. Users communicate via chat and file sharing. The architect proposes using a hybrid encryption scheme where each user has a public/private key pair, and for each message, a random symmetric key is used to encrypt the message, which is then encrypted with the recipient's public key. However, there is a requirement for the company to be able to lawfully intercept communications in case of a court order. This conflicts with E2EE. Which design can satisfy both confidentiality and lawful interception?

Accepted Answer

Implement a split-key design where the encryption keys are generated and held by the users, but a separate escrow agent splits the key into two parts: one held by the user and one held by the company. Alternatively, use a 'drop box' approach where communications are recorded in an encrypted format and the company can decrypt only after a court order by using a secondary key that is released upon authorization.. Option D is correct because it uses a split-key or drop-box design that preserves end-to-end encryption for regular communications while enabling lawful interception under strict authorization. In this scheme, the user holds one part of the key and the company holds another, or communications are recorded encrypted and a secondary key is released only after a court order, ensuring that neither the cloud provider nor the company can decrypt data without proper legal process. This satisfies both the E2EE requirement and the lawful interception mandate without compromising the core security principle of least privilege.

Answer

Implement key escrow where the company holds a copy of all users' private keys.

Answer

Implement a transparent encryption proxy on the user's device that logs all keys and sends them to the company.

Answer

Use client-side encryption where the encryption key is derived from user password and stored with a backup that can be recovered by the company using a master key.

Question 12

A company is implementing a digital signature system to ensure non-repudiation. The security architect must select a hash function that meets the required security properties. Which THREE of the following are necessary properties for the hash function?

Accepted Answer

Preimage resistance. A hash function must be preimage resistant (unable to invert), second preimage resistant (cannot find another input with the same hash), and collision resistant (cannot find two inputs with the same hash). Reversibility is not a property of hash functions—they are one-way. Determinism is inherent to all hash functions but is not a security property.

Answer

Reversibility

Answer

Determinism

Question 13

Refer to the exhibit. A database administrator implements the configuration shown to protect sensitive data. What is the most significant security flaw?

Accepted Answer

The database encryption key should be protected by a certificate rather than a password.. The correct answer is C. In SQL Server TDE, the database encryption key (DEK) should be protected by a certificate or asymmetric key stored in the master database, not by a password. Using a password is insecure because it is often stored in scripts or configuration files. Option A is also a concern but is a consequence of the password-based protection; the root cause is not using a certificate. Option B is incorrect because AES-256 is a strong algorithm. Option D is incorrect because TDE at the database level is appropriate for many scenarios and does not represent a flaw.

Answer

AES-256 is not a strong enough algorithm.

Answer

The encryption is applied at the database level rather than column level.

Answer

The encryption key is protected by a password that may be stored in scripts.

Question 14

A financial services company is migrating its customer relationship management (CRM) system to a public cloud provider. The CRM contains personally identifiable information (PII) and financial transaction records. The security architect must design a solution that ensures data confidentiality and integrity both at rest and in transit, while complying with PCI DSS requirements. The cloud provider offers a key management service (KMS) that can generate and store encryption keys, a hardware security module (HSM) in the cloud, and a certificate authority for TLS certificates. The architect needs to select the appropriate encryption methods and access controls. The company's security policy requires encryption keys to be rotated every 90 days and stored separately from the data. The cloud provider's KMS supports automatic key rotation, but the HSM requires manual intervention. The CRM application uses a database that supports transparent data encryption (TDE) with keys stored in the KMS, and the application also requires TLS for all network connections. Which course of action best meets all requirements?

Accepted Answer

Use the cloud provider's KMS to generate and store the database encryption key with automatic rotation, and use a certificate from a third-party CA for TLS. Store the KMS key in a separate account and region from the database.. Option D is correct because it uses the KMS with automatic key rotation (meeting the 90-day rotation requirement), stores the key in a separate account and region from the data (satisfying the separation requirement), and uses a third-party CA for TLS (providing strong trust and compliance). Option A stores the key in the same region, violating separation. Option B uses manual rotation, which is error-prone and may not meet the automation expectation. Option C uses self-signed certificates, which do not provide the trust required for external connections and disables automatic rotation, adding manual overhead.

Answer

Use the cloud provider's KMS to generate and store the database encryption key, disable automatic rotation, and manually rotate it every 90 days. Use a self-signed certificate for TLS to save costs.

Answer

Use the cloud HSM to generate and store the database encryption key, manually rotate it every 90 days, and use a certificate from the cloud provider's CA for TLS. Store the HSM key in a different region from the database.

Answer

Use the cloud provider's KMS to generate and store the database encryption key, enable automatic key rotation, and use a separate KMS-managed key for TLS certificates. Store all keys in the same KMS region as the database.

Question 15

Refer to the exhibit. A security analyst observes the audit log entry while troubleshooting a file access issue. The application is running under the myapp_t domain. Which action should the analyst take to resolve the issue while adhering to the principle of least privilege?

Accepted Answer

Add rule: allow myapp_t shadow_t:file read;. The exhibit shows that the SELinux policy currently allows myapp_t to read and write files of type myapp_data_t, but the application is trying to read a file of type shadow_t (the password file), which is denied. To resolve the access issue without over-privileging, the analyst should add a specific rule allowing myapp_t to read shadow_t files, but only if the application requires it. Option A is correct because it directly addresses the denied permission. Option B is incorrect because it allows write which is not needed. Option C removes the denial but is overbroad. Option D is unnecessary if the application runs in the correct domain.

Answer

Add rule: allow myapp_t shadow_t:file { read write };

Answer

Change the file context of /etc/shadow to myapp_data_t

Answer

Set the application to run in unconfined_t domain