CISSP Security Assessment and Testing Practice Test 3 — 15 Questions

Question 1

A security analyst reviews the syslog configuration exhibit. What is the primary security concern with this configuration?

Accepted Answer

Logs are sent in clear text to the remote syslog server. The configuration shows syslog messages being sent to a remote server using UDP port 514 without any encryption or authentication mechanism. By default, syslog over UDP transmits all log data in clear text, meaning any attacker with network access can intercept and read sensitive information such as failed login attempts, user names, or system events. This violates the confidentiality principle and is the primary security concern because it exposes potentially sensitive audit data in transit.

Answer

The remote syslog server is not configured to receive logs

Answer

The logging level for authentication is set to 'none'

Answer

Local7 and mail logs are being sent to different destinations

Question 2

A security analyst is reviewing logs and notices multiple failed login attempts from a single IP address followed by a successful login. What should the analyst do next?

Accepted Answer

Investigate the successful login. The correct answer is C because a successful login immediately following multiple failed attempts from the same IP address is a classic indicator of a brute-force or password-spraying attack that succeeded. The analyst must investigate the successful login to determine if it was legitimate or an account compromise, checking for anomalous behavior, time of access, and any subsequent actions. Ignoring or prematurely blocking the IP could destroy forensic evidence or lock out a legitimate user, while disabling the account without investigation may be premature if the login was authorized.

Answer

Disable the account immediately

Answer

Ignore, as failed logins are normal

Answer

Block the IP address

Question 3

A company wants to test the effectiveness of its security controls without causing disruption. Which type of assessment is most appropriate?

Accepted Answer

Vulnerability scan. A vulnerability scan is the most appropriate assessment because it passively identifies known vulnerabilities (e.g., missing patches, misconfigurations) without exploiting them, ensuring no disruption to production systems. Unlike active exploitation tests, vulnerability scanners use non-intrusive probes (e.g., banner grabbing, version fingerprinting) that do not trigger denial-of-service or system crashes. This aligns with the requirement to test control effectiveness while maintaining operational stability.

Answer

Penetration test

Answer

Security audit

Answer

Red team exercise

Question 4

During an internal audit, an organization discovers that a critical application has not been patched for six months. The application is business-critical and cannot be taken offline during business hours. Which of the following is the best course of action?

Accepted Answer

Implement compensating controls and schedule patching at the next available maintenance window. Option A is correct because compensating controls (e.g., network segmentation, WAF rules, or host-based IPS) reduce the immediate risk while the critical application remains online. Scheduling patching for the next maintenance window aligns with change management and ensures the patch is tested and applied without disrupting business operations. This balances security needs with operational continuity, a core principle of risk management.

Answer

Accept the risk and continue operations

Answer

Apply the patch immediately during off-hours even if it risks downtime

Answer

Disconnect the application until it is patched

Question 5

An organization is conducting a security assessment of a new web application. Which testing technique would best identify cross-site scripting (XSS) vulnerabilities?

Accepted Answer

Dynamic application security testing (DAST). DAST (Dynamic Application Security Testing) tests the running application by simulating external attacks, including injecting malicious scripts into input fields and observing the response. This directly identifies reflected, stored, and DOM-based XSS vulnerabilities because it exercises the application's runtime behavior, where XSS payloads are executed in the browser. Unlike static analysis, DAST does not require source code access and can detect vulnerabilities that only manifest during execution.

Answer

Manual code review

Answer

Static application security testing (SAST)

Answer

Interactive application security testing (IAST)

Question 6

A security team is analyzing logs from multiple sources and notices anomalous outbound traffic to a known command-and-control server. What is the most likely conclusion?

Accepted Answer

A host is compromised and is beaconing. Anomalous outbound traffic to a known command-and-control (C2) server is a classic indicator of compromise (IoC). Compromised hosts often beacon outbound to C2 infrastructure using HTTP, HTTPS, or DNS tunnels to receive instructions or exfiltrate data. This pattern is distinct from normal traffic and is a primary focus of network security monitoring and intrusion detection systems (IDS).

Answer

A misconfigured firewall is causing traffic

Answer

An employee is streaming video to a personal server

Answer

The network is under a DDoS attack

Question 7

A company's vulnerability management program requires that all critical vulnerabilities be remediated within 30 days. A critical vulnerability is discovered in a legacy system that cannot be patched because the vendor no longer supports it. Which of the following is the best compensating control?

Accepted Answer

Segment the system from the rest of the network. Network segmentation isolates the legacy system, reducing the attack surface. HIDS only detects, not prevents. Logging and monitoring are detective controls. Encryption does not prevent exploitation of the vulnerability.

Answer

Deploy a host-based intrusion detection system (HIDS)

Answer

Increase logging and monitoring

Answer

Encrypt all data at rest on the system

Question 8

Which of the following is the primary purpose of a security assessment?

Accepted Answer

To identify and evaluate security risks. A security assessment's primary purpose is to systematically identify and evaluate security risks by analyzing assets, threats, vulnerabilities, and existing controls. This aligns with the NIST SP 800-115 framework, which defines assessment as the process of determining how effectively an entity is meeting specific security objectives, not as a remediation or enforcement activity.

Answer

To fix all vulnerabilities

Answer

To achieve compliance with regulations

Answer

To punish non-compliant employees

Question 9

An organization has implemented a new SIEM system. What is the most critical factor for its effectiveness?

Accepted Answer

The ability to correlate events. The most critical factor for a SIEM's effectiveness is its ability to correlate events across diverse log sources to detect complex attack patterns, such as a lateral movement chain or a multi-stage exploit. Without correlation, a SIEM is merely a log aggregator, unable to distinguish a true security incident from isolated benign events. Correlation engines apply rule-based or statistical analysis (e.g., using Sigma rules or machine learning) to identify relationships between seemingly unrelated log entries, which is the core value proposition of a SIEM.

Answer

The cost of the solution

Answer

The speed of data ingestion

Answer

The number of log sources integrated

Question 10

During a penetration test, the tester gains access to a server and finds sensitive customer data. What should the tester do next?

Accepted Answer

Report the finding immediately and secure the data. Option D is correct because the tester's primary responsibility is to protect sensitive data and minimize risk. Upon discovering PII or other regulated data, the tester must immediately report the finding to the client and secure the data (e.g., by isolating the server or encrypting the data in place) to prevent unauthorized access or exposure. This aligns with the ethical hacking code of conduct and the CISSP principle of 'do no harm'.

Answer

Exfiltrate the data to demonstrate the risk

Answer

Delete the data to prevent exposure

Answer

Continue testing to find more vulnerabilities

Question 11

Which TWO of the following are examples of types of security assessments?

Accepted Answer

Vulnerability scan. A vulnerability scan is a security assessment that systematically identifies, categorizes, and reports known vulnerabilities in systems, networks, and applications. It uses automated tools (e.g., Nessus, OpenVAS) to compare system configurations and software versions against databases of known vulnerabilities (e.g., CVE, NVD). This is a core example of a security assessment because it evaluates the security posture without exploiting vulnerabilities, aligning with the 'Security Assessment and Testing' domain.

Answer

Firewall rule review

Answer

Password policy enforcement

Answer

Antivirus update

Question 12

Which THREE of the following are commonly used metrics for measuring the effectiveness of a vulnerability management program?

Accepted Answer

Patch coverage percentage. Patch coverage percentage is a direct measure of vulnerability management effectiveness because it tracks the proportion of systems that have received required patches. A high patch coverage percentage indicates that the organization is successfully applying fixes to known vulnerabilities, reducing the attack surface. This metric is commonly used in vulnerability management programs to assess the completeness of remediation efforts.

Answer

Mean time to detect (MTTD)

Answer

Number of security incidents

Question 13

Which TWO of the following are best practices for conducting a penetration test?

Accepted Answer

Define scope and rules of engagement. Obtaining written authorization and defining scope and rules of engagement are fundamental to ethical and legal testing. Using only automated tools is not best; manual techniques are also needed. Installing backdoors is unethical. Notifying law enforcement is not a standard practice and could compromise the test.

Answer

Install backdoors for future access

Answer

Notify law enforcement before testing

Answer

Use only automated tools

Question 14

Refer to the exhibit. Based on the exhibit, what does the sequence of requests indicate?

Accepted Answer

A privilege escalation attempt. The sequence of requests shows a user accessing a low-privilege resource (e.g., /user/profile) and then immediately requesting a high-privilege resource (e.g., /admin/config) without proper authentication or authorization checks. This pattern indicates an attempt to escalate privileges by exploiting missing access controls, which is a classic privilege escalation attempt.

Answer

A session hijacking attempt

Answer

A successful brute-force attack

Answer

A directory traversal attack

Question 15

Refer to the exhibit. What is a potential security weakness in this policy?

Accepted Answer

It grants access to a private IP range which is not routable over the internet. Option C is correct because the policy grants access to a private IP range (e.g., 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) which is not routable over the internet. This means the condition is ineffective for controlling access from external sources, as private IP addresses are only meaningful within a local network and cannot be used to authenticate or authorize remote users. An attacker could spoof such an IP address from within the same network or bypass the restriction entirely if the policy is intended to restrict internet-based access.

Answer

It does not specify a principal

Answer

It allows all actions on the bucket

Answer

It uses a condition that can be bypassed

CISSP Security Assessment and Testing Practice Test 3 — 15 Questions

Exhibit

CISSP Security Assessment and Testing Practice Test 3 — 15 Questions

Exhibit