CISSP Timed Practice Test 1 — 10 Questions

Question 1

A company recently suffered a data breach where an attacker was able to intercept network traffic and read sensitive data. Which network security control should be implemented to prevent this type of attack?

Accepted Answer

Encryption at the network layer (e.g., IPsec). IPsec operates at the network layer (Layer 3) and provides encryption of the entire IP packet, including the payload, ensuring that even if an attacker intercepts the traffic, the data remains unreadable. This directly addresses the scenario where an attacker reads sensitive data from intercepted network traffic, as IPsec can be configured in transport mode for end-to-end encryption or tunnel mode for VPNs.

Answer

Network segmentation

Answer

Intrusion prevention system (IPS)

Answer

Strong password policies

Question 2

Which TWO options are valid methods for providing confidentiality in network communications? (Choose two.)

Accepted Answer

ESP in transport mode. ESP (Encapsulating Security Payload) in transport mode provides confidentiality by encrypting the payload of an IP packet while leaving the original IP header intact. This is a core function of IPsec, where ESP can optionally include authentication but its primary role is encryption, making it a valid method for ensuring data confidentiality in network communications.

Answer

SSH

Answer

HMAC

Answer

AH in tunnel mode

Question 3

A network administrator is configuring switches to prevent VLAN hopping attacks. Which TWO of the following measures should be implemented?

Accepted Answer

Set the native VLAN to an unused VLAN.. Setting the native VLAN to an unused VLAN prevents VLAN hopping via double-tagging attacks. In a double-tagging attack, an attacker sends frames with two 802.1Q tags; the first tag is stripped by the trunk's native VLAN, and the second tag allows the frame to hop to a different VLAN. By using an unused VLAN as the native VLAN, there are no hosts on that VLAN to receive or exploit the double-tagged traffic.

Answer

Use private VLANs on all trunk ports.

Answer

Enable BPDU guard on all access ports.

Answer

Implement port security on all access ports.

Question 4

Which THREE of the following are common indicators of a privilege escalation attack? (Choose three.)

Accepted Answer

Creation of new user accounts with administrative privileges. Option A is correct because the creation of new user accounts with administrative privileges is a classic post-exploitation technique used by attackers to establish persistent elevated access. After successfully exploiting a vulnerability to gain initial elevated privileges, an attacker often creates a backdoor account (e.g., via `net user /add` and `net localgroup Administrators /add` on Windows, or `useradd -G wheel` on Linux) to maintain control even if the original exploit vector is patched. This indicator is directly tied to privilege escalation as it demonstrates an unauthorized elevation from a lower-privileged context to full administrative control.

Answer

Higher-than-normal network traffic

Answer

System performance degradation

Question 5

A company uses a cloud storage service. Which asset security control is most important to prevent unauthorized access to data?

Accepted Answer

Encryption in transit and at rest. Encryption in transit (e.g., TLS 1.3) and at rest (e.g., AES-256) is the most important asset security control because it renders data unreadable even if the cloud storage service is compromised or an attacker gains access to the underlying infrastructure. Without encryption, all other controls (logging, reviews, scanning) are reactive and cannot prevent a direct breach of the stored data. This aligns with the CISSP principle of defense in depth, where encryption provides a strong preventive layer for data confidentiality.

Answer

Logging and monitoring

Answer

Periodic access reviews

Answer

Regular vulnerability scanning

Question 6

A multinational corporation is designing a data retention schedule. Which factor is most critical when determining retention periods for personal data subject to the GDPR?

Accepted Answer

The purpose for which the data was collected. Under the GDPR, Article 5(1)(e) establishes the 'storage limitation' principle, which mandates that personal data must be kept no longer than necessary for the purposes for which it was collected. Therefore, the purpose of collection is the primary driver for determining the retention period, as it defines the lawful basis and necessity for processing. Without a defined purpose, any retention period would be arbitrary and non-compliant with the regulation.

Answer

The length of the third-party data processing agreement

Answer

The cost of storage media

Answer

The duration of any pending legal holds

Question 7

Refer to the exhibit. An organization uses this ACL on the external interface of a border router to control access to internal services. A security analyst discovered that an attacker from the Internet was able to SSH into the internal server at 192.168.1.100. Which of the following is the MOST likely reason for this security gap?

Accepted Answer

The ACL permits SSH from any source in 10.0.0.0/8 to the internal host, allowing an external attacker to spoof an internal IP. Option C is correct because the ACL permits SSH (TCP port 22) from any source within the 10.0.0.0/8 range to the internal host 192.168.1.100. Since 10.0.0.0/8 is a private RFC 1918 address space, an external attacker can spoof a source IP in that range, bypassing the intended restriction that only internal hosts should use those addresses. The ACL does not validate the source IP's legitimacy, so a spoofed packet from the Internet matching the permit rule will be allowed through.

Answer

The final permit ip any any rule allows all traffic, bypassing the other rules

Answer

The ACL permits HTTP traffic to host 10.0.0.1 which could be used as a pivot

Answer

The ACL is applied inbound on the external interface, so it should block all external traffic, but the permit rules override

Question 8

Refer to the exhibit. An IAM policy is attached to a user. What is the effective permission when the user attempts to read the object 'confidential/report.pdf'?

Accepted Answer

Denied because the Deny statement explicitly denies all actions on that path. The correct answer is A because IAM policies evaluate explicit Deny statements before any Allow statements. Since the Deny statement explicitly denies all actions on the 'confidential/report.pdf' path, the user's GetObject request is denied regardless of any broader Allow statements. This is a fundamental principle of AWS IAM policy evaluation logic: an explicit Deny overrides all Allow permissions.

Answer

Allowed because the resource match is broader in the Allow

Answer

Allowed because the Allow statement grants GetObject

Answer

Denied only if the user has no other Allow policies

Question 9

Which TWO of the following are considered the primary access control models in the context of the CISSP? (Select two.)

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) is a primary access control model where access decisions are based on fixed security labels (e.g., classification levels like Top Secret, Secret, Confidential) assigned to subjects and objects by a central authority. The system enforces these labels, and users cannot override them, making it a core model for high-security environments such as military or government systems. In the CISSP context, MAC and DAC are traditionally considered the two foundational models, with RBAC and ABAC often treated as extensions or implementations of DAC.

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Risk-Based Access Control

Question 10

A security analyst is reviewing an organization's password policy. Which THREE of the following are considered best practices for password security according to current NIST guidelines? (Select three.)

Accepted Answer

Enforce password history of 10. Option A is correct because NIST SP 800-63B recommends enforcing a password history to prevent users from reusing recent passwords, with a typical value of 10-24 previous passwords. This reduces the risk of password recycling attacks where compromised credentials are reused. Option D is correct because multi-factor authentication (MFA) is a core NIST recommendation to add an additional layer of security beyond passwords, mitigating credential theft. Option E is correct because NIST now advises a minimum password length of 8 characters (or more) as a primary defense against brute-force attacks, rather than relying on complexity rules.

Answer

Require password changes every 30 days

Answer

Allow password hints