CISSP Timed Practice Test 3 — 10 Questions

Question 1

A network administrator has configured private VLANs on a switch. The host in this port is part of PVLAN 100, and its associated secondary PVLAN is 200. What is the expected behavior for traffic from this host to other hosts in the same primary VLAN 100?

Accepted Answer

It can communicate with the promiscuous port only. In a private VLAN (PVLAN) configuration, a host in a community or isolated secondary VLAN cannot communicate with other hosts in the same primary VLAN unless they share the same secondary VLAN. However, the question specifies that the host is in PVLAN 100 and its associated secondary PVLAN is 200, but does not state that the host is in a community VLAN; the only way a host in a secondary VLAN can communicate with any other host is via the promiscuous port (typically connected to a router or firewall). Since the host is in an isolated secondary VLAN (or community without a matching community), it can only send traffic to the promiscuous port, which then forwards it as needed.

Answer

It cannot communicate with any other host

Answer

It can communicate only with other hosts in the same secondary VLAN 200

Answer

It can communicate with all hosts in primary VLAN 100

Question 2

Which three BGP security mechanisms help protect against route hijacking? (Choose THREE.)

Accepted Answer

Resource Public Key Infrastructure (RPKI). RPKI is correct because it uses cryptographically signed Route Origin Authorizations (ROAs) to validate that an AS is authorized to originate specific IP prefixes. This prevents route hijacking by allowing routers to reject BGP announcements that do not match the registered origin AS.

Answer

BGP Flowspec

Answer

BGP MED attribute

Question 3

Refer to the exhibit. Which security model does this policy enforce?

Accepted Answer

Bell-LaPadula. The Bell-LaPadula model enforces a mandatory access control policy based on the 'no read up, no write down' principle, which directly corresponds to the exhibit's rule that a subject at a given security level cannot read objects at a higher level (Simple Security Property) and cannot write to objects at a lower level (Star Property). This is the only model among the options that specifically addresses confidentiality through hierarchical classification levels and the prevention of information flow from higher to lower security levels.

Answer

Biba

Answer

Brewer-Nash

Answer

Clark-Wilson

Question 4

Refer to the exhibit. A security analyst finds these logs on a Linux server. What is the most likely cause of these events?

Accepted Answer

A brute-force attack is in progress. The logs show repeated SSH authentication failures from the same source IP address with different usernames, including root, admin, and user. This pattern of multiple failed login attempts in rapid succession is characteristic of a brute-force attack against the SSH service. The fact that attempts continue across different usernames indicates an automated tool is systematically trying credentials, not a single misconfiguration or network issue.

Answer

The root account is disabled

Answer

The firewall is blocking port 22

Answer

The SSH service is not running

Question 5

During a security assessment, an organization wants to ensure that its web application is resistant to common attacks. Which THREE testing types should be included?

Accepted Answer

Input validation testing. Input validation testing (A) is correct because it directly addresses common web application attacks such as SQL injection, cross-site scripting (XSS), and command injection by ensuring that all user-supplied data is properly sanitized, validated, and encoded before processing. Without rigorous input validation, an attacker can manipulate input fields to execute arbitrary code or access unauthorized data, making this a foundational security control in the OWASP Top 10.

Answer

Network segmentation testing

Answer

Load testing

Question 6

An auditor is reviewing the JSON policy exhibit. What is the most likely security issue with this policy?

Accepted Answer

The 'Allow' rule for customers does not restrict based on user identity, only IP. Option C is correct because the policy's 'Allow' rule for customers only restricts access based on source IP address, not on authenticated user identity. This means any user or system within the allowed IP range can access the resource, regardless of whether they are a legitimate customer. In a JSON-based policy (e.g., AWS IAM or Azure RBAC), failing to include a condition that checks user identity (such as a JWT claim or IAM user ARN) creates a significant authorization gap, allowing potential impersonation or lateral movement within the trusted network.

Answer

The policy allows all actions on public_data, which could be exploited

Answer

The policy uses JSON syntax, which is not secure

Answer

The 'Deny' rule uses a wildcard resource, which is too restrictive

Question 7

Which TWO of the following are common techniques used in dynamic application security testing (DAST)?

Accepted Answer

Fuzzing. Fuzzing is a DAST technique that involves sending malformed or unexpected input to an application to trigger unhandled exceptions, crashes, or security vulnerabilities. It tests the runtime behavior of the application, making it a dynamic testing method.

Answer

Static analysis

Answer

String search

Answer

Code review

Question 8

Refer to the exhibit. Based on the exhibit, what is the most urgent remediation?

Accepted Answer

Upgrade to Apache 2.4.50. The exhibit shows Apache 2.4.49 is in use, which is vulnerable to CVE-2021-41773 — a path traversal and remote code execution flaw in the `mod_cgi` module. Upgrading to Apache 2.4.50 is the most urgent remediation because it directly patches this critical vulnerability, preventing attackers from reading arbitrary files or executing commands via crafted URL paths like `/cgi-bin/.%2e/%2e%2e/bin/sh`.

Answer

Disable directory listing

Answer

Recompile Apache with security flags

Answer

Apply a WAF rule to block path traversal attempts

Question 9

Which THREE are key components of a business continuity plan (BCP)?

Accepted Answer

Backup strategies. Backup strategies are a core component of a BCP because they ensure that critical data and systems can be restored after a disruption. Without defined backup procedures (e.g., frequency, media rotation, off-site storage), the organization cannot recover its operational state, making this a fundamental technical requirement for continuity.

Answer

Vendor risk assessments

Answer

System hardening standards

Question 10

Refer to the exhibit. The network administrator applies this access control list to the inbound interface of a router connecting to the internet. Which type of access control model is being implemented?

Accepted Answer

Rule-Based Access Control. The access control list (ACL) applied to the inbound interface of a router connecting to the internet enforces traffic filtering based on a set of predefined rules (e.g., permit or deny statements based on source IP, destination IP, port numbers). This is the essence of Rule-Based Access Control (RBAC), where access decisions are governed by a global set of rules applied uniformly to all subjects, independent of user identity or roles. The ACL does not allow individual users to change permissions (eliminating DAC), does not use security labels or clearances (eliminating MAC), and does not map permissions to job roles (eliminating Role-Based Access Control).

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

CISSP Timed Practice Test 3 — 10 Questions

Exhibit

CISSP Timed Practice Test 3 — 10 Questions

Exhibit