CISSP Timed Practice Test 3 — 10 Questions

Question 1

A network security analyst receives an alert from the intrusion detection system (IDS) indicating a high volume of TCP SYN packets to a single external IP address from a compromised internal host. This is characteristic of which type of attack?

10 minute time limit — choose an answer to begin.

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target, exhausting its connection table and preventing legitimate connections. The IDS alert specifically describes a compromised internal host generating many SYN packets to a single external IP, which matches the classic behavior of a SYN flood where the attacker spoofs the source IP or uses a bot to saturate the target's resources.

Answer

Man-in-the-middle

Answer

ARP spoofing

Answer

DNS amplification

Question 2

A development team is adopting a secure SDLC. Which phase should include threat modeling to identify potential security vulnerabilities early?

Accepted Answer

Design. Threat modeling is a structured activity that identifies potential threats, vulnerabilities, and attack vectors against a system. It is most effective during the Design phase because architectural decisions, data flow diagrams, trust boundaries, and component interactions are being defined, allowing security controls to be built in rather than bolted on later. Performing threat modeling here aligns with the 'shift left' principle of secure SDLC, reducing cost and effort compared to retrofitting security after implementation.

Answer

Implementation

Answer

Testing

Answer

Requirements gathering

Question 3

A penetration tester is planning an engagement. Which of the following rules of engagement should be defined before testing begins? (Select TWO.)

Accepted Answer

Emergency contact procedures. Option B (Emergency contact procedures) is correct because rules of engagement must establish who to contact and how to halt testing immediately if a critical system outage or unintended impact occurs, ensuring safety and rapid escalation. Option C (The scope of systems to be tested) is correct because ROE must explicitly define in-scope and out-of-scope IP ranges, domains, and assets to prevent unauthorized testing and legal exposure. Option A is not required in the ROE because specific exploits are chosen during execution based on findings, not pre-defined in the engagement contract. Option D is irrelevant to ROE since compensation is a business/contractual matter, not a testing boundary or safety control. Option E is inappropriate because naming specific employees to target is not a standard ROE element and could raise ethical or legal concerns; targeting is defined by scope, not individuals.

Answer

The exact exploits to be used

Answer

The tester's personal compensation

Answer

The names of employees to be targeted

Question 4

A financial institution is implementing a data loss prevention (DLP) solution to protect customer financial information. The DLP system must detect and block the transmission of credit card numbers via email. Which of the following is the BEST approach to ensure accurate detection while minimizing false positives?

Accepted Answer

Apply a regular expression that validates the Luhn algorithm in addition to pattern matching. Combining a regular expression for credit card number patterns with Luhn algorithm validation significantly reduces false positives. The regular expression identifies potential matches (e.g., 16-digit patterns), and the Luhn algorithm checks the mathematical validity of the checksum. This dual-layer approach is a standard DLP best practice for accurately detecting sensitive data like credit card numbers.

Answer

Hash all outbound emails and compare against a database of known credit card hashes

Answer

Use a simple regular expression matching patterns like '\d{4}-\d{4}-\d{4}-\d{4}'

Answer

Rely on machine learning classifiers trained on past credit card data

Question 5

A software company uses a third-party library that has a known critical vulnerability. The library is used extensively and rewriting the code would take months. What is the BEST immediate action to reduce risk?

Accepted Answer

Implement a Web Application Firewall (WAF) rule to block exploitation. Implementing a Web Application Firewall (WAF) rule to block exploitation provides an immediate, compensating control that mitigates the known vulnerability without requiring code changes. This is the best immediate action because it buys time for a permanent fix while reducing risk, aligning with the principle of defense in depth. The WAF can inspect HTTP/HTTPS traffic for attack patterns (e.g., SQL injection, path traversal) specific to the vulnerable library and block malicious requests at the application layer.

Answer

Remove the library from the codebase immediately

Answer

Disable the vulnerable feature in the library

Answer

Increase logging and monitoring to detect exploitation attempts

Question 6

A company has implemented a new web application firewall (WAF) and wants to test its effectiveness. Which of the following testing methods would provide the MOST accurate assessment?

Accepted Answer

Conduct a penetration test that includes attempts to bypass the WAF.. A penetration test that actively attempts to bypass the WAF provides the most accurate assessment because it simulates a real attacker's behavior, testing the WAF's ability to detect and block evasion techniques such as HTTP parameter pollution, encoding obfuscation, and SQL injection payload splitting. This method validates the WAF's effectiveness under realistic adversarial conditions, revealing gaps that passive or disabled-state testing cannot uncover.

Answer

Perform a vulnerability scan on the web application with the WAF disabled.

Answer

Review the WAF logs for any blocked attacks.

Answer

Run an automated web application scanner against the application with the WAF enabled.

Question 7

A security architect is designing a network for a high-security data center. The requirement is to ensure that even if an attacker compromises one server, they cannot easily move laterally to other servers in the same data center. Which network design principle should be applied?

Accepted Answer

Microsegmentation (e.g., using virtual firewalls on each hypervisor). Microsegmentation (D) is the correct network design principle because it enforces granular, per-workload firewall rules—often implemented via virtual firewalls on each hypervisor or using VXLAN/ACL policies—that restrict east-west traffic between servers. Even if an attacker compromises one server, microsegmentation prevents lateral movement by allowing only explicitly permitted inter-server communication, effectively isolating the breach to the compromised host.

Answer

Principle of least privilege

Answer

Defense in depth

Answer

Single point of failure elimination

Question 8

A company deploys DNSSEC to protect its DNS infrastructure. Which cryptographic operation does DNSSEC primarily use to ensure the authenticity and integrity of DNS data?

Accepted Answer

Digital signatures of DNS records. DNSSEC primarily uses digital signatures to ensure the authenticity and integrity of DNS data. Each DNS zone is signed with a private key, and resolvers verify the signatures using the corresponding public key, which is published as a DNSKEY record. This process allows the resolver to cryptographically confirm that the data has not been modified in transit and originates from the authoritative source.

Answer

Hashing of DNS responses without keys

Answer

Transport Layer Security for DNS

Answer

Symmetric encryption of DNS queries

Question 9

Drag and drop the steps for a disaster recovery (DR) plan activation in the correct order.

Accepted Answer

1. Declare disaster, 2. Notify stakeholders, 3. Failover to alternate site, 4. Restore operations, 5. Test and resume normal operations. The correct order for DR plan activation is: declare disaster first to initiate the plan, then notify all stakeholders, perform failover to the alternate site, restore operations from backups or other means, and finally test and resume normal operations. This sequence ensures that activation is acknowledged, resources are aware, critical systems are recovered, and operations can safely return to normal after validation.

Answer

1. Notify stakeholders, 2. Declare disaster, 3. Failover to alternate site, 4. Test and resume normal operations, 5. Restore operations

Answer

1. Declare disaster, 2. Failover to alternate site, 3. Notify stakeholders, 4. Restore operations, 5. Test and resume normal operations

Answer

1. Declare disaster, 2. Notify stakeholders, 3. Restore operations, 4. Failover to alternate site, 5. Test and resume normal operations

Question 10

A company wants to securely transfer files between systems over SSH. Which protocol should they use to leverage the existing SSH infrastructure and provide both authentication and encryption?

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol) is the correct choice because it operates over the SSH protocol (typically port 22), leveraging its existing authentication and encryption mechanisms. Unlike FTPS, which adds SSL/TLS to FTP, SFTP is designed as a secure file transfer subsystem of SSH, providing both confidentiality and integrity without requiring additional infrastructure.

Answer

FTPS

Answer

TFTP

Answer

SCP