Certified Information Systems Security Professional CISSP (CISSP) — Questions 76–150

A policy is a mandatory, high-level statement approved by management, articulating the organization's strategic intent and overarching requirements for information security. It establishes the fundamental rules and direction for protecting assets, often driven by legal, regulatory, or business imperatives, without specifying technical details. Policies are foundational, setting the broad scope and purpose of security efforts across the enterprise.

A covert timing channel encodes information by precisely modulating the temporal relationship between observable events within a shared system. This involves a sender manipulating the timing of an action, like delaying a process or altering packet transmission intervals, which a receiver then observes and decodes based on the temporal variations. For example, a short delay might represent a '0' bit, while a longer delay signifies a '1' bit, transmitting data without using explicit storage or direct communication channels.

The design phase is the optimal stage for threat modeling because detailed architectural diagrams, data flow diagrams, and component interactions are established. This allows security professionals to systematically analyze the system's structure, identify trust boundaries, and pinpoint potential attack vectors using methodologies like STRIDE or PASTA. Addressing security concerns here ensures controls are built-in from the ground up, preventing vulnerabilities before any code is written, which is far more efficient and cost-effective.

A data breach is precisely defined as the unauthorized access, disclosure, or exfiltration of sensitive, protected, or confidential information. The SIEM alert indicating unauthorized data transfer out of the network directly describes the core characteristic of a data breach, where data has left the secure perimeter without proper authorization. This makes it the most accurate classification for an incident involving data exfiltration.

The 'no read up' rule is formally known as the Simple Security Property within the Bell-LaPadula model. This principle states that a subject at a given security clearance level cannot read information from an object classified at a higher security level. Its purpose is to enforce confidentiality by preventing unauthorized disclosure of classified information to subjects with insufficient clearance, ensuring that users only access data they are authorized to view.

Volatility is an advanced, open-source framework specifically engineered for volatile memory (RAM) extraction and analysis. It allows forensic analysts to reconstruct active network connections, extract running processes, inspect loaded DLLs, and recover cached credentials directly from a memory dump, making it the premier choice for memory forensics.

Varying the spacing between keystrokes is a classic example of a timing covert channel. The secret information is not stored in any persistent state or modified data field, but rather conveyed through the temporal relationship between events. By subtly altering the inter-event delay, such as the time between keystrokes, the sender encodes data that the receiver can decode by observing these timing variations.

Prepared statements ensure user input is treated as data, not executable SQL.

Segmenting the system from the rest of the network is a highly effective preventive and mitigating control for managing a known vulnerability. By isolating the system into a separate network zone, access to the vulnerable service or system is severely restricted, drastically reducing its attack surface. This containment strategy limits the number of potential attackers who can reach the system and prevents an exploit from easily propagating to other network resources, thereby minimizing the overall risk.

This scenario precisely describes a Time of Check to Time of Use (TOCTOU) vulnerability, where a system first checks a resource's state, such as file permissions, and then later uses that resource, like opening the file. An attacker exploits the brief interval between these two operations to maliciously alter the file, for instance, by replacing a legitimate file with a symlink to a sensitive system file. This allows the attacker to bypass the initial security check and gain unauthorized access or control over the system's subsequent actions.

This option is correct because it combines the strongest available security algorithms within SNMPv3's User-based Security Model (USM). SHA (Secure Hash Algorithm) provides robust message integrity and authentication, ensuring that messages have not been tampered with and originate from a legitimate source. AES (Advanced Encryption Standard) delivers strong confidentiality, encrypting the entire SNMP message to protect sensitive monitoring data from eavesdropping and unauthorized disclosure, aligning with current best practices for secure network management.

Displaying generic error messages like 'An unexpected error occurred' to users is a critical security practice that prevents the inadvertent disclosure of sensitive system information, such as database schemas, server configurations, or internal file paths. Concurrently, logging detailed error messages, including stack traces and specific error codes, for administrators is essential for effective debugging, incident response, and proactive identification of application vulnerabilities. This balanced approach ensures operational efficiency and maintainability without compromising the application's security posture by exposing internal workings to potential attackers.

Encrypting backups protects data confidentiality both in transit and at rest, preventing unauthorized access even if the storage media is compromised. Storing these encrypted backups offline or in an air-gapped manner physically isolates them from the production network, making them impervious to network-borne threats like ransomware, malware, or insider attacks that target online data. This strategy ensures data immutability and provides a secure, last-resort recovery point.

Two-person control, also known as the "two-man rule" or dual control, is a procedural security mechanism requiring the simultaneous involvement and agreement of two authorized individuals to perform a critical or sensitive action. This control prevents a single person from initiating or completing a high-risk transaction or operation, significantly mitigating the risk of fraud, error, or malicious intent by ensuring mutual oversight and accountability. It directly addresses the need for multiple people to complete a sensitive action.

Scanning container images for vulnerabilities identifies known CVEs and misconfigurations within the software components before deployment. Concurrently, using minimal base images significantly reduces the attack surface by excluding unnecessary libraries, packages, and executables. This dual approach proactively minimizes the number of potential vulnerabilities and limits the scope for exploitation, directly enhancing the security posture of the containerized application.

A tabletop exercise is a collaborative, discussion-based session where key stakeholders verbally walk through a simulated disaster scenario. Participants discuss their roles, responsibilities, decision-making processes, and interdependencies without activating any technical systems. This low-cost, low-risk method effectively identifies gaps in plans, validates communication protocols, and enhances team understanding of the business continuity strategy before more complex tests.

Structured review against regulatory clauses.

STRIDE is a widely recognized threat modeling methodology developed by Microsoft, specifically designed to identify and categorize potential threats to a system during its design phase. Its acronym represents six distinct threat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. These categories directly map to fundamental security properties like Authenticity, Integrity, Non-Repudiation, Confidentiality, Availability, and Authorization, making it highly effective for systematic threat identification in software.

WPA2-Enterprise provides robust encryption and authentication by integrating the 802.1X framework with an external authentication server, typically RADIUS. This architecture supports strong, centralized user or device authentication using methods like EAP-TLS with certificates, EAP-PEAP, or EAP-TTLS, dynamically generating unique encryption keys for each client session. This ensures strong, individualized security, accountability, and protection against unauthorized access.

The Identity Provider (IdP) is the authoritative entity responsible for authenticating the user's identity within a SAML 2.0 federation. It verifies user credentials against its own identity store (e.g., an LDAP directory or database) and, upon successful authentication, generates a digitally signed SAML assertion containing the user's authentication status and relevant attributes. This assertion is then securely transmitted to the Service Provider, confirming the user's identity without sharing their actual credentials.

SAST (Static Application Security Testing) directly examines the application's source code, bytecode, or binary code without executing it, identifying potential security vulnerabilities like SQL injection or cross-site scripting. This "white-box" approach is ideal for finding flaws early in the development lifecycle, before the application is even compiled or deployed, making it highly effective for proactive security.

Following the identification and prioritization of vulnerabilities based on their potential impact and likelihood, the immediate and most critical next phase in the vulnerability management lifecycle is remediation. This involves applying patches, reconfiguring systems, implementing compensating controls, or otherwise eliminating or reducing the risk posed by the identified weaknesses. Prioritization dictates what to fix first, and remediation is how those fixes are applied.

This value correctly represents the Annualized Loss Expectancy (ALE), which is a key metric in quantitative risk analysis. It is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). Assuming an SLE of $15,000 and an ARO of 0.5 (meaning the event is expected to occur once every two years), the ALE is $15,000 * 0.5 = $7,500. This figure quantifies the expected financial loss from a specific risk over a one-year period, informing cost-benefit analyses for security controls.

Regulatory requirements are the primary driver for log retention policies because various compliance frameworks, such as HIPAA, PCI DSS, GDPR, and SOX, explicitly mandate specific types of logs and their minimum retention periods. These mandates ensure accountability, provide an audit trail, and support legal defensibility, with non-compliance leading to severe penalties, fines, and reputational damage. Organizations must align their log retention strategies directly with these external obligations.

Provides per-user authentication and strong encryption.

Manual verification helps identify false positives and prioritize real vulnerabilities.

Emergency stop criteria are a critical component of the Rules of Engagement (RoE) because they explicitly define the conditions under which an engagement must be immediately halted to prevent unintended harm, legal issues, or excessive risk. These criteria ensure that testing can be safely terminated if unexpected system instability, unauthorized access to sensitive data, or other critical incidents occur, thereby protecting the target environment and the testing team. Establishing these clear boundaries is fundamental to responsible and controlled security assessments.

The Client Credentials grant type is specifically designed for machine-to-machine authentication, where a confidential client (e.g., a service, daemon, or another API) needs to access protected resources on behalf of itself, rather than a specific end-user. In this flow, the client authenticates directly with the authorization server using its own client ID and client secret, receiving an access token that grants it access to resources it is authorized for. This grant is ideal for server-to-server interactions or automated processes where no user interaction is present or required.

Preparation is the foundational phase of an incident response plan, establishing the necessary policies, procedures, and resources before an incident occurs. This includes developing communication plans, training personnel, acquiring essential tools, and conducting regular drills to ensure the organization is ready to respond effectively. Proper preparation significantly reduces the impact and duration of security incidents by building a robust framework for action.

Consent is a fundamental lawful basis where the data subject explicitly and unambiguously agrees to the processing of their personal data for a specific purpose. For consent to be valid, it must be freely given, specific, informed, and an unambiguous indication of the data subject's wishes, often requiring a clear affirmative action. This places control directly with the individual.

Implementing a screened subnet architecture with two firewalls is the industry-standard and most robust method for DMZ deployment. The first firewall isolates the DMZ from the internet, while the second firewall strictly controls traffic between the DMZ and the internal network. This design provides defense-in-depth, ensuring that even if a DMZ server is compromised, the attacker still faces a second, dedicated firewall before gaining access to sensitive internal resources, significantly limiting the blast radius of a breach.

AES (Advanced Encryption Standard) is a symmetric block cipher, widely recognized and adopted as the global standard for secure data encryption. It operates by encrypting data in fixed-size blocks (128 bits) using key sizes of 128, 192, or 256 bits, offering robust security against all known practical attacks when properly implemented. Its excellent balance of strong cryptographic properties, high performance, and efficiency makes it the optimal choice for encrypting bulk data in contemporary systems.

Escalating the finding to the risk management team for formal risk acceptance is the correct procedure when a significant vulnerability is identified and immediate remediation is not feasible or desired. This process ensures that the decision to operate with a known risk is thoroughly documented, reviewed by appropriate organizational stakeholders, and approved by management with the authority to accept that level of risk. Formal acceptance establishes clear accountability and ensures the organization's risk posture is transparently understood and managed.

Designing the landscape to provide clear sightlines from a guard post directly implements the CPTED principle of natural surveillance. By eliminating potential hiding spots and ensuring unobstructed views, this design choice increases the perceived risk for potential offenders, as they believe their actions are more likely to be observed. This proactive environmental design deters criminal activity by making illicit behavior more difficult to conceal, thereby enhancing overall security through visibility.

The primary objective of a Business Impact Analysis (BIA) is to identify and prioritize the organization's critical business processes. By distinguishing core operations from non-essential ones, the BIA allows planners to allocate recovery resources effectively and establish realistic recovery timelines. Without this inventory, the BCP cannot target the most vital survival functions of the enterprise.

This option is correct because continuous replication ensures near-zero data loss, effectively meeting the stringent 30-minute Recovery Point Objective (RPO). Leveraging cloud-based Disaster Recovery (DR) allows for rapid provisioning of resources and pre-configured environments, which can be activated to meet the 4-hour Recovery Time Objective (RTO). Furthermore, cloud DR typically offers a more cost-effective solution compared to maintaining a dedicated physical hot site, making it an optimal choice that satisfies all technical and financial requirements.

A reciprocal agreement is a mutual arrangement between two organizations, often competitors or peers, to provide each other with backup facilities, equipment, or resources in the event of a disaster. This type of agreement directly addresses the concept of 'an agreement with' another entity to ensure business continuity, leveraging shared risk and resources rather than dedicated, pre-built recovery sites.

Layered security, also known as defense-in-depth, is a fundamental secure design principle that involves deploying multiple, independent security controls throughout a system. This approach ensures that if one security control fails or is bypassed, other controls are still in place to detect and prevent unauthorized access or actions. It significantly increases the attacker's effort and time required to compromise a system, making it a cornerstone of robust cybersecurity architectures.

The primary purpose of a Hardware Security Module (HSM) is to provide a highly secure, tamper-resistant environment for the entire lifecycle of cryptographic keys, including generation, storage, and usage. HSMs are engineered with robust physical and logical security mechanisms to protect keys from unauthorized access, extraction, and manipulation, often meeting stringent security standards like FIPS 140-2. This secure key management is critical for maintaining the integrity and confidentiality of cryptographic operations across various applications and systems.

The primary purpose of a Configuration Management Database (CMDB) is to serve as a centralized repository for information about all Configuration Items (CIs) within an IT environment. This includes not only detailed attributes of each asset, such as hardware specifications, software versions, and network addresses, but critically, also the intricate relationships and dependencies between these CIs. By mapping these connections, a CMDB enables organizations to understand the impact of changes and facilitate effective incident and problem management.

A Key Performance Indicator (KPI) is a quantifiable metric used to evaluate the success of a particular activity, process, or project against predefined objectives. Mean time to remediate (MTTR) is an excellent example of a KPI because it directly measures the efficiency and effectiveness of the incident response and vulnerability management processes. Tracking MTTR allows security managers to assess operational performance, identify bottlenecks, and drive continuous improvement in their remediation efforts.

This sequence precisely matches the four canons of the (ISC)² Code of Ethics, which are hierarchically ordered to guide cybersecurity professionals. The primary responsibility is to protect society, followed by acting honorably, providing diligent service to principals, and finally advancing the profession. This specific order reflects the increasing scope of responsibility, from global impact to individual professional growth, making it the correct representation of the ethical framework.

WireGuard is the superior choice due to its modern cryptographic design, which inherently incorporates elliptic curve cryptography (ECC) for efficient key exchange and strong Perfect Forward Secrecy (PFS) through its Noise protocol framework. Its extremely lightweight codebase, consisting of only a few thousand lines, significantly reduces the attack surface and contributes to its high performance and minimal overhead, making it ideal for various platforms and resource-constrained environments.

Attribute-Based Access Control (ABAC) makes access decisions by evaluating a comprehensive set of attributes associated with the subject (e.g., user's department, clearance level), the object (e.g., resource sensitivity, file type), the action being requested (e.g., read, write), and the environmental context (e.g., time of day, network location). This highly dynamic and granular model uses policies that define rules based on these combined attributes, enabling context-aware authorization beyond static roles or identities.

Vulnerable and Outdated Components refers to the risk posed by using software components, such as libraries, frameworks, and other modules, that have known security flaws or are no longer supported. Exploiting these vulnerabilities, often documented as Common Vulnerabilities and Exposures (CVEs), can grant attackers unauthorized access, data breaches, or system control. Regularly updating and patching all third-party components is crucial to mitigate this significant attack vector.

Correct. DAC allows owners to grant or deny access.

Consent is a valid lawful basis under GDPR Article 6(1)(a) when the data subject has given their explicit agreement to the processing of their personal data for one or more specific purposes. For consent to be valid, it must be freely given, specific, informed, and unambiguous, signified by a clear affirmative action. Furthermore, the data subject must be able to withdraw their consent as easily as they gave it, and the controller must be able to demonstrate that consent was obtained.

Implementing memory encryption ensures that sensitive user data remains unintelligible even if an attacker gains unauthorized access to the system's RAM, for instance, through memory scraping malware, cold boot attacks, or direct memory access (DMA) exploits. This proactive measure protects data in its most vulnerable state—during active processing—by encrypting memory pages or regions, thereby preventing the compromise of sensitive information residing in volatile memory.

Correct. Isolating the database servers contains the potential breach, and forensic analysis on logs and memory dumps is essential to determine the scope and cause of the anomaly.

In an SDN architecture, the data plane, also known as the forwarding plane, is directly responsible for the physical movement of network traffic. It comprises the network devices (e.g., switches, routers) that execute the forwarding rules, or "flow tables," pushed down by the control plane. Its primary function is high-speed packet forwarding, encapsulation, and decapsulation, strictly adhering to the instructions received to direct packets to their next hop.

The Recovery Time Objective (RTO) is the maximum acceptable duration of time within which a business process or system must be restored after a disruption to avoid unacceptable consequences. During a Business Impact Analysis (BIA), the team identifies the RTO for critical functions by assessing the financial, operational, and reputational impacts of downtime over time. This objective serves as a key target for disaster recovery and business continuity planning, guiding the selection of appropriate recovery strategies.

Diversity of defense is a fundamental principle requiring the deployment of different types of security controls, technologies, and vendors across various layers. This strategic heterogeneity ensures that a single vulnerability or attack method targeting one specific control type cannot bypass all defenses simultaneously. By avoiding reliance on a uniform set of protections, the overall resilience against sophisticated threats is significantly enhanced, making it harder for attackers to find a common weakness.

Automated data classification tools are essential for a multinational corporation because they consistently identify and label sensitive content across diverse systems and jurisdictions. These tools leverage predefined rules, machine learning, and regular expressions to scan vast datasets, ensuring uniform application of data handling policies. This consistency is critical for maintaining regulatory compliance and enforcing appropriate security controls, regardless of where the data resides or travels.

A fundamental objective of a Business Impact Analysis (BIA) is to systematically identify and prioritize the organization's critical business processes. This involves determining which operations are essential for the organization's survival and mission fulfillment. Furthermore, the BIA meticulously maps out the internal and external dependencies—such as IT systems, personnel, facilities, and third-party services—that these critical processes rely upon to function effectively.

WireGuard is a modern, high-performance VPN protocol distinguished by its extremely small codebase, which significantly reduces the attack surface and simplifies auditing. It leverages state-of-the-art cryptographic primitives, including ChaCha20 for symmetric encryption, Poly1305 for authentication, and Curve25519 for Elliptic Curve Cryptography (ECC) and Perfect Forward Secrecy (PFS) key exchange. This combination ensures robust security, exceptional speed, and efficient resource utilization, making it ideal for remote employees seeking a fast and secure connection.

Network DLP inspects traffic at network egress points, including email.

This is the correct answer because it represents the first and highest priority canon in the (ISC)² Code of Ethics. It mandates that certified professionals prioritize the safety, welfare, and security of the public, critical systems, and shared resources above all other considerations. This overarching responsibility ensures that individual or organizational interests never compromise the broader societal well-being or the integrity of essential information technology infrastructure.

S/MIME (Secure/Multipurpose Internet Mail Extensions) is a widely adopted standard for public key encryption and digital signing of MIME data, primarily used for email. It leverages a hierarchical Public Key Infrastructure (PKI) where X.509 certificates, issued by trusted Certificate Authorities (CAs), bind public keys to user identities. This enables end-to-end encryption for confidentiality, digital signatures for integrity and non-repudiation, and sender authentication, making it the most suitable choice for securing corporate email communications.

Physical destruction, such as shredding, is the most secure and definitive method for sanitizing solid-state drives. This process involves mechanically breaking the SSD's components, including the NAND flash memory chips where data is stored, into tiny, unrecoverable fragments. By rendering the storage media physically unreadable and non-functional, shredding ensures that data cannot be reconstructed or accessed by any means, providing absolute data destruction.

Regenerating the session ID immediately after a user successfully authenticates is the most effective direct countermeasure against session fixation. This action ensures that any session ID an attacker might have previously forced upon the victim's browser becomes invalid and unusable. By issuing a completely new, cryptographically random session ID for the authenticated session, the application effectively severs the link between the attacker's known ID and the legitimate user's secure session, preventing unauthorized access.

An Incident Response (IR) plan establishes a systematic and predefined set of procedures, roles, and communication protocols for an organization to effectively handle security breaches. This structured approach ensures that incidents are detected promptly, analyzed thoroughly, contained efficiently, eradicated completely, and that systems are recovered swiftly. Its primary purpose is to minimize impact, restore normal operations, and learn from each event to enhance overall security posture.

Implementing Network Access Control (NAC) is the most effective solution for managing BYOD security by dynamically assessing the security posture of devices attempting to connect to the network. NAC verifies device compliance with organizational policies, checking for up-to-date antivirus, patch levels, and configuration settings before granting or restricting network access. This allows for granular control and automated remediation, ensuring only healthy and compliant devices can access corporate resources.

SFTP (SSH File Transfer Protocol) is the correct choice because it runs as a subsystem over a single SSH connection, leveraging SSH's robust authentication and encryption capabilities. This provides strong security for both data in transit and control commands, operating efficiently over a single port (typically 22) which simplifies firewall management. SFTP also offers a rich set of features, including directory listings, file deletion, and resume capabilities, making it a comprehensive solution for secure file management.

The security kernel is the concrete implementation of the abstract reference monitor concept within a Trusted Computing Base (TCB). It is the core of the operating system that enforces the system's access control policies, mediating all subject-object interactions to ensure security. This critical component is responsible for isolating processes, managing memory, and controlling access to resources, making it the actual mechanism that implements the TCB's security functions.

Physically shredding a drive into small, unrecoverable pieces is the most secure and definitive method of data sanitization, as it renders the storage media completely unusable and the data inaccessible. This process involves mechanical destruction, breaking the platters or flash memory chips into fragments too small to reconstruct, thereby eliminating any possibility of data retrieval, even with advanced forensic techniques. It is often considered the ultimate method for highly sensitive data.

This option correctly calculates the Annual Loss Expectancy (ALE) by first determining the Single Loss Expectancy (SLE) and then multiplying it by the Annualized Rate of Occurrence (ARO). The SLE is derived from the Asset Value ($50,000) multiplied by the Exposure Factor (0.4), resulting in $20,000. Subsequently, multiplying this SLE by the ARO (0.5) yields the correct ALE of $10,000, representing the expected financial loss from this specific risk over a year.

The Bell-LaPadula security model is specifically designed to enforce confidentiality, primarily within military and government hierarchical classification systems. It prevents unauthorized disclosure of information by implementing two core rules: the Simple Security Property (no read up) and the *-Property (no write down). This ensures that subjects can only access information at or below their security clearance level and cannot write information to a lower clearance level, thus maintaining strict confidentiality.

TLS 1.3 mandates forward secrecy, primarily achieved through the exclusive use of ephemeral Diffie-Hellman (DHE or ECDHE) key exchange mechanisms. This means that a unique, temporary session key is generated for each connection, which is then discarded after the session ends. Even if a server's long-term private key is compromised in the future, past session keys cannot be derived, thus protecting the confidentiality of previously recorded communications. This design significantly enhances long-term data security against future compromises.

Using AES-256 in Galois/Counter Mode (GCM) for authenticated encryption represents a strong and recommended cryptographic best practice. AES-256 provides robust confidentiality with its 256-bit key, making brute-force attacks computationally infeasible. GCM, as an Authenticated Encryption with Associated Data (AEAD) mode, simultaneously ensures data integrity and authenticity by generating an authentication tag, which verifies that the ciphertext has not been tampered with and originated from a legitimate source. This combination offers comprehensive protection against both eavesdropping and active manipulation.

Non-repudiation provides irrefutable proof that a specific action or event has occurred and that a particular entity was responsible for it, preventing them from later denying their involvement. This is typically achieved through robust audit trails, digital signatures, and secure logging mechanisms that cryptographically link an action to a user. Therefore, it directly addresses the requirement to prevent users from disclaiming responsibility for their actions within an access control system.

The Business Impact Analysis (BIA) identified that the current 8-hour recovery time for a critical system far exceeds the required 2-hour Recovery Time Objective (RTO). Implementing faster backup technologies, such as incremental backups with rapid restore capabilities, or enhancing restoration procedures, directly addresses this gap. This strategy reduces the impact of an outage by bringing the actual recovery time within acceptable business parameters, thereby mitigating the identified risk.

Cloud Disaster Recovery (DR) with replication leverages public or private cloud infrastructure to host backup systems and data. This approach enables rapid recovery with low RTO and RPO by continuously replicating data and virtual machine images to the cloud, allowing for quick spin-up of services in a disaster. Its scalability and pay-as-you-go model also offer cost-effectiveness compared to maintaining a dedicated secondary site.