Certified Information Systems Security Professional CISSP (CISSP) — Questions 451–525

Session recording is a critical component of Privileged Access Management (PAM) that captures and archives all activities performed during a privileged session. This includes keystrokes, mouse movements, and screen content, providing an immutable audit trail. Such recordings are invaluable for forensic analysis, compliance auditing, and identifying unauthorized or suspicious actions by privileged users, enhancing accountability and security posture.

Hypervisor-level network policies are enforced directly by the hypervisor, which sits above all virtual machines and has ultimate control over their network interactions. This allows for granular control over traffic flow, micro-segmentation, and robust isolation between VMs, even those on the same virtual network. Because these policies are enforced at a layer inaccessible to guest operating systems, they provide the most effective and resilient security control against compromised VMs or lateral movement within the virtualized environment.

Correct. Whether a known exploit exists is a key factor because vulnerabilities with existing exploits are more likely to be targeted, increasing urgency.

Port scanning involves an attacker systematically probing a target system's ports to discover which services are listening or open. When a scanner attempts to connect to numerous closed or filtered ports, the firewall will log these connection attempts as dropped packets, as it denies access or the target service does not respond. A high volume of such drops across various ports is a strong indicator of an adversary performing reconnaissance.

A SIEM aggregates and correlates FIM alerts, patch deployment records, and change management logs, providing the centralized detection and evidence repository continuous monitoring requires. Retention aligned to the audit period ensures auditors can review historical events, and correlation surfaces changes that lack an approved change record.

A legal hold, also known as a litigation hold or preservation order, is a formal directive issued by an organization to suspend the normal disposition or alteration of records and information that may be relevant to a pending or reasonably anticipated legal action, investigation, or audit. This critical process ensures that all potentially discoverable data, including electronically stored information (ESI), is preserved, overriding any routine data retention policies that might otherwise lead to its deletion. It directly addresses the requirement to retain customer transaction data in anticipation of legal needs.

A smart card is a physical token the user possesses, satisfying something you have. A fingerprint is a biometric trait inherent to the user, satisfying something you are. Together they combine possession and inherence factors for MFA.

Encryption directly addresses confidentiality by transforming plaintext data into an unreadable ciphertext using a cryptographic algorithm and a secret key. This process ensures that even if unauthorized individuals gain access to the encrypted data, they cannot decipher its content without the correct decryption key. Consequently, encryption effectively prevents unauthorized disclosure of sensitive information, making it the primary control for upholding the confidentiality of data both at rest and in transit.

The Bell-LaPadula model is specifically designed to enforce confidentiality in multi-level security environments. It achieves this through two primary rules: the simple security property, which prevents subjects from reading objects at a higher classification level ('no read up'), and the *-property (star property), which prevents subjects from writing to objects at a lower classification level ('no write down'). These rules collectively ensure that sensitive information cannot flow downwards to less secure classifications, thereby preserving its secrecy.

After implementing security controls, the inherent risk (high likelihood, potentially high impact) is expected to be reduced to a more acceptable level. "Medium likelihood, medium impact" represents a plausible and common outcome of effective risk mitigation strategies, where controls successfully diminish the probability of the event occurring and/or lessen its potential consequences. This remaining risk, after controls are applied, is precisely what is defined as residual risk, indicating a successful but not absolute reduction from the initial state.

Deleting financial records after 2555 days would directly violate most regulatory compliance mandates, which typically require these records to be retained and accessible for auditability over extended periods. The specified action for financial data is archiving, which preserves the data in a secure, immutable state for its required lifecycle, rather than permanent destruction. Deletion would render the organization non-compliant and unable to produce necessary documentation if requested by auditors or legal entities.

The OpenSSL Heartbleed vulnerability (CVE-2014-0160) is a critical memory disclosure flaw that allowed attackers to read up to 64KB of memory from affected servers, potentially exposing private keys, user credentials, and other sensitive data without leaving a trace. Its high severity stems from its widespread impact on internet services, ease of exploitation, and the direct compromise of confidentiality, making it a top priority for immediate remediation.

Federated identity management fundamentally depends on established, open standards to facilitate secure and interoperable communication between distinct identity providers and service providers. Protocols like Security Assertion Markup Language (SAML) and OpenID Connect (OIDC) define the formats for exchanging authentication and authorization assertions, ensuring that diverse systems can understand and trust each other's identity information. This standardization is critical for enabling seamless cross-domain access and single sign-on without requiring proprietary integrations.

A smart card represents 'something you have' (Type 2) because it is a physical token that must be possessed by the user to grant access. These cards typically contain an embedded microchip capable of performing cryptographic operations, such as storing digital certificates or generating one-time passwords. Its security relies on the physical control of the device, making it a robust authentication factor, often combined with a PIN for multi-factor authentication.

An essential characteristic of an effective data classification scheme is that its labels (e.g., "Confidential," "Internal Use Only") must directly correspond to specific, actionable handling procedures. These procedures dictate how data at each classification level should be stored, transmitted, accessed, and disposed of. Without this clear mapping, labels become meaningless, as users would lack the necessary guidance to protect information appropriately, rendering the entire classification effort ineffective.

Reporting suspicious emails shows that employees are applying their training.

This configuration directly enforces the use of HTTPS by making TCP port 443 (HTTPS) accessible while explicitly denying TCP port 80 (HTTP). It ensures all web traffic to the application is encrypted, meeting security requirements for data confidentiality and integrity. Any attempt to connect via unencrypted HTTP would be blocked at the network perimeter, preventing insecure access and upholding the 'HTTPS-only' mandate.

Requiring peer review for all pull requests is a critical security control because human reviewers can identify complex logical flaws, design vulnerabilities, and business logic errors that automated static analysis tools often miss. This manual inspection allows for a deeper understanding of the code's intent and potential misuse, ensuring adherence to secure coding standards and architectural principles before changes are integrated into the main codebase. It provides an essential layer of defense against subtle security defects.

Intel Software Guard Extensions (SGX) is a set of CPU instructions that allows developers to protect specific code and data from disclosure or modification. It achieves this by creating "enclaves," which are isolated, hardware-protected memory regions within an application's address space. Even if the operating system, hypervisor, or other privileged software is compromised, the code and data inside an SGX enclave remain protected, making it suitable for mitigating vulnerabilities that target runtime execution integrity and confidentiality.

ITIL (Information Technology Infrastructure Library) is a widely adopted framework providing best practices for IT service management (ITSM). It specifically guides organizations through the entire service lifecycle, encompassing Service Strategy, Design, Transition, Operation, and Continual Service Improvement, making it ideal for managing the full journey of IT services.

WPA3 significantly enhances wireless security by replacing the vulnerable Pre-Shared Key (PSK) 4-way handshake with the Simultaneous Authentication of Equals (SAE) protocol, also known as Dragonfly. SAE is a password-authenticated key agreement (PAKE) protocol that establishes a secure session key without ever transmitting the password directly. This robust cryptographic exchange provides stronger protection against offline dictionary attacks and ensures forward secrecy, making it the correct answer for replacing the PSK mechanism.

DAST tests a running application from the outside, simulating attacks similar to those a real attacker would use. It can identify vulnerabilities such as injection, authentication flaws, and misconfigurations that only appear at runtime. This directly meets the requirement to test for security vulnerabilities by simulating real-world attacks against the deployed application.

The core function of a security audit is to systematically evaluate an organization's security posture by comparing its implemented security controls, policies, and procedures against a predetermined set of criteria. These criteria typically include industry best practices, regulatory requirements (e.g., GDPR, HIPAA), internal policies, or recognized security frameworks (e.g., ISO 27001, NIST CSF). This comparison determines the degree of compliance and identifies any deviations or gaps that need remediation.

This option correctly identifies a fundamental limitation of k-anonymity, known as the homogeneity attack. If all individuals within an equivalence class (a group of k records sharing identical quasi-identifiers) also share the same value for a sensitive attribute, then that attribute is effectively disclosed for everyone in the group. Despite the anonymity of individual identity, the sensitive information becomes known, leading to attribute disclosure and a moderate level of risk.

Network DLP systems specifically monitor "data in motion" by inspecting network traffic as it traverses the organization's boundaries or internal segments. These solutions typically employ deep packet inspection (DPI) to analyze data streams for sensitive content, patterns, or metadata, preventing unauthorized transmission over protocols like HTTP, FTP, or email. They are often deployed at network egress points or internal chokepoints to enforce data security policies.

This sequence accurately represents the decreasing order of volatility for digital evidence, which is crucial for forensic collection. CPU registers are the most volatile, holding data only during active processing and being lost immediately upon power loss or context switch. Cache memory is slightly less volatile but still transient, followed by RAM, which requires continuous power to retain data. Swap space, residing on disk, is less volatile than RAM but more dynamic than persistent disk storage, making disk the least volatile and most persistent data source.

GDPR Article 33 mandates that in the event of a personal data breach, the data controller must notify the relevant supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it. This notification is required unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. The notification must include details such as the nature of the breach, categories of data subjects and records concerned, and the likely consequences.

Parameterized queries with prepared statements are the most effective defense against SQL injection vulnerabilities. By separating the SQL code from user-supplied data, the database engine can distinguish between the query structure and the values to be inserted, updated, or retrieved. This mechanism ensures that user input is always treated as literal data, preventing it from being interpreted as executable SQL commands.

A fundamental characteristic of a Trusted Execution Environment (TEE) is its ability to provide robust hardware-enforced isolation from the main operating system. This isolation ensures that code and data running within the TEE are protected from unauthorized access or tampering by the rich OS, hypervisor, or any other software running in the less privileged 'normal world.' This hardware-level separation is critical for maintaining the integrity and confidentiality of sensitive computations.

This option is correct because the authentication system leverages two distinct types of factors to verify a user's identity. The password serves as the 'something you know' factor, requiring the user to recall a secret piece of information. The SMS One-Time Password (OTP), delivered to a registered mobile device, functions as the 'something you have' factor, relying on the user's possession of that specific device. This combination of two different factor categories precisely defines two-factor authentication (2FA).

DAC binds permissions to resource owners, who grant or revoke access at their discretion. This directly satisfies the stem's requirement that the owner determines both who may access the resource and which permissions they hold, unlike mandatory or role-based models where policy is centrally imposed.

Compressing logs significantly reduces their storage footprint, making them more economical to retain over extended periods. Moving these compressed logs to low-cost archival storage, such as tape libraries, object storage, or cloud cold storage tiers, directly addresses the challenge of managing large volumes of data while meeting the seven-year retention requirement. This strategy ensures data integrity and availability for compliance and forensic needs without incurring prohibitive costs on primary storage systems.

PPTP (Point-to-Point Tunneling Protocol) is a legacy VPN protocol that relies heavily on MS-CHAPv2 for authentication. MS-CHAPv2 has well-documented cryptographic weaknesses, including susceptibility to offline dictionary attacks and specific attacks that can extract the NT password hash, compromising user credentials. Furthermore, PPTP lacks a robust key exchange mechanism like IKE, making its session key negotiation vulnerable and failing to provide forward secrecy, which is a critical security requirement for modern VPNs.

Automated data classification tools leverage machine learning, regular expressions, and predefined policies to scan, identify, and label data based on its content (e.g., PII, PCI data) and context (e.g., location, creator, access patterns). This significantly reduces human error and subjectivity, ensuring consistent, scalable, and real-time application of classification labels across vast and dynamic data repositories. Such tools enforce organizational policies uniformly, enhancing compliance and security posture effectively.

IPsec (Internet Protocol Security) is a suite of protocols that provides cryptographic security services at the IP layer, ensuring confidentiality, integrity, and authenticity of data packets. It is the industry standard for establishing secure, encrypted tunnels between networks, making it ideal for connecting multiple office locations over an untrusted WAN. IPsec VPNs utilize protocols like Authentication Header (AH) and Encapsulating Security Payload (ESP) to secure all traffic flowing between the connected sites, providing robust site-to-site connectivity.

Reviewing application logs for database error messages is the most immediate, passive, and non-intrusive method to validate a suspected SQL injection. Successful SQL injection attempts, especially those designed to extract information or manipulate queries, often result in distinct database errors (e.g., syntax errors, unhandled exceptions, or specific database-level warnings) that are logged by the application or database server. These errors provide direct, forensic evidence of an attempted or successful injection, allowing the analyst to confirm the vulnerability without active probing or risk to the system.

Using a key derivation function (KDF) like bcrypt with a per-user salt is the most secure method for storing passwords. Bcrypt is specifically designed to be computationally intensive and slow, making brute-force attacks economically infeasible by requiring significant processing power for each guess. The unique, randomly generated per-user salt ensures that even identical passwords produce different hashes, effectively neutralizing precomputed rainbow table attacks and dictionary attacks across multiple user accounts.

The Condition element specifies that the Allow effect is only active when the source IP address of the request is within the 10.0.0.0/8 range. For any request originating from an IP address outside this specified range, the condition evaluates to false, causing the Allow statement to not apply. In AWS IAM, if no explicit Allow statement applies and no explicit Deny statement exists, the default behavior is an implicit deny, effectively blocking access.

An authenticated scan is performed with valid user credentials, allowing the scanner to interact with the application as a legitimate, logged-in user. This approach provides a comprehensive view of vulnerabilities, including those in protected areas, authorization flaws, and business logic issues that are only accessible post-authentication. By simulating a real user, it significantly reduces false positives and offers a more accurate security posture assessment of the application's internal workings.

A SOC 2 Type II report provides a comprehensive evaluation of a service organization's controls related to the Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, and Privacy). Crucially, it assesses both the suitability of the design of these controls and their operating effectiveness over a defined period, typically 6-12 months. This report offers user entities a high level of assurance that controls were consistently applied and functioned as intended throughout the audit period.

Requiring distinct permissions for committing code into a repository versus deploying that code to a production environment is a fundamental application of separation of duties. This ensures that individuals responsible for developing and modifying code are not the same ones authorized to release it, thereby introducing an independent control point. It mitigates risks associated with insider threats and accidental errors by distributing critical responsibilities.

Implementing a robust data classification policy clearly defines what "internal use" data means, outlines specific labeling conventions, and details the mandatory handling procedures for such information. Coupled with comprehensive employee training, this approach directly communicates the organization's expectations and legal obligations to all personnel. This ensures employees understand their responsibilities and the implications of mishandling sensitive data, fostering a culture of compliance.

Risk acceptance is a deliberate decision by an organization to acknowledge and bear the potential consequences of a specific risk, often when the cost or effort of implementing other response strategies outweighs the potential impact. This strategy is typically documented, and the organization may establish a contingency plan or simply monitor the risk without further action.

This is the correct answer. XML External Entity (XXE) vulnerabilities allow an attacker to define or reference external entities within XML documents, which are then processed by the XML parser. By leveraging the `file://` protocol, an attacker can instruct the server to read arbitrary local files, such as `/etc/passwd`, application configuration files, or other sensitive system files, and include their content within the XML parser's response or error messages, leading to unauthorized data disclosure.

Implement a self-service password reset (SSPR) with identity verification. — SSPR empowers users to reset forgotten passwords independently by leveraging pre-registered identity verification methods, such as multi-factor authentication (MFA) or security questions. This significantly reduces the volume of password reset requests directed to the help desk, freeing up their resources for more complex issues. The integrated identity verification ensures that only the legitimate user can perform the reset, maintaining security while improving operational efficiency.

Documenting who accessed the evidence and when is the fundamental purpose of maintaining a chain of custody during a forensic investigation. This process creates an unbroken, verifiable audit trail that identifies every individual who has handled or had control over a piece of evidence, along with the precise dates and times of these interactions. This meticulous record is essential for demonstrating that the evidence has not been tampered with, substituted, or compromised, thereby ensuring its integrity and legal admissibility in court.

Content Security Policy (CSP) is a crucial security mechanism that allows web administrators to define trusted sources for content, such as scripts, stylesheets, and images, that a user agent is permitted to load for a given page. By restricting script execution to only approved origins, CSP significantly mitigates Cross-Site Scripting (XSS) attacks, preventing browsers from executing malicious scripts injected from untrusted sources, even if an injection vulnerability exists. This policy acts as a powerful, browser-enforced second layer of defense.

Penetration testing is a highly effective and common method for proactively assessing an organization's security posture by simulating real-world attacks. Ethical hackers attempt to exploit identified vulnerabilities in systems, applications, and networks to determine the extent to which an attacker could compromise assets. This hands-on approach provides valuable insights into the effectiveness of existing security controls and the potential impact of a successful breach.

Formatting a removable drive prepares it for data storage by creating a file system, but this process does not automatically encrypt the data written to it. Encryption, such as using Windows' BitLocker To Go, is a distinct security measure that must be explicitly enabled by the user after formatting. This separate step involves generating and managing cryptographic keys to protect the data at rest, ensuring confidentiality even if the physical device is compromised.

Disabling USB ports via Group Policy establishes a robust logical control, preventing unauthorized mounting of removable storage devices across an organization's endpoints. Concurrently, physically locking computer cases adds a crucial physical security layer, thwarting attempts to bypass software controls or access internal ports for data transfer. This dual-layered approach effectively eliminates the primary vector for data exfiltration using portable media, making it a highly enforceable preventative measure.

Volatility is an open-source framework specifically designed for memory forensics, enabling investigators to extract and analyze digital artifacts from volatile memory (RAM) dumps. It allows for the examination of running processes, open network connections, loaded kernel modules, and user activity, which are crucial for incident response, malware analysis, and understanding the runtime state of a compromised system. Its capabilities are centered on analyzing live system memory rather than persistent storage.

A Security Information and Event Management (SIEM) system aggregates and correlates security event data from various sources, including network devices, servers, applications, and intrusion detection systems. By analyzing these logs in real-time for anomalous patterns, policy violations, and known attack signatures, SIEM can effectively detect sophisticated unauthorized access attempts and ongoing breaches that might otherwise go unnoticed.

The data custodian is responsible for the operational implementation and maintenance of security controls and safeguards for information assets. This includes tasks such as data backup, system patching, access control enforcement, and ensuring data integrity and availability according to the policies established by the data owner. They act as the 'hands-on' technical and administrative staff who manage the data on a day-to-day basis.

Address Space Layout Randomization (ASLR) is an effective defense that randomizes the memory locations of program components, such as the stack, heap, and libraries. By making these addresses unpredictable, ASLR prevents attackers from reliably targeting specific memory addresses with malicious payloads during a buffer overflow attack. This significantly increases the difficulty of executing successful shellcode or return-oriented programming (ROP) exploits.

The Ticket Granting Ticket (TGT) serves as a crucial credential, issued by the Authentication Server (AS), that the client presents to the Ticket Granting Service (TGS). It contains the user's identity and a session key, encrypted with the TGS's secret key, proving the user has been successfully authenticated by the AS. This allows the TGS to trust the client's request for service tickets without requiring re-authentication to the AS for each new service.

Log retention requirements explicitly define the mandatory duration for which security logs must be stored and maintained by an organization. These requirements are typically driven by legal obligations (e.g., GDPR, HIPAA), industry regulations (e.g., PCI DSS), compliance frameworks, or internal corporate policies for forensic investigations, auditing, and historical analysis. They directly address the "how long" aspect of log management, ensuring data availability for specified periods.

Implementing a private repository that mirrors approved open-source libraries establishes a controlled and trusted software supply chain, preventing direct reliance on potentially compromised public sources. Enforcing signature verification confirms the authenticity of the package's origin, while hash checks guarantee the integrity of the content, ensuring no unauthorized modifications or malicious injections have occurred. This proactive approach effectively blocks compromised or malicious packages from entering the development environment.

This testing method rigorously examines how an application processes and sanitizes all user-supplied data, both client-side and server-side. Its primary goal is to identify vulnerabilities where malicious input, such as SQL injection payloads, Cross-Site Scripting (XSS) scripts, or command injection strings, could be accepted and executed by the application or underlying systems. Effective input validation is fundamental to preventing a wide array of application-layer attacks that exploit trust in user input.

Virtual machine escape is a critical security vulnerability where an attacker breaks out of the confines of a guest operating system to gain unauthorized access to the hypervisor or other virtual machines. This breach compromises the fundamental isolation provided by the hypervisor, potentially allowing an attacker to control the host system or access sensitive data across multiple tenants. It represents a severe failure of the hypervisor's security mechanisms, making it a top concern for cloud providers.

Clear criteria ensure consistent application of classification levels across the organization. Without defined criteria, employees may classify data inconsistently, leading to either overprotection or underprotection. Criteria should consider factors such as confidentiality, integrity, availability, legal requirements, and business impact. This is essential for a successful data classification program.

The primary objective of asset classification is to assign a sensitivity level to information assets, such as 'Confidential' or 'Public,' based on the potential impact of their compromise. This classification directly dictates the specific security controls—like encryption, access restrictions, or data handling procedures—that must be applied to protect the asset effectively. By aligning controls with sensitivity, organizations ensure resources are allocated efficiently to safeguard their most critical information.

OCSP stapling significantly improves the efficiency and privacy of certificate revocation checks. Instead of each client directly querying the Certificate Authority's (CA) OCSP responder, the web server periodically fetches a signed OCSP response from the CA and "staples" it to its own certificate during the TLS handshake. This reduces the load on CA infrastructure, minimizes client-side latency, and enhances user privacy by preventing the CA from logging individual client queries.

Under HIPAA, a cloud provider storing or processing Protected Health Information (PHI) is considered a Business Associate. Before any PHI can be legally shared or stored with such a provider, a signed Business Associate Agreement (BAA) is a mandatory contractual requirement. This agreement legally obligates the cloud provider to comply with HIPAA's Security and Privacy Rules, safeguarding PHI and outlining their responsibilities, permitted uses, disclosures, and breach notification procedures.

This is the most appropriate solution as it adheres to the principle of least privilege and just-in-time (JIT) access. By temporarily assigning an existing, appropriate role with an explicit expiration date, the user gains only the necessary permissions for the required duration, automatically revoking access once the task is complete. This minimizes the window of potential misuse and maintains strong access control governance.

This rule correctly permits inbound HTTP traffic from the internet to the specified web server. The 'Outside' interface is the proper entry point for external traffic, and 'Source any' allows requests from any public IP address. Directing traffic to destination 10.0.0.10 on Port 80 precisely targets the web server for standard HTTP communication, fulfilling the requirement.

Running the container process as a non-root user enforces least privilege, so a container escape or compromised application cannot gain root on the host. This directly satisfies the stem's container-hardening constraint by removing unnecessary privileged capabilities from the workload.

This option directly corresponds to PCI DSS Requirement 4: 'Encrypt transmission of cardholder data across open, public networks.' This foundational requirement mandates the use of strong cryptography and security protocols, such as TLS 1.2 or higher, to protect cardholder data during transit over untrusted networks, preventing interception and unauthorized disclosure. It is one of the 12 high-level requirements.

The policy grants read access to anyone, exposing sensitive data.

The logistics provider processes PII solely on the controller's documented instructions for shipping, satisfying GDPR's Article 28 processor definition. It determines neither purposes nor means of processing, unlike a controller or joint controller. This distinction hinges on decision-making authority over processing, not data volume or technical access.

VLANs provide the crucial capability to logically segment a network into distinct broadcast domains, irrespective of the physical location of the connected devices. This means that devices belonging to the same logical group or department can be physically distributed across different switches or geographical areas, yet still reside on their dedicated VLAN, simplifying network management and policy enforcement.

The fundamental value proposition of a SIEM system lies in its capacity to aggregate disparate security event data from numerous sources and identify meaningful relationships between them. Event correlation allows the SIEM to detect complex attack patterns, anomalous behaviors, and potential security incidents that would be invisible when examining individual log entries in isolation. This capability transforms raw data into actionable intelligence, enabling proactive threat detection and efficient incident response by linking seemingly unrelated events into a coherent narrative.

The data owner holds ultimate accountability for the data, making them responsible for determining its classification level, such as "confidential," based on its business value, sensitivity, and regulatory compliance requirements. This classification dictates the necessary security controls and handling procedures. Furthermore, the data owner ensures that the data is appropriately labeled to communicate its sensitivity to all users and systems, thereby guiding its protection throughout its lifecycle.

Network segmentation is a classic example of risk mitigation, as it directly reduces the potential impact and likelihood of a successful attack spreading across an entire network. By isolating critical systems or sensitive data into separate segments, a breach in one area is contained, preventing lateral movement and significantly diminishing the overall damage. This proactive control implements safeguards to lower the risk exposure to an acceptable level.

Containment is the priority once an active compromise is confirmed, because the host is beaconing to attacker infrastructure and could enable lateral movement. Network isolation stops command-and-control and spread while keeping memory and disk intact, so the subsequent investigation can determine how the malware arrived and what data was touched.