CISSP Practice Questions

Question 1

Which of the following is the primary purpose of the CIA triad in information security?

Accepted Answer

To define the core objectives of information security. The CIA triad—Confidentiality, Integrity, and Availability—provides a foundational model for developing security policies and ensuring that data is protected from unauthorized access, tampering, and downtime.

Answer

To establish a framework for risk management

Answer

To ensure compliance with regulatory requirements

Answer

To balance security controls with usability

Question 2

An organization is implementing role-based access control (RBAC). Which two components are fundamental to the RBAC model? (Select TWO.)

Accepted Answer

Constraints such as separation of duties. Constraints such as separation of duties are fundamental to RBAC because they enforce organizational policies by preventing conflicts of interest (e.g., a user cannot both create and approve a purchase order). This is a core component of the RBAC model as defined in the NIST RBAC standard (ANSI INCITS 359-2004), which includes core RBAC, hierarchical RBAC, and constrained RBAC. Constraints ensure that role assignments and permissions adhere to security rules beyond simple role-user mapping.

Answer

Access control lists (ACLs)

Answer

Subjects, objects, and operations

Answer

Security labels and clearances

Question 3

A security analyst discovers that an attacker has gained domain admin privileges by forging a Kerberos TGT using the KRBTGT account hash. Which attack has occurred?

Accepted Answer

Golden ticket attack. A Golden Ticket attack occurs when an attacker compromises the KRBTGT account's password hash and uses it to forge a legitimate-looking Kerberos Ticket Granting Ticket (TGT). Because the KRBTGT account signs all TGTs in the domain, a forged TGT is trusted by every Kerberos-enabled service, granting the attacker persistent domain-wide access — often as domain admin — without needing to authenticate normally.

Answer

Pass-the-ticket attack

Answer

Silver ticket attack

Answer

Kerberos brute force attack

Question 4

A hospital chain collects and stores electronic health records (EHR) for millions of patients. The EHR system is hosted in a private cloud and accessed by doctors, nurses, and administrative staff from various locations. Recently, an internal audit found that several employees shared their login credentials with colleagues to expedite workflows. The hospital must comply with HIPAA and state privacy laws. The security officer wants to implement a solution that minimizes the risk of unauthorized access due to shared credentials while still allowing efficient access for patient care. Which of the following is the BEST approach?

Accepted Answer

Implement single sign-on (SSO) integrated with role-based access control (RBAC) and enforce audit logging of all access. SSO integrated with RBAC reduces the attack surface of shared credentials by centralizing authentication and enforcing least-privilege access based on job roles. Audit logging provides non-repudiation and traceability, which deters credential sharing and satisfies HIPAA's requirement to track access to ePHI. This combination directly addresses the root cause (shared credentials) while maintaining workflow efficiency through seamless authentication.

Answer

Enforce a policy requiring password changes every 30 days and complexity requirements

Answer

Replace passwords with biometric authentication (fingerprint and iris scans) for all users

Answer

Disable remote access to the EHR system and require all access to occur only from within the hospital's LAN

Question 5

An organization's security policy requires that privileged accounts have their passwords changed every 30 days and be monitored. Which solution effectively manages these requirements?

Accepted Answer

Privileged Access Management (PAM) solution. A Privileged Access Management (PAM) solution is specifically designed to manage privileged accounts, enforce password rotation policies (e.g., every 30 days), and provide detailed monitoring and auditing of privileged sessions. It automates password changes, vaults credentials, and logs all access, directly meeting the policy requirements for privileged accounts.

Answer

Role-based access control

Answer

Enterprise password manager

Answer

Single sign-on for administrators

Question 6

An organization is developing a business continuity plan (BCP). The IT department has identified a critical application that must be restored within 4 hours of a disruption. Which metric defines the maximum acceptable time that the application can be unavailable?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable downtime for a critical application after a disruption. In this scenario, the IT department has specified that the application must be restored within 4 hours, which directly aligns with the RTO metric. RTO is a key BCP parameter that drives resource allocation and recovery strategy design.

Answer

Recovery Point Objective (RPO)

Answer

Mean Time to Repair (MTTR)

Answer

Mean Time Between Failures (MTBF)

Answer

Service Level Agreement (SLA)

Question 7

A company wants to ensure that its security policy is effectively enforced across all departments. Currently, the policy is published on the intranet and included in the employee handbook. However, the security team notices that many employees are not following the policy, leading to security incidents. Which of the following would be the most effective way to improve policy enforcement?

Accepted Answer

Require annual signed acknowledgment of the policy. Requiring annual signed acknowledgment ensures that employees are aware of and agree to comply with the policy. This creates a record of acceptance and can be used in disciplinary actions. Publishing on intranet or handbook alone does not guarantee reading or acceptance. Random audits with penalties may enforce compliance but without awareness, employees may not know what is expected.

Answer

Include the policy in the employee handbook

Answer

Conduct random audits and penalize non-compliance

Answer

Publish the policy on the intranet only

Question 8

A network analyst suspects a host on the internal network is sending abnormal amounts of traffic. Which tool should be used to capture and analyze the packets?

Accepted Answer

Wireshark. Wireshark is the correct tool because it is a packet analyzer that captures live network traffic and provides deep inspection of individual packets, including headers and payloads. This allows the analyst to examine the abnormal traffic patterns, identify source/destination IPs, protocols, and payload content to diagnose the issue.

Answer

Nmap

Answer

Netstat

Answer

Traceroute

Question 9

In the context of physical security, which of the following is an example of a preventive control?

Accepted Answer

Mantrap door. A mantrap door is a preventive physical security control because it actively prevents unauthorized entry by requiring authentication and verification before allowing passage through a series of interlocking doors. Unlike monitoring or detection systems, a mantrap physically blocks access until the user is validated, thereby stopping a breach before it occurs.

Answer

Security guards monitoring

Answer

CCTV cameras

Answer

Intrusion detection system

Question 10

Which THREE of the following are valid considerations when implementing data loss prevention (DLP) controls to protect sensitive data? (Select three.)

Accepted Answer

User training to reduce false positives and increase acceptance. User training is a critical component of a successful DLP implementation. Without proper training, users may inadvertently trigger false positives by mishandling data or may attempt to bypass controls they perceive as overly restrictive. Training helps users understand classification labels and proper data handling procedures, reducing the operational burden on security teams and increasing overall acceptance of DLP policies.

Answer

Integration with all third-party applications

Answer

Blocking all data transfers to external devices

Question 11

Which THREE of the following are valid risk response strategies?

Accepted Answer

Transfer. Common risk responses include Avoid, Transfer, Mitigate, and Accept.

Answer

Eliminate

Answer

Ignore

Question 12

A multinational company must comply with the EU General Data Protection Regulation (GDPR) for processing personal data of EU citizens. The company's data protection officer (DPO) has been appointed but reports to the Chief Marketing Officer (CMO). Which compliance issue is most critical?

Accepted Answer

The DPO must report directly to the board of directors or CEO. Under the GDPR, the Data Protection Officer (DPO) must report directly to the highest level of management, typically the board of directors or CEO, to ensure independence and authority. Reporting to the Chief Marketing Officer (CMO) creates a conflict of interest because the CMO oversees marketing activities that often involve extensive personal data processing, compromising the DPO's ability to provide unbiased oversight. This structural subordination is the most critical compliance issue as it directly undermines the DPO's statutory role under Article 38(3) of the GDPR.

Answer

The DPO should not hold any other role within the organization

Answer

The DPO must be a lawyer certified in data protection

Answer

The DPO must be located in the EU

Question 13

A security analyst is reviewing SIEM logs and notices multiple failed login attempts from a single IP address followed by a successful login. The account belongs to a user in finance. Which incident category is most appropriate?

Accepted Answer

Unauthorized access. The sequence of multiple failed login attempts followed by a successful login from the same external IP address indicates a brute-force or password-spraying attack that succeeded. This constitutes unauthorized access because the attacker gained entry to an account without legitimate authorization, violating the confidentiality and integrity of the finance user's account.

Answer

DoS

Answer

Insider threat

Answer

Social engineering

Question 14

A company implements a centralized authentication system using RADIUS for network devices. The security team notices that after a user's password is changed in Active Directory, the user can still authenticate to network devices using the old password for up to 30 minutes. What is the most likely cause?

Accepted Answer

Active Directory replication delay. When a password is changed in Active Directory, the change is processed by a specific Domain Controller (DC) and urgently replicated to the PDC Emulator. However, if the RADIUS server queries a different DC (such as one in a different AD site), that DC will not know about the password change until normal replication occurs. Inter-site replication typically occurs on a schedule (often 15 to 30 minutes). During this replication window, the DC queried by the RADIUS server still holds the old password hash as valid, allowing the user to successfully authenticate with their old password.

Answer

Kerberos ticket lifetime

Answer

Network devices caching authentication responses

Answer

RADIUS server caching credentials

Question 15

A security architect is reviewing a web application's design and identifies several potential vulnerabilities. Which TWO of the following are effective mitigations for cross-site scripting (XSS) attacks?

Accepted Answer

Enabling Content Security Policy (CSP). Option A, enabling Content Security Policy (CSP), is correct because CSP is a browser-enforced response header (e.g., Content-Security-Policy: default-src 'self') that restricts which scripts may execute, blocking inline scripts and untrusted external sources, which directly mitigates XSS. Option E, using output encoding, is correct because encoding untrusted data for the correct context (HTML entity, JavaScript, URL, or CSS encoding) ensures injected markup is rendered as inert text rather than executable script, which is the primary defense against XSS. Option B, using CSRF tokens, does not belong because anti-CSRF tokens defend against cross-site request forgery, a different attack that abuses a victim's authenticated session, not script injection. Option C, disabling client-side scripts entirely, does not belong because it is an impractical, functionality-breaking measure rather than a targeted XSS mitigation and is not a standard remediation. Option D, implementing parameterized queries, does not belong because prepared statements with bound parameters mitigate SQL injection, not XSS.

Answer

Using CSRF tokens

Answer

Disabling client-side scripts entirely

Answer

Implementing parameterized queries

Certified Information Systems Security Professional CISSP practice test

Three ways to study

Study CISSP by domain

Study CISSP by topic

Identity and Access Management practice questions

Security and Risk Management practice questions

Security Operations practice questions

Asset Security practice questions

Security Architecture and Engineering practice questions

Software Development Security practice questions

Security Assessment and Testing practice questions

Communication and Network Security practice questions

CISSP fundamentals practice questions

CISSP scenario practice questions

CISSP troubleshooting practice questions

Top CISSP questions

Certified Information Systems Security Professional CISSP practice questions