CISSP Exam — Questions and Answers

Question 1: A CI/CD pipeline automatically deploys code to production after tests pass. Which security control BEST reduces the risk of malicious code being deployed without human review?

Encrypting the pipeline configuration files
Logging all pipeline execution events to a SIEM
Implementing mandatory code peer review and approval gates before merging (Correct answer)
Requiring multi-factor authentication for developers

Correct answer: Implementing mandatory code peer review and approval gates before merging

Mandatory peer review approval gates ensure at least one additional human verifies changes before they can be merged and deployed to production.

Question 2: Which cloud security principle states that workloads should be isolated so that a compromise in one does not affect others?

Defense in depth
Zero trust
Least privilege
Blast radius reduction (Correct answer)

Correct answer: Blast radius reduction

Blast radius reduction limits the impact of a security incident by isolating workloads through segmentation and micro-perimeters.

Question 3: What is the recommended approach when managing conflicting priorities in CISSP?

Ignore lower-priority items
Address them in alphabetical order
Prioritize based on impact and urgency (Correct answer)
Delegate all decisions upward

Correct answer: Prioritize based on impact and urgency

Prioritizing based on impact and urgency ensures the most critical issues receive attention first while maintaining progress on other goals.

Question 4: During eradication of an incident, a responder removes malware from all affected systems. What should immediately follow eradication before returning systems to production?

Closing the incident ticket
Performing recovery and verification (Correct answer)
Assigning a root cause
Notifying the public

Correct answer: Performing recovery and verification

After eradication, recovery involves restoring systems to normal operation and verifying they are clean and functioning correctly before returning them to the production environment.

Question 5: Which skill is most critical for effective identity and access management?

Technical expertise alone
Speed of decision-making
Individual work preferences
Communication and stakeholder engagement (Correct answer)

Correct answer: Communication and stakeholder engagement

Communication and stakeholder engagement are essential because management success depends on effectively coordinating with and influencing others.

Question 6: A security team discovers that someone has been using a cloned RFID badge to access the building. Which control would BEST prevent this attack?

Switching to longer PIN codes
Increasing security guard patrols
Adding more CCTV cameras at entrances
Implementing multi-factor authentication (badge + biometric) (Correct answer)

Correct answer: Implementing multi-factor authentication (badge + biometric)

Multi-factor authentication combines something-you-have (badge) with something-you-are (biometric), so a cloned badge alone is insufficient.

Question 7: Which threat modeling methodology uses an attacker-centric approach organized around four categories: Goals, Observations, Plan, and Actions?

DREAD
VAST
STRIDE
PASTA (Correct answer)

Correct answer: PASTA

PASTA (Process for Attack Simulation and Threat Analysis) is a risk-centric threat modeling framework that aligns attacker motivations with business objectives across seven stages.

Question 8: What is the most effective approach to security and risk management in the CISSP field?

Systematic planning and continuous improvement (Correct answer)
Following competitors
Reactive problem-solving
Maintaining the status quo

Correct answer: Systematic planning and continuous improvement

Systematic planning combined with continuous improvement ensures sustainable success and allows for proactive management of challenges.

Question 9: An attacker compromises a low-privilege account and uses it to request a service ticket for a high-privilege account, then cracks the ticket offline. What attack is this?

Pass-the-ticket
Silver ticket attack
Golden ticket attack
Kerberoasting (Correct answer)

Correct answer: Kerberoasting

Kerberoasting exploits Kerberos by requesting service tickets for accounts with SPNs and cracking them offline to recover plaintext passwords.

Question 10: Which control helps prevent sensitive data from leaving an organization via email or USB drives?

Intrusion Detection System (IDS)
Data Loss Prevention (DLP) (Correct answer)
Web Application Firewall (WAF)
Security Information and Event Management (SIEM)

Correct answer: Data Loss Prevention (DLP)

Data Loss Prevention (DLP) solutions monitor and block the unauthorized transmission of sensitive data across various egress channels including email, USB, and cloud uploads.

Question 11: Which federation standard allows identity assertions to be passed between domains using XML-based tokens?

OpenID Connect
SAML 2.0 (Correct answer)
Kerberos
OAuth 2.0

Correct answer: SAML 2.0

SAML 2.0 (Security Assertion Markup Language) uses XML-based assertions to communicate identity information between identity providers and service providers across domains.

Question 12: Configuration management is most likely handled during which phase (s) of the asset lifecycle?

Secure (Correct answer)
Secure, Monitor
Identify and classify, Secure
Monitor, Recover

Correct answer: Secure

Configuration management is the systematic process of managing changes to a system's configuration to maintain its integrity, security, and performance. While it impacts all phases, it is most critically handled during the 'Secure' phase of the asset lifecycle. This is where controls are implemented, maintained, and updated to protect the asset from unauthorized access, use, disclosure, disruption, modification, or destruction, ensuring its ongoing security posture.

Question 13: Which type of assessment involves authorized simulated attacks that replicate tactics of real-world threat actors to test detection and response capabilities?

Vulnerability assessment
Red team exercise (Correct answer)
Compliance audit
Risk assessment

Correct answer: Red team exercise

Red team exercises use adversary simulation techniques to test an organization's people, processes, and technology against realistic attack scenarios.

Question 14: A qualitative risk assessment differs from a quantitative one in that it:

Relies on expert judgment and descriptive categories like High/Medium/Low (Correct answer)
Is only applicable to physical security risks
Always produces more accurate results
Uses numerical monetary values for all calculations

Correct answer: Relies on expert judgment and descriptive categories like High/Medium/Low

Qualitative risk assessments use subjective ratings and expert judgment rather than precise monetary calculations, making them faster but less precise.

Question 15: Which metric is most useful for evaluating program effectiveness in CISSP?

Number of meetings held
Outcome-based performance indicators (Correct answer)
Amount of money spent
Number of staff involved

Correct answer: Outcome-based performance indicators

Outcome-based performance indicators directly measure whether the program is achieving its intended results and goals.

Question 16: The Gramm-Leach-Bliley Act (GLBA) primarily requires which type of organization to protect customer financial information?

Financial institutions (Correct answer)
Federal government agencies
Educational institutions
Healthcare providers

Correct answer: Financial institutions

GLBA mandates that banks, insurance companies, and other financial institutions implement safeguards to protect the privacy of consumer financial information.

Question 17: Which threat modeling methodology focuses on identifying threats using attacker-centric categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

STRIDE (Correct answer)
DREAD
PASTA
VAST

Correct answer: STRIDE

STRIDE, developed by Microsoft, categorizes threats into six types and is widely used to systematically identify security threats during design.

Question 18: Which documentation is essential when working with security architecture in CISSP?

Marketing materials
Only verbal notes
Detailed technical specifications and as-built diagrams (Correct answer)
General descriptions without specifics

Correct answer: Detailed technical specifications and as-built diagrams

Detailed technical specifications and as-built diagrams provide the accurate reference information needed for maintenance and troubleshooting.

Question 19: Which network architecture principle is BEST demonstrated by placing database servers in a separate VLAN accessible only from the application tier?

Least privilege
Network segmentation (Correct answer)
Defense in depth
Zero trust

Correct answer: Network segmentation

Placing database servers in an isolated VLAN with restricted inter-tier access is a direct application of network segmentation.

Question 20: Which network security device operates at Layer 7 and can inspect application-layer content for threats?

Stateful inspection firewall
Next-generation firewall (NGFW) (Correct answer)
Packet-filtering firewall
Network switch

Correct answer: Next-generation firewall (NGFW)

Next-generation firewalls operate at Layer 7 (application layer) and can perform deep packet inspection, application identification, and intrusion prevention.

Question 21: Which principle is fundamental to good software development security practice?

Writing as much code as possible
Avoiding all abstraction
Never refactoring code
Separation of concerns and modularity (Correct answer)

Correct answer: Separation of concerns and modularity

Separation of concerns and modularity make code easier to understand, test, maintain, and extend over time.

Question 22: In the context of secure hardware, what does a Trusted Platform Module (TPM) primarily provide?

Biometric authentication processing
Network packet filtering and inspection
Secure storage of cryptographic keys and platform integrity measurements (Correct answer)
Hardware-accelerated encryption for disk volumes

Correct answer: Secure storage of cryptographic keys and platform integrity measurements

A TPM is a dedicated chip that provides secure key storage, platform integrity attestation via PCRs, and cryptographic functions.

Question 23: A CISO needs to ensure that sensitive R&D files on employee laptops remain protected even if the laptops are stolen. Which control BEST addresses this risk?

Endpoint antivirus software
Strong login passwords
Network access control (NAC)
Full-disk encryption (FDE) (Correct answer)

Correct answer: Full-disk encryption (FDE)

Full-disk encryption protects data at rest on stolen or lost devices by making stored data unreadable without the correct decryption key.

Question 24: Which term describes the remaining risk after safeguards and controls have been applied?

Total risk
Residual risk (Correct answer)
Control risk
Inherent risk

Correct answer: Residual risk

Residual risk is the leftover risk exposure after all planned countermeasures have been implemented and accepted by management.

Question 25: The principle of 'open design' in security architecture means:

Security controls are publicly documented so attackers cannot exploit unknown weaknesses
All source code must be open-source for community review
Encryption algorithms must use publicly known keys
System security should not depend on the secrecy of its design (Correct answer)

Correct answer: System security should not depend on the secrecy of its design

Open design means the security of a system should not rely on keeping its design secret — only keys/credentials should be secret.

Question 26: Which access provisioning approach reduces risk by granting users only the minimum permissions required for their specific job responsibilities?

Zero trust
Least privilege (Correct answer)
Need-to-know
Separation of duties

Correct answer: Least privilege

The principle of least privilege restricts user access rights to only what is necessary to perform their job, reducing the attack surface if the account is compromised.

Question 27: Which approach is recommended for troubleshooting communication and network security issues?

Replace all components simultaneously
Rely solely on past experience
Wait for the problem to resolve itself
Use systematic isolation and testing methods (Correct answer)

Correct answer: Use systematic isolation and testing methods

Systematic isolation and testing methodically narrows down the root cause, making troubleshooting efficient and accurate.

Question 28: The contents of mail communications are frequently encrypted using a symmetric technique, most typically AES. However, non-repudiation is achieved using a mix of hashing and an asymmetric algorithm. What is the process of non-repudiation?

By encrypting the document with the sender’s private key, then hashing document
By hashing the document and then encrypting the hash with the sender’s private key (Correct answer)
By encrypting the document with the sender’s public key, then hashing the document
By hashing the document then encrypting the hash with the receiver’s public key

Correct answer: By hashing the document and then encrypting the hash with the sender’s private key

To achieve non-repudiation, the sender first creates a hash (a unique digital fingerprint) of the document. This hash is then encrypted using the sender's *private* key, creating a digital signature. Anyone can then use the sender's *public* key to decrypt the hash and compare it to a newly generated hash of the document, verifying both the sender's identity and that the document hasn't been tampered with.

Question 29: Which concept describes the combination of policies, procedures, standards, and guidelines that collectively define how security is managed across an organization?

Defense in depth
Security posture
Security governance framework (Correct answer)
Security architecture

Correct answer: Security governance framework

A security governance framework integrates all security management elements—policies, processes, roles, and metrics—to ensure consistent, accountable security decision-making.

Question 30: Which of the following BEST describes 'data sovereignty'?

The principle that data is subject to the laws of the country where it is stored (Correct answer)
An organization's right to encrypt its own data
The process of classifying data by sensitivity level
The right of individuals to access their personal data

Correct answer: The principle that data is subject to the laws of the country where it is stored

Data sovereignty means that data stored in a particular country is subject to that nation's laws and regulations, which impacts cloud storage decisions.

Question 31: A company wants to assess whether employees follow clean desk and physical security policies. Which assessment technique is most appropriate?

Physical security walkthrough / inspection (Correct answer)
Web application penetration test
Network vulnerability scan
Social engineering phone call

Correct answer: Physical security walkthrough / inspection

A physical security walkthrough allows assessors to directly observe and document compliance with policies like clean desk, visitor management, and access control.

Question 32: Which Kerberos component issues Ticket Granting Tickets (TGTs) after authenticating a user's credentials?

Service Principal
Ticket Granting Server
Key Distribution Center (Correct answer)
Authentication Agent

Correct answer: Key Distribution Center

The Key Distribution Center (KDC) contains the Authentication Server (AS) that validates credentials and issues TGTs used to request service tickets.

Question 33: What is the primary purpose of encryption in CISSP security?

To make data transfer slower
To compress data
To organize data more efficiently
To protect data confidentiality during storage and transmission (Correct answer)

Correct answer: To protect data confidentiality during storage and transmission

Encryption protects data confidentiality by converting information into an unreadable format that can only be decoded with the proper key.

Question 34: An organization's alternate processing site has identical hardware and software in a fully operational state, synchronized in real time. What type of site is this?

Mobile site
Warm site
Cold site
Hot site (Correct answer)

Correct answer: Hot site

A hot site is a fully operational duplicate facility that can take over processing with minimal or no delay.

Question 35: What is the best practice for maintaining communication and network security performance over time?

Outsource all maintenance
Wait for failures before acting
Upgrade all equipment annually
Implement scheduled preventive maintenance (Correct answer)

Correct answer: Implement scheduled preventive maintenance

Scheduled preventive maintenance catches potential issues before they cause failures, maintaining reliability and extending equipment life.

Question 36: Which type of law imposes obligations on organizations to protect personal data and can result in civil penalties paid to affected individuals?

Tort law (civil law) (Correct answer)
Contract law
Administrative law
Criminal law

Correct answer: Tort law (civil law)

Tort law allows individuals harmed by negligent data handling to sue for damages, making it a key driver of privacy obligations for organizations.

Question 37: What is the PRIMARY objective of conducting a lessons-learned review after an incident has been resolved?

Improving processes and controls to prevent recurrence (Correct answer)
Satisfying regulatory reporting requirements
Calculating the financial impact for insurance claims
Determining liability and assigning blame to responsible parties

Correct answer: Improving processes and controls to prevent recurrence

Lessons-learned reviews identify gaps in detection, response, and prevention so that controls and procedures can be improved before the next incident.

Question 38: Which risk treatment option involves sharing risk with a third party, such as through insurance or outsourcing?

Risk mitigation
Risk acceptance
Risk transference (Correct answer)
Risk avoidance

Correct answer: Risk transference

Risk transference shifts the financial burden of a risk to another party, such as purchasing cyber liability insurance.

Question 39: Which standard defines a common framework for assurance levels in digital identity, classifying them as IAL, AAL, and FAL?

PCI DSS
NIST SP 800-63 (Correct answer)
ISO/IEC 27001
FIPS 140-3

Correct answer: NIST SP 800-63

NIST SP 800-63 Digital Identity Guidelines defines Identity Assurance Level (IAL), Authenticator Assurance Level (AAL), and Federation Assurance Level (FAL).

Question 40: Which of the following is a primary benefit of having a Computer Security Incident Response Team (CSIRT)?

Eliminating all security vulnerabilities
Providing a structured, coordinated response to security incidents (Correct answer)
Replacing the need for security monitoring tools
Preventing all malware infections

Correct answer: Providing a structured, coordinated response to security incidents

A CSIRT provides an organized, expert team that can respond quickly and effectively to incidents, minimizing damage and recovery time through coordinated effort.

Question 41: What is the MAIN security purpose of implementing Private VLANs (PVLANs)?

Isolate hosts within the same VLAN from communicating directly with each other (Correct answer)
Extend VLANs across WAN links
Encrypt traffic between VLAN members
Prevent VLAN hopping attacks via trunk ports

Correct answer: Isolate hosts within the same VLAN from communicating directly with each other

PVLANs use isolated, community, and promiscuous port types to restrict lateral communication between hosts sharing the same IP subnet.

Question 42: Under which data classification level would government information whose unauthorized disclosure could cause serious damage to national security be placed?

Top Secret
Sensitive But Unclassified
Confidential
Secret (Correct answer)

Correct answer: Secret

The Secret classification applies to information whose unauthorized disclosure could cause serious damage to national security, while Top Secret applies when damage would be exceptionally grave.

Question 43: An assessor wants to determine which vulnerabilities pose the greatest risk to the business. Which process combines vulnerability data with threat intelligence and asset criticality?

Risk-based vulnerability management (Correct answer)
Patch management
Vulnerability scanning
Security benchmarking

Correct answer: Risk-based vulnerability management

Risk-based vulnerability management prioritizes vulnerabilities by correlating scanner findings with threat intelligence, exploit availability, and business asset value.

Question 44: In a zero trust architecture, what is the role of the Policy Decision Point (PDP)?

Evaluates access requests against policy and grants or denies access (Correct answer)
Encrypts data in transit between endpoints
Stores and manages cryptographic keys
Monitors network traffic for anomalies

Correct answer: Evaluates access requests against policy and grants or denies access

The PDP evaluates access requests using identity, context, and policy to make authorization decisions in a zero trust model.

Question 45: A security assessment reveals that a web server is running an outdated TLS 1.0 configuration. Under CVSS v3.1, which metric would reflect that an attacker must be on the same network segment to exploit this?

Attack Complexity: High
Privileges Required: Low
User Interaction: Required
Attack Vector: Adjacent (Correct answer)

Correct answer: Attack Vector: Adjacent

The CVSS Attack Vector metric 'Adjacent' indicates exploitation requires the attacker to be on the same shared network, such as Bluetooth, RF, or local subnet.

Question 46: In the context of security governance, which committee typically has responsibility for approving major security investments and accepting residual risk at the enterprise level?

Security operations center
IT steering committee
Change advisory board
Executive management / board of directors (Correct answer)

Correct answer: Executive management / board of directors

Ultimate risk ownership and acceptance authority rests with executive management or the board, who are accountable for organizational outcomes.

Question 47: Which security architecture framework divides networks into security zones based on trust levels?

Zachman Framework
Defense in depth with DMZ segmentation (Correct answer)
TOGAF
COBIT

Correct answer: Defense in depth with DMZ segmentation

Defense in depth with DMZ segmentation places untrusted, semi-trusted, and trusted networks in separate zones with controls between each layer.

Question 48: Which security model defines a formal state machine and requires that the system always transitions to a secure state?

Noninterference model
Take-Grant model
Information Flow model
State machine model (Correct answer)

Correct answer: State machine model

The State Machine model defines all allowable system states and ensures every transition moves the system from one secure state to another.

Question 49: Which OAuth 2.0 grant type is most appropriate for a server-side web application that can securely store a client secret?

Implicit Grant
Client Credentials Grant
Authorization Code Grant (Correct answer)
Device Authorization Grant

Correct answer: Authorization Code Grant

The Authorization Code Grant is the most secure OAuth 2.0 flow for server-side apps because it exchanges a short-lived code for tokens without exposing them in the browser.

Question 50: Which protocol extends RADIUS capabilities to support mobile and distributed network authentication with better reliability and security?

DIAMETER (Correct answer)
LDAP
Kerberos
TACACS+

Correct answer: DIAMETER

DIAMETER is the successor to RADIUS, offering improved reliability (TCP/SCTP), better error handling, and enhanced security features for AAA services.

Question 51: An organization is selecting a backup site for disaster recovery. Which site type offers the FASTEST recovery time but at the HIGHEST cost?

Hot site (Correct answer)
Cold site
Warm site
Mobile site

Correct answer: Hot site

A hot site is a fully operational duplicate facility with live data replication, enabling near-immediate failover at the highest cost.

Question 52: What is the best practice for documenting assessment results in CISSP practice?

Document results from memory at end of day
Use subjective descriptions only
Document all findings objectively and completely (Correct answer)
Record only abnormal findings

Correct answer: Document all findings objectively and completely

Best practice requires documenting all findings objectively and completely at the time of assessment for accuracy and legal protection.

Question 53: What is the legal significance of a 'chain of custody' in digital forensics?

It defines how long digital evidence must be retained
It documents the unbroken possession and handling of evidence to maintain its admissibility in court (Correct answer)
It establishes who is responsible for incident response
It ensures evidence is encrypted during storage

Correct answer: It documents the unbroken possession and handling of evidence to maintain its admissibility in court

Chain of custody creates a documented trail proving evidence integrity and proper handling, which is essential for admissibility in legal proceedings.

Question 54: A company's ALE for a specific threat is $50,000 per year. A control costing $30,000 annually reduces the ALE to $10,000. What is the value of this control?

$10,000
$40,000
$20,000 (Correct answer)
$50,000

Correct answer: $20,000

Control value = (original ALE - residual ALE) - control cost = ($50,000 - $10,000) - $30,000 = $10,000, but the net risk reduction is $40,000 - $30,000 = $10,000; ALE reduction is $40,000 so value = $40,000 - $30,000 = $10,000.

Question 55: What is the main advantage of using automated vulnerability scanners combined with manual verification during an assessment?

Manual testing is faster than automated scanning
Manual verification confirms true positives and identifies complex logic flaws scanners miss (Correct answer)
Automation provides legal authorization for testing
Automation eliminates all false positives

Correct answer: Manual verification confirms true positives and identifies complex logic flaws scanners miss

Automated scanners efficiently enumerate known vulnerabilities but produce false positives and miss business logic flaws, which manual verification addresses.

Question 56: In the context of security assessments, what does 'pivoting' refer to during a penetration test?

Using a compromised system as a launching point to attack other internal systems (Correct answer)
Rotating through different vulnerability categories
Switching from automated to manual testing
Changing the test methodology mid-engagement

Correct answer: Using a compromised system as a launching point to attack other internal systems

Pivoting uses an already-compromised host as an intermediary to reach and attack systems in network segments that would otherwise be inaccessible.

Question 57: Which attack surface analysis technique involves systematically identifying all entry points where untrusted data enters a system?

Vulnerability scanning
Penetration testing
Attack surface mapping / threat surface analysis (Correct answer)
Red teaming

Correct answer: Attack surface mapping / threat surface analysis

Attack surface mapping catalogs all points where an adversary could interact with a system, enabling prioritized hardening of the most exposed areas.

Question 58: Which type of fire suppression system discharges agent only in the zone where heat is detected, minimizing damage to surrounding equipment?

Deluge system
Wet pipe sprinkler
Dry pipe sprinkler
Pre-action sprinkler (Correct answer)

Correct answer: Pre-action sprinkler

A pre-action system requires two triggers (heat detector AND sprinkler head activation) before water is released, limiting discharge to the affected zone.

Question 59: Which concept in security operations describes the process of proactively searching for threats that have evaded existing security controls?

Red team exercise
Vulnerability assessment
Threat hunting (Correct answer)
Penetration testing

Correct answer: Threat hunting

Threat hunting is a proactive, human-led activity that assumes compromise has occurred and searches for attacker activity not caught by automated tools.

Question 60: What distinguishes a Business Continuity Plan (BCP) from a Disaster Recovery Plan (DRP)?

The BCP focuses on IT system restoration while the DRP addresses entire business operations
The BCP applies only to natural disasters while the DRP covers cyberattacks
The BCP addresses maintaining business operations during a disruption; the DRP focuses on restoring IT systems afterward (Correct answer)
The BCP is created by IT and the DRP is created by executive management

Correct answer: The BCP addresses maintaining business operations during a disruption; the DRP focuses on restoring IT systems afterward

The BCP is broader, covering how the business continues to operate during a disruption, while the DRP specifically addresses IT and infrastructure restoration.

Question 61: In Common Criteria, a Security Target (ST) is best described as:

A document specifying the security claims for a specific product under evaluation (Correct answer)
A list of all known vulnerabilities in a product
The final certification report issued by an evaluation lab
A generic template of security requirements for a product class

Correct answer: A document specifying the security claims for a specific product under evaluation

A Security Target details the specific security properties and claims for the product being evaluated, often based on a Protection Profile.

Question 62: What is the recommended response when a security incident is detected in an CISSP environment?

Delete all logs immediately
Follow the incident response plan: contain, eradicate, recover (Correct answer)
Ignore minor incidents
Immediately shut down all systems

Correct answer: Follow the incident response plan: contain, eradicate, recover

Following a structured incident response plan ensures containment of the threat, eradication of the cause, and recovery to normal operations.

Question 63: What is the MAIN difference between data marking and data labeling?

Marking is for government data; labeling is for commercial data
They are synonymous terms in CISSP
Marking applies to physical documents; labeling applies to digital files
Marking is a visible classification indicator; labeling includes metadata embedded in the file (Correct answer)

Correct answer: Marking is a visible classification indicator; labeling includes metadata embedded in the file

Data marking refers to visible human-readable classification indicators on documents, while labeling typically embeds classification metadata within digital files for automated handling.

Question 64: What is the most effective approach to identity and access management in the CISSP field?

Reactive problem-solving
Systematic planning and continuous improvement (Correct answer)
Maintaining the status quo
Following competitors

Correct answer: Systematic planning and continuous improvement

Systematic planning combined with continuous improvement ensures sustainable success and allows for proactive management of challenges.

Question 65: An organization implements context-aware authentication that increases scrutiny when login attempts occur from unusual countries. Which authentication approach does this describe?

Attribute-based access control
Step-up authentication
Time-based OTP
Adaptive / risk-based authentication (Correct answer)

Correct answer: Adaptive / risk-based authentication

Adaptive (risk-based) authentication dynamically adjusts the level of authentication challenge based on contextual risk signals such as location, device, or behavior anomalies.

Question 66: Which of the following best describes a Reference Monitor?

An abstract machine that mediates all access between subjects and objects (Correct answer)
A hardware module that encrypts memory
A firewall rule set enforcing network policy
A software agent that monitors user behavior

Correct answer: An abstract machine that mediates all access between subjects and objects

A Reference Monitor is an abstract machine concept that intercepts every access attempt between subjects and objects to enforce policy.

Question 67: What is the primary consideration when implementing changes to communication and network security?

Speed of implementation
Vendor preference
Personal convenience
Impact assessment and change management (Correct answer)

Correct answer: Impact assessment and change management

Impact assessment and proper change management ensure that modifications do not introduce unexpected problems or service disruptions.

Question 68: What security risk is most directly mitigated by using immutable infrastructure (replace rather than patch)?

Insider threat from privileged administrators
Denial of service attacks against servers
Zero-day vulnerability exploitation
Configuration drift and unauthorized changes accumulating over time (Correct answer)

Correct answer: Configuration drift and unauthorized changes accumulating over time

Immutable infrastructure eliminates configuration drift by replacing entire instances rather than patching running systems.

Question 69: A company discovers that a former employee's Active Directory account was disabled but their VPN certificate was never revoked. Which process failed?

Role mining
User provisioning
Account de-provisioning / offboarding (Correct answer)
Access recertification

Correct answer: Account de-provisioning / offboarding

Incomplete de-provisioning — failing to revoke all credentials including certificates — leaves residual access vectors open after an employee departs.

Question 70: Which threat modeling methodology uses attack trees to enumerate potential attack paths against a system?

STRIDE
PASTA
Attack tree analysis (Correct answer)
VAST

Correct answer: Attack tree analysis

Attack tree analysis visually represents attack paths as a tree structure, with the root being the attacker's goal and leaves being specific attack methods.

Question 71: What is the recommended approach when managing conflicting priorities in CISSP?

Address them in alphabetical order
Prioritize based on impact and urgency (Correct answer)
Ignore lower-priority items
Delegate all decisions upward

Correct answer: Prioritize based on impact and urgency

Prioritizing based on impact and urgency ensures the most critical issues receive attention first while maintaining progress on other goals.

Question 72: What does the term 'dead man's door' refer to in physical security?

A door that automatically locks if power fails
An emergency exit that triggers an alarm when opened
A mantrap that traps an intruder once unauthorized entry is detected (Correct answer)
A secondary exit used only during fire evacuations

Correct answer: A mantrap that traps an intruder once unauthorized entry is detected

A dead man's door (or mantrap) captures a person between two interlocked doors when unauthorized access is detected, preventing entry or exit.

Question 73: Which wireless authentication protocol is considered the MOST secure option for enterprise WPA3 deployments?

WPA2-Enterprise with PEAP-MSCHAPv2
WPA3-Personal with SAE
Open authentication with captive portal
WPA3-Enterprise with 192-bit mode (CNSA Suite) (Correct answer)

Correct answer: WPA3-Enterprise with 192-bit mode (CNSA Suite)

WPA3-Enterprise in 192-bit mode uses CNSA Suite algorithms (GCMP-256, BIP-GMAC-256, ECDHE) providing the highest security for wireless enterprise authentication.

Question 74: Which skill is most critical for effective security and risk management?

Communication and stakeholder engagement (Correct answer)
Individual work preferences
Technical expertise alone
Speed of decision-making

Correct answer: Communication and stakeholder engagement

Communication and stakeholder engagement are essential because management success depends on effectively coordinating with and influencing others.

Question 75: Which US law requires publicly traded companies to maintain accurate financial records and internal controls, with CISOs often accountable for IT controls?

SOX (Sarbanes-Oxley Act) (Correct answer)
COPPA
GLBA
FISMA

Correct answer: SOX (Sarbanes-Oxley Act)

SOX Section 404 requires management to assess internal controls over financial reporting, which heavily involves IT systems and access controls.

Question 76: A covert channel in a secure system is best described as:

A backdoor installed by a malicious developer
A communication path that was not intended for information transfer but can leak data (Correct answer)
An out-of-band management interface for administrators
An encrypted tunnel used to bypass firewall rules

Correct answer: A communication path that was not intended for information transfer but can leak data

Covert channels exploit unintended communication paths — such as timing or storage — to exfiltrate information in violation of security policy.

Question 77: In the context of secure software development, what is the definition of 'code signing'?

Adding a copyright watermark to compiled binaries
Applying a digital signature to software so recipients can verify its integrity and authenticity (Correct answer)
Encrypting source code before committing to a repository
Marking code modules as reviewed in a bug tracker

Correct answer: Applying a digital signature to software so recipients can verify its integrity and authenticity

Code signing uses a developer's private key to sign software, allowing users to verify via the corresponding public key that the code is untampered and from a trusted author.

Question 78: Which architectural component validates that all security controls are properly tested and verified before deployment?

Security baseline
Security kernel
Trusted Computing Base (TCB) (Correct answer)
Evaluation Assurance Level (EAL)

Correct answer: Trusted Computing Base (TCB)

The Trusted Computing Base encompasses all hardware, software, and firmware that enforce the system security policy.

Question 79: An organization wants to prevent employees from exfiltrating data via encrypted DNS tunnels. Which control is MOST effective?

Deploy a recursive DNS resolver with anomaly detection for high-volume or large TXT record queries (Correct answer)
Implement DNS over HTTPS for all clients
Block all UDP port 53 at the perimeter
Require all DNS queries to use DNSSEC

Correct answer: Deploy a recursive DNS resolver with anomaly detection for high-volume or large TXT record queries

DNS tunneling detection relies on behavioral analysis—unusually high query volumes, large TXT records, and long subdomains—which a monitored internal resolver can identify.

Question 80: Which asset management practice involves tracking hardware and software throughout its entire lifecycle from procurement to disposal?

Patch management
Asset inventory management (Correct answer)
Configuration management
Change management

Correct answer: Asset inventory management

Asset inventory management tracks physical and logical assets across their full lifecycle, ensuring accountability, compliance, and secure decommissioning.

Question 81: Which principle requires that personnel are granted only the permissions necessary to perform their specific job functions?

Least privilege (Correct answer)
Separation of duties
Job rotation
Need to know

Correct answer: Least privilege

Least privilege restricts user access rights to only what is required to perform authorized tasks, minimizing the attack surface.

Question 82: Which Evaluation Assurance Level (EAL) in Common Criteria represents 'structurally tested' and is the most common for commercial products seeking formal evaluation?

EAL4 (Correct answer)
EAL7
EAL6
EAL1

Correct answer: EAL4

EAL4 (methodically designed, tested, and reviewed) is the highest level typically economically feasible for commercial products.

Question 83: In cloud computing, what is 'elasticity'?

The ability to recover quickly from a disaster
The ability to automatically scale resources up or down based on demand (Correct answer)
The geographic distribution of data centers
The redundancy built into cloud storage systems

Correct answer: The ability to automatically scale resources up or down based on demand

Elasticity enables cloud resources to scale dynamically in response to workload changes, optimizing cost and performance.

Question 84: Which US federal law specifically requires federal agencies to protect information systems and mandates FISMA compliance?

GLBA
Federal Information Security Modernization Act (FISMA) (Correct answer)
Sarbanes-Oxley Act
HIPAA

Correct answer: Federal Information Security Modernization Act (FISMA)

FISMA requires federal agencies to develop, document, and implement agency-wide programs to provide information security for their systems.

Question 85: A CISSP is reviewing an assessment report that lists 200 vulnerabilities. Which approach should the organization prioritize?

Patch all vulnerabilities simultaneously
Fix only Critical CVSS scores and ignore the rest
Prioritize based on risk score combining exploitability, impact, and asset criticality (Correct answer)
Address vulnerabilities alphabetically by CVE ID

Correct answer: Prioritize based on risk score combining exploitability, impact, and asset criticality

Effective remediation prioritizes vulnerabilities by combining exploitability likelihood, potential business impact, and the criticality of the affected asset.

Question 86: Which approach is recommended for troubleshooting security architecture issues?

Wait for the problem to resolve itself
Use systematic isolation and testing methods (Correct answer)
Rely solely on past experience
Replace all components simultaneously

Correct answer: Use systematic isolation and testing methods

Systematic isolation and testing methodically narrows down the root cause, making troubleshooting efficient and accurate.

Question 87: In CISSP certification, what does redundancy in system design primarily provide?

Increased complexity
Fault tolerance and high availability (Correct answer)
Lower initial cost
Simplified maintenance

Correct answer: Fault tolerance and high availability

Redundancy provides fault tolerance by ensuring that if one component fails, backup components maintain system availability.

Question 88: What is the FIRST step an organization should take when establishing a data classification program?

Train employees on handling classified data
Identify and inventory all data assets owned by the organization (Correct answer)
Deploy a DLP solution to monitor data flows
Define the classification levels and labeling standards

Correct answer: Identify and inventory all data assets owned by the organization

Before data can be classified or protected, organizations must first identify and inventory all data assets to understand what they have, where it is, and who is responsible for it.

Question 89: An organization implements a proxy server that terminates client SSL sessions, inspects decrypted content, then re-encrypts and forwards traffic. This is BEST described as:

VPN split tunneling
SSL offloading
SSL/TLS inspection (man-in-the-middle proxy) (Correct answer)
TLS mutual authentication

Correct answer: SSL/TLS inspection (man-in-the-middle proxy)

SSL/TLS inspection proxies act as a controlled man-in-the-middle, decrypting traffic for content inspection then re-encrypting to the destination server.

Question 90: What is the fundamental principle behind security architecture in the CISSP domain?

Using the newest technology exclusively
Cost minimization at all costs
Balancing performance, reliability, and efficiency (Correct answer)
Following a single vendor solution

Correct answer: Balancing performance, reliability, and efficiency

Effective technical design requires balancing performance requirements with reliability needs and operational efficiency.

Question 91: Which privacy principle requires that personal data collected for one specified purpose should not be used for a different, incompatible purpose?

Purpose limitation (Correct answer)
Accuracy
Data minimization
Storage limitation

Correct answer: Purpose limitation

Purpose limitation, a core GDPR principle, restricts use of personal data to the original stated purpose unless new consent is obtained.

Question 92: What is the MAIN difference between a stateful packet inspection (SPI) firewall and a stateless packet filter?

SPI firewalls only inspect inbound traffic
SPI firewalls operate faster than packet filters
SPI firewalls track connection state and context; packet filters evaluate each packet in isolation (Correct answer)
Packet filters can block application-layer attacks; SPI cannot

Correct answer: SPI firewalls track connection state and context; packet filters evaluate each packet in isolation

Stateful inspection firewalls maintain a connection state table to evaluate packets in the context of their TCP/UDP session, while packet filters assess each packet independently.

Question 93: In CISSP practice, reliability in assessment refers to:

The cost of the assessment tool
The consistency and reproducibility of results (Correct answer)
The speed of administration
The popularity of the instrument

Correct answer: The consistency and reproducibility of results

Reliability refers to the consistency and reproducibility of assessment results when the test is repeated under similar conditions.

Question 94: Which term describes the legal authority to determine how data is classified and who may access it?

Data processor
Data custodian
Data owner (Correct answer)
Data steward

Correct answer: Data owner

The data owner, typically a senior business manager, has the authority and responsibility to classify data, set access policies, and determine handling requirements.

Question 95: A privileged access management (PAM) solution stores administrator passwords and rotates them after each use. Which PAM capability does this describe?

Privilege elevation
Just-in-time access
Password vaulting with check-out (Correct answer)
Session recording

Correct answer: Password vaulting with check-out

Password vaulting with check-out allows admins to retrieve a password for one session; the vault automatically rotates it afterward, preventing password reuse.

Question 96: A system that defaults to denying access when an error occurs is implementing which security principle?

Economy of mechanism
Complete mediation
Open design
Fail-secure (Correct answer)

Correct answer: Fail-secure

Fail-secure (or fail-safe) ensures systems default to a secure state — denying access — upon failure.

Question 97: A company wants to ensure that data is permanently unrecoverable from decommissioned HDDs containing PII. Which method is MOST appropriate?

Degaussing or physical destruction (Correct answer)
Formatting the drive using the OS
Performing a single-pass overwrite
Deleting all files and emptying the recycle bin

Correct answer: Degaussing or physical destruction

Degaussing destroys the magnetic properties of the drive making data unrecoverable, and physical destruction ensures no data can be retrieved from decommissioned media.

Question 98: What is the MAIN security advantage of using a biometric system over a PIN-based access system?

Biometrics do not require network connectivity
Biometric credentials cannot be shared or stolen as easily as PINs (Correct answer)
Biometrics are less expensive to deploy
Biometric systems have zero false acceptance rates

Correct answer: Biometric credentials cannot be shared or stolen as easily as PINs

Biometric credentials are tied to an individual's unique physical traits, making them far harder to share, guess, or steal than PINs.

Question 99: Which risk analysis approach assigns probability and impact using descriptive scales, is faster to perform, and is well-suited when hard data is unavailable?

Annualized loss expectancy calculation
Monte Carlo simulation
Quantitative analysis
Qualitative analysis (Correct answer)

Correct answer: Qualitative analysis

Qualitative analysis uses descriptive ratings (e.g., High/Medium/Low) based on expert opinion, making it faster but more subjective than quantitative methods.

Question 100: Which Bluetooth attack allows an attacker to send unsolicited messages to a discoverable Bluetooth device without pairing?

Bluesnarfing
Bluejacking (Correct answer)
BIAS attack
Bluebugging

Correct answer: Bluejacking

Bluejacking sends unsolicited messages (typically via vCard or messages) to nearby discoverable Bluetooth devices without requiring authentication or pairing.

Question 101: Under the NIST incident response lifecycle, which phase directly follows containment, eradication, and recovery?

Post-Incident Activity (Correct answer)
Identification
Detection and Analysis
Preparation

Correct answer: Post-Incident Activity

The NIST IR lifecycle ends with Post-Incident Activity (lessons learned), which follows the Containment, Eradication, and Recovery phase to improve future response capabilities.

Question 102: Which legal concept holds that an organization can be found liable if it fails to implement security controls that a 'reasonable person' would consider adequate?

Vicarious liability
Strict liability
Due care / Due diligence (Correct answer)
Respondeat superior

Correct answer: Due care / Due diligence

Due care (doing the right thing) combined with due diligence (proving you did it) form the legal standard that organizations must meet to avoid negligence claims.

Question 103: What is the PRIMARY purpose of a network tap versus a SPAN port for security monitoring?

Taps provide passive, out-of-band full-duplex capture without affecting production traffic (Correct answer)
SPAN ports capture more traffic than taps
Taps require no additional hardware
Taps encrypt captured traffic; SPAN ports do not

Correct answer: Taps provide passive, out-of-band full-duplex capture without affecting production traffic

Network taps passively copy all traffic on a link out-of-band without introducing latency or risking dropped packets, unlike SPAN ports which share switch resources.

Question 104: What is the key security advantage of using SNMPv3 over SNMPv2c for network device management?

SNMPv3 supports more OIDs
SNMPv3 operates over TCP instead of UDP
SNMPv3 provides authentication and encryption; SNMPv2c uses only community strings (Correct answer)
SNMPv3 eliminates the need for a management station

Correct answer: SNMPv3 provides authentication and encryption; SNMPv2c uses only community strings

SNMPv3 adds USM (User-based Security Model) providing message authentication (HMAC-MD5/SHA) and encryption (AES), unlike SNMPv2c's cleartext community strings.

Question 105: Which technique involves mapping existing user permissions to derive a normalized, minimal set of roles that covers the organization's access needs?

Access recertification
Role mining (Correct answer)
Permission inheritance
Entitlement explosion

Correct answer: Role mining

Role mining analyzes existing user-to-permission assignments to discover natural role groupings, enabling organizations to build RBAC structures from real access patterns.

Question 106: Which protocol is used by network devices to dynamically assign IP addresses and provide configuration parameters to hosts?

DHCP (Correct answer)
ICMP
ARP
IGMP

Correct answer: DHCP

DHCP (Dynamic Host Configuration Protocol) dynamically assigns IP addresses, subnet masks, default gateways, and DNS server addresses to network clients.

Question 107: Which framework provides a standardized vocabulary for describing hardware and software asset information to support vulnerability management?

COBIT
NIST RMF
ISO 27001
Common Platform Enumeration (CPE) (Correct answer)

Correct answer: Common Platform Enumeration (CPE)

Common Platform Enumeration (CPE) is a structured naming scheme for IT systems, software, and packages that enables consistent identification of assets in vulnerability databases like NVD.

Question 108: When implementing IPsec in tunnel mode between two VPN gateways, which part of the original packet is encrypted?

Only the TCP/UDP payload
The entire original IP packet (header + payload) (Correct answer)
Only the original IP header
Only the application layer data

Correct answer: The entire original IP packet (header + payload)

In IPsec tunnel mode, the entire original IP packet (header and payload) is encapsulated and encrypted within a new outer IP packet.

Question 109: An organization uses 802.1X for wired network access control. Which component authenticates the end-user credentials?

Supplicant
Certificate Authority
Authenticator
Authentication Server (RADIUS) (Correct answer)

Correct answer: Authentication Server (RADIUS)

In 802.1X, the Authentication Server (typically RADIUS) validates supplicant credentials; the authenticator (switch) enforces the decision.

Question 110: What does 'safe harbor' mean in the context of US-EU data transfers before Privacy Shield was invalidated?

A self-certification framework allowing US companies to transfer EU personal data by agreeing to privacy principles (Correct answer)
A physical secure facility for data storage
A legal immunity provision for accidental data breaches
An encryption standard approved for cross-border transfers

Correct answer: A self-certification framework allowing US companies to transfer EU personal data by agreeing to privacy principles

Safe Harbor was a self-certification program enabling US organizations to receive EU personal data by committing to FTC-enforced privacy standards.

Question 111: What is the primary threat that quantum computing poses to current public-key cryptography systems like RSA and ECC?

Shor's algorithm can efficiently factor large integers and compute discrete logs (Correct answer)
Quantum computers render all symmetric encryption algorithms obsolete
Quantum computers generate true randomness, breaking deterministic ciphers
Quantum entanglement allows decryption without the private key

Correct answer: Shor's algorithm can efficiently factor large integers and compute discrete logs

Shor's algorithm, runnable on a sufficiently powerful quantum computer, can factor integers and compute discrete logarithms exponentially faster, breaking RSA and ECC.

Question 112: A CISSP candidate is reviewing a data center's power redundancy. Which configuration provides the HIGHEST availability?

Generator with no UPS
UPS with surge protection only
Dual utility feeds with UPS and generator (2N configuration) (Correct answer)
Single UPS with generator backup

Correct answer: Dual utility feeds with UPS and generator (2N configuration)

A 2N configuration with dual utility feeds, UPS, and generator provides full redundancy with no single point of failure for power.

Question 113: What is the primary purpose of conducting a gap analysis during a security assessment?

To identify zero-day vulnerabilities
To compare current security posture against a target framework or standard (Correct answer)
To test employee phishing susceptibility
To enumerate all network assets

Correct answer: To compare current security posture against a target framework or standard

A gap analysis compares the organization's current security controls and practices against a target baseline such as NIST CSF or ISO 27001 to identify deficiencies.

Question 114: A security team uses honeypots on their network. What is the PRIMARY purpose?

Detecting and studying attacker behavior without exposing real assets (Correct answer)
Encrypting sensitive data in transit
Authenticating remote users securely
Blocking known malicious IP addresses

Correct answer: Detecting and studying attacker behavior without exposing real assets

Honeypots are decoy systems designed to lure attackers, detect intrusion attempts, and gather threat intelligence without exposing production assets.

Question 115: Which personnel security control requires that critical roles be filled by two or more employees to prevent knowledge concentration and ensure continuity?

Cross-training / succession planning (Correct answer)
Background screening
Job rotation
Mandatory vacations

Correct answer: Cross-training / succession planning

Cross-training and succession planning ensure that at least two people can perform each critical function, reducing single points of failure in human resources.

Question 116: To acquire access to a database and begin his work as an administrator, Jeffrey utilizes a secret code. He must also offer a thumbprint, a retina scan, and the system checks the position of his terminal's authentication. What is most likely being described?

Since there are two biometrics, one item of knowledge, and a location based factor, this is a form of tri-factor authentication
Since there are four items provided and three categories of factors, this is a form of hybrid authentication
Since there are four items required and three categories provided, this is a form of multi-factor authentication (Correct answer)
Since there are four categories provided and three itemized provisions, this is a form of type 3 authentication

Correct answer: Since there are four items required and three categories provided, this is a form of multi-factor authentication

Multi-factor authentication (MFA) requires a user to provide two or more distinct authentication factors from different categories. Jeffrey uses 'something he knows' (secret code), 'something he is' (thumbprint, retina scan - biometrics), and 'where he is' (terminal's position). Since these factors belong to different categories, this scenario clearly describes multi-factor authentication, enhancing security beyond a single factor.

Question 117: What is 'salting' in the context of password storage?

Adding a unique random value to each password before hashing (Correct answer)
Storing passwords in a hardware security module
Hashing passwords multiple times to increase complexity
Encrypting passwords with AES-256 before storage

Correct answer: Adding a unique random value to each password before hashing

Salting adds a unique random value to each password before hashing, preventing rainbow table attacks and ensuring identical passwords produce different hashes.

Question 118: What is the primary purpose of assessment in the CISSP context?

To rank individuals competitively
To gather information for informed decision-making (Correct answer)
To replace professional judgment
To fulfill administrative requirements only

Correct answer: To gather information for informed decision-making

Assessment is fundamentally about gathering reliable information to support informed professional decisions and appropriate interventions.

Question 119: Which approach to system design creates multiple layers of redundant security controls so that failure of one does not result in a breach?

Security by obscurity
Defense in depth (Correct answer)
Minimal footprint
Security through diversity

Correct answer: Defense in depth

Defense in depth implements layered security controls so an attacker must defeat multiple independent mechanisms to succeed.

Question 120: Which forensic acquisition method produces a bit-for-bit copy of storage media, including deleted files and unallocated space?

Logical acquisition
File system acquisition
Sparse acquisition
Physical (raw) acquisition (Correct answer)

Correct answer: Physical (raw) acquisition

Physical (raw) acquisition creates a sector-by-sector, bit-for-bit image of the entire storage device, capturing all data including deleted files and unallocated space.

Question 121: Which type of token used in OAuth 2.0 / OIDC contains encoded claims about the user and can be validated without contacting the authorization server?

JSON Web Token (JWT) (Correct answer)
Opaque token
SAML assertion
Refresh token

Correct answer: JSON Web Token (JWT)

JWTs are self-contained tokens that embed claims as a signed JSON payload, allowing resource servers to validate them locally without a round-trip to the authorization server.

Question 122: Which phase of a penetration test involves gathering publicly available information about the target without directly interacting with its systems?

Exploitation
Passive reconnaissance (Correct answer)
Post-exploitation
Scanning

Correct answer: Passive reconnaissance

Passive reconnaissance (OSINT) collects information from public sources like WHOIS, DNS records, and social media without sending traffic to the target.

Question 123: Which approach to data collection is required by the privacy principle of data minimization?

Collect all available data to support future analytics
Anonymize all data before storage
Encrypt all collected data at the point of collection
Collect only the data necessary to fulfill the stated purpose (Correct answer)

Correct answer: Collect only the data necessary to fulfill the stated purpose

Data minimization requires organizations to collect only the personal data that is adequate, relevant, and limited to what is necessary for the specified purpose.

Question 124: A CISSP candidate reviews a system where subjects access objects based on their security clearance and object classification labels. Which model is in use?

Bell-LaPadula (Correct answer)
Brewer-Nash
Biba
Clark-Wilson

Correct answer: Bell-LaPadula

The Bell-LaPadula model enforces confidentiality by requiring that subjects only read at or below their clearance level (no read-up) and write at or above their clearance level (no write-down).

Question 125: Which type of evidence is derived from a primary source and may be used to support other evidence in a forensic investigation?

Direct evidence
Hearsay evidence
Best evidence
Corroborative evidence (Correct answer)

Correct answer: Corroborative evidence

Corroborative evidence supports or confirms other evidence in the case; it does not stand alone but strengthens the overall body of evidence.

Question 126: An application uses a hardware security module (HSM) to perform all cryptographic operations. What is the primary security advantage?

It enables hardware-based multi-factor authentication
Private keys never leave the tamper-resistant hardware boundary (Correct answer)
It automatically rotates encryption keys on a schedule
It speeds up encryption for high-traffic applications

Correct answer: Private keys never leave the tamper-resistant hardware boundary

HSMs ensure private keys are generated and used inside tamper-resistant hardware, preventing key extraction even by privileged administrators.

Question 127: Which VPN technology operates at Layer 2 and allows remote sites to appear as if they are on the same local network segment?

L2TP/IPsec
MPLS L2VPN (VPLS) (Correct answer)
GRE over IPsec
SSL VPN

Correct answer: MPLS L2VPN (VPLS)

VPLS (Virtual Private LAN Service) is an MPLS-based L2VPN that bridges remote sites at Layer 2, making them appear as a single LAN.

Question 128: A security assessor finds that an organization rates all vulnerabilities as 'Critical' regardless of actual risk. Which CVSS component is the organization likely ignoring?

Base Score
Attack Vector
Temporal Score
Environmental Score (Correct answer)

Correct answer: Environmental Score

The Environmental Score adjusts the CVSS base score based on the organization's specific environment, asset criticality, and existing controls, enabling contextualized risk ratings.

Question 129: Which privacy principle requires that personal data collected for one purpose should not be used for a different purpose without consent?

Purpose limitation (Correct answer)
Accuracy
Data minimization
Storage limitation

Correct answer: Purpose limitation

Purpose limitation restricts the use of personal data to the specific purpose declared at the time of collection, which is a core GDPR and privacy principle.

Question 130: A company's Single Loss Expectancy (SLE) for a server failure is $200,000 and the Annualized Rate of Occurrence (ARO) is 0.25. What is the Annualized Loss Expectancy (ALE)?

$25,000
$50,000 (Correct answer)
$200,000
$800,000

Correct answer: $50,000

ALE = SLE × ARO = $200,000 × 0.25 = $50,000, representing the expected annual loss from this specific threat.

Question 131: An organization wants to prevent a single administrator from having both the ability to create accounts and approve their own access requests. Which principle addresses this?

Segregation of duties (Correct answer)
Defense in depth
Least privilege
Need to know

Correct answer: Segregation of duties

Segregation of duties (SoD) divides critical tasks between multiple people to prevent fraud and error by ensuring no single person controls an entire process.

Question 132: What is the key difference between a security audit and a security assessment?

Audits are more expensive than assessments
Audits measure compliance against defined standards; assessments evaluate overall security posture and risk (Correct answer)
Audits are performed by internal teams; assessments are always external
Assessments only cover technical controls; audits only cover people and process

Correct answer: Audits measure compliance against defined standards; assessments evaluate overall security posture and risk

Security audits verify adherence to specific standards or policies, while assessments take a broader view to identify risks, gaps, and improvement opportunities.

Question 133: What is the PRIMARY security concern with end-of-life (EOL) software still running in a production environment?

It increases software licensing costs
It is incompatible with modern encryption standards
It violates data retention policies
It no longer receives security patches, leaving vulnerabilities unmitigated (Correct answer)

Correct answer: It no longer receives security patches, leaving vulnerabilities unmitigated

EOL software no longer receives vendor security updates, so discovered vulnerabilities remain permanently unpatched and exploitable in production environments.

Question 134: What is the best practice for maintaining security architecture performance over time?

Wait for failures before acting
Implement scheduled preventive maintenance (Correct answer)
Upgrade all equipment annually
Outsource all maintenance

Correct answer: Implement scheduled preventive maintenance

Scheduled preventive maintenance catches potential issues before they cause failures, maintaining reliability and extending equipment life.

Question 135: Which directory protocol is most commonly used for querying and modifying user account information in enterprise environments?

LDAP (Correct answer)
DIAMETER
TACACS+
RADIUS

Correct answer: LDAP

LDAP (Lightweight Directory Access Protocol) is the standard protocol for reading and writing to directory services like Active Directory.

Question 136: Under the OSI model, which layer is responsible for end-to-end error recovery and flow control between communicating hosts?

Session layer (Layer 5)
Network layer (Layer 3)
Data Link layer (Layer 2)
Transport layer (Layer 4) (Correct answer)

Correct answer: Transport layer (Layer 4)

The Transport layer (Layer 4) provides end-to-end error detection, retransmission, and flow control using protocols like TCP.

Question 137: A penetration tester successfully gains domain administrator privileges during an internal test. What should be the tester's immediate next step?

Create a persistent backdoor to demonstrate long-term risk
Delete evidence of the compromise to test incident response
Continue exploiting other systems to demonstrate full domain compromise
Document the finding, notify the client per the rules of engagement, and await guidance (Correct answer)

Correct answer: Document the finding, notify the client per the rules of engagement, and await guidance

Upon achieving a significant objective like domain admin, testers must document findings immediately and notify the client per agreed-upon escalation procedures in the rules of engagement.

Question 138: Under the EU General Data Protection Regulation (GDPR), what is the maximum fine for the most serious violations?

$100 million or 5% of US revenue
€10 million or 2% of global annual turnover
€50 million or 10% of EU revenue
€20 million or 4% of global annual turnover (Correct answer)

Correct answer: €20 million or 4% of global annual turnover

GDPR Article 83(5) sets the maximum fine at €20 million or 4% of total worldwide annual turnover for the preceding year, whichever is higher.

Question 139: Which access control model assigns permissions based on rules evaluated against environmental conditions such as time of day or location?

MAC
RBAC
ABAC (Correct answer)
DAC

Correct answer: ABAC

Attribute-Based Access Control (ABAC) evaluates policies using attributes of the subject, resource, and environment — including contextual conditions like time or location.

Question 140: When designing a secure parking lot adjacent to a corporate facility, which CPTED principle reduces the risk of theft and assault?

Painting parking spaces with designated colors
Ensuring adequate lighting throughout the lot (Correct answer)
Installing boom gates at the entrance
Requiring employee ID for parking access

Correct answer: Ensuring adequate lighting throughout the lot

Adequate lighting removes dark hiding spots, increases natural surveillance, and is a core CPTED deterrent for parking area crime.

Question 141: Which of the following BEST describes the concept of 'scoping' in security baseline selection?

Selecting which regulatory framework applies to the organization
Defining the boundary of the information system
Reducing the number of controls applied based on the specific environment and mission (Correct answer)
Expanding controls to cover additional assets beyond minimum requirements

Correct answer: Reducing the number of controls applied based on the specific environment and mission

Scoping allows organizations to eliminate controls that are not applicable to their specific environment, technology, or operational requirements while maintaining the intent of the baseline.

Question 142: What is the purpose of a 'tiger team' in the context of security assessments?

A group of security experts authorized to conduct aggressive, goal-based offensive testing (Correct answer)
A team responsible for patch management
An incident response team that handles active breaches
A team that only performs compliance audits

Correct answer: A group of security experts authorized to conduct aggressive, goal-based offensive testing

A tiger team is a specialized group authorized to conduct adversarial testing using any means necessary to achieve defined objectives, simulating advanced threat actors.

Question 143: A company discovers that an attacker exploited a switch to access traffic on a VLAN they should not have access to by sending specially crafted 802.1Q frames. This attack is known as:

VLAN hopping (double tagging) (Correct answer)
MAC flooding
ARP spoofing
STP manipulation

Correct answer: VLAN hopping (double tagging)

VLAN hopping via double tagging embeds two 802.1Q tags so traffic crosses VLAN boundaries when the outer tag is stripped by the first switch.

Question 144: The Brewer-Nash (Chinese Wall) model was specifically designed to prevent:

Unauthorized modification of financial records
Covert channels in military systems
Conflicts of interest in commercial environments (Correct answer)
Privilege escalation by insider threats

Correct answer: Conflicts of interest in commercial environments

The Brewer-Nash (Chinese Wall) model prevents analysts from accessing data belonging to competing clients to avoid conflicts of interest.

Question 145: What distinguishes a white-box penetration test from a black-box penetration test?

White-box testers are given full knowledge of the environment; black-box testers receive no prior information (Correct answer)
White-box tests focus on networks; black-box tests focus on applications
White-box tests use automated tools; black-box tests are fully manual
White-box tests are performed externally; black-box tests are performed internally

Correct answer: White-box testers are given full knowledge of the environment; black-box testers receive no prior information

White-box testing provides the tester with full knowledge including source code and architecture, while black-box testing simulates an external attacker with no prior information.

Question 146: What is the primary purpose of a Web Application Firewall (WAF) in a software security architecture?

Managing user authentication tokens
Scanning source code for vulnerabilities
Encrypting data at rest
Filtering malicious HTTP traffic before it reaches the application (Correct answer)

Correct answer: Filtering malicious HTTP traffic before it reaches the application

A WAF inspects and filters HTTP/HTTPS requests to block common web attacks like SQLi and XSS before they reach the application.

Question 147: A company defines its crisis communication plan. Which group should be addressed FIRST in an external communication sequence?

Regulators and key stakeholders as required by law or contract (Correct answer)
Media and press outlets
General public via social media
Customers via marketing email

Correct answer: Regulators and key stakeholders as required by law or contract

Legal and contractual obligations typically require notifying regulators and key stakeholders before broader public communications.

Question 148: During a network forensic investigation, an analyst discovers TCP sessions with SYN packets but no corresponding SYN-ACK replies across many source IPs. This MOST likely indicates:

A distributed denial-of-service SYN flood attack (Correct answer)
Normal asymmetric routing
A TCP session hijacking attempt
BGP route flapping

Correct answer: A distributed denial-of-service SYN flood attack

Numerous SYN packets from many sources with no SYN-ACK responses is the classic signature of a SYN flood DDoS attack exhausting the target's connection table.

Question 149: Which network protocol allows multiple physical WAN links to be combined into a single logical channel for increased bandwidth and redundancy?

Link Aggregation Control Protocol (LACP / 802.3ad) (Correct answer)
OSPF equal-cost multipath (ECMP)
Spanning Tree Protocol (STP)
Border Gateway Protocol (BGP)

Correct answer: Link Aggregation Control Protocol (LACP / 802.3ad)

LACP (802.3ad) negotiates link aggregation between devices, bundling multiple physical links into a single logical interface for both throughput and redundancy.

Question 150: Which type of security policy provides the highest-level direction and is signed by executive leadership to express management commitment to security?

Procedure
Baseline policy
Organizational (master) security policy (Correct answer)
Standard

Correct answer: Organizational (master) security policy

The organizational or master security policy is the top-level document that expresses executive commitment and sets the strategic direction for the entire security program.

Question 151: Which metric is most useful for evaluating program effectiveness in CISSP?

Outcome-based performance indicators (Correct answer)
Number of meetings held
Number of staff involved
Amount of money spent

Correct answer: Outcome-based performance indicators

Outcome-based performance indicators directly measure whether the program is achieving its intended results and goals.

Question 152: The concept that no single person should have complete control over a critical process is known as:

Least privilege
Defense in depth
Separation of duties (Correct answer)
Need to know

Correct answer: Separation of duties

Separation of duties divides critical tasks among multiple individuals to prevent fraud and error by ensuring no one person can complete a harmful act alone.

CISSP Exam

The CISSP (Certified Information Systems Security Professional) Exam is a CAT-format exam covering eight domains of the ISC² CISSP CBK including security and risk management, asset security, security architecture, network security, IAM, security assessment, and security operations.

150

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds