CISSP Exam — Questions and Answers

Question 1: In CISSP practice, what is the primary purpose of strategic planning?

To align resources with goals and anticipate challenges (Correct answer)
To create paperwork
To satisfy external auditors
To reduce workforce

Correct answer: To align resources with goals and anticipate challenges

Strategic planning aligns organizational resources with goals and helps anticipate challenges before they become critical issues.

Question 2: What is the primary purpose of encryption in CISSP security?

To protect data confidentiality during storage and transmission (Correct answer)
To make data transfer slower
To compress data
To organize data more efficiently

Correct answer: To protect data confidentiality during storage and transmission

Encryption protects data confidentiality by converting information into an unreadable format that can only be decoded with the proper key.

Question 3: What is the most effective approach to identity and access management in the CISSP field?

Following competitors
Reactive problem-solving
Systematic planning and continuous improvement (Correct answer)
Maintaining the status quo

Correct answer: Systematic planning and continuous improvement

Systematic planning combined with continuous improvement ensures sustainable success and allows for proactive management of challenges.

Question 4: Under the NIST incident response lifecycle, which phase directly follows containment, eradication, and recovery?

Detection and Analysis
Identification
Preparation
Post-Incident Activity (Correct answer)

Correct answer: Post-Incident Activity

The NIST IR lifecycle ends with Post-Incident Activity (lessons learned), which follows the Containment, Eradication, and Recovery phase to improve future response capabilities.

Question 5: An organization's IR plan calls for isolating an infected workstation by disabling its network interface. Which containment strategy does this represent?

Short-term containment (Correct answer)
Recovery
Eradication
Long-term containment

Correct answer: Short-term containment

Short-term containment involves immediate actions like disabling a network interface to stop the spread of an incident while longer-term solutions are prepared.

Question 6: Which VPN technology operates at Layer 2 and allows remote sites to appear as if they are on the same local network segment?

SSL VPN
L2TP/IPsec
MPLS L2VPN (VPLS) (Correct answer)
GRE over IPsec

Correct answer: MPLS L2VPN (VPLS)

VPLS (Virtual Private LAN Service) is an MPLS-based L2VPN that bridges remote sites at Layer 2, making them appear as a single LAN.

Question 7: An organization implements a proxy server that terminates client SSL sessions, inspects decrypted content, then re-encrypts and forwards traffic. This is BEST described as:

SSL offloading
TLS mutual authentication
SSL/TLS inspection (man-in-the-middle proxy) (Correct answer)
VPN split tunneling

Correct answer: SSL/TLS inspection (man-in-the-middle proxy)

SSL/TLS inspection proxies act as a controlled man-in-the-middle, decrypting traffic for content inspection then re-encrypting to the destination server.

Question 8: Which threat modeling methodology uses attack trees and is primarily attacker-centric in its approach?

OCTAVE
VAST
PASTA (Correct answer)
STRIDE

Correct answer: PASTA

PASTA (Process for Attack Simulation and Threat Analysis) is attacker-centric and uses attack trees to simulate adversarial objectives.

Question 9: In CISSP practice, what is the purpose of vulnerability scanning?

To slow down network traffic
To exploit systems
To identify weaknesses before attackers do (Correct answer)
To replace firewalls

Correct answer: To identify weaknesses before attackers do

Vulnerability scanning proactively identifies security weaknesses in systems and applications so they can be remediated before exploitation.

Question 10: Which attack targets the ARP table of hosts on a LAN to redirect traffic through an attacker's machine?

MAC flooding
ARP poisoning (ARP spoofing) (Correct answer)
VLAN hopping
IP spoofing

Correct answer: ARP poisoning (ARP spoofing)

ARP poisoning sends forged ARP replies to associate the attacker's MAC with a legitimate IP, causing victim hosts to send traffic to the attacker.

Question 11: An organization wants to prevent employees from exfiltrating data via encrypted DNS tunnels. Which control is MOST effective?

Deploy a recursive DNS resolver with anomaly detection for high-volume or large TXT record queries (Correct answer)
Require all DNS queries to use DNSSEC
Block all UDP port 53 at the perimeter
Implement DNS over HTTPS for all clients

Correct answer: Deploy a recursive DNS resolver with anomaly detection for high-volume or large TXT record queries

DNS tunneling detection relies on behavioral analysis—unusually high query volumes, large TXT records, and long subdomains—which a monitored internal resolver can identify.

Question 12: Which type of assessment provides a snapshot of current status at a single point in time?

Baseline assessment (Correct answer)
Continuous assessment
Formative assessment
Summative assessment

Correct answer: Baseline assessment

A baseline assessment captures the current status at a specific point in time, establishing a reference point for measuring future changes.

Question 13: Which firewall architecture places a screened subnet (DMZ) between two firewalls to isolate public-facing servers?

Bastion host architecture
Packet filtering firewall
Screened subnet (dual-firewall DMZ) architecture (Correct answer)
Screened host architecture

Correct answer: Screened subnet (dual-firewall DMZ) architecture

The screened subnet architecture uses two firewalls creating a DMZ between them, isolating public services from the internal network even if the outer firewall is compromised.

Question 14: What is the primary purpose of assessment in the CISSP context?

To gather information for informed decision-making (Correct answer)
To replace professional judgment
To fulfill administrative requirements only
To rank individuals competitively

Correct answer: To gather information for informed decision-making

Assessment is fundamentally about gathering reliable information to support informed professional decisions and appropriate interventions.

Question 15: A forensic investigator uses a write blocker during evidence acquisition. What is the primary reason for this?

To speed up the imaging process
To compress the forensic image file
To decrypt encrypted drives before imaging
To prevent any writes to the evidence media that would alter it (Correct answer)

Correct answer: To prevent any writes to the evidence media that would alter it

A write blocker prevents any data from being written to the original evidence media during acquisition, preserving its integrity and ensuring the copy is forensically sound.

Question 16: Which of the following is a primary benefit of having a Computer Security Incident Response Team (CSIRT)?

Eliminating all security vulnerabilities
Providing a structured, coordinated response to security incidents (Correct answer)
Preventing all malware infections
Replacing the need for security monitoring tools

Correct answer: Providing a structured, coordinated response to security incidents

A CSIRT provides an organized, expert team that can respond quickly and effectively to incidents, minimizing damage and recovery time through coordinated effort.

Question 17: Which documentation is essential when working with security architecture in CISSP?

Marketing materials
General descriptions without specifics
Only verbal notes
Detailed technical specifications and as-built diagrams (Correct answer)

Correct answer: Detailed technical specifications and as-built diagrams

Detailed technical specifications and as-built diagrams provide the accurate reference information needed for maintenance and troubleshooting.

Question 18: In CISSP practice, what is the best approach to quality improvement in cryptography?

Wait for problems to occur before acting
Use data-driven methods with measurable outcomes (Correct answer)
Copy what other organizations do without analysis
Make changes without measuring results

Correct answer: Use data-driven methods with measurable outcomes

Data-driven quality improvement with measurable outcomes ensures that changes actually produce the intended improvements and can be verified.

Question 19: Which cloud service model gives customers the most control over the operating system and runtime environment?

IaaS (Correct answer)
PaaS
FaaS
SaaS

Correct answer: IaaS

IaaS (Infrastructure as a Service) provides raw compute, storage, and networking, giving customers full OS and runtime control.

Question 20: What does validity mean when selecting an assessment tool for CISSP certification purposes?

The tool is easy to administer
The tool is widely used
The tool is inexpensive
The tool measures what it claims to measure (Correct answer)

Correct answer: The tool measures what it claims to measure

Validity indicates that an assessment tool accurately measures the construct or ability it was designed to measure.

Question 21: What is the value of continuing education in business continuity for CISSP professionals?

It replaces workplace experience
It is only needed for recertification
It is primarily a social activity
It keeps professionals current with evolving standards and practices (Correct answer)

Correct answer: It keeps professionals current with evolving standards and practices

Continuing education ensures professionals stay current with the latest developments, standards, and best practices in their field.

Question 22: In CISSP practice, what is the primary purpose of strategic planning?

To align resources with goals and anticipate challenges (Correct answer)
To create paperwork
To reduce workforce
To satisfy external auditors

Correct answer: To align resources with goals and anticipate challenges

Strategic planning aligns organizational resources with goals and helps anticipate challenges before they become critical issues.

Question 23: A security engineer needs to ensure that a cryptographic key is never stored in plaintext anywhere. Which technique best addresses this requirement?

Key rotation
Key stretching
Key wrapping (Correct answer)
Key escrow

Correct answer: Key wrapping

Key wrapping encrypts a cryptographic key with another key so the plaintext key is never exposed in storage.

Question 24: Which type of testing sends random, malformed, or unexpected inputs to an application interface to discover crashes and vulnerabilities?

User acceptance testing
Unit testing
Fuzz testing (Correct answer)
Regression testing

Correct answer: Fuzz testing

Fuzz testing (fuzzing) automatically generates large volumes of invalid or random inputs to trigger unexpected behavior, crashes, or security flaws.

Question 25: Which professional attribute is most valued in cryptography within the CISSP field?

Avoiding challenging situations
Working in isolation
Prioritizing personal convenience
Accountability and commitment to standards (Correct answer)

Correct answer: Accountability and commitment to standards

Accountability and commitment to professional standards build trust and ensure consistent, high-quality practice.

Question 26: Which software development model integrates security activities such as abuse case development and attack surface analysis into each sprint?

Microsoft SDL
RAD
Agile SDL (Correct answer)
Waterfall

Correct answer: Agile SDL

Agile SDL adapts security practices like abuse case modeling and attack surface analysis to fit iterative sprint cycles.

Question 27: What is the best practice for documenting assessment results in CISSP practice?

Document results from memory at end of day
Record only abnormal findings
Use subjective descriptions only
Document all findings objectively and completely (Correct answer)

Correct answer: Document all findings objectively and completely

Best practice requires documenting all findings objectively and completely at the time of assessment for accuracy and legal protection.

Question 28: In the context of secure software development, what is the definition of 'code signing'?

Applying a digital signature to software so recipients can verify its integrity and authenticity (Correct answer)
Adding a copyright watermark to compiled binaries
Encrypting source code before committing to a repository
Marking code modules as reviewed in a bug tracker

Correct answer: Applying a digital signature to software so recipients can verify its integrity and authenticity

Code signing uses a developer's private key to sign software, allowing users to verify via the corresponding public key that the code is untampered and from a trusted author.

Question 29: What is the primary consideration when implementing changes to communication and network security?

Personal convenience
Impact assessment and change management (Correct answer)
Vendor preference
Speed of implementation

Correct answer: Impact assessment and change management

Impact assessment and proper change management ensure that modifications do not introduce unexpected problems or service disruptions.

Question 30: What role does collaboration play in cryptography for CISSP professionals?

It slows down work unnecessarily
It reduces individual accountability
It is only needed in emergencies
It enhances outcomes through diverse perspectives and shared expertise (Correct answer)

Correct answer: It enhances outcomes through diverse perspectives and shared expertise

Collaboration leverages diverse perspectives and combined expertise to achieve better outcomes than any individual could alone.

Question 31: Which of the following does not belong in the category of personnel security?

Non disclosure agreement that fails to cite legal authority
Current revision of the employee handbook that has not been released (Correct answer)
Detailed job description with some missing elements
Employment contract with no signatures

Correct answer: Current revision of the employee handbook that has not been released

Senior management commitment is absolutely critical at the very beginning of the Business Continuity Plan (BCP) development process, during the Project Initiation phase. Without their explicit support, funding, and endorsement, the BCP project lacks the necessary resources, authority, and organizational buy-in to be successfully developed, implemented, and maintained throughout its lifecycle.

Question 32: A negative test is described by which of the following?

Where the expected result is a graceful rejection of data without crashing the application
An attempt to provoke an application’s failure
Providing evidence of application behavior when unexpected or invalid data is used
Where the application fails a test if it does not provide the expected result (Correct answer)

Correct answer: Where the application fails a test if it does not provide the expected result

Personnel security focuses on ensuring that individuals with access to sensitive information or systems are trustworthy and that their access is appropriately managed. Detailed job descriptions, non-disclosure agreements, and employment contracts are all direct tools or elements of personnel security. A current revision of an employee handbook that has not been released, however, is a document management issue, not an active control or concern related to an individual's trustworthiness or access management.

Question 33: Which regulation governs the security and privacy of student education records in the US?

GLBA
HIPAA
FERPA (Correct answer)
COPPA

Correct answer: FERPA

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records and grants parents/students access rights.

Question 34: A legacy application uses MD5 to hash passwords. What is the PRIMARY cryptographic concern?

MD5 is too slow for authentication systems
MD5 produces hashes that are too short for storage
MD5 lacks a salt parameter
MD5 is cryptographically broken and collision-prone (Correct answer)

Correct answer: MD5 is cryptographically broken and collision-prone

MD5 is cryptographically broken, susceptible to collision attacks and extremely fast brute-force cracking, making it unsuitable for password hashing.

Question 35: What is the PRIMARY goal of a Business Impact Analysis (BIA)?

Determine recovery time objectives for critical processes (Correct answer)
Establish the organization's risk appetite
Define security policies and procedures
Identify security vulnerabilities in systems

Correct answer: Determine recovery time objectives for critical processes

A BIA identifies critical business functions and determines RTOs, RPOs, and financial impacts of disruptions.

Question 36: Which skill is most critical for effective security and risk management?

Communication and stakeholder engagement (Correct answer)
Individual work preferences
Technical expertise alone
Speed of decision-making

Correct answer: Communication and stakeholder engagement

Communication and stakeholder engagement are essential because management success depends on effectively coordinating with and influencing others.

Question 37: Which authentication factor is classified as "something you are"?

Security token
Biometric data (Correct answer)
Password
Smart card

Correct answer: Biometric data

Biometric data such as fingerprints, facial recognition, or retinal scans represents the "something you are" authentication factor.

Question 38: Which skill is most critical for effective identity and access management?

Communication and stakeholder engagement (Correct answer)
Individual work preferences
Technical expertise alone
Speed of decision-making

Correct answer: Communication and stakeholder engagement

Communication and stakeholder engagement are essential because management success depends on effectively coordinating with and influencing others.

Question 39: When implementing IPsec in tunnel mode between two VPN gateways, which part of the original packet is encrypted?

The entire original IP packet (header + payload) (Correct answer)
Only the TCP/UDP payload
Only the application layer data
Only the original IP header

Correct answer: The entire original IP packet (header + payload)

In IPsec tunnel mode, the entire original IP packet (header and payload) is encapsulated and encrypted within a new outer IP packet.

Question 40: Which documentation is essential when working with communication and network security in CISSP?

Detailed technical specifications and as-built diagrams (Correct answer)
Marketing materials
General descriptions without specifics
Only verbal notes

Correct answer: Detailed technical specifications and as-built diagrams

Detailed technical specifications and as-built diagrams provide the accurate reference information needed for maintenance and troubleshooting.

Question 41: In CISSP practice, reliability in assessment refers to:

The popularity of the instrument
The consistency and reproducibility of results (Correct answer)
The speed of administration
The cost of the assessment tool

Correct answer: The consistency and reproducibility of results

Reliability refers to the consistency and reproducibility of assessment results when the test is repeated under similar conditions.

Question 42: What is the benefit of continuous integration in CISSP workflows?

It detects integration issues early through frequent builds and tests (Correct answer)
It automatically fixes all bugs
It eliminates the need for development environments
It removes the need for code review

Correct answer: It detects integration issues early through frequent builds and tests

Continuous integration detects integration issues early by automatically building and testing code whenever changes are committed.

Question 43: Which network security concept ensures that all traffic, including internal east-west traffic, is inspected and no implicit trust is granted based on network location?

Defense in depth
Zero Trust Network Access (ZTNA) (Correct answer)
Network Access Control (NAC)
Microsegmentation

Correct answer: Zero Trust Network Access (ZTNA)

Zero Trust Network Access operates on the principle of 'never trust, always verify,' requiring authentication and authorization for all traffic regardless of source location.

Question 44: Which protocol provides hop-by-hop encryption for MPLS VPN traffic between provider edge routers?

TLS 1.3
MACsec (802.1AE) (Correct answer)
DTLS
IPsec Transport Mode

Correct answer: MACsec (802.1AE)

MACsec (802.1AE) operates at Layer 2 and provides hop-by-hop encryption between directly connected devices such as MPLS PE routers.

Question 45: Which protocol is used by network devices to dynamically assign IP addresses and provide configuration parameters to hosts?

IGMP
ARP
ICMP
DHCP (Correct answer)

Correct answer: DHCP

DHCP (Dynamic Host Configuration Protocol) dynamically assigns IP addresses, subnet masks, default gateways, and DNS server addresses to network clients.

Question 46: An attacker manipulates a serialized object sent to a Java application causing remote code execution. What vulnerability class does this represent?

XML External Entity (XXE)
Server-Side Request Forgery
Insecure deserialization (Correct answer)
Broken access control

Correct answer: Insecure deserialization

Insecure deserialization occurs when an application deserializes attacker-controlled data, potentially enabling RCE or privilege escalation.

Question 47: What does the term 'due diligence' mean in the context of information security governance?

Conducting annual security awareness training
Investigating and verifying security practices before entering a business relationship (Correct answer)
Following the minimum legal requirements for data protection
Implementing security controls after a breach occurs

Correct answer: Investigating and verifying security practices before entering a business relationship

Due diligence involves proactively investigating security posture, risks, and controls before a merger, acquisition, or vendor engagement.

Question 48: What is the key benefit of evidence-based decision making in CISSP management?

It eliminates all risk
It improves accuracy and reduces bias in decisions (Correct answer)
It speeds up all processes
It reduces reliance on data

Correct answer: It improves accuracy and reduces bias in decisions

Evidence-based decision making uses data and research to improve the accuracy of decisions and reduce the influence of personal bias.

Question 49: Which network protocol allows multiple physical WAN links to be combined into a single logical channel for increased bandwidth and redundancy?

Spanning Tree Protocol (STP)
Link Aggregation Control Protocol (LACP / 802.3ad) (Correct answer)
Border Gateway Protocol (BGP)
OSPF equal-cost multipath (ECMP)

Correct answer: Link Aggregation Control Protocol (LACP / 802.3ad)

LACP (802.3ad) negotiates link aggregation between devices, bundling multiple physical links into a single logical interface for both throughput and redundancy.

Question 50: A penetration tester uses a rogue AP broadcasting the same SSID as the corporate network to capture credentials. This attack is BEST described as:

Bluejacking
KRACK attack
Evil twin attack (Correct answer)
Deauthentication attack

Correct answer: Evil twin attack

An evil twin attack creates a fraudulent access point mimicking a legitimate SSID to intercept client connections and capture credentials.

Question 51: What is the fundamental principle behind security architecture in the CISSP domain?

Balancing performance, reliability, and efficiency (Correct answer)
Cost minimization at all costs
Using the newest technology exclusively
Following a single vendor solution

Correct answer: Balancing performance, reliability, and efficiency

Effective technical design requires balancing performance requirements with reliability needs and operational efficiency.

Question 52: Which attestation report type provides a confidential SOC 2 security report shared only with customers under NDA?

SOC 2 Type I
SOC 1 Type I
SOC 3
SOC 2 Type II (Correct answer)

Correct answer: SOC 2 Type II

SOC 2 Type II covers a period of time (vs. a point in time) and is restricted to customers, while SOC 3 is the public version.

Question 53: In CISSP practice, what is the purpose of vulnerability scanning?

To replace firewalls
To exploit systems
To identify weaknesses before attackers do (Correct answer)
To slow down network traffic

Correct answer: To identify weaknesses before attackers do

Vulnerability scanning proactively identifies security weaknesses in systems and applications so they can be remediated before exploitation.

Question 54: What is the most important professional competency for CISSP certification in cryptography?

Memorization of all reference materials
Deep knowledge combined with practical application skills (Correct answer)
Ability to work alone exclusively
Speed of task completion

Correct answer: Deep knowledge combined with practical application skills

Professional competency requires both deep knowledge of the subject matter and the ability to apply that knowledge in practical situations.

Question 55: The contents of mail communications are frequently encrypted using a symmetric technique, most typically AES. However, non-repudiation is achieved using a mix of hashing and an asymmetric algorithm. What is the process of non-repudiation?

By encrypting the document with the sender’s public key, then hashing the document
By hashing the document and then encrypting the hash with the sender’s private key (Correct answer)
By encrypting the document with the sender’s private key, then hashing document
By hashing the document then encrypting the hash with the receiver’s public key

Correct answer: By hashing the document and then encrypting the hash with the sender’s private key

To achieve non-repudiation, the sender first creates a hash (a unique digital fingerprint) of the document. This hash is then encrypted using the sender's *private* key, creating a digital signature. Anyone can then use the sender's *public* key to decrypt the hash and compare it to a newly generated hash of the document, verifying both the sender's identity and that the document hasn't been tampered with.

Question 56: Which protocol vulnerability does the POODLE attack exploit?

MD5 collision in TLS certificates
RC4 statistical bias in WEP
TLS 1.2 HMAC truncation
SSL 3.0 CBC padding oracle (Correct answer)

Correct answer: SSL 3.0 CBC padding oracle

POODLE (Padding Oracle On Downgraded Legacy Encryption) exploits a padding oracle vulnerability in SSL 3.0's CBC mode encryption.

Question 57: Which professional attribute is most valued in business continuity within the CISSP field?

Prioritizing personal convenience
Working in isolation
Accountability and commitment to standards (Correct answer)
Avoiding challenging situations

Correct answer: Accountability and commitment to standards

Accountability and commitment to professional standards build trust and ensure consistent, high-quality practice.

Question 58: The least acceptable security configuration for a given environment is referred to as a system's minimum security baseline. Before defining the MSB, the system must be classified according to the Confidentiality, Integrity, and Availability requirements of its data. What is the overall category of a system where the potential impact of unauthorized disclosure is "high," the impact of an integrity breach is "mid," and the impact of data being momentarily unavailable is "low"?

Low
High (Correct answer)
Medium-high
Medium

Correct answer: High

When categorizing a system based on Confidentiality, Integrity, and Availability (CIA) impacts, the overall system category is determined by the highest potential impact level across all three security objectives. In this scenario, the potential impact of unauthorized disclosure (Confidentiality) is 'high.' Therefore, the system's overall classification must be 'High' to ensure adequate protection for its most critical security aspect.

Question 59: Which NIST Special Publication provides the primary guidelines for computer security incident handling?

NIST SP 800-137
NIST SP 800-53
NIST SP 800-30
NIST SP 800-61 (Correct answer)

Correct answer: NIST SP 800-61

NIST SP 800-61, 'Computer Security Incident Handling Guide,' provides guidelines for establishing and operating an incident response capability.

Question 60: An organization uses 802.1X for wired network access control. Which component authenticates the end-user credentials?

Certificate Authority
Authenticator
Authentication Server (RADIUS) (Correct answer)
Supplicant

Correct answer: Authentication Server (RADIUS)

In 802.1X, the Authentication Server (typically RADIUS) validates supplicant credentials; the authenticator (switch) enforces the decision.

Question 61: What is the recommended response when a security incident is detected in an CISSP environment?

Follow the incident response plan: contain, eradicate, recover (Correct answer)
Delete all logs immediately
Immediately shut down all systems
Ignore minor incidents

Correct answer: Follow the incident response plan: contain, eradicate, recover

Following a structured incident response plan ensures containment of the threat, eradication of the cause, and recovery to normal operations.

Question 62: What is the recommended approach when managing conflicting priorities in CISSP?

Ignore lower-priority items
Delegate all decisions upward
Prioritize based on impact and urgency (Correct answer)
Address them in alphabetical order

Correct answer: Prioritize based on impact and urgency

Prioritizing based on impact and urgency ensures the most critical issues receive attention first while maintaining progress on other goals.

Question 63: To authenticate the company's public users, your CIO wishes to employ Lightweight Directory Access Protocol (LDAP). The following should be your initial consideration:

Whether the considered version of LDAP has sufficient support for transport layer security (Correct answer)
Whether the Domain Component (DC) is included in the entry
Whether the software can support LDAP using a hierarchical tree structure
Whether the LDAP entry includes the appropriate Common Name (CN)

Correct answer: Whether the considered version of LDAP has sufficient support for transport layer security

When using LDAP for authenticating public users, the primary concern should be the security of the credentials and data transmitted. LDAP itself is not inherently secure, so ensuring that the version considered has sufficient support for Transport Layer Security (TLS) or Secure Sockets Layer (SSL) is critical. This encryption protects the authentication process from eavesdropping and man-in-the-middle attacks, safeguarding user information.

Question 64: What cloud data security technique ensures that even if the provider is compromised, customer data remains unreadable?

Client-side encryption with customer-managed keys (Correct answer)
Data masking
TLS in transit
Access control lists

Correct answer: Client-side encryption with customer-managed keys

Encrypting data client-side before upload with customer-managed keys means the provider never possesses the decryption key.

Question 65: What is the key benefit of evidence-based decision making in CISSP management?

It reduces reliance on data
It speeds up all processes
It eliminates all risk
It improves accuracy and reduces bias in decisions (Correct answer)

Correct answer: It improves accuracy and reduces bias in decisions

Evidence-based decision making uses data and research to improve the accuracy of decisions and reduce the influence of personal bias.

Question 66: Which routing protocol security feature prevents unauthorized routers from injecting false routing information into an OSPF domain?

Route filtering with ACLs
OSPF MD5 or SHA authentication (Correct answer)
BGP route reflectors
Spanning Tree Protocol BPDU Guard

Correct answer: OSPF MD5 or SHA authentication

OSPF neighbor authentication (MD5 or SHA) requires routers to prove identity before exchanging routing updates, preventing rogue router injection.

Question 67: Which memory forensics artifact can reveal currently running processes, open network connections, and loaded drivers that may not appear in on-disk analysis?

Windows Registry hive
System log files
RAM (volatile memory) dump (Correct answer)
File allocation table

Correct answer: RAM (volatile memory) dump

A RAM dump captures volatile memory that contains live process information, network connections, encryption keys, and loaded drivers, revealing attacker activity that may not persist on disk.

Question 68: The security of a system is determined by its individual components. The system's trust is a reflection of the components' trust. The __________ of the system refers to all of these parts.

Firmware
Ring 1 elements
Trusted Computing Base (Correct answer)
Operating System Kernel

Correct answer: Trusted Computing Base

The Trusted Computing Base (TCB) refers to the entire collection of hardware, firmware, and software components within a system that are critical to enforcing its security policy. If any part of the TCB is compromised, the security of the entire system is at risk. Therefore, the overall trust in a system is directly derived from the trustworthiness of all these underlying components working together.

Question 69: What is the recommended FIRST action when a security analyst discovers an active intrusion on a production server?

Contain the incident to prevent further spread (Correct answer)
Immediately power off the server
Notify law enforcement
Eradicate the malware

Correct answer: Contain the incident to prevent further spread

Containment is the first priority to limit the damage and prevent the attacker from spreading further, while preserving evidence and minimizing business impact.

Question 70: Under HIPAA, what term describes organizations that handle protected health information on behalf of a covered entity?

Data processor
Business associate (Correct answer)
Sub-contractor
Data custodian

Correct answer: Business associate

A business associate is a third party that creates, receives, maintains, or transmits PHI on behalf of a HIPAA-covered entity.

Question 71: Which approach best demonstrates mastery of business continuity in CISSP practice?

Relying entirely on technology
Following procedures without understanding
Avoiding complex scenarios
Applying principles to novel situations with sound judgment (Correct answer)

Correct answer: Applying principles to novel situations with sound judgment

True mastery involves understanding underlying principles well enough to apply them to new and unfamiliar situations with professional judgment.

Question 72: Which software security concept ensures that a module performs only the functions necessary for its purpose and does not have access to unneeded resources?

Security by obscurity
Fail-safe defaults
Principle of least privilege (Correct answer)
Defense in depth

Correct answer: Principle of least privilege

The principle of least privilege limits software modules to only the permissions and resources they need to perform their defined function, reducing the blast radius of a compromise.

Question 73: What is the MAIN difference between a stateful packet inspection (SPI) firewall and a stateless packet filter?

SPI firewalls operate faster than packet filters
Packet filters can block application-layer attacks; SPI cannot
SPI firewalls track connection state and context; packet filters evaluate each packet in isolation (Correct answer)
SPI firewalls only inspect inbound traffic

Correct answer: SPI firewalls track connection state and context; packet filters evaluate each packet in isolation

Stateful inspection firewalls maintain a connection state table to evaluate packets in the context of their TCP/UDP session, while packet filters assess each packet independently.

Question 74: Both the principal and mirror sites of Astrotek Company have recently gone down due to an unplanned outage. The outage will last at least three weeks, according to officials. What is the first category of items you should check for while reviewing the contingency plan?

Recovery steps to the alternate site within the recovery time objective (Correct answer)
Reconstitution steps to the cold site within the recovery point objective
Reconstitution steps to the warm site that exceed the maximum allowable downtime
Recovery steps to the hot site within the given recovery time objective

Correct answer: Recovery steps to the alternate site within the recovery time objective

With both the principal and mirror sites down for an extended period, the company must activate its disaster recovery plan to an alternate site. The first category of items to check in the contingency plan would be the recovery steps to this alternate site. It is crucial to ensure these steps can be completed within the defined Recovery Time Objective (RTO), which dictates the maximum acceptable downtime for the business.

Question 75: Trust and Assurance are two elements that are included in the evaluation scope when evaluating a system using the TCSEC and the more modern Common Criteria. Which of the following best describes assurance and trust?

Trust describes the function of the product, while assurance describes the reliability of the process used to create the product. (Correct answer)
Assurance describes the function of the product, while trust describes the reliability of the process used to create the product.
Assurance describes how secure the system is, while trust describes performance capabilities.
Trust describes how secure the system is, while assurance describes performance capabilities.

Correct answer: Trust describes the function of the product, while assurance describes the reliability of the process used to create the product.

In security evaluations like TCSEC and Common Criteria, 'trust' describes the confidence that a system will behave as expected and enforce its security policy, focusing on *what* the product does. 'Assurance,' on the other hand, refers to the degree of confidence that the system meets its security requirements through rigorous development, testing, and evaluation processes, focusing on *how* the product was built and verified. Together, they provide a comprehensive view of a system's security posture.

Question 76: Which principle states that users should only have access necessary for their role?

Defense in depth
Principle of least privilege (Correct answer)
Separation of duties
Need to share

Correct answer: Principle of least privilege

The principle of least privilege ensures users only have the minimum access rights needed to perform their job functions, limiting potential damage.

Question 77: What is the legal significance of a 'chain of custody' in digital forensics?

It ensures evidence is encrypted during storage
It documents the unbroken possession and handling of evidence to maintain its admissibility in court (Correct answer)
It establishes who is responsible for incident response
It defines how long digital evidence must be retained

Correct answer: It documents the unbroken possession and handling of evidence to maintain its admissibility in court

Chain of custody creates a documented trail proving evidence integrity and proper handling, which is essential for admissibility in legal proceedings.

Question 78: Which Agile security practice involves writing test cases for known attack scenarios before writing the feature code itself?

Penetration testing
Red team testing
Regression testing
Abuse case development (Correct answer)

Correct answer: Abuse case development

Abuse cases (or misuse cases) define how an attacker could misuse a feature, guiding developers to build defenses proactively.

Question 79: What is the primary benefit of version control in software development security for CISSP?

It makes files larger
It eliminates the need for documentation
It tracks changes and enables collaboration (Correct answer)
It replaces testing

Correct answer: It tracks changes and enables collaboration

Version control systems track all changes to code and configurations, enabling collaboration, rollback, and audit trails.

Question 80: What has most likely happened if a colleague uses publicly available information from social media to guess one of your system administrator's passwords and then takes classified information?

Masquerading, where audit logs could still be useful (Correct answer)
Escalation of privilege with non-repudiation
Tampering, one of the damaging steps within the STRIDE model
Spoofing without repudiation or recourse

Correct answer: Masquerading, where audit logs could still be useful

Masquerading occurs when an attacker successfully assumes the identity of an authorized user, in this case, a system administrator, by guessing their password. Even though the attacker is impersonating a legitimate user, audit logs would still record the actions performed under that administrator's account. These logs would be invaluable for detecting the intrusion, investigating the incident, and performing forensic analysis after the fact.

Question 81: What is the primary consideration when implementing changes to security architecture?

Vendor preference
Personal convenience
Speed of implementation
Impact assessment and change management (Correct answer)

Correct answer: Impact assessment and change management

Impact assessment and proper change management ensure that modifications do not introduce unexpected problems or service disruptions.

Question 82: Which XML-specific vulnerability allows an attacker to read arbitrary files on the server by referencing external entities in a crafted XML document?

XML External Entity (XXE) Injection (Correct answer)
XPATH Injection
JSON Hijacking
SOAP Action Spoofing

Correct answer: XML External Entity (XXE) Injection

XXE injection exploits misconfigured XML parsers that process external entity references, enabling attackers to read local files or perform SSRF attacks.

Question 83: What is the value of continuing education in cryptography for CISSP professionals?

It is primarily a social activity
It keeps professionals current with evolving standards and practices (Correct answer)
It is only needed for recertification
It replaces workplace experience

Correct answer: It keeps professionals current with evolving standards and practices

Continuing education ensures professionals stay current with the latest developments, standards, and best practices in their field.

Question 84: In CISSP certification, what does redundancy in system design primarily provide?

Increased complexity
Simplified maintenance
Fault tolerance and high availability (Correct answer)
Lower initial cost

Correct answer: Fault tolerance and high availability

Redundancy provides fault tolerance by ensuring that if one component fails, backup components maintain system availability.

Question 85: What is the PRIMARY purpose of a network tap versus a SPAN port for security monitoring?

SPAN ports capture more traffic than taps
Taps provide passive, out-of-band full-duplex capture without affecting production traffic (Correct answer)
Taps encrypt captured traffic; SPAN ports do not
Taps require no additional hardware

Correct answer: Taps provide passive, out-of-band full-duplex capture without affecting production traffic

Network taps passively copy all traffic on a link out-of-band without introducing latency or risking dropped packets, unlike SPAN ports which share switch resources.

Question 86: What is the recommended approach when managing conflicting priorities in CISSP?

Address them in alphabetical order
Prioritize based on impact and urgency (Correct answer)
Delegate all decisions upward
Ignore lower-priority items

Correct answer: Prioritize based on impact and urgency

Prioritizing based on impact and urgency ensures the most critical issues receive attention first while maintaining progress on other goals.

Question 87: Which concept describes the systematic process of identifying, preserving, analyzing, and presenting digital evidence in a legally acceptable manner?

Threat intelligence
Risk analysis
Vulnerability assessment
Digital forensics (Correct answer)

Correct answer: Digital forensics

Digital forensics is the scientific discipline of identifying, preserving, analyzing, and presenting digital evidence in ways that are legally defensible.

Question 88: A CISSP candidate evaluates a third-party library with an open-source license. What is the MOST critical security concern for software supply chain integrity?

Whether the library uses object-oriented design
The library's version number
License compatibility with commercial software
Verifying the library's cryptographic hash against the official repository (Correct answer)

Correct answer: Verifying the library's cryptographic hash against the official repository

Verifying cryptographic hashes ensures the downloaded library has not been tampered with during distribution (supply chain attack prevention).

Question 89: What is the main purpose of a privacy impact assessment (PIA)?

To document all data breaches over the past year
To identify and mitigate privacy risks before deploying new systems or processes (Correct answer)
To verify compliance with PCI DSS requirements
To classify all data assets by sensitivity level

Correct answer: To identify and mitigate privacy risks before deploying new systems or processes

A PIA proactively identifies privacy risks in new projects and recommends controls before the system is built or deployed.

Question 90: During a network forensic investigation, an analyst discovers TCP sessions with SYN packets but no corresponding SYN-ACK replies across many source IPs. This MOST likely indicates:

A TCP session hijacking attempt
Normal asymmetric routing
A distributed denial-of-service SYN flood attack (Correct answer)
BGP route flapping

Correct answer: A distributed denial-of-service SYN flood attack

Numerous SYN packets from many sources with no SYN-ACK responses is the classic signature of a SYN flood DDoS attack exhausting the target's connection table.

Question 91: Which memory protection technique randomizes the location of key memory areas (stack, heap, executables) at runtime to impede exploitation?

Data Execution Prevention (DEP)
Address Space Layout Randomization (ASLR) (Correct answer)
Stack canaries
Control Flow Integrity (CFI)

Correct answer: Address Space Layout Randomization (ASLR)

ASLR randomizes the base addresses of memory regions at each execution, making it harder for attackers to predict jump targets for exploits.

Question 92: What security control helps prevent unauthorized data exfiltration from cloud storage buckets?

Multi-factor authentication for the provider console
Bucket policy with least-privilege access and public access block settings (Correct answer)
Network segmentation
Intrusion detection system

Correct answer: Bucket policy with least-privilege access and public access block settings

Restricting bucket policies to least-privilege and enabling public access blocks prevents unintended public exposure of cloud storage objects.

Question 93: What is hypervisor type 1 (bare-metal) most commonly used for in cloud environments?

Running directly on hardware to host multiple guest VMs for cloud workloads (Correct answer)
Running on top of a host OS for desktop virtualization
Encrypting data at the storage layer
Providing browser-based access to virtual desktops

Correct answer: Running directly on hardware to host multiple guest VMs for cloud workloads

Type 1 hypervisors run directly on physical hardware without a host OS, providing the efficient multi-tenant isolation that cloud platforms require.

Question 94: What is the primary purpose of a Web Application Firewall (WAF) in a software security architecture?

Scanning source code for vulnerabilities
Managing user authentication tokens
Encrypting data at rest
Filtering malicious HTTP traffic before it reaches the application (Correct answer)

Correct answer: Filtering malicious HTTP traffic before it reaches the application

A WAF inspects and filters HTTP/HTTPS requests to block common web attacks like SQLi and XSS before they reach the application.

Question 95: The “State Machine Concept” security model stipulates that a system must be secure in all of its states (Startup, Function, and Shutdown) or it will not be secure. This requirement demands responding to security events in order to prevent further compromises. What security aspect is exemplified by this way of response?

Closed Design
Trusted Recovery (Correct answer)
Least Privilege
Open Design

Correct answer: Trusted Recovery

To proactively reduce the chance of an attacker gaining network access and sniffing data, the best strategy involves implementing preventative network security measures. Disabling unused switch ports and implementing MAC filtering prevents unauthorized devices from physically connecting. Additionally, software restriction policies prevent attackers from installing unauthorized sniffing tools. This combination directly addresses the threat at multiple layers, making it highly effective and preventative.

Question 96: A security architect needs to ensure that a cloud-hosted application's API traffic is protected from volumetric DDoS attacks. Which solution is MOST appropriate?

Use a cloud-based DDoS scrubbing service or CDN with DDoS mitigation (Correct answer)
Increase server bandwidth capacity
Deploy an on-premises IPS
Implement IP reputation blacklists on the application server

Correct answer: Use a cloud-based DDoS scrubbing service or CDN with DDoS mitigation

Cloud-based DDoS scrubbing services absorb and filter volumetric attacks upstream, before traffic reaches the application, providing scalable mitigation beyond on-premises capacity.

Question 97: Which metric is most useful for evaluating program effectiveness in CISSP?

Number of staff involved
Number of meetings held
Outcome-based performance indicators (Correct answer)
Amount of money spent

Correct answer: Outcome-based performance indicators

Outcome-based performance indicators directly measure whether the program is achieving its intended results and goals.

Question 98: Which metric is most useful for evaluating program effectiveness in CISSP?

Amount of money spent
Outcome-based performance indicators (Correct answer)
Number of meetings held
Number of staff involved

Correct answer: Outcome-based performance indicators

Outcome-based performance indicators directly measure whether the program is achieving its intended results and goals.

Question 99: You receive a message from Jeff. On his message, the cryptosystem does a hash. After that, Jeff's private key is used to encrypt the digest. This method is most likely to describe:

An asymmetric cryptosystem with public and non-public keys
A messaging system with strong cryptographic solutions and possibly weak hashing algorithms
Jeff’s digital signature that may have used a weak hashing algorithm (Correct answer)
A digital hashing system with strong digests and collision resistant algorithms

Correct answer: Jeff’s digital signature that may have used a weak hashing algorithm

The process described—hashing a message and then encrypting the digest with a private key—is the standard method for creating a digital signature. This signature provides authenticity and integrity. The mention of a 'weak hashing algorithm' highlights a potential vulnerability in the digital signature process, as a weak hash could be susceptible to collision attacks, undermining the integrity of the signature.

Question 100: What is defense in depth in the context of CISSP security?

Relying solely on encryption
Using one strong security control
Implementing multiple layers of security controls (Correct answer)
Focusing only on perimeter security

Correct answer: Implementing multiple layers of security controls

Defense in depth uses multiple layers of security controls so that if one layer fails, additional layers continue to provide protection.

Question 101: An IDS generates an alert for a known attack signature, but investigation reveals no actual attack occurred. This scenario is BEST described as:

False negative
False positive (Correct answer)
True negative
True positive

Correct answer: False positive

A false positive occurs when an IDS alerts on benign activity that matches an attack signature, incorrectly indicating an attack took place.

Question 102: The source contents of a message or file should not be revealed by reversing a hash. In a hashing algorithm, what provides the secrecy?

A private key
One-way math (Correct answer)
A digital signature
A public key

Correct answer: One-way math

Hashing algorithms are designed to be one-way functions, meaning it is computationally infeasible to reverse the process and derive the original input from the hash output. This 'one-way math' property ensures that the source content remains secret, as the hash value cannot be used to reconstruct the original data. This characteristic is fundamental to their use in integrity checks and password storage.

Question 103: Which factor should CISSP professionals consider first when choosing an assessment method?

Cost of the instrument
Ease of scoring
Appropriateness for the target population (Correct answer)
Availability of the tool

Correct answer: Appropriateness for the target population

The most important consideration is whether the assessment method is appropriate and validated for the specific population being assessed.

Question 104: Security measures must be matched with business goals, according to a fundamental security principle. Why is business alignment important when it comes to the influence security has on an organization's success?

Security is too costly to implement in small organizations.
There is always a tradeoff for security, so an organization has to weigh the cost vs. benefits of the security measures. (Correct answer)
Security is so important that every organization must implement as much as possible.
Security is cheap and easily implemented compared to the potential for loss. Security should be implemented everywhere possible.

Correct answer: There is always a tradeoff for security, so an organization has to weigh the cost vs. benefits of the security measures.

Security measures always involve a trade-off between protection, cost, and operational efficiency. Implementing excessive security can be prohibitively expensive and hinder business operations, while insufficient security leaves the organization vulnerable. Business alignment ensures that security investments are proportionate to the risks faced and support the organization's strategic goals and financial health, rather than impeding them.

Question 105: Which approach is recommended for troubleshooting security architecture issues?

Rely solely on past experience
Wait for the problem to resolve itself
Replace all components simultaneously
Use systematic isolation and testing methods (Correct answer)

Correct answer: Use systematic isolation and testing methods

Systematic isolation and testing methodically narrows down the root cause, making troubleshooting efficient and accurate.

Question 106: What is the fundamental principle behind communication and network security in the CISSP domain?

Following a single vendor solution
Using the newest technology exclusively
Balancing performance, reliability, and efficiency (Correct answer)
Cost minimization at all costs

Correct answer: Balancing performance, reliability, and efficiency

Effective technical design requires balancing performance requirements with reliability needs and operational efficiency.

Question 107: Which principle states that users should only have access necessary for their role?

Principle of least privilege (Correct answer)
Separation of duties
Need to share
Defense in depth

Correct answer: Principle of least privilege

The principle of least privilege ensures users only have the minimum access rights needed to perform their job functions, limiting potential damage.

Question 108: Which network architecture principle is BEST demonstrated by placing database servers in a separate VLAN accessible only from the application tier?

Network segmentation (Correct answer)
Least privilege
Zero trust
Defense in depth

Correct answer: Network segmentation

Placing database servers in an isolated VLAN with restricted inter-tier access is a direct application of network segmentation.

Question 109: What is the purpose of canary values placed on the stack by modern compilers?

Encrypt function return addresses
Detect stack buffer overflow before function returns (Correct answer)
Randomize heap memory allocation
Log system call activity for auditing

Correct answer: Detect stack buffer overflow before function returns

Stack canaries are secret values placed before the return address; if overwritten by a buffer overflow they trigger a process termination.

Question 110: What does FedRAMP require for cloud services used by US federal agencies?

PCI DSS Level 1 compliance
HIPAA certification
ISO 27001 certification
Standardized security assessment, authorization, and continuous monitoring (Correct answer)

Correct answer: Standardized security assessment, authorization, and continuous monitoring

FedRAMP establishes a standardized government-wide approach for security assessment, authorization, and continuous monitoring of cloud products.

Question 111: What is defense in depth in the context of CISSP security?

Using one strong security control
Relying solely on encryption
Focusing only on perimeter security
Implementing multiple layers of security controls (Correct answer)

Correct answer: Implementing multiple layers of security controls

Defense in depth uses multiple layers of security controls so that if one layer fails, additional layers continue to provide protection.

Question 112: What does the term 'cloud bursting' refer to?

Automatically scaling workloads from a private cloud to a public cloud during peak demand (Correct answer)
Data leakage from cloud storage
Unauthorized access to multi-tenant cloud environments
A DDoS attack targeting cloud resources

Correct answer: Automatically scaling workloads from a private cloud to a public cloud during peak demand

Cloud bursting allows workloads to overflow from a private cloud to a public cloud when on-premises capacity is exceeded.

Question 113: During eradication of an incident, a responder removes malware from all affected systems. What should immediately follow eradication before returning systems to production?

Closing the incident ticket
Performing recovery and verification (Correct answer)
Notifying the public
Assigning a root cause

Correct answer: Performing recovery and verification

After eradication, recovery involves restoring systems to normal operation and verifying they are clean and functioning correctly before returning them to the production environment.

Question 114: Which principle is fundamental to good software development security practice?

Never refactoring code
Separation of concerns and modularity (Correct answer)
Avoiding all abstraction
Writing as much code as possible

Correct answer: Separation of concerns and modularity

Separation of concerns and modularity make code easier to understand, test, maintain, and extend over time.

Question 115: What is the shared responsibility model in cloud security?

Security responsibilities are divided between the cloud provider and the customer (Correct answer)
The cloud provider is responsible for all security
The customer is responsible for all security
Security is managed by a third-party auditor

Correct answer: Security responsibilities are divided between the cloud provider and the customer

In the shared responsibility model, the cloud provider secures the underlying infrastructure while the customer secures their data and configurations.

Question 116: A security analyst observes that a web application firewall is generating excessive false positives for legitimate API calls. Which tuning approach is BEST?

Increase WAF sensitivity threshold to maximum
Create allowlist rules for known-good API endpoints and tighten base signatures (Correct answer)
Disable WAF signatures for the affected application
Switch WAF to detection-only mode permanently

Correct answer: Create allowlist rules for known-good API endpoints and tighten base signatures

Creating allowlist rules for known-good API patterns while refining base signatures reduces false positives without eliminating protection.

Question 117: In CISSP certification, what does redundancy in system design primarily provide?

Simplified maintenance
Fault tolerance and high availability (Correct answer)
Increased complexity
Lower initial cost

Correct answer: Fault tolerance and high availability

Redundancy provides fault tolerance by ensuring that if one component fails, backup components maintain system availability.

Question 118: An organization discovers that an employee has been accessing files outside their job role for six months. Which preventive control would have been MOST effective?

Principle of least privilege enforcement (Correct answer)
Security awareness training
Intrusion detection system
Data loss prevention (DLP)

Correct answer: Principle of least privilege enforcement

Enforcing least privilege would have restricted the employee's access to only the files required for their job duties.

Question 119: Which secure design principle dictates that a system should deny access by default and only grant access when explicitly permitted?

Separation of privilege
Economy of mechanism
Fail-safe defaults (Correct answer)
Open design

Correct answer: Fail-safe defaults

Fail-safe defaults means access is denied unless explicitly granted, ensuring that errors or omissions result in a secure (locked) state rather than open access.

Question 120: During a forensic investigation, an investigator calculates an MD5 hash of a disk image immediately after acquisition. What is this process called?

Digital signing
Chain of custody logging
Hash validation / integrity verification (Correct answer)
Evidence tagging

Correct answer: Hash validation / integrity verification

Hashing the evidence immediately after acquisition and then verifying the hash before analysis is called integrity verification, confirming the image has not been altered.

Question 121: What is the most effective approach to security and risk management in the CISSP field?

Reactive problem-solving
Following competitors
Maintaining the status quo
Systematic planning and continuous improvement (Correct answer)

Correct answer: Systematic planning and continuous improvement

Systematic planning combined with continuous improvement ensures sustainable success and allows for proactive management of challenges.

Question 122: Which standard specifically addresses security controls for cloud service providers?

ISO 27001
PCI DSS
NIST SP 800-53
ISO 27017 (Correct answer)

Correct answer: ISO 27017

ISO 27017 provides cloud-specific security controls and guidance extending ISO 27001 for cloud environments.

Question 123: Which software assurance concept involves identifying the minimum set of interfaces and entry points exposed by an application to reduce its attack exposure?

Threat modeling
Code signing
Security regression testing
Attack surface reduction (Correct answer)

Correct answer: Attack surface reduction

Attack surface reduction minimizes the number of exposed code paths, APIs, and interfaces that could be exploited by attackers.

Question 124: Configuration management is most likely handled during which phase (s) of the asset lifecycle?

Identify and classify, Secure
Secure, Monitor
Secure (Correct answer)
Monitor, Recover

Correct answer: Secure

Configuration management is the systematic process of managing changes to a system's configuration to maintain its integrity, security, and performance. While it impacts all phases, it is most critically handled during the 'Secure' phase of the asset lifecycle. This is where controls are implemented, maintained, and updated to protect the asset from unauthorized access, use, disclosure, disruption, modification, or destruction, ensuring its ongoing security posture.

Question 125: In a SaaS model, who is responsible for patching the application software?

The cloud customer's IT team
The cloud service provider (Correct answer)
A third-party managed service
The end user

Correct answer: The cloud service provider

In SaaS, the cloud provider manages and patches the application; the customer only manages their data and user access.

Question 126: What is the role of an incident response retainer agreement with a third-party IR firm?

It permanently outsources all security operations
It ensures access to specialized IR expertise on short notice when needed (Correct answer)
It replaces the need for an internal CSIRT
It provides automated malware removal services

Correct answer: It ensures access to specialized IR expertise on short notice when needed

A retainer agreement with an external IR firm provides pre-negotiated access to specialized expertise and resources that can be quickly engaged when the organization needs help responding to a significant incident.

Question 127: What compliance framework is mandatory for organizations that process payment card data?

SOC 2
ISO 27001
NIST CSF
PCI DSS (Correct answer)

Correct answer: PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) is contractually required by card brands for any entity storing, processing, or transmitting cardholder data.

Question 128: During a penetration test, the tester finds an application concatenating user input directly into SQL queries. Which vulnerability class is this?

Path traversal
Buffer overflow
SQL injection (Correct answer)
Cross-site scripting (XSS)

Correct answer: SQL injection

SQL injection occurs when untrusted input is inserted directly into SQL queries, allowing attackers to manipulate database commands.

Question 129: Under the Computer Fraud and Abuse Act (CFAA), what element is typically required to establish unauthorized access?

Evidence of financial gain
Access to a protected computer without authorization or exceeding authorized access (Correct answer)
Use of malware or exploit code
Data exfiltration exceeding $10,000 in value

Correct answer: Access to a protected computer without authorization or exceeding authorized access

The CFAA criminalizes accessing a protected computer without authorization or in a way that exceeds authorized access, regardless of intent.

Question 130: What is the best practice for maintaining security architecture performance over time?

Upgrade all equipment annually
Wait for failures before acting
Implement scheduled preventive maintenance (Correct answer)
Outsource all maintenance

Correct answer: Implement scheduled preventive maintenance

Scheduled preventive maintenance catches potential issues before they cause failures, maintaining reliability and extending equipment life.

Question 131: Which phase of the incident response process involves identifying indicators of compromise and determining the scope of an attack?

Eradication
Recovery
Detection and Analysis (Correct answer)
Containment

Correct answer: Detection and Analysis

Detection and Analysis is the phase where security teams identify indicators of compromise (IoCs), analyze events, and determine the nature and scope of the incident.

Question 132: A company discovers that an attacker exploited a switch to access traffic on a VLAN they should not have access to by sending specially crafted 802.1Q frames. This attack is known as:

STP manipulation
ARP spoofing
MAC flooding
VLAN hopping (double tagging) (Correct answer)

Correct answer: VLAN hopping (double tagging)

VLAN hopping via double tagging embeds two 802.1Q tags so traffic crosses VLAN boundaries when the outer tag is stripped by the first switch.

Question 133: Which term describes an attack technique where an adversary uses legitimate administrative tools (e.g., PowerShell, WMI) to conduct malicious activity, making detection harder?

Zero-day exploit
Living off the land (LotL) (Correct answer)
Watering hole attack
SQL injection

Correct answer: Living off the land (LotL)

Living off the land (LotL) attacks use built-in OS tools and legitimate software to carry out malicious activities, blending in with normal administrative behavior and evading signature-based detection.

Question 134: Which approach best demonstrates mastery of cryptography in CISSP practice?

Applying principles to novel situations with sound judgment (Correct answer)
Relying entirely on technology
Avoiding complex scenarios
Following procedures without understanding

Correct answer: Applying principles to novel situations with sound judgment

True mastery involves understanding underlying principles well enough to apply them to new and unfamiliar situations with professional judgment.

Question 135: Which protocol provides authentication and encryption for remote access but operates at the network layer?

RADIUS
SSL/TLS
SSH
IPsec (Correct answer)

Correct answer: IPsec

IPsec operates at the network layer (Layer 3) and provides authentication and encryption for IP traffic, commonly used in VPNs.

Question 136: A user receives an email that he or she believes came from a coworker. An attacker spoofed the email. What security services would have alerted you to the fact that the mail had been spoofed?

Integrity
Authorization
Privacy
Non-repudiation (Correct answer)

Correct answer: Non-repudiation

Non-repudiation provides undeniable proof of origin and integrity, preventing a sender from falsely denying they sent a message or that its content was altered. If an email were digitally signed, the recipient could verify the sender's identity and the message's integrity, thus detecting the spoofing attempt. Without non-repudiation, an attacker can easily forge the sender's address, as seen in email spoofing.

Question 137: Which practice improves the security of software development security implementations?

Input validation and principle of least privilege (Correct answer)
Using default credentials
Disabling all logging
Granting maximum permissions to all users

Correct answer: Input validation and principle of least privilege

Input validation prevents injection attacks while the principle of least privilege limits the damage potential of any compromised component.

Question 138: Under the OSI model, which layer is responsible for end-to-end error recovery and flow control between communicating hosts?

Transport layer (Layer 4) (Correct answer)
Session layer (Layer 5)
Data Link layer (Layer 2)
Network layer (Layer 3)

Correct answer: Transport layer (Layer 4)

The Transport layer (Layer 4) provides end-to-end error detection, retransmission, and flow control using protocols like TCP.

Question 139: At what point in the BCP development process must Senior Management commit to supporting, funding, and assisting the BCP's creation?

Implementation
Project Initiation (Correct answer)
Development
Planning

Correct answer: Project Initiation

Explanation: <br> Project Initiation is traditionally the phase in which senior management pledges its support for the project. Often in this phase, management provides a project charter, which is a formal written document in which the project is officially authorized, a project manager is selected and named, and management makes a commitment to support. Management’s BCP support must continue through the whole development process and include review and feedback as well as resources for the BCP to be successful.

Question 140: Which type of code review technique has reviewers examine source code without executing it, looking for logic flaws and vulnerabilities?

Dynamic analysis
Penetration testing
Fuzz testing
Static analysis (Correct answer)

Correct answer: Static analysis

Static analysis (or static code review) inspects source or binary code without running it, identifying vulnerabilities through pattern and logic analysis.

Question 141: Which type of evidence is derived from a primary source and may be used to support other evidence in a forensic investigation?

Direct evidence
Hearsay evidence
Corroborative evidence (Correct answer)
Best evidence

Correct answer: Corroborative evidence

Corroborative evidence supports or confirms other evidence in the case; it does not stand alone but strengthens the overall body of evidence.

Question 142: What does a birthday attack imply?

An attack on passwords based on the idea that many users choose weak passwords based on personal information such as birthdays.
A logic bomb that triggers on the date of the attacker’s birthday.
An attack that attempts to find collisions in separate messages. (Correct answer)
An attack that focuses on personnel databases in an attempt to compromise personal information for the purpose of identity theft.

Correct answer: An attack that attempts to find collisions in separate messages.

A birthday attack exploits the mathematics behind the 'birthday paradox,' which states that in a relatively small group, there's a surprisingly high probability of two people sharing the same birthday. In cryptography, this translates to finding two different inputs that produce the same hash output (a collision) much faster than brute-forcing the entire hash space. This weakens the integrity provided by hashing functions.

Question 143: What's the best proactive (and least time-consuming) strategy to reduce the chance of an attacker acquiring network access and sniffing unencrypted data with a protocol analyzer?

Provide security such as disabling ports and mac filtering on the enterprise switches to prevent an unauthorized device from connecting to the network. Implement software restriction policies to prevent unauthorized software from being installed on systems. (Correct answer)
Install anti-spyware software on all systems on the network.
Scan the network periodically to determine if unauthorized devices are connected. If those devices are detected, disconnect them immediately, and provide management a report on the violation.
Implement a policy that forbids the use of packet analyzers/sniffers. Monitor the network frequently.

Correct answer: Provide security such as disabling ports and mac filtering on the enterprise switches to prevent an unauthorized device from connecting to the network. Implement software restriction policies to prevent unauthorized software from being installed on systems.

Explanation: <br> To significantly mitigate risks on the network, we have to implement security that limits connectivity to our network from external devices. Additionally, we are concerned with monitoring software being installed on our hosts, so we want to limit the ability of such software to be installed. Further, we want to ensure that other basic security requirements are satisfied, such as using strong passwords, lockout policies on systems, physical security, etc. <br> Remember: Proactive devices PREVENT an attack, as opposed to responding to it. Network scans often detect these devices, but they rarely prevent them. Policies describe high-level enterprise intentions which can then be implemented. Installing antispyware is a detective/corrective control, not a proactive/preventative one.

Question 144: The possibility of a user's private key becoming lost is a security problem when employing private keys. A practitioner can mitigate this risk by using a key recovery agent that can backup and recover his keys. Because another party has key access, granting a single individual the capacity to recover users' private keys increases the risk of nonrepudiation. Which of the following principles could be used to reduce the risk?

Need to know
Dual control (Correct answer)
Segregation of duties
Principle of least privilege

Correct answer: Dual control

Explanation: <br> Dual Control is a security principle that requires multiple parties to be present for a task that might have severe security implications. In this instance, it is likely best to have at least two network administrators present before a private key can be recovered. A subset of dual control is called M of N control. M and N are variables, but this control requires M out of a total of N administrators to be present to recover a key. Segregation of Duties is the concept of having more than one person required to complete a sensitive task. The principle of least privilege (PoLP) refers to an information security concept in which a user is given the minimum levels of access or permissions needed to perform his job functions. The need-to-know principle is that access to secured data must be necessary for the conduct of the users’ job functions.

Question 145: What is the primary purpose of encryption in CISSP security?

To protect data confidentiality during storage and transmission (Correct answer)
To organize data more efficiently
To make data transfer slower
To compress data

Correct answer: To protect data confidentiality during storage and transmission

Encryption protects data confidentiality by converting information into an unreadable format that can only be decoded with the proper key.

Question 146: A developer uses a third-party open-source component that contains a known critical vulnerability. Which process is MOST effective at systematically identifying this risk across an enterprise?

Code signing all third-party libraries
Software Composition Analysis (SCA) (Correct answer)
Manual code review of all dependencies
Penetration testing the production application

Correct answer: Software Composition Analysis (SCA)

SCA tools automatically inventory open-source dependencies and match them against vulnerability databases like NVD to flag known-vulnerable components.

Question 147: Social engineering attacks can be used to compromise security. Although training can help reduce the amount of attacks, it cannot completely eliminate the risk. Which of the following options is the most likely to assist lessen this risk?

Job Rotation
Segregation of Duties (Correct answer)
Formal Off-boarding Policies
Formal onboarding Policies

Correct answer: Segregation of Duties

Segregation of Duties (SoD) is a control that prevents a single individual from having complete control over a critical process or transaction. By requiring multiple people to complete different parts of a task, it significantly reduces the risk of fraud, error, or a successful social engineering attack. Even if one person is tricked, they cannot complete the malicious action alone, thus lessening the overall risk.

Question 148: In CISSP practice, what is the purpose of vulnerability scanning?

To identify weaknesses before attackers do (Correct answer)
To exploit systems
To replace firewalls
To slow down network traffic

Correct answer: To identify weaknesses before attackers do

Vulnerability scanning proactively identifies security weaknesses in systems and applications so they can be remediated before exploitation.

Question 149: Which US federal law established privacy rights and restrictions on the collection of personal data by federal agencies?

HIPAA
The Privacy Act of 1974 (Correct answer)
FERPA
GLBA

Correct answer: The Privacy Act of 1974

The Privacy Act of 1974 governs how US federal agencies collect, maintain, use, and disseminate personally identifiable information.

Question 150: Which authentication factor is classified as "something you are"?

Smart card
Security token
Password
Biometric data (Correct answer)

Correct answer: Biometric data

Biometric data such as fingerprints, facial recognition, or retinal scans represents the "something you are" authentication factor.

Question 151: What is the purpose of a non-disclosure agreement (NDA) in information security?

To establish data retention requirements for employees
To transfer liability for data breaches to a third party
To authorize penetration testing activities
To legally bind parties to keep sensitive information confidential and restrict its disclosure (Correct answer)

Correct answer: To legally bind parties to keep sensitive information confidential and restrict its disclosure

An NDA creates a legal obligation of confidentiality, protecting trade secrets and sensitive data shared between parties in a business relationship.

Question 152: What is the best practice for maintaining communication and network security performance over time?

Upgrade all equipment annually
Outsource all maintenance
Implement scheduled preventive maintenance (Correct answer)
Wait for failures before acting

Correct answer: Implement scheduled preventive maintenance

Scheduled preventive maintenance catches potential issues before they cause failures, maintaining reliability and extending equipment life.

CISSP Exam

The CISSP (Certified Information Systems Security Professional) Exam is a CAT-format exam covering eight domains of the ISC² CISSP CBK including security and risk management, asset security, security architecture, network security, IAM, security assessment, and security operations.

150

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

isc2.org — Test delivery, eligibility, passing score, test dates, score validity, retake policy, score release, renewal, time limit, fees · verified Oct 2026