CISSP CISSP 2

Question 1

Which access control model uses security labels and clearance levels to enforce mandatory access controls?

Accepted Answer

Bell-LaPadula Model

Answer

Bell-LaPadula enforces confidentiality using classification labels and clearances, with 'no read up, no write down' rules.

Question 2

A security engineer needs to ensure that a cryptographic key is never stored in plaintext anywhere. Which technique best addresses this requirement?

Accepted Answer

Key wrapping

Answer

Key wrapping encrypts a cryptographic key with another key so the plaintext key is never exposed in storage.

Question 3

During a penetration test, the tester finds an application concatenating user input directly into SQL queries. Which vulnerability class is this?

Accepted Answer

SQL injection

Answer

SQL injection occurs when untrusted input is inserted directly into SQL queries, allowing attackers to manipulate database commands.

Question 4

What is the PRIMARY goal of a Business Impact Analysis (BIA)?

Accepted Answer

Determine recovery time objectives for critical processes

Answer

A BIA identifies critical business functions and determines RTOs, RPOs, and financial impacts of disruptions.

Question 5

Which protocol provides authentication and encryption for remote access but operates at the network layer?

Accepted Answer

IPsec

Answer

IPsec operates at the network layer (Layer 3) and provides authentication and encryption for IP traffic, commonly used in VPNs.

CISSP - Certified Information Systems Security Professional Practice Test