CISSP CISSP 3 — Questions and Answers
Question 1: Which disaster recovery strategy involves maintaining a fully equipped and operational duplicate facility?
- Cold site
- Warm site
- Hot site (Correct answer)
- Mobile site
Correct answer: Hot site
A hot site is a fully operational duplicate data center that can take over immediately with near-zero recovery time.
Question 2: What does the 'separation of duties' control primarily prevent?
- Unauthorized physical access to data centers
- Single individuals from completing high-risk transactions alone (Correct answer)
- Employees from accessing data after hours
- Insider threats from using encrypted communications
Correct answer: Single individuals from completing high-risk transactions alone
Separation of duties divides critical tasks among multiple people to prevent any single individual from committing fraud or error undetected.
Question 3: A developer implements input validation only on the client side. What is the MAIN security risk?
- Performance degradation on the server
- Attackers can bypass client-side controls and send malicious input directly (Correct answer)
- Users experience poor interface responsiveness
- The application becomes non-compliant with WCAG standards
Correct answer: Attackers can bypass client-side controls and send malicious input directly
Client-side validation can be bypassed by intercepting and modifying requests, so server-side validation is essential for security.
Question 4: Which of the following BEST describes a 'rainbow table' attack?
- Trying every possible password combination
- Using precomputed hash values to reverse password hashes (Correct answer)
- Injecting malicious scripts into web applications
- Intercepting authentication tokens in transit
Correct answer: Using precomputed hash values to reverse password hashes
A rainbow table attack uses precomputed tables of hash values to quickly look up the plaintext corresponding to a stolen password hash.
Question 5: Under GDPR, what is the maximum timeframe to notify supervisory authorities of a personal data breach?
- 24 hours
- 48 hours
- 72 hours (Correct answer)
- 7 days
Correct answer: 72 hours
GDPR Article 33 requires controllers to notify the supervisory authority within 72 hours of becoming aware of a personal data breach.
Question 6: Which security architecture framework divides networks into security zones based on trust levels?
- TOGAF
- Zachman Framework
- Defense in depth with DMZ segmentation (Correct answer)
- COBIT
Correct answer: Defense in depth with DMZ segmentation
Defense in depth with DMZ segmentation places untrusted, semi-trusted, and trusted networks in separate zones with controls between each layer.
Question 7: What is 'salting' in the context of password storage?
- Encrypting passwords with AES-256 before storage
- Adding a unique random value to each password before hashing (Correct answer)
- Hashing passwords multiple times to increase complexity
- Storing passwords in a hardware security module
Correct answer: Adding a unique random value to each password before hashing
Salting adds a unique random value to each password before hashing, preventing rainbow table attacks and ensuring identical passwords produce different hashes.
CISSP CISSP 3
Which disaster recovery strategy involves maintaining a fully equipped and operational duplicate facility?