CISSP CISSP 4 — Questions and Answers
Question 1: Which type of malware disguises itself as legitimate software but performs malicious actions when executed?
- Worm
- Rootkit
- Trojan horse (Correct answer)
- Logic bomb
Correct answer: Trojan horse
A Trojan horse masquerades as benign or useful software while secretly performing malicious functions when executed by the user.
Question 2: In the context of risk management, what does 'residual risk' mean?
- The risk that exists before any controls are applied
- The risk that remains after controls have been implemented (Correct answer)
- The maximum possible loss from a threat event
- The probability of a threat agent exploiting a vulnerability
Correct answer: The risk that remains after controls have been implemented
Residual risk is the remaining risk exposure after security controls have been applied to mitigate the inherent risk.
Question 3: An attacker sends a fraudulent email appearing to come from the CEO requesting an urgent wire transfer. This is BEST classified as:
- Vishing
- Whaling (Correct answer)
- Smishing
- Pharming
Correct answer: Whaling
Whaling is a phishing attack that specifically targets high-profile individuals like executives, often impersonating them for financial fraud.
Question 4: Which network security device operates at Layer 7 and can inspect application-layer content for threats?
- Packet-filtering firewall
- Stateful inspection firewall
- Next-generation firewall (NGFW) (Correct answer)
- Network switch
Correct answer: Next-generation firewall (NGFW)
Next-generation firewalls operate at Layer 7 (application layer) and can perform deep packet inspection, application identification, and intrusion prevention.
Question 5: What is the purpose of a 'chain of custody' in digital forensics?
- Encrypting evidence to prevent tampering during analysis
- Documenting the handling and transfer of evidence to maintain its integrity (Correct answer)
- Ensuring investigators have the proper clearances to view evidence
- Establishing legal authority to collect digital evidence
Correct answer: Documenting the handling and transfer of evidence to maintain its integrity
Chain of custody documents every person who handled evidence and all actions taken, proving the evidence has not been tampered with.
Question 6: Which cryptographic property ensures that a sender cannot later deny having sent a message?
- Confidentiality
- Integrity
- Non-repudiation (Correct answer)
- Availability
Correct answer: Non-repudiation
Non-repudiation, typically achieved through digital signatures, prevents a party from denying the authenticity of their actions or communications.
Question 7: An organization wants to test its incident response procedures without disrupting production systems. Which exercise type is MOST appropriate?
- Full interruption test
- Tabletop exercise (Correct answer)
- Parallel test
- Checklist review
Correct answer: Tabletop exercise
A tabletop exercise walks participants through a simulated scenario verbally without activating actual systems or recovery procedures.
CISSP CISSP 4
Which type of malware disguises itself as legitimate software but performs malicious actions when executed?