CISSP CISSP 5 — Questions and Answers
Question 1: Which security testing methodology involves testers having no prior knowledge of the target environment?
- White-box testing
- Gray-box testing
- Black-box testing (Correct answer)
- Crystal-box testing
Correct answer: Black-box testing
Black-box testing simulates an external attacker with no internal knowledge, testing only what is publicly visible or accessible.
Question 2: What is the PRIMARY security concern with using shared credentials among multiple administrators?
- Increased password complexity requirements
- Inability to attribute actions to specific individuals for accountability (Correct answer)
- Higher risk of brute force attacks
- Violation of data classification policies
Correct answer: Inability to attribute actions to specific individuals for accountability
Shared credentials eliminate individual accountability, making it impossible to audit which specific person performed administrative actions.
Question 3: Which of the following BEST describes 'data sovereignty'?
- The right of individuals to access their personal data
- The principle that data is subject to the laws of the country where it is stored (Correct answer)
- An organization's right to encrypt its own data
- The process of classifying data by sensitivity level
Correct answer: The principle that data is subject to the laws of the country where it is stored
Data sovereignty means that data stored in a particular country is subject to that nation's laws and regulations, which impacts cloud storage decisions.
Question 4: A security team uses honeypots on their network. What is the PRIMARY purpose?
- Blocking known malicious IP addresses
- Detecting and studying attacker behavior without exposing real assets (Correct answer)
- Encrypting sensitive data in transit
- Authenticating remote users securely
Correct answer: Detecting and studying attacker behavior without exposing real assets
Honeypots are decoy systems designed to lure attackers, detect intrusion attempts, and gather threat intelligence without exposing production assets.
Question 5: Under the CISSP CBK, which domain covers the secure design principles including fail-safe defaults and economy of mechanism?
- Security and Risk Management
- Security Architecture and Engineering (Correct answer)
- Identity and Access Management
- Software Development Security
Correct answer: Security Architecture and Engineering
Security Architecture and Engineering covers secure design principles such as fail-safe defaults, least privilege, economy of mechanism, and open design.
Question 6: What does 'cross-site request forgery (CSRF)' exploit?
- Weak password hashing algorithms on the server
- The trust a web application has in an authenticated user's browser (Correct answer)
- SQL injection vulnerabilities in database queries
- Unencrypted session tokens in local storage
Correct answer: The trust a web application has in an authenticated user's browser
CSRF tricks an authenticated user's browser into sending unauthorized requests to a web application that trusts that browser's session.
Question 7: Which backup strategy copies only data that has changed since the LAST FULL backup, regardless of subsequent incremental backups?
- Incremental backup
- Differential backup (Correct answer)
- Full backup
- Snapshot backup
Correct answer: Differential backup
A differential backup captures all changes since the last full backup, making restoration faster than incremental backups (only full + latest differential needed).
CISSP CISSP 5
Which security testing methodology involves testers having no prior knowledge of the target environment?