Practice questions · Cybersecurity
CISSP (ISC2): Practice Questions
Original concept-check questions on core CISSP ideas across the eight domains. Choose an answer to reveal the explanation, including why the other options are wrong. Aim to reason like a risk-focused manager. These are concept checks, not real exam questions.
Answered 0 · Correct 0
-
Giving a user only the access strictly required to do their job is the principle of:
Correct answer: C. Least privilege limits access to the minimum necessary, reducing the impact of misuse or compromise. -
Ensuring data has not been altered in an unauthorised way protects which part of the CIA triad?
Correct answer: C. Integrity is about preventing unauthorised modification so information stays accurate and trustworthy. -
The Bell-LaPadula model is primarily designed to protect:
Correct answer: B. Bell-LaPadula focuses on confidentiality, with rules such as 'no read up' and 'no write down'. -
Buying insurance to handle the financial impact of a risk is an example of risk:
Correct answer: C. Transferring risk shifts its impact to a third party, for example through insurance or outsourcing. -
'Defense in depth' means:
Correct answer: B. Defense in depth uses multiple, overlapping layers of control so that one failure does not compromise everything. -
Risk is most commonly assessed as a function of:
Correct answer: C. Risk is typically the likelihood of a threat exploiting a vulnerability multiplied by the impact if it does. -
Multi-factor authentication (MFA) requires:
Correct answer: C. MFA combines factors of different types - knowledge, possession, inherence - so a single stolen factor is not enough. -
Which statement describes hashing rather than encryption?
Correct answer: B. Hashing is one-way and verifies integrity (and stores passwords with a salt). Encryption is reversible and protects confidentiality. -
An access control model where the system enforces access using security labels and clearances is:
Correct answer: D. MAC enforces access centrally using classifications and clearances, rather than leaving it to resource owners as DAC does. -
The Recovery Time Objective (RTO) defines:
Correct answer: B. RTO is the target time to recover a function. RPO addresses acceptable data loss; MTD is the absolute maximum tolerable downtime. -
The main purpose of separation of duties is to:
Correct answer: C. Separation of duties splits sensitive tasks so that collusion would be required to commit and hide wrongdoing. -
'Residual risk' is best described as:
Correct answer: C. Residual risk is what remains after controls reduce inherent risk; management then decides whether to accept it. -
Labeling data as Public, Internal, Confidential and Restricted is an example of:
Correct answer: D. Classification assigns sensitivity levels so the right controls apply. Encryption, tokenization and hashing protect data but do not categorize it. -
To ensure data on a decommissioned drive cannot be recovered, you should:
Correct answer: C. Secure wiping or destruction addresses data remanence. Deleting, renaming or recycling leave data recoverable. -
Symmetric encryption is generally preferred over asymmetric encryption for:
Correct answer: C. Symmetric is fast, so it suits bulk data. Asymmetric is used for key exchange, signatures and non-repudiation, where its properties matter despite being slower. -
A hardware component that securely stores cryptographic keys on a device is a:
Correct answer: B. A TPM stores keys in tamper-resistant hardware. A VPN encrypts a tunnel, a DMZ is a network zone, and an IDS detects intrusions. -
Which protocol encrypts web traffic in transit?
Correct answer: A. TLS encrypts data in transit (HTTPS). FTP, Telnet and SNMPv1 transmit in clear text. -
A stateful firewall differs from a stateless one because it:
Correct answer: A. A stateful firewall tracks connection state to make context-aware decisions. Stateless filtering only matches individual packets; encryption and addressing are other functions. -
Dividing a network into zones so a breach in one cannot easily reach others is:
Correct answer: D. Segmentation limits lateral movement. Hashing and tokenization protect data; federation shares identity. -
SAML is most commonly used to enable:
Correct answer: A. SAML exchanges authentication assertions between an identity provider and service provider to enable federated single sign-on across domains. Disk encryption, data classification and packet filtering are unrelated functions handled by other technologies. -
Promptly removing access when an employee leaves is part of:
Correct answer: D. Timely deprovisioning is part of the identity lifecycle and prevents orphaned accounts. The other areas are unrelated to account offboarding. -
A penetration test differs from a vulnerability scan because it:
Correct answer: A. A pen test exploits weaknesses to demonstrate impact; a scan only identifies and rates them. It does not encrypt or patch. -
Analyzing source code for flaws without running the application is:
Correct answer: D. SAST inspects code at rest. DAST tests a running application; load testing measures performance; social engineering targets people. -
Regularly reviewing audit logs primarily supports:
Correct answer: C. Log review surfaces anomalies and supports investigations. It does not improve speed, storage cost or encryption. -
The generally accepted order of incident response is:
Correct answer: A. The generally accepted order is preparation, detection, containment, eradication, recovery, then lessons learned. The other sequences misplace these steps, for example starting with eradication or recovery before detection, or putting lessons learned before containment. -
A '3-2-1' backup strategy means:
Correct answer: A. A 3-2-1 strategy means three copies of data, on two different media types, with one copy offsite. 'One backup taken weekly', 'three servers in one room' and 'two-factor authentication for backups' all misstate what 3-2-1 refers to. -
Configuring a system to run only the services it actually needs is the principle of:
Correct answer: D. Running only the services a system actually needs is the principle of least functionality, which shrinks the attack surface. Least privilege governs user access rights; separation of duties and defense in depth are different principles entirely. -
Validating and sanitizing user input primarily prevents:
Correct answer: C. Input validation stops untrusted input from being executed (injection/XSS). It does not address hardware or performance issues. -
Building security into every phase of development rather than adding it at the end describes a:
Correct answer: C. A secure SDLC integrates security throughout development. A firewall rule and pen test are point activities; waterfall is a methodology, not a security approach. -
Due diligence differs from due care in that due diligence is:
Correct answer: D. Due diligence is the ongoing effort to identify risks and verify that controls work, whereas due care is acting reasonably on what diligence reveals. Buying insurance, an access-control model and a type of encryption are unrelated to this distinction. -
A company calculates that a single flood would cause $200,000 in damage and that such a flood is expected once every 20 years. What is the annualized loss expectancy (ALE)?
Correct answer: A. ALE = SLE x ARO. The single loss expectancy is $200,000 and the annualized rate of occurrence is 1/20 = 0.05, so ALE = $200,000 x 0.05 = $10,000. '$200,000' is the SLE, not the annualized figure. '$20,000' would result from an ARO of 0.1 (once per 10 years). '$4,000' does not match any correct combination of these values. -
Which document tells employees what they must do, in mandatory language, and is the highest-level statement of management intent?
Correct answer: B. A policy is the high-level, mandatory statement of management's intent and direction. A standard specifies mandatory technical or operational choices that support a policy, so it is more specific and subordinate. A guideline is discretionary advice, not mandatory. A procedure is a detailed step-by-step instruction, the most granular document, not the top-level statement. -
A security manager decides not to operate a new service line at all because the risk is unacceptable and cannot be reduced affordably. This response is risk:
Correct answer: C. Risk avoidance means stopping or not undertaking the activity that creates the risk, which is exactly what abandoning the service line does. Mitigation would reduce the risk while still doing the activity. Acceptance would mean proceeding and absorbing the risk. Transfer would shift the financial impact to a third party such as an insurer, but the activity would still occur. -
Under most modern data protection laws, the party that determines the purposes and means of processing personal data is the:
Correct answer: D. The data controller decides why and how personal data is processed and carries primary legal accountability. A data processor only acts on the controller's instructions, so it does not set the purposes. A data custodian is an operational role for day-to-day protection, not a legal determiner of purpose. The data subject is the individual the data is about, not the party deciding how it is used. -
When a security manager faces a scenario question, ISC2 generally expects the first action to be the one that is:
Correct answer: A. CISSP rewards the 'manager mindset': the best first action addresses risk and follows governance and policy rather than jumping to a technical patch. The fastest technical fix often skips root cause and process, so it is not the expected first move. The cheapest option ignores whether risk is actually addressed. Deferring to a vendor abdicates the manager's own risk judgement. -
Quantitative risk analysis differs from qualitative analysis primarily because quantitative analysis:
Correct answer: B. Quantitative analysis assigns numeric, usually monetary, values to assets, losses and likelihood (for example ALE, SLE, ARO). Descriptive ratings such as high, medium and low are the hallmark of qualitative analysis, not quantitative. Quantitative analysis is usually slower, not faster, because it needs reliable figures. It also relies heavily on data rather than avoiding it. -
A clause in a contract stating that neither party will disclose the other's confidential information is most precisely a(n):
Correct answer: C. A non-disclosure agreement specifically binds parties to protect each other's confidential information. An SLA defines service levels and availability targets, not confidentiality obligations. An MOU records a general, often non-binding, understanding between parties rather than a confidentiality commitment. An AUP governs how internal users may use organizational systems, not mutual confidentiality between contracting parties. -
The main reason to enforce mandatory vacations for staff in sensitive financial roles is to:
Correct answer: D. Mandatory vacation forces someone else to perform the absent person's duties, which can expose fraud that depends on the original person's continuous control. Morale may improve but that is not the security rationale. Vacations do not reduce payroll costs. While labour law may require rest, the security control's purpose is fraud detection, not legal compliance with rest periods. -
An organization adopts a recognized control framework so it can structure and benchmark its security program. Which of the following is such a framework?
Correct answer: A. The NIST Cybersecurity Framework is a recognized framework for organizing and benchmarking security activities (identify, protect, detect, respond, recover). TCP/IP is a networking protocol suite, not a governance framework. RAID is a disk redundancy technology. LDAP is a directory access protocol. None of the last three structure a security program. -
A threat is best defined as:
Correct answer: B. A threat is any potential event or actor with the capacity to cause harm to an asset. A weakness that could be exploited is a vulnerability, not a threat. The actual damage after an incident is impact or loss, which occurs after a threat materializes. A control that reduces risk is a safeguard, the opposite of a threat. -
Why is senior management 'buy-in' considered essential to an information security program?
Correct answer: C. Senior management sets the tone at the top and supplies the authority and budget without which security efforts stall. Buy-in cannot guarantee zero breaches, which is unrealistic. It does not remove the need for policies; rather it endorses them. It also does not transfer liability to the security team; ultimate accountability stays with management. -
An organization is legally required to keep tax records for seven years. The document that defines how long different records are kept and when they are destroyed is the:
Correct answer: D. A data retention policy specifies how long each category of data is kept and when it is securely destroyed, which directly governs the seven-year tax requirement. An incident response plan covers handling security incidents, not retention schedules. A disaster recovery plan covers restoring IT after disruption. An acceptable use policy governs how users may use systems, not record retention. -
The (ISC)2 Code of Ethics canons are listed in a deliberate order. When two canons appear to conflict, a CISSP should resolve it by:
Correct answer: A. The canons are intentionally ordered, and earlier canons (such as protecting society) take precedence over later ones when they conflict. Choosing the most convenient canon ignores this ordering. Discarding the code for personal judgement abandons the professional obligation entirely. Letting a client choose the canon improperly shifts an ethical duty that rests with the professional. -
A vulnerability is most accurately described as:
Correct answer: B. A vulnerability is a weakness in a system, process or control that a threat could exploit. An actor who wants to cause harm is a threat agent, not a vulnerability. Likelihood multiplied by impact expresses risk, not a weakness. A safeguard that reduces exposure is a control, which counters vulnerabilities rather than being one. -
Security awareness training is most effective when its main goal is to:
Correct answer: C. Awareness training aims to change daily behaviour and foster a security-conscious culture, reducing human-factor risk. It supplements, not replaces, technical controls, which remain necessary. Treating it as a box-ticking sign-in sheet defeats the purpose of genuine behaviour change. Teaching all staff to write secure code is unrealistic and not the goal of general awareness training. -
A company keeps operating its legacy system and budgets for the expected losses because fixing it would cost more than the risk. This is a documented case of risk:
Correct answer: D. Risk acceptance means a knowing, documented decision to bear a risk because treating it is not justified, exactly as described. Avoidance would mean discontinuing the legacy system. Transfer would shift the loss to a third party such as an insurer. Mitigation would invest in controls to reduce the risk, which the company has decided not to do. -
Intellectual property that is protected only as long as it is kept secret, such as a recipe or algorithm, is a:
Correct answer: A. A trade secret is protected by keeping the information confidential and loses protection if disclosed, which fits a secret recipe or algorithm. A patent requires public disclosure of the invention in exchange for time-limited exclusivity, the opposite of secrecy. A trademark protects brand identifiers such as names and logos. Copyright protects original creative works, not undisclosed processes. -
In a quantitative risk analysis, the single loss expectancy (SLE) is calculated as:
Correct answer: B. SLE = asset value x exposure factor, where the exposure factor is the percentage of the asset lost in one event. SLE multiplied by the annualized rate of occurrence gives the ALE, not the SLE itself. Likelihood multiplied by impact rating is a qualitative expression of risk, not the SLE formula. Asset value multiplied by the number of assets is not a recognized risk formula. -
Why does CISSP guidance treat people as 'the weakest link' in security?
Correct answer: C. People can be socially engineered, make mistakes and intentionally or accidentally circumvent controls, which is why they are often the weakest link. The claim that hardware never fails is false, but it is also not why people are the weak link. Software is frequently insecure, so that statement is wrong. Networks certainly can be attacked, so that option is also incorrect. -
Who is ultimately accountable for deciding how a particular set of corporate data is classified and protected?
Correct answer: D. The data owner, typically a senior business manager, is accountable for classifying the data and defining how it must be protected. The data custodian implements and maintains those protections day to day but does not set them. The end user simply works with the data under the rules others define. The system administrator is usually a custodian-type role carrying out technical tasks, not the accountable owner. -
Protecting cardholder data while it is being processed in a server's memory is an example of protecting data:
Correct answer: A. Data in use is data actively being processed in memory or by an application, which is exactly the case described. Data at rest is stored data on disk or other media, not data being processed. Data in transit is data moving across a network. 'In archive' is simply a form of data at rest in long-term storage, not data being actively processed. -
The risk that deleted or overwritten data can still be recovered from storage media is known as data:
Correct answer: B. Data remanence is residual data that persists after deletion or formatting and can sometimes be recovered, which is the described risk. Classification is labelling data by sensitivity, unrelated to recovery of deleted data. Data sovereignty concerns which country's laws govern stored data. Data masking obscures data values for use in non-production environments, not the persistence of deleted data. -
An organization must keep customer data on servers physically located within its own country to satisfy local law. This requirement reflects data:
Correct answer: C. Data sovereignty means data is subject to the laws of the country where it is stored, driving requirements to keep it within national borders. Data remanence concerns residual data after deletion, not storage location. Tokenization replaces sensitive values with tokens and does not dictate geography. Deduplication removes redundant copies to save space and is unrelated to legal jurisdiction. -
Replacing the digits of a credit card number with a surrogate value that has no exploitable meaning, while keeping the format, is:
Correct answer: D. Tokenization substitutes sensitive data with a format-preserving token that has no mathematical relationship to the original, reducing exposure. Hashing produces a fixed-length, irreversible digest and does not preserve the original format for reuse. Encryption transforms data reversibly with a key and changes its form. Classification only labels data by sensitivity; it does not substitute the values. -
Under a typical four-tier scheme (Public, Internal, Confidential, Restricted), customer payment details would most appropriately be labelled:
Correct answer: A. Payment details are highly sensitive and warrant the strongest controls, so 'Restricted' (the highest tier here) is the appropriate label. 'Public' is for information meant for open release and would underprotect payment data. 'Internal' is for low-sensitivity internal use, still too weak for payment data. 'Unclassified' is not part of the stated four-tier scheme and would leave the data unmanaged. -
The main security benefit of a clearly defined data retention schedule is that it:
Correct answer: B. Retaining data only as long as needed shrinks the pool that could be breached, mishandled, or compelled in legal discovery. A retention schedule reduces stored data over time rather than increasing it. It does not remove the need for backups, which protect available data. It also does not guarantee data is never deleted; on the contrary, it mandates timely destruction. -
Disguising portions of a value, such as showing a card as **** **** **** 1234 on a receipt, is best described as data:
Correct answer: C. Data masking hides part or all of a value from view while keeping it usable for its purpose, exactly as on the receipt. Encryption transforms the entire value reversibly with a key, not partial visual hiding for display. Classification labels sensitivity and does not alter how a value is shown. Remanence is residual recoverable data, unrelated to masking displayed output. -
Degaussing is an appropriate sanitization method for:
Correct answer: D. Degaussing uses a strong magnetic field to erase data on magnetic media such as HDDs and tapes. SSDs store data in flash cells, not magnetically, so degaussing does not reliably erase them. Optical discs store data optically and are unaffected by magnetic fields. Paper is not magnetic and must be shredded or incinerated, not degaussed. -
Assigning each major information asset a business owner who is responsible for its protection mainly supports:
Correct answer: A. Naming an owner for each asset establishes who is accountable for its classification and protection, closing accountability gaps. Asset ownership does not affect network speed. It does not reduce licensing costs, which is a procurement matter. It also does not change the strength of encryption algorithms, which is a separate technical decision. -
A data custodian's responsibilities most accurately include:
Correct answer: B. The custodian operationally implements and maintains the protections (backups, access enforcement, patching) that the owner has specified. Setting the classification level is the owner's decision, not the custodian's. Deciding the business purpose of the data is a business-owner responsibility. Approving who may access the data is an ownership and authorization decision, again belonging to the owner. -
When media is reused within the same security boundary but for a different purpose, the recommended action is to:
Correct answer: C. Clearing overwrites existing data so it is not easily recovered and is appropriate when media is reused within the same boundary. Physical destruction is excessive when the media will be reused internally. Taking no action risks exposing the prior data to the new user or purpose. Encrypting only new data leaves the old data intact and potentially recoverable. -
The primary purpose of classifying information is to:
Correct answer: D. Classification ensures controls are proportional to how sensitive and valuable the data is, avoiding both under- and over-protection. It is not aimed at making data easier to delete, which is a retention concern. It does not reduce the number of data owners; ownership is assigned separately. It also has no bearing on database query performance. -
The Biba security model is designed primarily to protect:
Correct answer: A. Biba enforces integrity with rules of 'no write up' and 'no read down', preventing low-integrity data from corrupting higher-integrity data. Confidentiality is the focus of Bell-LaPadula, not Biba. Availability is not what Biba's rules address. Non-repudiation is provided by mechanisms like digital signatures, not by the Biba model. -
A digital signature provides integrity and non-repudiation by:
Correct answer: B. A digital signature is created by hashing the message and encrypting that hash with the sender's private key, which only the sender holds, giving integrity and non-repudiation. Encrypting the whole message with the recipient's public key provides confidentiality, not a signature. A single shared secret key is symmetric encryption and cannot prove which party signed. Compression affects size, not authenticity or integrity. -
In public key cryptography, to send a message that only the intended recipient can read, the sender encrypts it with the recipient's:
Correct answer: C. Encrypting with the recipient's public key means only the matching private key, held solely by the recipient, can decrypt it, ensuring confidentiality. Using the recipient's private key is impossible for the sender, who does not have it, and would not protect confidentiality. A shared symmetric key would first have to be exchanged securely and is not what the scenario specifies. A password hash is not an encryption key at all. -
The component in a trusted system that mediates all access between subjects and objects, and must be tamperproof, is the:
Correct answer: D. The reference monitor is the abstract concept that mediates every access between subjects and objects and must be tamperproof, always invoked, and verifiable. A trusted platform module is a hardware chip for key storage, not the access-mediation concept. A security kernel patch is just a code update, not the mediating component. A hypervisor manages virtual machines and is not the reference monitor concept. -
Two users who have never met need to agree on a shared secret over an insecure channel. The classic protocol designed for this is:
Correct answer: A. Diffie-Hellman lets two parties derive a shared secret over an insecure channel without transmitting the secret itself. AES is a symmetric cipher that uses a key but does not establish one between strangers. SHA-256 is a hashing algorithm and cannot perform key agreement. Base64 is an encoding scheme, not encryption or key exchange, and provides no security at all. -
A certificate authority's main role in a public key infrastructure (PKI) is to:
Correct answer: B. A certificate authority issues digital certificates that vouch for the link between an identity and its public key, creating trust in PKI. It does not encrypt all user data; that is done by the parties using the keys. It should not store users' private keys, which must remain private to the owner. Generating passwords is unrelated to a CA's function. -
The principle that a system should default to denying access unless access is explicitly granted is called:
Correct answer: C. Fail secure, or default deny, means access is refused unless explicitly permitted, which limits exposure when rules are unclear or a component fails. Fail open does the opposite, granting access on failure, which is riskier. Security through obscurity relies on hiding details rather than denying by default and is not a sound principle. 'Open by design' contradicts the secure default and is not a recognized security principle. -
A salted hash improves password storage over a plain hash primarily because the salt:
Correct answer: D. A unique salt makes identical passwords hash to different values and renders precomputed rainbow tables ineffective. Salting does not make a hash reversible; hashing remains one-way. It does not encrypt the password with a key, which is a different operation. It does not compress the stored value; if anything it adds data. -
Keeping a security design simple and minimizing complexity is valuable mainly because:
Correct answer: A. Simplicity (economy of mechanism) shrinks the attack surface and makes a design easier to review and verify for flaws. Complex systems are not inherently cheaper; they often cost more to build and maintain. Complexity does not guarantee better security and frequently hides defects. Simplicity reduces but does not remove the need for testing, which is still essential. -
A mantrap (access control vestibule) at a data centre entrance is designed primarily to prevent:
Correct answer: B. A mantrap allows one person through at a time, stopping tailgating where someone slips in behind an authorized entrant. It has nothing to do with power surges, which are addressed by electrical protection. It does not affect network sniffing, a logical network threat. It does not prevent malware, which is a software-level concern. -
An organization wants to ensure a message's sender cannot later deny sending it. Which property is required?
Correct answer: C. Non-repudiation provides proof of origin so a sender cannot credibly deny an action, typically via digital signatures. Availability ensures systems are reachable and does not address denial of authorship. Redundancy provides backup capacity for reliability, unrelated to proving who sent a message. Scalability concerns handling growth in load, not accountability for actions. -
Why is AES generally preferred over DES for new systems?
Correct answer: D. DES's 56-bit effective key length is too small for modern computing power and can be brute-forced, so AES with longer keys replaced it. AES does not use a shorter key; it uses longer, stronger keys. AES is a symmetric algorithm, not asymmetric. Neither DES nor AES provides non-repudiation on its own, so that claim is false. -
The security weakness of relying on 'security through obscurity' is that:
Correct answer: A. Security through obscurity depends on secrecy of design or implementation, so once those details leak, the protection fails. It does not involve too many layers; if anything it lacks real layered controls. It is unrelated to encrypting data too strongly. It does not require multifactor authentication, which is a separate, legitimate control. -
A fire suppression system that removes heat or oxygen rather than using water is preferred in a server room because:
Correct answer: B. Gas-based or clean-agent suppression protects sensitive electronics by avoiding the water damage that sprinklers would cause. Cost is not the rationale, and water systems are often cheaper, not the reason to avoid them. Adding humidity would harm equipment, so that is not a benefit. Such systems are not legally required for all office spaces; they are chosen specifically for equipment protection. -
The Clark-Wilson integrity model enforces integrity mainly through:
Correct answer: C. Clark-Wilson maintains integrity by requiring changes to occur through well-formed, controlled transactions and by enforcing separation of duties. 'No read up, no write down' describes Bell-LaPadula's confidentiality rules, not Clark-Wilson. Encrypting data at rest protects confidentiality, not the transactional integrity Clark-Wilson targets. Mandatory clearance labels belong to mandatory access control and Bell-LaPadula, not Clark-Wilson. -
Perfect forward secrecy in a key exchange ensures that:
Correct answer: D. Perfect forward secrecy derives unique ephemeral session keys so that stealing a long-term key cannot decrypt previously recorded sessions. Reusing one master key for all sessions is the opposite and defeats forward secrecy. It does not eliminate key generation; it relies on fresh ephemeral keys per session. Sending traffic in plaintext provides no security and is unrelated to forward secrecy. -
At which layer of the OSI model do IP addressing and routing primarily operate?
Correct answer: A. IP addressing and routing decisions happen at Layer 3, the Network layer, which moves packets between networks. Layer 2 handles MAC addressing and switching within a local segment, not IP routing. Layer 4 manages end-to-end transport such as TCP and UDP ports, not IP routing. Layer 7 is where applications interact and does not perform IP routing. -
A demilitarized zone (DMZ) in network design is used to:
Correct answer: B. A DMZ is a buffer subnet for public-facing services like web servers, so external users never reach the internal network directly. Internal databases should sit in the protected internal network, not the exposed DMZ. A DMZ does not replace firewalls; it is created and protected by them. It does not itself encrypt internal traffic, which is a separate control. -
Which attack involves an attacker secretly relaying and possibly altering communication between two parties who believe they are talking directly?
Correct answer: C. An on-path (man-in-the-middle) attack intercepts and may modify traffic between two parties who think their connection is direct and private. A denial of service attack overwhelms a system's availability rather than intercepting a conversation. SQL injection targets database queries through unsanitized input. A brute-force attack guesses credentials or keys and does not relay a conversation. -
A VPN using IPsec in tunnel mode primarily provides:
Correct answer: D. IPsec in tunnel mode encrypts and authenticates traffic, giving confidentiality and integrity over untrusted networks like the internet. It does not make routing faster; encryption adds overhead. Automatic IP assignment is the job of DHCP, not IPsec. Domain name resolution is handled by DNS, which is unrelated to IPsec tunnels. -
Why is plain DNS (without DNSSEC) considered a security weakness?
Correct answer: A. Standard DNS does not authenticate responses, allowing attackers to spoof or poison records and redirect users. It does not encrypt queries at all, let alone too strongly, which is itself a separate privacy gap. DNS works across the public internet, not only internally. It resolves names rather than blocking web traffic. -
A network access control (NAC) solution primarily helps by:
Correct answer: B. NAC verifies the identity and security posture of devices and grants or restricts network access accordingly. It does not encrypt hard drives, which is endpoint disk encryption. It does not compress packets; that is a performance function unrelated to access control. Generating certificates is the role of a certificate authority, not NAC. -
WPA2/WPA3 are preferred over WEP for wireless networks because WEP:
Correct answer: C. WEP has well-known cryptographic weaknesses (weak IVs and a flawed use of RC4) that allow keys to be recovered quickly, so WPA2/WPA3 replaced it. WEP does not use a stronger key exchange; its key handling is precisely the weakness. Hardware demand is not the reason WEP is deprecated. WEP does not encrypt traffic twice; double encryption is not its problem. -
Placing Internet of Things (IoT) devices on a separate, isolated VLAN is recommended chiefly to:
Correct answer: D. Isolating often-insecure IoT devices on their own segment contains a compromise and prevents lateral movement to critical systems. Segmentation does not affect battery life. It does not increase a device's processing speed. It also does not assign public IP addresses; that is unrelated to the isolation goal. -
The key difference between an intrusion detection system (IDS) and an intrusion prevention system (IPS) is that an IPS:
Correct answer: A. An IPS sits in line and can actively block or drop traffic it judges malicious, whereas an IDS mainly detects and alerts. Logging for later review describes detection, more like an IDS, not prevention. Neither device's defining feature is encrypting all traffic. Assigning IP addresses is a DHCP function, unrelated to IDS/IPS. -
A SYN flood attack works by:
Correct answer: B. A SYN flood sends many connection requests without completing the handshake, tying up the server's connection table and denying service. Repeatedly guessing passwords is a brute-force attack, not a SYN flood. Injecting SQL into a form is SQL injection, a different attack class. Encrypting files for ransom describes ransomware, unrelated to the TCP handshake. -
Network Address Translation (NAT) contributes to security mainly by:
Correct answer: C. NAT maps many private internal addresses to public ones, obscuring the internal addressing scheme from outsiders. NAT does not encrypt packets; encryption is a separate function. It does not authenticate users, which is an identity function. It does not detect malware signatures, which is the role of anti-malware or IDS tools. -
Which protocol should replace Telnet for secure remote administration of network devices?
Correct answer: D. SSH provides encrypted, authenticated remote administration and is the secure replacement for cleartext Telnet. HTTP is for unencrypted web traffic, not secure device administration. SNMPv1 sends data and community strings in clear text and is itself insecure. FTP transfers files in clear text and is not a secure remote administration protocol. -
The core idea of a zero trust network architecture is to:
Correct answer: A. Zero trust assumes no implicit trust and verifies each request, applying least privilege whether the user is inside or outside the network. Trusting devices simply because they are inside the perimeter is the traditional model zero trust rejects. Removing authentication contradicts the principle of verifying everything. Relying solely on a perimeter firewall is exactly the perimeter-centric thinking zero trust moves away from. -
A captive portal on a guest Wi-Fi network is mainly used to:
Correct answer: B. A captive portal intercepts initial traffic and forces users to authenticate or accept an acceptable-use agreement before granting access. It does not encrypt the wireless signal; that is the job of WPA2/WPA3. It does not extend wireless range, which depends on hardware and placement. It does not assign static IPs, which is unrelated to the portal's purpose. -
Why are out-of-band management networks used for critical infrastructure devices?
Correct answer: C. Out-of-band management uses a separate channel so administrators can still reach devices when the production network fails or is compromised, and it isolates management traffic. Cost is not the driver; dedicated channels can be more expensive. Out-of-band access does not remove the need for authentication. It does not automatically patch devices; patching is a separate process. -
ARP spoofing on a local network allows an attacker to:
Correct answer: D. ARP spoofing sends forged ARP messages so the attacker's MAC is linked to a legitimate IP, letting them intercept or redirect local traffic. Cracking encrypted passwords offline is a separate attack on captured hashes, not ARP spoofing. Overwriting BIOS firmware is a low-level hardware attack unrelated to ARP. Bypassing door locks is a physical security issue, not a network attack. -
In access control terminology, the user or process requesting access to a resource is the:
Correct answer: A. A subject is the active entity, a user or process, that requests access to a resource. The object is the passive resource being accessed, such as a file, not the requester. An attribute is a characteristic used in access decisions, not the requester itself. A token is a credential or device used during authentication, not the requesting entity. -
A fingerprint scan is an example of which authentication factor?
Correct answer: B. A fingerprint is a biometric trait, so it is 'something you are' (inherence). 'Something you know' refers to knowledge factors like passwords or PINs. 'Something you have' refers to possession factors like a token or smart card. 'Somewhere you are' is a location-based factor, not a biometric characteristic. -
Access control based on a user's department, time of day and device location, evaluated dynamically, best describes:
Correct answer: C. ABAC makes decisions from multiple attributes and context such as department, time and location, evaluated dynamically. DAC lets resource owners grant access and does not natively combine many contextual attributes. RBAC grants access by assigned role, not by a flexible mix of contextual attributes. MAC enforces fixed security labels and clearances, not dynamic attribute combinations. -
In identity and access management, 'authorization' refers to:
Correct answer: D. Authorization decides what an already-authenticated identity is permitted to access or do. Proving who you are is authentication, a separate step that precedes authorization. Recording what a user did is accounting or auditing, not authorization. Issuing a new password is a credential management task, not the authorization decision. -
OAuth 2.0 is primarily a framework for:
Correct answer: A. OAuth 2.0 provides delegated authorization so an application can act on a user's behalf using tokens rather than the user's password. It is not a file encryption mechanism. It does not classify data, which is an asset security activity. It does not detect network intrusions, which is the role of IDS/IPS tools. -
The main risk of accounts that retain access from previous roles after staff change jobs is called:
Correct answer: B. Privilege creep is the accumulation of unnecessary access as people change roles without old rights being revoked, violating least privilege. Salting is a cryptographic technique for hashing passwords, unrelated to access accumulation. Tokenization replaces sensitive data with tokens and has nothing to do with role changes. Load balancing distributes traffic across servers and is irrelevant to access rights. -
A 'false acceptance' in a biometric system means the system:
Correct answer: C. A false acceptance (Type II error) occurs when the system wrongly recognizes an impostor as a valid user, a serious security failure. Rejecting a legitimate user is a false rejection (Type I error), the opposite case. Failing to capture a sample is an enrollment or read failure, not a false acceptance. Requiring a second factor is an MFA design choice, not a biometric error type. -
Single sign-on (SSO) improves usability but introduces the risk that:
Correct answer: D. With SSO, one set of credentials unlocks many systems, so if that credential is stolen the attacker gains broad access. SSO reduces, not increases, the number of passwords users must remember. It removes the need for separate logins per system, which is its benefit. It does not make authentication impossible; it centralizes it. -
A time-based one-time password (TOTP) app provides which authentication factor?
Correct answer: A. A TOTP generated on a device you possess is a possession factor, 'something you have'. It is not 'something you know' like a memorized password, even though it is a number you type. It is not a biometric 'something you are'. It is not a behavioural 'something you do', such as a typing pattern. -
The purpose of an access recertification (periodic access review) is to:
Correct answer: B. Periodic access reviews verify that each user's current access is still appropriate, catching privilege creep and orphaned rights. They are not about resetting passwords, which is a credential operation. They do not encrypt the directory, which is a separate protection. They have no effect on login speed. -
Provisioning, modifying, reviewing and deprovisioning user access over time is collectively known as:
Correct answer: C. Creating, changing, reviewing and removing user access across an employee's tenure is the identity or access lifecycle. The key lifecycle covers generation, distribution and retirement of cryptographic keys, not user accounts. The software development lifecycle covers building software, not managing identities. The incident response lifecycle covers handling security incidents. -
Why is privileged access management (PAM) given special attention compared with normal user access?
Correct answer: D. Administrative and privileged accounts hold broad power, so their misuse or compromise can be catastrophic, justifying extra controls like vaulting and session monitoring. Privileged accounts are not simply used less often; frequency is not the point. They still require strong authentication, not none. They should be audited more, not exempt from auditing. -
Kerberos uses a trusted third party to issue tickets. The component that grants service tickets after initial authentication is the:
Correct answer: A. In Kerberos the ticket-granting service, part of the key distribution centre, issues service tickets once the user has authenticated and holds a ticket-granting ticket. A certificate authority issues digital certificates in PKI, not Kerberos tickets. A reference monitor is the abstract access-mediation concept, not a Kerberos component. A proxy server forwards network requests and is unrelated to ticket granting. -
Federated identity management primarily allows:
Correct answer: B. Federation establishes trust between organizations so a user authenticated in one domain can access resources in another without a new account. It is not a mechanism for encrypting stored passwords. It does not patch servers, which is an operations task. It does not control physical data centre access, which is a facilities matter. -
The 'accounting' (or auditing) element of the AAA model refers to:
Correct answer: C. Accounting records the actions and resource usage of authenticated users, supporting auditing and non-repudiation. Verifying identity is authentication, the first A, not accounting. Granting permissions is authorization, the second A. Encrypting authentication traffic is a transport protection, not part of the accounting function. -
Just-in-time (JIT) privileged access aims to reduce risk by:
Correct answer: D. JIT access grants elevated rights only for the specific window they are required and removes them afterward, shrinking the standing attack surface. Granting permanent admin rights to everyone is the opposite of JIT and very risky. Disabling logging would undermine accountability, not reduce risk. Sharing one admin account destroys individual accountability and is poor practice. -
In a 'black box' penetration test, the tester is given:
Correct answer: A. A black box test gives the tester no internal knowledge, simulating an external attacker discovering everything from scratch. Receiving full source code and architecture is characteristic of a white box test, the opposite approach. Being handed admin credentials in advance reflects a credentialed or white/grey box scenario, not black box. A complete asset inventory would also be internal knowledge a black box tester does not get. -
A 'false positive' in a vulnerability scan means the tool:
Correct answer: B. A false positive is an alert for a vulnerability that is not genuinely present, wasting effort to investigate. Missing a real vulnerability is a false negative, the dangerous opposite. The tool crashing is an operational failure, not a false positive. Finding a confirmed exploit is a true positive, an accurate detection. -
Why is independence important when an organization undergoes a security audit?
Correct answer: C. An independent auditor has no stake in the outcome, so the findings are more objective and credible. Independence does not mean the audit is free; auditors are paid. It does not necessarily speed up the audit. Independent auditors still require evidence to support their conclusions; independence does not waive that. -
A SOC 2 Type II report is most useful to a customer because it:
Correct answer: D. A SOC 2 Type II report evaluates whether a service provider's controls operated effectively over a defined period, giving evidence-based assurance. It is not a list of marketing claims; it is an independent attestation. It cannot guarantee zero breaches, which no report can. It informs but does not replace the customer's own risk assessment of the relationship. -
Reviewing whether terminated employees' accounts were actually disabled is an example of testing:
Correct answer: A. Checking that leaver accounts are disabled tests account management (provisioning and deprovisioning) controls. It does not measure network bandwidth, a performance metric. It does not assess encryption strength, a cryptographic property. It has nothing to do with power redundancy, a facilities control. -
Fuzz testing primarily evaluates software by:
Correct answer: B. Fuzzing feeds malformed, unexpected or random inputs to a program to surface crashes, hangs and security flaws. Reading code line by line is manual code review or static analysis, not fuzzing. Measuring user capacity is load or performance testing. Checking visual design is usability testing, unrelated to fuzzing. -
The main reason to define a clear scope and rules of engagement before a penetration test is to:
Correct answer: C. Scope and rules of engagement authorize the test and set boundaries so it does not cause unintended outages or cross legal lines. They do not primarily aim to reduce cost. They cannot guarantee that no vulnerabilities are found, nor would that be desirable. They do not let testers skip reporting; reporting is a core deliverable. -
Synthetic transaction monitoring tests a production system by:
Correct answer: D. Synthetic transactions are scripted, simulated user actions run against a live system to confirm availability and correct behaviour. They do not encrypt database records, which is a data protection task. They do not delete log files, which is a retention activity. They do not assign IP addresses, a DHCP function. -
A code review where developers manually inspect each other's source code is best categorized as a:
Correct answer: A. Peer code review inspects source code without executing it, making it a manual static testing technique. A dynamic test exercises the running application, which code review does not. A load test measures performance under demand, unrelated to reading code. A physical security review assesses facilities, not source code. -
Why should an organization periodically test its backups by performing actual restores?
Correct answer: B. Only an actual restore proves a backup is usable; untested backups can be corrupt, incomplete or misconfigured and fail in a real disaster. Restoring does not make backups smaller. Performing a restore does not encrypt the data. It does not remove the need for a regular backup schedule, which remains essential. -
Key risk indicators (KRIs) and key performance indicators (KPIs) in a security program are mainly used to:
Correct answer: C. KRIs and KPIs give management measurable signals about risk levels and how well security is performing, supporting decisions. They do not replace technical controls, which still do the protecting. They are metrics, not a means of encrypting reports. They inform but do not eliminate the need for independent audits. -
A 'gray box' penetration test is characterized by the tester having:
Correct answer: D. A gray box test gives the tester partial knowledge, for example limited credentials or some documentation, blending black and white box approaches. Having no information at all describes a black box test. Having complete source code and full rights is the white box end of the spectrum. Having only physical access describes a different, facilities-focused engagement, not the gray box definition. -
When a vulnerability assessment produces a long list of findings, the security manager should first:
Correct answer: A. Findings should be prioritized by the risk they pose to the business so the most dangerous issues are fixed first, reflecting the manager mindset. Patching alphabetically ignores severity and business impact. Permanently ignoring all medium and low findings is reckless, as some may still matter. Public disclosure before fixing would expose the organization to attack. -
In digital forensics, maintaining a documented chain of custody is essential because it:
Correct answer: B. Chain of custody documents who handled evidence, when and how, which is what makes it trustworthy and admissible in proceedings. It does not primarily speed up the investigation. It does not encrypt evidence; integrity is shown through hashing and documentation. It does not reduce how much evidence is needed; it governs how evidence is handled. -
During incident response, the containment phase is intended to:
Correct answer: C. Containment limits the incident's spread and damage, buying time before the threat is fully eradicated. Permanently removing the threat is eradication, a later phase. Restoring systems to normal is recovery, which follows eradication. Documenting lessons learned is the final phase, after the incident is resolved. -
A business impact analysis (BIA) is performed mainly to:
Correct answer: D. A BIA identifies the organization's critical functions and quantifies the impact of losing them over time, driving recovery priorities. It is not about selecting firewall vendors, a procurement task. It does not involve writing secure code. It has nothing to do with configuring user passwords. -
The recovery point objective (RPO) specifies the:
Correct answer: A. RPO defines how much data, expressed as a time window, the organization can afford to lose, which dictates backup frequency. The time needed to restore a function is the RTO, a different metric. The total cost of an outage is a financial impact figure, not the RPO. The number of backup copies is a strategy detail, not the RPO definition. -
A 'hot site' as a disaster recovery facility is best described as one that:
Correct answer: B. A hot site is fully equipped with hardware, data and connectivity so operations can resume almost immediately after a disaster. A facility with only space and power is a cold site, which needs equipment installed first. A mere contract for future equipment is closer to a cold or reciprocal arrangement, not a hot site. A trailer without connectivity is not a ready hot site. -
Formal change management exists primarily to:
Correct answer: C. Change management reviews, approves, tests and documents changes so they do not cause unexpected outages or security gaps. Its goal is controlled change, not simply slowing work down. It does not remove the need for backups, which protect data regardless. It is distinct from, not a replacement for, incident response. -
A SIEM platform adds value over isolated log files mainly because it:
Correct answer: D. A SIEM aggregates logs from many systems and correlates them to detect patterns and raise alerts that isolated logs would miss. Cheaper storage alone is not its primary value. It does not encrypt the network, which is a different control. It does not replace a firewall; it consumes and analyzes data, including from the firewall. -
Why should organizations protect log files from modification by ordinary users and administrators?
Correct answer: A. If logs can be altered, attackers or insiders can erase their tracks, so protecting log integrity is vital for investigations and accountability. Storage space is a capacity issue, not the reason to prevent tampering. Logs do not meaningfully slow the network as a security rationale. User preference is irrelevant to protecting log integrity. -
The principle behind keeping golden images and configuration baselines is to:
Correct answer: B. Baselines and golden images define a known-good secure configuration, speeding consistent deployment and revealing unauthorized drift. They are not about branding or appearance. They tend to reduce ad hoc patching effort, not increase required patches. They support, rather than remove, the need for ongoing monitoring. -
When investigating an incident, why is it best practice to work from a forensic copy rather than the original media?
Correct answer: C. Analyzing a verified bit-for-bit copy keeps the original untouched, preserving its integrity and admissibility as evidence. Copies are not inherently faster to read than originals. Making a copy does not automatically encrypt it. The original can technically be analysed, but doing so risks altering evidence, which is why a copy is used. -
The maximum tolerable downtime (MTD) for a business function represents:
Correct answer: D. MTD is the absolute longest a function can be down before the harm becomes severe or unrecoverable, and the RTO must be shorter than it. Acceptable lost data is the RPO, a different metric. The backup window is an operational detail, not the MTD. Time to detect an incident is a detection metric, not downtime tolerance. -
A primary reason to apply patches through a managed patch management process rather than ad hoc is to:
Correct answer: A. A managed process tests, schedules and tracks patches so known vulnerabilities are closed consistently while minimizing the risk of outages. No process can guarantee patches never break anything, so that claim is false. Patching often requires reboots; avoiding them is not the goal. It complements, not replaces, vulnerability scanning. -
Egress filtering at the network boundary is used mainly to:
Correct answer: B. Egress filtering restricts and inspects outbound traffic, which can block command-and-control channels and help catch data being exfiltrated. It is not primarily about speeding up internal traffic. It does not assign internal IP addresses, a DHCP role. It does not encrypt stored backups, an unrelated data protection task. -
Why is a tabletop exercise valuable for incident response and business continuity readiness?
Correct answer: C. A tabletop exercise discusses scenarios so the team can test understanding and surface plan gaps cheaply and without disrupting live systems. It cannot guarantee that no incident will occur. It does not replace written plans; it validates and improves them. It does not patch systems, which is unrelated to the exercise. -
The first priority during any incident or disaster response should be:
Correct answer: D. Human life and safety always take precedence over any technical or business consideration during a response. Restoring revenue systems matters but comes after people are safe. Preserving evidence is important but never ahead of life safety. Notifying the media is a low-priority, controlled communication step, not the first action. -
A SQL injection vulnerability is best prevented by:
Correct answer: A. Parameterized queries separate code from data so user input cannot alter the SQL command, which is the core defence, reinforced by input validation. Longer database passwords protect credentials but do nothing against injection through the application. Encrypting data at rest protects stored data, not the query path that injection abuses. Adding servers is a scaling measure, irrelevant to injection. -
Cross-site scripting (XSS) primarily allows an attacker to:
Correct answer: B. XSS injects scripts that execute in victims' browsers, enabling session theft, defacement or redirection. It does not give direct read access to the server's disk. It cannot overclock a database server, which is not even a security concept here. It has nothing to do with bypassing physical access controls. -
Storing user passwords using a slow, salted hashing algorithm (such as bcrypt) rather than a fast hash is recommended because it:
Correct answer: C. A deliberately slow, salted hash like bcrypt makes each guess expensive, hampering offline brute-force and dictionary attacks if the hash store is stolen. It does not make login faster; it intentionally adds cost. Hashing is one-way, not reversible encryption. It does not remove the need for HTTPS, which protects credentials in transit. -
The principle of 'secure defaults' in software design means that:
Correct answer: D. Secure defaults ship the safest configuration so users are protected without extra effort and must deliberately enable riskier options. Enabling all features by default expands the attack surface and is the opposite of secure defaults. Adding security only after release contradicts building it in from the start. Random defaults provide no assurance of safety. -
Why is it risky for an application to display detailed internal error messages (such as stack traces) to end users?
Correct answer: A. Verbose errors can expose file paths, software versions, queries and other internals that aid an attacker in crafting exploits. Slower page loads are not the security concern with error verbosity. Bandwidth use is negligible and not the issue. Search engine confusion is irrelevant to the security risk of leaking internals. -
Performing threat modeling early in the development lifecycle helps teams to:
Correct answer: B. Threat modeling anticipates how a system could be attacked so countermeasures are designed in before flaws are coded, when fixes are cheapest. It does not let teams skip writing code; it informs how code is written. It cannot guarantee bug-free software. It complements, not replaces, later testing. -
A buffer overflow vulnerability occurs when a program:
Correct answer: C. A buffer overflow writes past a buffer's bounds, overwriting adjacent memory and potentially allowing code execution or crashes. Encrypting with a weak key is a cryptographic weakness, not a buffer overflow. Sending data unencrypted is a transport confidentiality issue. Storing passwords in plaintext is a storage flaw, unrelated to memory bounds. -
Integrating automated security scanning into a CI/CD pipeline (often called 'shift left') aims to:
Correct answer: D. Shifting security left embeds automated checks throughout the pipeline so defects are caught early and continuously, when they are cheaper to fix. Delaying checks until production is precisely what shift left avoids. It does not remove the need for developers; it supports them. It is not about encrypting the source repository, a separate protection. -
Why should developers avoid hardcoding credentials or API keys directly in source code?
Correct answer: A. Hardcoded secrets can leak via source repositories, binaries or decompilation and are difficult to rotate, so secrets belong in secure vaults or configuration. Code length is not the security concern. Compilation speed is irrelevant to the risk. The problem is a genuine security exposure, not merely a style-guide preference. -
A software composition analysis (SCA) tool primarily helps secure software by:
Correct answer: B. SCA inventories third-party and open-source dependencies and flags those with known vulnerabilities, addressing supply-chain risk. It does not encrypt application traffic, a transport control. It does not perform load testing, a performance activity. It has nothing to do with designing the user interface. -
Validating input on the server side, even when client-side validation already exists, is necessary because:
Correct answer: C. Client-side validation is for convenience and can be bypassed by an attacker, so the server must independently validate all input it receives. Server validation is not necessarily faster; that is not the reason. It does not reduce database size. There is no legal requirement on browsers driving this; it is a security necessity. -
A race condition (time-of-check to time-of-use, TOCTOU) flaw arises when:
Correct answer: D. A TOCTOU race condition occurs when the state of a resource changes between the check and the subsequent use, allowing an attacker to exploit the gap. Two users sharing a password is a credential management problem, not a race condition. Encrypting with the wrong key is a cryptographic error. Running out of disk space is a capacity issue, not a timing flaw. -
Why is it important to manage and patch open-source libraries an application depends on?
Correct answer: A. Your application inherits the security posture of its dependencies, so an unpatched library vulnerability is effectively your vulnerability. Open-source code is not always insecure; that is an overgeneralization. Patching does not make the app smaller. Licenses do not mandate daily updates, so that is not the reason. -
An organization documents who is accountable, responsible, consulted and informed for each security task using a RACI chart. This primarily improves:
Correct answer: A. A RACI chart maps roles to tasks so everyone knows who is accountable and responsible, strengthening governance and accountability. It does not change encryption strength, which is a cryptographic decision. It has no effect on network throughput, a performance concern. It is unrelated to backup compression ratios, a storage detail. -
A company must comply with GDPR for its European customers. The maximum administrative fine under GDPR for the most serious violations is set as the higher of a fixed sum or a percentage of:
Correct answer: B. GDPR caps the most serious fines at the higher of 20 million euros or 4% of total worldwide annual turnover, tying penalties to global revenue. Quarterly net profit is not the basis; the regulation uses annual turnover, not profit. The IT security budget is irrelevant to the fine calculation. The monetary value of the breached data is not how GDPR fines are scaled. -
Threat modeling using the STRIDE method helps categorize threats. The 'R' in STRIDE stands for:
Correct answer: C. In STRIDE the R is Repudiation, the threat that a party can deny an action without proof to the contrary. Redundancy is an availability design concept, not a STRIDE category. Recovery is a continuity activity, not part of STRIDE. Resilience is a general reliability property, not one of the six STRIDE threat types. -
A security manager wants to compare the cost of a proposed control against the loss it is expected to prevent. The most appropriate figure to justify the control is the reduction in:
Correct answer: D. Comparing the control's cost to the reduction in annualized loss expectancy shows whether the safeguard is cost-justified over a year. Mean time between failures measures hardware reliability, not financial loss prevented. The number of firewall rules is an implementation detail, not a cost-benefit measure. The amount of policy text has no bearing on quantifying prevented loss. -
When a third-party vendor will process the company's customer data, the strongest way to ensure the vendor maintains required security controls is to:
Correct answer: A. Building security requirements and a right to audit into the contract makes the vendor's obligations enforceable and verifiable. Assuming compliance because a vendor is large is not a control and ignores real risk. An informal email does not create binding, enforceable obligations. Website marketing claims are unverified and provide no assurance. -
The primary goal of a security governance program, as opposed to day-to-day security management, is to:
Correct answer: B. Governance sets direction and oversight, aligning the security strategy with business goals and ensuring accountability. Configuring firewalls is an operational management task, not governance. Nightly server patching is routine operations, again not governance. Writing application code is a development activity, unrelated to strategic oversight. -
An organization treats a newly discovered risk by both buying insurance and adding a detective control. Using two responses for one risk is best described as:
Correct answer: C. Combining responses, such as transfer through insurance plus mitigation with a detective control, is a legitimate hybrid risk treatment. It is not avoidance only, since the activity continues and is insured. Combining treatments is permitted and common, not invalid. It is not pure acceptance, because active steps are taken to transfer and reduce the risk. -
Under the concept of 'standard of due care', an organization is expected to:
Correct answer: D. Due care means acting as a reasonable, prudent organization would under the circumstances, implementing sensible controls. It does not require eliminating every risk at any cost, which is impossible and not the legal standard. Liability cannot simply be outsourced away; accountability remains with the organization. Merely documenting risks without acting falls short of due care. -
A multinational must follow different privacy laws in each country it operates in. The discipline of ensuring the organization meets all applicable laws, regulations and contracts is called:
Correct answer: A. Compliance management is the systematic effort to meet all applicable laws, regulations, standards and contractual obligations. Penetration testing assesses technical weaknesses, not legal adherence. Load balancing distributes traffic for performance and is unrelated. Disaster recovery restores systems after disruption, not legal compliance. -
An employee reports a colleague pressuring them to bypass a control 'just this once'. According to the manager mindset, the security manager should first:
Correct answer: B. The risk-based manager investigates and handles the issue through established policy and process, ensuring fairness and root-cause action. Ignoring it as a personal dispute lets a real control-bypass risk fester. Bypassing the control rewards the pressure and increases risk. Firing someone instantly without any inquiry skips due process and proper investigation. -
The main purpose of a job rotation policy as a security control is to:
Correct answer: C. Rotating staff through roles spreads knowledge, reduces single-person dependence, and exposes irregularities that a permanent role-holder might conceal. It does not automatically raise salaries, which is a compensation matter. It increases, rather than removes, the need for cross-training. Faster promotions are not the security rationale for rotation. -
A risk register is best described as:
Correct answer: D. A risk register centrally records identified risks along with their likelihood, impact, owner and treatment status for ongoing tracking. It is not a roster of users with access, which is an access list. It is not a packet log, which is network telemetry. It is not a software release schedule, which is a development plan. -
An organization adopts ISO/IEC 27001. The central artefact this standard requires an organization to establish and maintain is a(n):
Correct answer: A. ISO/IEC 27001 specifies requirements for establishing and continually improving an Information Security Management System. A single firewall is one technical control, not the management system the standard demands. A bug bounty program is an optional testing approach, not the standard's core requirement. A marketing plan is unrelated to information security management. -
A 'qualitative' risk technique that gathers anonymous expert opinions over several rounds to reach consensus is the:
Correct answer: B. The Delphi technique collects anonymous expert input across rounds to build consensus, a qualitative method that reduces dominance bias. A Monte Carlo simulation is a quantitative, probabilistic modelling approach, not anonymous polling. An annualized loss calculation is a quantitative formula, not a consensus method. A penetration test is a technical assessment, not a risk-opinion technique. -
The principal reason to classify a security incident's severity early in incident handling is to:
Correct answer: C. Classifying severity early ensures the response and escalation match the incident's seriousness, allocating resources appropriately. Assigning blame is not the purpose of early classification and can hinder a calm response. Incident severity has nothing to do with tax. Choosing branding is entirely unrelated to incident handling. -
A company calculates that a server failure causes a single loss expectancy of $50,000 and occurs on average twice per year. A proposed control costing $30,000 per year would cut the failure rate in half. Is the control cost-justified?
Correct answer: D. Current ALE is $50,000 x 2 = $100,000; halving the rate gives $50,000, a $50,000 reduction that exceeds the $30,000 cost, so it is justified. Citing only the SLE ignores the annual rate of occurrence and the full ALE. There is no rule capping control cost at $10,000. The claim that any control is always worth buying ignores cost-benefit analysis. -
Why does CISSP guidance stress aligning the security program with the organization's mission and objectives?
Correct answer: A. Security is a business enabler, so it must support the organization's mission rather than operate as an isolated end in itself. Business goals are highly relevant, not irrelevant, to setting security priorities. Alignment increases, not removes, the security team's accountability and oversight. It does not guarantee unlimited budget; resources still depend on risk and priorities. -
When a company shares a draft acquisition deal with an outside advisory firm, which agreement most directly limits how that firm may use and share the confidential information?
Correct answer: B. A non-disclosure or confidentiality agreement directly restricts how the advisory firm may use and disclose the shared confidential information. A service level agreement sets performance and availability targets, not confidentiality limits. An acceptable use policy governs internal users of the company's own systems, not an external firm's handling of secrets. A warranty is a promise about a product or service, not a confidentiality control. -
An asset inventory that records hardware, software and data the organization owns primarily supports security by:
Correct answer: C. A complete inventory is foundational because unknown assets cannot be classified, patched or protected, leaving blind spots. An inventory does not speed up the network, a performance matter. The claim that unknown assets can still be protected is false; you cannot protect what you do not know you have. It does not reduce electricity costs, an unrelated operational concern. -
A 'data steward' role in data governance is generally responsible for:
Correct answer: D. A data steward oversees data quality and ensures classification and handling policies are correctly applied for a data domain. Setting the stock price is a financial-market matter, not a stewardship duty. Physically guarding the building is a facilities or guard role. Writing marketing copy is unrelated to data governance. -
Encrypting an entire laptop hard drive so that all stored data is protected if the device is lost is an example of protecting data:
Correct answer: A. Full-disk encryption protects stored data, which is data at rest, against exposure if the laptop is lost or stolen. Data in transit is data moving over a network, not stored on disk. Data in use is data actively being processed in memory, not at rest. A SIEM analyzes logs and is not a data state at all. -
Combining many individually low-sensitivity records so that the combined dataset reveals sensitive information is the security concern known as:
Correct answer: B. Aggregation, often leading to inference, is when combining low-sensitivity data yields higher-sensitivity insight that needs stronger protection. Degaussing is a magnetic media sanitization method, not a data combination risk. Load balancing distributes traffic and is unrelated. Tokenization substitutes sensitive values and does not describe the combining risk. -
The recommended action for highly classified media that has reached end of life and will leave the organization's control is to:
Correct answer: C. Highly classified media leaving organizational control should be destroyed (purged or physically destroyed) so the data cannot be recovered. Reformatting often leaves recoverable data and is insufficient for high classification. Giving it to staff exposes sensitive data and is unacceptable. Selling it without sanitization likewise risks exposing the data. -
Marking a printed report 'Confidential' in its header and footer is an example of:
Correct answer: D. Applying a visible sensitivity marking such as 'Confidential' is data labeling, which signals required handling. Encryption transforms data to protect confidentiality, not a printed marking. Hashing produces a one-way digest for integrity, unrelated to labels. Network segmentation isolates network zones and has nothing to do with marking documents. -
An organization shares a dataset with researchers but first removes names, addresses and IDs so individuals cannot be readily identified. This process is:
Correct answer: A. Removing identifiers so individuals cannot be readily re-identified is anonymization or de-identification, reducing privacy risk in shared data. Encryption protects data reversibly with a key but does not de-identify the content for use. Compression reduces size and does not remove identifiers. Replication copies data and does nothing to protect identities. -
Why must a data owner consider the entire data lifecycle (creation, storage, use, sharing, archival, destruction) rather than just storage?
Correct answer: B. Data is exposed to distinct risks at each lifecycle stage, so controls must be tailored throughout, not only while stored. Treating storage as the only stage ignores risks during use, sharing and disposal. Lifecycle management does not lower data value; it protects it appropriately. It complements, not replaces, classification. -
In data governance terms, a 'data processor' under typical privacy law is the party that:
Correct answer: C. A data processor handles personal data on behalf of and under the instructions of the controller, with no independent authority over purposes. Deciding the purposes of processing is the controller's role, not the processor's. Owning the company is a corporate matter, not a data-processing role. The individual the data describes is the data subject. -
A 'scoping' decision when applying a baseline of security controls to a system means the organization:
Correct answer: D. Scoping tailors a control baseline by excluding controls that are not applicable to the specific system or environment. Adding every control regardless of relevance is the opposite of scoping and wastes effort. Deleting the baseline entirely abandons the structured starting point. 'Encrypting controls' is not a meaningful action in this context. -
A government uses classification levels Top Secret, Secret, Confidential and Unclassified. Information whose unauthorized disclosure could cause 'exceptionally grave damage' is typically labelled:
Correct answer: A. In the US government scheme, Top Secret is reserved for information whose disclosure could cause exceptionally grave damage to national security. Unclassified information carries no such damage potential and the lowest controls. Confidential covers information whose disclosure could cause damage, a lower threshold than exceptionally grave. 'Public' is not a level in this government scheme. -
A cipher that encrypts data one bit or byte at a time, often used where data arrives continuously, is a:
Correct answer: B. A stream cipher encrypts data continuously, one bit or byte at a time, which suits streaming or real-time data. A block cipher encrypts fixed-size blocks at once, not bit by bit. A hash function is one-way and does not encrypt for later decryption. A digital certificate binds an identity to a public key and is not a cipher. -
A 'collision' in a cryptographic hash function occurs when:
Correct answer: C. A collision is when two distinct inputs hash to the same output, which undermines integrity guarantees if it can be engineered. A single input always producing different outputs would mean the function is not deterministic, which is not what a collision is. Reusing a key is a key-management issue, not a hash collision. Sending data unencrypted is a confidentiality problem, unrelated to hashing. -
The isolation provided by sandboxing an application means the application:
Correct answer: D. A sandbox confines an application to a restricted environment so a compromise or misbehaviour cannot easily reach the wider system. Granting full administrative rights is the opposite of containment. Sharing all memory with other applications removes isolation entirely. Exemption from logging would reduce, not improve, security oversight. -
Which statement correctly distinguishes the ECB block cipher mode from CBC?
Correct answer: A. ECB encrypts each block independently, so identical plaintext blocks produce identical ciphertext and leak patterns, which is why it is discouraged. CBC chains blocks together using the previous ciphertext, so blocks are related, not independent. ECB is generally less secure than CBC because of that pattern leakage. CBC specifically uses an initialization vector to randomize the first block. -
A trusted computing base (TCB) refers to:
Correct answer: B. The TCB is the totality of protection mechanisms (hardware, firmware, software) responsible for enforcing the system's security policy. It is not the marketing department's systems, which is unrelated. It is not limited to one user's laptop; it is a system-wide concept. It is certainly not the public internet, which is outside the protected boundary. -
Why is hardcoding a single, never-changing encryption key into thousands of shipped devices a poor design?
Correct answer: C. A shared static key means recovering it from one device compromises all of them, so unique per-device keys are far safer. Performance is not the concern; the issue is catastrophic shared exposure. Using a static symmetric key is not inherently asymmetric, so that option is incorrect. Excessive key length is not the problem; the problem is reuse across all devices. -
The cryptographic property ensuring that even a tiny change in input produces a drastically different output is the:
Correct answer: D. The avalanche effect means a small input change cascades into a large, unpredictable change in the output, a desirable property of strong ciphers and hashes. Key escrow is storing keys with a third party, unrelated to output sensitivity. A replay property is not a desirable cryptographic trait; replay is an attack. A null cipher hides a message within other text and is not this property. -
An organization wants confidentiality, integrity and authenticity for messages in one operation. The class of algorithm designed for this is:
Correct answer: A. Authenticated encryption modes such as AES-GCM provide confidentiality and integrity/authenticity together in one operation. Base64 is an encoding scheme that provides no security at all. A simple checksum detects accidental errors but offers no confidentiality and is not cryptographically strong against tampering. A monoalphabetic cipher is trivially broken and provides neither integrity nor authenticity. -
Placing critical servers in a locked cage within a data centre, in addition to building access control, is an example of:
Correct answer: B. Adding a locked cage on top of building access control is layered physical security, applying defense in depth to physical assets. Security through obscurity relies on hiding details, not adding real physical layers. A locked cage is a physical, not logical, access control. Data classification labels information sensitivity and is unrelated to physical layering. -
The use of a hardware security module (HSM) in an enterprise is primarily to:
Correct answer: C. An HSM generates, stores and uses cryptographic keys inside tamper-resistant hardware, protecting them from extraction. Serving web pages is a web server's job, not an HSM's. Providing Wi-Fi is a networking function unrelated to key protection. Storing user emails is a mail server function, not the purpose of an HSM. -
Why is reusing the same initialization vector (IV) with the same key in certain cipher modes dangerous?
Correct answer: D. Reusing an IV with the same key removes the randomization the IV provides, allowing patterns to leak and, in some modes, plaintext recovery. It does not meaningfully slow encryption; the risk is confidentiality loss. It does not lengthen the ciphertext as the core issue. It does not change the key; the key stays the same, which is precisely the problem. -
A 'fail secure' electronic door lock during a power outage will:
Correct answer: A. A fail-secure lock defaults to locked on power loss, prioritizing keeping unauthorized people out. Unlocking on failure describes fail-safe, which prioritizes life-safety egress, the opposite default. Disabling logging is not a defining behaviour of a fail-secure lock. Sending an email is unrelated to the lock's failure default. -
Embedding security requirements into a system from the earliest design stage, rather than bolting them on later, reflects the principle of:
Correct answer: B. Security by design builds protection into a system from the outset, which is cheaper and more effective than adding it afterward. 'Security by accident' is not a real principle and implies unplanned protection. Security through obscurity relies on secrecy of design, a weak approach. 'Patch and pray' is a reactive anti-pattern, the opposite of designing security in. -
A side-channel attack against a cryptographic device works by:
Correct answer: C. A side-channel attack infers secrets from physical leakage like power consumption, timing or electromagnetic emanations rather than breaking the math. Repeated password guessing is a brute-force attack, not a side channel. Sending malformed packets is a network or fuzzing attack. Editing source code is tampering with software, not exploiting physical leakage. -
Why does CISSP guidance recommend not creating your own custom encryption algorithm for production use?
Correct answer: D. Standard algorithms have undergone extensive public scrutiny, so they are far more trustworthy than untested in-house designs that may hide flaws. Custom algorithms are not inherently faster, and speed is not the point. Writing your own algorithm is not universally illegal, so that claim is false. Custom algorithms can still use keys; key absence is not the issue. -
A water sprinkler system that keeps pipes empty until a fire is detected, then fills and discharges, is a:
Correct answer: A. A dry pipe system keeps pipes free of water until a fire triggers them, reducing accidental water damage and freezing risk. A wet pipe system keeps water in the pipes at all times, which is the opposite design. A clean agent system uses gas, not water, so it does not fit this description. A foam concentrate system uses foam in specialized settings, not the empty-then-fill water design described. -
The main security advantage of using well-defined trust boundaries in a system architecture is that they:
Correct answer: B. Trust boundaries reveal where data moves between areas of differing trust, indicating where validation and controls must be enforced. They are not about making the system look complex; they clarify it. They do not increase server count by themselves. They do not remove the need for encryption, which may still be required across boundaries. -
Storing a copy of an encryption key with a trusted third party so data can be recovered if the original key is lost is called:
Correct answer: C. Key escrow deposits a recoverable copy of a key with a trusted party so encrypted data is not permanently lost if the original key is unavailable. Key stretching strengthens weak keys or passwords through repeated hashing, a different concept. Salting adds randomness to hashed passwords, unrelated to key recovery. Steganography hides data within other data and is not key storage. -
A common reason quantum computing concerns cryptographers is that sufficiently powerful quantum computers could:
Correct answer: D. Quantum algorithms such as Shor's could factor large numbers efficiently, threatening RSA and similar asymmetric schemes that rely on that being hard. Quantum computing does not make hashing instant and free in a security sense. It does not remove the need for encryption; it motivates quantum-resistant encryption. It does not write secure code, which is unrelated. -
A subnet that hosts public-facing servers and sits between two firewalls, isolating them from the internal network, is commonly called a:
Correct answer: A. A screened subnet, also known as a DMZ, places public servers between firewalls so external traffic never reaches the internal network directly. A loopback is an internal interface a host uses to talk to itself, not a public zone. A broadcast domain is the set of devices that receive each other's broadcasts, not a security zone design. A default gateway is the router a host uses to reach other networks, not a subnet of servers. -
At which OSI layer do MAC addresses and Ethernet switching primarily operate?
Correct answer: B. MAC addressing and switching occur at Layer 2, the Data Link layer, which moves frames within a local segment. Layer 1 is the physical layer of cables and signals, not addressing. Layer 4 handles end-to-end transport such as TCP and UDP, not MAC addresses. Layer 7 is where applications operate and does not deal with MAC-level switching. -
A DNS amplification attack abuses open DNS resolvers to:
Correct answer: C. DNS amplification sends small queries with the victim's spoofed source address so resolvers send large responses to the victim, overwhelming it. Encrypting files for ransom is ransomware, a different attack. DNS resolvers do not hold a private key for this purpose, so key theft is not the mechanism. Patching servers is a defensive action, not an attack outcome. -
The main purpose of 802.1X in a wired or wireless network is to:
Correct answer: D. 802.1X provides port-based network access control, authenticating a device or user before the switch or access point grants network access. It does not compress traffic, a performance function. It does not assign domain names, which is DNS. It does not encrypt files at rest, an endpoint storage concern. -
Why is using TLS 1.2 or 1.3 preferred over older SSL 3.0?
Correct answer: A. SSL 3.0 contains known flaws like POODLE and is deprecated, so modern TLS versions replaced it for secure communication. Being faster would not make SSL 3.0 safer, and the flaws are the issue. TLS does encrypt web traffic; that statement is false. Key length is not the distinguishing problem; SSL 3.0's protocol weaknesses are. -
A proxy server that sits between internal users and the internet, fetching content on their behalf, primarily provides:
Correct answer: B. A forward proxy fetches content for internal users, enabling caching, content filtering and concealment of internal client details. It does not provide physical building security, a facilities matter. It does not classify data automatically. Disk defragmentation is a storage maintenance task, unrelated to a proxy. -
VLAN hopping is an attack in which an attacker:
Correct answer: C. VLAN hopping uses techniques like double tagging or switch spoofing so an attacker reaches a VLAN they are not authorized for. Physically unplugging a switch is a physical disruption, not VLAN hopping. Encrypting the switch configuration is not the attack described. Increasing network speed is not an attack outcome at all. -
The security benefit of disabling unused physical switch ports is to:
Correct answer: D. Disabling unused ports stops someone from plugging in a rogue device and obtaining network access through an open jack. It has nothing to do with cable colour coding. It does not increase electricity use as a security purpose. It does not affect DNS lookup speed, an unrelated function. -
A 'smurf' attack achieves denial of service by:
Correct answer: A. A smurf attack sends ICMP echo requests to a network's broadcast address with the victim's spoofed source, so many hosts reply to the victim, flooding it. Cracking WPA2 passwords is a wireless attack, not smurf. Injecting JavaScript is cross-site scripting, a web attack. Stealing session cookies is session hijacking, unrelated to ICMP flooding. -
Segmenting a network so that payment-card systems are isolated from general office systems is most directly driven by the goal of:
Correct answer: B. Isolating payment systems reduces the regulated scope and limits how far an attacker could move toward sensitive data. It is not primarily about faster Wi-Fi, a performance concern. It does not lower electricity bills. It does not aim to increase the number of IP addresses; that is unrelated. -
The primary reason to prefer SNMPv3 over SNMPv1/v2c for managing network devices is that SNMPv3:
Correct answer: C. SNMPv3 adds authentication and encryption, addressing the cleartext community-string weakness of SNMPv1 and v2c. It does not merely use shorter community strings; it improves security fundamentally. It is not limited to wireless networks. It does not disable monitoring; it secures it. -
A 'honeypot' deployed on a network is intended to:
Correct answer: D. A honeypot is a deliberately exposed decoy that attracts attackers so defenders can detect and study malicious activity. It is not a production database; using it as one would defeat its purpose. It does not replace a firewall, which still controls real traffic. It does not encrypt backups, an unrelated data protection task. -
Why is broadcasting an open (unencrypted) Wi-Fi network for sensitive business use a poor choice?
Correct answer: A. On an open network the traffic is unencrypted over the air, so anyone within range can eavesdrop on sensitive data. Speed is not the security problem with open Wi-Fi. It does not inherently require more access points. It does not block internet access; the risk is exposure, not loss of connectivity. -
A 'replay attack' on a network protocol succeeds when an attacker:
Correct answer: B. A replay attack captures legitimate messages, such as an authentication exchange, and resends them to impersonate the sender or repeat an action. Destroying a router physically is a different, physical attack. Renaming a file is a local file action, not a network replay. Lowering screen brightness is entirely unrelated to security. -
The main security purpose of an email gateway that performs SPF, DKIM and DMARC checks is to:
Correct answer: C. SPF, DKIM and DMARC verify that mail genuinely comes from the claimed domain, helping block spoofing and phishing. They do not encrypt the recipient's hard drive, an endpoint storage concern. Their purpose is anti-spoofing, not merely faster delivery. They do not translate languages, which is unrelated. -
Why is placing a database server directly in the internet-facing DMZ generally discouraged?
Correct answer: D. The DMZ is intentionally exposed to the internet, so sensitive databases should sit deeper in the protected internal network. Databases do not run faster simply by being outside the network. DMZ servers can use encryption, so that claim is false. Databases do not require public IPs to function; they are typically reached internally. -
A 'directory traversal' attack against a web server attempts to:
Correct answer: A. Directory traversal manipulates file path input (for example using ../ sequences) to reach files outside the intended web directory. Overloading the CPU is a resource exhaustion attack, not traversal. Cracking a Wi-Fi key is a wireless attack. Spoofing a MAC address is a Layer 2 technique, unrelated to file path manipulation. -
The first step in the identity and access management process, before authentication, is:
Correct answer: B. Identification is the initial claim of an identity, such as entering a username, which authentication then verifies. Authorization comes after authentication, deciding what the verified identity may do. Accounting records actions after access is granted, later still. Encryption protects data and is not a step in the identify-authenticate-authorize sequence. -
The 'crossover error rate' (CER) of a biometric system is the point where:
Correct answer: C. The CER is where the false acceptance rate and false rejection rate are equal, and a lower CER indicates a more accurate biometric system. It is not the point where all users are rejected, which would be an extreme false rejection setting. It is not where the system stops working. It says nothing about eliminating passwords. -
Role-based access control (RBAC) assigns permissions based on:
Correct answer: D. RBAC grants permissions according to a user's role or job function, simplifying administration as people move between defined roles. It is not based on personal preferences, which would be unmanageable and inconsistent. Time of day alone is a rule-based factor, not the basis of RBAC. The colour of the device is irrelevant to access decisions. -
An access control list (ACL) attached to a file specifies:
Correct answer: A. An ACL lists which subjects (users or groups) may perform which operations on the object it protects, such as read or write. It does not describe the file's compression ratio, a storage attribute. It says nothing about a power supply rating, a hardware spec. It has nothing to do with an office floor plan. -
OpenID Connect builds on OAuth 2.0 to add a standardized way to:
Correct answer: B. OpenID Connect adds an identity layer on top of OAuth 2.0, providing a standard way to authenticate users and share basic profile information. It does not encrypt hard drives, an endpoint storage function. It does not compress images, an unrelated task. It does not route packets, which is a network-layer function. -
Why are shared 'generic' accounts (for example one login used by a whole team) discouraged?
Correct answer: C. A shared account means actions cannot be attributed to an individual, eliminating accountability and complicating investigations. The difficulty of typing is irrelevant to the security objection. Shared accounts do not consume notably more disk space as the concern. They do not require biometric scanners, which is unrelated. -
A 'password spraying' attack differs from classic brute force because the attacker:
Correct answer: D. Password spraying tries a few common passwords against many accounts, staying under per-account lockout thresholds, unlike hammering one account. It does not encrypt accounts, which is not an attack technique here. It does not involve physically stealing the server. Sending spam is a different activity entirely. -
Assigning a new employee access by adding them to predefined role groups rather than copying a colleague's permissions is preferred because it:
Correct answer: A. Assigning predefined role-based access avoids copying a colleague's possibly excessive permissions, helping prevent privilege creep. It is generally faster and more consistent to administer, not slower. It does not remove the need for approval; access still follows process. It has nothing to do with eliminating authentication. -
An identity provider (IdP) in a federated SSO arrangement is the party that:
Correct answer: B. The identity provider authenticates users and issues assertions about their identity that relying (service) applications trust. Hosting a cafeteria menu is unrelated to identity federation. Physically guarding the data centre is a facilities role. Manufacturing laptops is a hardware supply function, not an IdP role. -
Why is enforcing account lockout after several failed login attempts a useful control, but with a trade-off?
Correct answer: C. Lockout slows password guessing, but an attacker can deliberately trigger lockouts to deny legitimate users access, so thresholds need balancing. It does not speed up logins; it can slow them when triggered. It does not remove the need for passwords. It does not encrypt the network, an unrelated control. -
A 'capability table' in access control is organized by:
Correct answer: D. A capability table is bound to a subject and lists the objects and rights that subject possesses, the row-wise view of the access matrix. Organizing by object and listing permitted subjects describes an access control list, the column-wise view. Time zone is not how the access matrix is structured. A hardware serial number is irrelevant to capability tables. -
The main reason to require re-authentication before a user performs a highly sensitive action (such as changing payment details) is to:
Correct answer: A. Step-up re-authentication confirms the legitimate user is present before a sensitive action, limiting damage from a hijacked or unattended session. The goal is not to slow the site down for its own sake. It is not about collecting more passwords. It has nothing to do with graphics quality. -
In the access control matrix model, the rows typically represent subjects and the columns represent:
Correct answer: B. In the access control matrix, columns represent objects (resources) and the cells specify each subject's rights to each object. Time of day is not an axis of the basic matrix model. Network speed is unrelated to the matrix structure. Encryption keys are not what the matrix's columns represent. -
Why is single sign-off (centralized session termination) an important companion to single sign-on?
Correct answer: C. If one credential unlocks many systems, logging off must reliably end access across them, or stale sessions remain a risk. It does not make login slower; it concerns sign-off. It does not double passwords; SSO reduces them. Encrypting the monitor is not a meaningful action. -
Audit logging that records which administrator changed a user's permissions and when primarily supports the AAA element of:
Correct answer: D. Recording who did what and when is accounting, the element of AAA that provides traceability and supports investigations. Authentication is proving identity, not recording actions. Authorization decides what is permitted, not the logging of changes. 'Acceleration' is not part of the AAA model. -
A 'walk-through' (structured review) test of a disaster recovery plan involves:
Correct answer: A. A walk-through has the team review the plan together step by step to confirm completeness and clarity, without disrupting systems. Actually failing over to the alternate site is a more disruptive parallel or full-interruption test, not a walk-through. Encrypting backups is unrelated to plan review. Shutting down production without warning would be a risky full-interruption test, not a structured review. -
The key difference between a vulnerability assessment and an audit is that an audit primarily:
Correct answer: B. An audit checks whether controls comply with defined requirements or standards, providing formal assurance. Scanning only for missing patches is closer to a vulnerability assessment, narrower than an audit. Encrypting findings is not the defining feature of an audit. Exploiting weaknesses to prove impact describes penetration testing, not an audit. -
When interpreting CVSS scores for prioritization, a higher base score generally indicates:
Correct answer: C. A higher CVSS base score reflects greater inherent severity, so such findings usually deserve higher remediation priority. A higher score does not mean less severe; that is backwards. The score does not indicate a vulnerability is fictional. CVSS measures severity, not the dollar cost of remediation. -
The main reason to use both automated scanning and manual testing in a security assessment is that:
Correct answer: D. Automated tools efficiently surface common, signature-based issues, while skilled manual testing uncovers business-logic and contextual flaws that tools overlook. Automation alone does not catch every issue, especially logic flaws. Manual testing is usually more expensive, not cheaper. Regulations do not forbid automation; both approaches are encouraged. -
A 'parallel test' of a disaster recovery plan means the organization:
Correct answer: A. A parallel test activates the recovery site and processes work alongside live production to verify it functions, without taking production down. Only discussing the plan is a walk-through, a lower-impact test. Deleting production data is destructive and not a valid test. Encrypting the recovery site is unrelated to testing the plan. -
Why is it important to retest a vulnerability after the fix is applied (validation)?
Correct answer: B. Retesting verifies that the fix genuinely closed the vulnerability and did not create new issues, closing the remediation loop. It is not done merely to lengthen the report. Retesting does not encrypt the system. Retesting is necessary precisely because applied fixes can fail or be incomplete. -
Reviewing a representative subset of records rather than every record during an audit is called:
Correct answer: C. Sampling examines a representative subset of records to draw conclusions efficiently when reviewing everything is impractical. Tokenization replaces sensitive values with tokens, unrelated to audit method. Encryption protects data confidentiality, not an audit technique. Segmentation isolates network zones and is not an audit approach. -
A 'red team' engagement differs from a standard penetration test mainly because it:
Correct answer: D. A red team emulates a determined real-world adversary across people, processes and technology, often covertly, to test detection and response. It does more than document missing patches, which is a narrow scan output. Red teaming is usually longer and more costly, not cheaper. It often includes social engineering rather than avoiding it. -
The purpose of including a 'remediation timeline' with severity ratings in an assessment report is to:
Correct answer: A. A remediation timeline tied to severity gives owners clear, risk-based deadlines so the most dangerous findings get fixed soonest. It is not about making the document colourful. It does not hide findings; it organizes their resolution. It does not encrypt the report, which is unrelated. -
Why should security testing in a production environment be carefully controlled and authorized?
Correct answer: B. Active testing against production can disrupt services, corrupt data or be mistaken for a real attack, so it must be authorized and controlled. Testing does not inherently speed up production. Production can be tested, but carefully, so the claim that it cannot is false. Authorization does not make testing free; cost is a separate matter. -
A 'full interruption' test of a business continuity plan is the most thorough but also the riskiest because it:
Correct answer: C. A full interruption test stops primary operations to prove the recovery site can truly take over, giving the strongest assurance but the highest disruption risk. Only reviewing documents is a walk-through, not a full interruption. It does involve real systems, which is why it is risky. It is among the most costly and risky options, not the cheapest. -
Tracking metrics such as mean time to detect (MTTD) and mean time to respond (MTTR) helps a security program by:
Correct answer: D. MTTD and MTTR quantify detection and response speed, letting the program track and improve its incident-handling performance over time. Encrypting metrics is not their purpose. They depend on, rather than remove, monitoring. They cannot guarantee zero incidents; they measure how incidents are handled. -
Why is comparing assessment results against a defined baseline useful over time?
Correct answer: A. Measuring against a baseline reveals trends, showing whether security is improving, holding steady or worsening so action can be taken. It is not about shortening the report. Baselines do not encrypt data. They inform control decisions rather than removing the need for controls. -
The main reason an auditor collects and retains evidence for findings is to:
Correct answer: B. Retaining evidence lets the auditor substantiate each finding and defend conclusions if they are later questioned. Increasing storage cost is a side effect, not the reason. Collecting evidence is part of doing the audit properly, not a way to slow it. Evidence supports, rather than replaces, the testing that produced it. -
The first action when a serious security incident is confirmed, after ensuring people are safe, is usually to:
Correct answer: C. Once safety is assured, activating the incident response plan and mobilizing the team ensures a coordinated, prepared response. Publicly posting about it is uncontrolled disclosure that can worsen the situation. Deleting logs destroys evidence needed to investigate. Reformatting systems immediately would destroy evidence and skip containment and analysis. -
The 'eradication' phase of incident response is where the team:
Correct answer: D. Eradication removes the root cause, such as deleting malware and disabling compromised accounts, so the threat no longer persists. Identifying that an incident occurred is the detection phase. Limiting immediate spread is containment, which precedes eradication. Writing the after-action report is the lessons-learned phase at the end. -
A 'warm site' as a recovery facility is best characterized as one that has:
Correct answer: A. A warm site sits between cold and hot, with hardware and connectivity ready but needing recent data and final configuration before it can operate. Having nothing but a contract is closer to a cold or reciprocal arrangement. Being fully running and synchronized at all times describes a hot site. Only office furniture would be an under-equipped cold site. -
Why does CISSP guidance place 'lessons learned' as a distinct final phase of incident response?
Correct answer: B. The lessons-learned phase reviews what happened and feeds improvements back into preparation, strengthening future response. Its goal is improvement, not assigning blame, which discourages honest reporting. It should not be skipped; it is what closes the loop. It is not about encrypting incident data. -
Correlating external threat intelligence feeds with internal logs primarily helps operations teams to:
Correct answer: C. Matching external threat intelligence against internal logs surfaces known malicious indicators and helps prioritize relevant emerging threats. It does not reduce electricity costs. It is not a log-compression technique. It does not replace the firewall, which performs a different control function. -
Why are administrators advised to use separate accounts for routine work and for privileged administration?
Correct answer: D. Using a separate privileged account means a phishing or malware hit on the everyday account does not instantly grant admin rights, limiting blast radius. It is not about using more usernames for amusement. Privileged accounts still require strong authentication, not none. The goal is containment, not slowing logins. -
The principle of 'least privilege for service accounts' means service accounts should:
Correct answer: A. Service accounts should hold only the minimal rights their service requires, limiting damage if the account is compromised. Running every service as full administrator violates least privilege and widens risk. Sharing one password across services destroys isolation and accountability. Service accounts should be monitored, not exempt from oversight. -
A 'cold site' is the cheapest recovery option but has the longest recovery time because it:
Correct answer: B. A cold site offers only space, power and cooling, so equipment and data must be installed and configured, making recovery slow but cheap. Being fully operational at all times describes a hot site, the opposite. Real-time data synchronization is a hot-site feature. Preconfigured ready-to-run servers describe a warm or hot site, not a cold one. -
Why should an organization define and rehearse a communication plan as part of incident response?
Correct answer: C. A rehearsed communication plan ensures the right people, including regulators and customers, get accurate and timely updates through approved channels during a crisis. It is not aimed at gaining social media followers. Communication is highly relevant to managing an incident, not irrelevant. It is not about permanently encrypting all phone calls. -
The operations practice of 'configuration management' primarily helps security by:
Correct answer: D. Configuration management records and controls how systems are set up, so drift and unauthorized or insecure changes can be detected and corrected. It has nothing to do with screen brightness. It is not a headcount-reduction tool. It does not translate documents, an unrelated function. -
During the recovery phase of incident response, monitoring restored systems closely is important because:
Correct answer: A. Heightened monitoring after recovery catches signs that an attacker persisted through a backdoor and is attempting to return. Monitoring does not meaningfully slow systems as a reason to avoid it. Recovery does not make further compromise impossible, which is why vigilance is needed. Monitoring does not encrypt systems. -
Why is it best practice to store at least one backup copy offsite or in a separate region?
Correct answer: B. Keeping a backup offsite ensures a localized disaster such as fire or flood cannot wipe out both the live data and its only backup. Offsite copies are not chosen for faster loading. Offsite storage still requires security; the data remains sensitive. It does not remove the need to test restores, which remains essential. -
A 'jump server' (jump box) used to administer sensitive systems improves security by:
Correct answer: C. A jump server centralizes admin access through a single hardened, closely monitored host, reducing exposure of sensitive systems. Allowing direct internet access to every server is the opposite of what a jump server provides. It does not remove the need for authentication; it adds a controlled chokepoint. Encrypting office printers is unrelated. -
Why should an organization log and review privileged user activity more closely than ordinary user activity?
Correct answer: D. Privileged actions can cause far more harm, so closer logging and review deter and detect misuse where the impact is highest. The reason is the power of the actions, not an assumption that the people are inherently untrustworthy. Logging privileged users is encouraged, not forbidden. Ordinary users should also be logged, just typically with less scrutiny. -
The purpose of an emergency 'break-glass' procedure for privileged access is to:
Correct answer: A. A break-glass procedure grants emergency privileged access under strict control and heavy logging when normal paths are unavailable, then is reviewed. It does not hand everyone permanent admin rights. Logging should be intensified, not disabled, during such use. It is a narrow access mechanism, not a replacement for the disaster recovery plan. -
Why does the manager mindset favour containing an active breach before immediately rebuilding affected servers?
Correct answer: B. Containing first stops the bleeding and preserves evidence, so the team understands scope and root cause before rebuilding. Rebuilding first is not always faster and can destroy evidence and miss persistence. Containment is a standard, legal response step. Servers certainly can be rebuilt; the issue is sequencing. -
The OWASP Top Ten is best described as:
Correct answer: C. The OWASP Top Ten is a widely used awareness document highlighting the most critical web application security risks. It is not a ranking of programming language speed. It is not a hardware benchmark. It is not a network routing protocol, which is unrelated to application security awareness. -
Insecure deserialization vulnerabilities arise when an application:
Correct answer: D. Insecure deserialization occurs when untrusted serialized data is reconstructed without validation, letting attackers tamper with objects or execute code. Aggressive image compression is a media concern, not a deserialization flaw. Excessive code comments are a style issue, not a vulnerability. Storing logs offsite is an operations practice, unrelated to deserialization. -
The principle of 'complete mediation' in secure software design requires that:
Correct answer: A. Complete mediation means every access to a resource is checked against authorization each time, preventing reliance on stale, cached decisions. Writing all code in one language is unrelated to mediation. Never updating software is poor practice and not what the principle means. Letting users choose their own permissions undermines authorization rather than mediating it. -
Why is it important to validate the authorization of a request server-side even after a user is authenticated?
Correct answer: B. Being authenticated only proves identity; the server must still enforce that the user is authorized for each resource, or broken access control results. Authentication and authorization are distinct steps, not the same thing. The concern is security, not database speed. Clients cannot be trusted to enforce authorization, so the server must. -
A cross-site request forgery (CSRF) attack tricks a logged-in user's browser into:
Correct answer: C. CSRF abuses a user's existing authenticated session to make their browser send an unintended state-changing request to a trusting site. It is not about mining cryptocurrency, a different abuse. It does not format the hard drive. It does not disable the monitor; these are unrelated to forged web requests. -
Using a 'least privilege' database account for a web application means the application's database user should:
Correct answer: D. Granting the application's database account only the rights it needs limits the damage if the application is compromised, for example by injection. Full administrator rights would let an attacker do far more harm. Sharing the account across applications removes isolation and accountability. Having no password leaves the database wide open. -
Why is it risky to trust data from a hidden HTML form field or a client-side cookie for pricing or access decisions?
Correct answer: A. Anything stored client-side, including hidden fields and cookies, can be altered by the user, so the server must independently verify it. Load speed is irrelevant to the security risk. Cookies are not encrypted by default and can be read and changed. Hidden fields are not invisible to attackers; they can inspect and edit them. -
Code signing of a software package primarily provides:
Correct answer: B. A code signature lets users verify who published the software and that it has not been tampered with since it was signed, providing integrity and authenticity. It does not make installation faster. It does not reduce file size; a signature adds a little data. It does not automatically fix bugs. -
Why is maintaining a software bill of materials (SBOM) increasingly recommended?
Correct answer: C. An SBOM catalogs the components and dependencies in software, enabling teams to track which are affected when a new vulnerability is disclosed. It is not a marketing feature list. It does not encrypt source code. It has no effect on user-interface speed. -
Separating the development, testing and production environments primarily serves to:
Correct answer: D. Separate environments keep unfinished or risky changes and test data away from live systems and real customer data, reducing the chance of harm. Adding servers for its own sake is not the goal; the goal is isolation. It is not meant to deliberately slow developers. It does not remove the need for backups, which protect data regardless. -
Why should an application enforce contextual output encoding when displaying user-supplied content in a web page?
Correct answer: A. Encoding user-supplied content for the output context ensures any injected markup or script is treated as data, not executed, preventing XSS. It is not about making text bigger. It is not a compression technique. It does not translate content; the purpose is preventing script injection. -
A web application that lets a user change a numeric account ID in the URL and view another user's data suffers from:
Correct answer: B. Allowing a user to alter an identifier and access data that is not theirs is an insecure direct object reference, a broken object-level authorization flaw. A power supply fault is a hardware issue, not an application authorization flaw. A DNS misconfiguration affects name resolution, not record-level access. A printer driver bug is entirely unrelated to web authorization.
Practice questions FAQ
- Are these real CISSP exam questions?
- No. These are original study questions written to test understanding. They are not real exam questions, exam dumps, or copied from any provider.
- How should I use these practice questions?
- Answer each one, read the explanation (including why the wrong options are wrong), and use the per-domain score below to focus your revision on weak areas. Revisit before exam day.
- How many questions should I do before the exam?
- Enough to score consistently across every domain, alongside full-length practice from official or reputable providers. Understanding why each answer is right matters more than raw volume.
- What score means I am ready?
- A good signal is consistently scoring around 80% or higher across all domains on questions you have not seen before, and being able to explain why the wrong options are wrong.
- Should I use exam dumps?
- No. Dumps (real or leaked questions) breach provider policy, can void your certification, and do not build the understanding the exam actually tests.