121 free ISC2 CISSP practice questions from the CertStash pack of 484, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 121 free here, all 484 in the pack, and each step includes the one before it.
Get all 484 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Physical assets defined in an organization's business impact analysis (BIA) could include which of the following?
Show answer and explanation
Correct answer: D. Supplies kept off-site a remote facility
Physical assets in a BIA are tangible items the organization owns and needs to continue operations. Supplies kept at a remote facility are physical assets that support business continuity. Personal belongings are not organizational assets, DR revenues are financial metrics not physical assets, and cloud-based applications are logical/virtual assets, not physical ones.
Why the other options are wrong
- A. Personal belongings belong to staff members, not the organization, and are not considered organizational assets in a BIA.
- B. DR line-item revenues are financial projections or accounting entries, not physical assets.
- C. Cloud-based applications are logical or virtual assets hosted remotely, not physical assets owned by the organization.
Question 2
When assessing the audit capability of an application, which of the following activities is MOST important?
Show answer and explanation
Correct answer: B. Determine if audit records contain sufficient information.
When assessing audit capability, the most critical activity is determining whether audit records contain sufficient information to support investigations and compliance. Sufficient information is foundational, without it, auditing is ineffective regardless of storage capacity or response procedures. While storage and procedures matter, the quality and completeness of logged data is the primary concern for audit effectiveness.
Why the other options are wrong
- A. Investigating suspicious activity is a response action that comes after audit records are deemed adequate.
- C. Storage allocation is important but secondary; inadequate storage becomes irrelevant if the records captured lack necessary detail.
- D. Security plan responses to audit failures are important for incident management but don't directly assess whether current audit capability is sufficient.
Question 3
An organization would like to implement an authorization mechanism that would simplify the assignment of various system access permissions for many users with similar job responsibilities. Which type of authorization mechanism would be the BEST choice for the organization to implement?
Show answer and explanation
Correct answer: A. Role-based access control (RBAC)
Role-based access control (RBAC) is specifically designed to simplify permission assignment by grouping users with similar job responsibilities into roles, then assigning permissions to those roles. This reduces administrative overhead and scales well. DAC places control with individual owners, content-dependent access is based on data sensitivity, and rule-based access uses conditional logic, none directly address simplifying bulk assignment for similar job roles.
Why the other options are wrong
- B. Discretionary access control requires individual owners to manage permissions, making it less efficient for assigning permissions to many similar users.
- C. Content-dependent access control bases decisions on data content characteristics, not user job responsibilities.
- D. Rule-based access control applies conditional logic but doesn't inherently simplify group assignment by job role.
Question 4
What is the PRIMARY reason for criminal law being difficult to enforce when dealing with cybercrime?
Show answer and explanation
Correct answer: A. Jurisdiction is hard to define.
Jurisdiction is the primary challenge in cybercrime enforcement because attacks cross borders instantly, making it unclear which country's laws apply and which law enforcement agency has authority. This fundamental jurisdictional ambiguity complicates investigation, prosecution, and enforcement more than other factors. While understaffing, extradition, and language barriers exist, they are secondary issues compared to the core jurisdictional problem.
Why the other options are wrong
- B. Understaffing is a resource issue but not the primary structural reason criminal law is difficult to enforce in cybercrime.
- C. Extradition treaty enforcement is challenging but is a consequence of jurisdictional issues, not the primary reason.
- D. Language barriers exist but are manageable through translation and are not the fundamental obstacle to enforcement.
Question 5
Wi-Fi Protected Access 2 (WPA2) provides users with a higher level of assurance that their data will remain protected by using which protocol?
Show answer and explanation
Correct answer: A. Extensible Authentication Protocol (EAP)
WPA2 uses the Extensible Authentication Protocol (EAP) framework to provide stronger authentication and encryption than earlier standards. EAP enables various authentication methods (EAP-TLS, EAP-PEAP, etc.) for secure Wi-Fi access. IPsec, SSL, and SSH are protocols for different purposes, IPsec operates at the network layer for VPNs, while SSL/SSH operate at transport or application layers, not as WPA2's core authentication mechanism.
Why the other options are wrong
- B. IPsec is a network-layer security protocol for VPNs, not the protocol WPA2 uses for Wi-Fi protection.
- C. SSL operates at the transport layer for HTTPS and other protocols, not as WPA2's authentication mechanism.
- D. SSH is an application-layer protocol for secure remote access, not the protocol underlying WPA2 wireless security.
Question 6
Which part of an operating system (OS) is responsible for providing security interfaces among the hardware, OS, and other parts of the computing system?
Show answer and explanation
Correct answer: D. Security kernel
The security kernel is the minimal subset of the operating system responsible for enforcing security policy and mediating all access to protected resources. It provides the security interfaces between hardware, the OS, and applications. While the reference monitor is a conceptual model for authorization decisions and the TCB includes all security-relevant components, the security kernel is the specific architectural component that implements these interfaces and protections at the OS level.
Why the other options are wrong
- A. The reference monitor is a conceptual model describing how access control should work, not the actual OS component providing the interfaces.
- B. The Trusted Computing Base is a broader concept encompassing all security-relevant components, not the specific architectural component providing interfaces.
- C. Time separation is a scheduling technique for isolating processes, not the component providing security interfaces among hardware, OS, and applications.
Question 7
What process facilitates the balance of operational and economic costs of protective measures with gains in mission capability?
Show answer and explanation
Correct answer: D. Risk management
Risk management is the process that systematically balances the costs of implementing protective security measures against the benefits and improvements to mission capability and operational resilience. It involves assessing risks, evaluating countermeasures, and making informed decisions about resource allocation for security controls. Performance testing measures capability, security audits evaluate compliance, and risk assessment is a component of risk management but not the overarching balancing process.
Why the other options are wrong
- A. Performance testing evaluates system or application capability but doesn't address the balance between security costs and mission gains.
- B. Risk assessment identifies and analyzes risks but is a component within risk management, not the overarching balancing process.
- C. Security audit evaluates compliance with policies and standards but doesn't directly balance protective costs with mission capability gains.
Question 8
Clothing retailer employees are provisioned with user accounts that provide access to resources at partner businesses. All partner businesses use common identity and access management (IAM) protocols and differing technologies. Under the Extended Identity principle, what is the process flow between partner businesses to allow this IAM action?
Show answer and explanation
Correct answer: B. Clothing retailer acts as identity provider (IdP), confirms identity of user using industry standards, then sends credentials to partner businesses that act as a Service Provider and allows access to services.
Under Extended Identity principles, the clothing retailer acts as an identity provider (IdP) that authenticates its own users using industry-standard protocols and then sends security assertions or credentials to partner businesses, which act as service providers. This federated identity model allows the IdP to vouch for user identity to multiple service providers without those providers needing to authenticate the user directly. User Self Service is not a valid IAM role, and the clothing retailer cannot be the Service Provider for its own employees accessing partner resources.
Why the other options are wrong
- A. User Self Service is not a standard IAM role in federated identity models, and this flow incorrectly positions the clothing retailer in a non-standard role.
- C. This reverses the roles, the clothing retailer cannot be a Service Provider for its own users; it must be the IdP that authenticates them.
- D. Access Control Provider is not a standard IAM role, and this doesn't reflect the actual federated identity pattern where an IdP authenticates users for multiple service providers.
Question 9
Which of the following statements BEST describes least privilege principle in a cloud environment?
Show answer and explanation
Correct answer: A. A single cloud administrator is configured to access core functions.
Least privilege principle means granting users and administrators only the minimum access necessary to perform their job functions. Option A directly describes this by limiting a single administrator to only core functions they need, rather than giving broad access. This is the foundational security concept that minimizes potential damage from compromised accounts or insider threats.
Why the other options are wrong
- B. Inspecting all incoming and outgoing packets describes intrusion detection/prevention, not least privilege access control.
- C. Regularly updating routing configurations is a network maintenance task unrelated to least privilege.
- D. Keeping network segments private is network segmentation, which is a defense-in-depth strategy but not the definition of least privilege.
Question 10
An organization has been collecting a large amount of redundant and unusable data and filling up the storage area network (SAN). Management has requested the identification of a solution that will address ongoing storage problems. Which is the BEST technical solution?
Show answer and explanation
Correct answer: D. Deduplication
Deduplication is the best solution for redundant and unusable data filling a SAN. It identifies and eliminates duplicate data blocks, storing only one copy and using pointers for references. This directly addresses the problem of redundant data consuming storage space while maintaining data availability and is more effective than compression for datasets with high redundancy.
Why the other options are wrong
- A. Compression reduces file size but doesn't eliminate redundant copies of the same data across the SAN.
- B. Caching improves performance for frequently accessed data but doesn't reduce overall storage consumption.
- C. Replication creates additional copies of data, which would worsen the storage problem rather than solve it.
What people say about the full CISSP pack 4.9 from 26
Certstash is the best site for dumps! I passed my CISSP exam with their help and now feel like anyone can do it. They have thorough, up-to-date content that will get you more than 80% on your paper - Highly recommended!!
Thanks Certstash Today I have Successfully pass my exam with your cissp dumps. Thanks once again.
I am grateful to this Cert Stash for providing such premium quality resources which allowed me to pass my CISSP exam by a score of 960/1000. I highly recommended Cert Stash for best preparation of this exam.
Question 11
Which is MOST important when negotiating an Internet service provider (ISP) service-level agreement (SLA) by an organization that solely provides Voice over Internet Protocol (VoIP) services?
Show answer and explanation
Correct answer: D. Availability of network services
For an organization providing only VoIP services, availability of network services is the MOST important SLA metric. VoIP is entirely dependent on network connectivity; any unavailability directly prevents the company from delivering its core product and generates immediate revenue loss. While other metrics matter, guaranteed service availability is the foundation that must be prioritized in the SLA negotiation.
Why the other options are wrong
- A. MTTR is important but secondary to ensuring availability does not occur in the first place.
- B. QoS between applications is relevant but less critical than overall network availability for a VoIP-only provider.
- C. Financial penalties are important for risk mitigation but do not prevent service disruption; availability guarantees are more valuable.
Question 12
Which of the following encryption technologies has the ability to function as a stream cipher?
Show answer and explanation
Correct answer: C. Cipher Feedback (CFB)
Cipher Feedback (CFB) mode has the ability to function as a stream cipher because it converts block ciphers into stream ciphers by feeding back ciphertext to generate a keystream. CBC (A) is block-oriented with error propagation, ECB (B) is a basic block cipher mode without stream capabilities, and Feistel (D) is a cipher structure, not an encryption mode that functions as a stream cipher.
Why the other options are wrong
- A. CBC is a block cipher mode designed for block-by-block encryption, not stream cipher operation.
- B. ECB operates on fixed blocks independently and does not function as a stream cipher.
- D. Feistel is a cipher design structure, not an operational mode that can function as a stream cipher.
Question 13
Which of the following is the MOST comprehensive Business Continuity (BC) test?
Show answer and explanation
Correct answer: A. Full interruption
A full interruption test (also called a cutover test) is the most comprehensive BC test because it actually shuts down production systems and switches to backup/recovery systems in a real operating scenario. This provides the most complete validation that business continuity plans actually work under realistic conditions.
Why the other options are wrong
- B. A full simulation is less comprehensive than a full interruption because it simulates the scenario without actually interrupting real operations.
- C. A tabletop exercise is the least comprehensive test type, involving only discussion and walkthrough without actual system activation.
- D. A full functional drill tests specific functions but is less comprehensive than shutting down actual operations and testing the full cutover.
Question 14
Building blocks for software-defined networks (SDN) require which of the following?
Show answer and explanation
Correct answer: C. The SDN is mostly composed of virtual machines (VM).
Software-defined networks (SDN) are mostly composed of virtual machines (VMs). SDN architecture separates the control plane from the data plane and leverages virtualization to create flexible, programmable network infrastructure. The building blocks of SDN implementations typically include virtualized network functions and virtual machines that handle network services, making VMs fundamental to SDN composition.
Why the other options are wrong
- A. SDN is not composed entirely of client-server pairs; it uses a more complex control plane and data plane architecture.
- B. RAM preference over virtual memory is a performance consideration unrelated to SDN architectural requirements.
- D. Virtual memory preference over RAM is not a requirement for SDN building blocks; this is not an architectural characteristic of SDN.
Question 15
A company developed a web application which is sold as a Software as a Service (SaaS) solution to the customer. The application is hosted by a web server running on a specific operating system (OS) on a virtual machine (VM). During the transition phase of the service, it is determined that the support team will need access to the application logs. Which of the following privileges would be the MOST suitable?
Show answer and explanation
Correct answer: B. Administrative privileges on the application folders
Administrative privileges on the application folders is the most suitable access level for a support team needing to review application logs. This grants the minimal necessary access to retrieve logs without exposing the web server, operating system, or hypervisor to unnecessary administrative access. This follows the principle of least privilege.
Why the other options are wrong
- A. Hypervisor administrative access is excessive and grants control over all VMs and infrastructure.
- C. Web server administrative privileges exceed what is needed to read application logs.
- D. Operating system administrative access grants broader system control than required for log access.
Question 16
What is the FIRST step in risk management?
Show answer and explanation
Correct answer: A. Identify the factors that have potential to impact business.
Identifying the factors that have potential to impact business is the first step in risk management. Before you can establish scope, identify controls, or engage stakeholders, you must first recognize and identify what risks exist. Risk identification is the foundation upon which all subsequent risk management activities are built, including scope determination and control assessment.
Why the other options are wrong
- B. Establishing scope and actions comes after identifying the risks that need to be managed.
- C. Identifying existing controls is part of the risk assessment process, which follows initial risk identification.
- D. Establishing stakeholder expectations typically occurs early but after understanding what risks need to be managed and communicated.
Question 17
A financial services organization has employed a security consultant to review processes used by employees across various teams. The consultant interviewed a member of the application development practice and found gaps in their threat model. Which of the following correctly represents a trigger for when a threat model should be revised?
Show answer and explanation
Correct answer: D. A new data repository is added.
A new data repository represents a material change to the system's architecture and data handling, which directly impacts the threat landscape. New data types, storage mechanisms, and access patterns introduce new threats that must be modeled. OS patches and firewall rule changes are operational maintenance but don't fundamentally alter the system design or data flow. Hiring a new developer doesn't inherently trigger threat model revision unless accompanied by architectural changes.
Why the other options are wrong
- A. OS patches are maintenance activities that don't change the system's threat landscape or architecture.
- B. Hiring a developer doesn't change the system design or threat model unless they contribute architectural modifications.
- C. Firewall rule changes are operational adjustments but don't alter the fundamental threats to the application or system.
Question 18
Which of the following is an indicator that a company's new user security awareness training module has been effective?
Show answer and explanation
Correct answer: C. Fewer incidents of phishing attempts are being reported.
An effective security awareness training program should result in better user behavior and decision-making, directly leading to fewer successful attacks. Phishing attempts may still occur at similar rates, but when trained employees recognize and report suspicious emails, reported incidents increase while successful compromises decrease. The key indicator of effectiveness is fewer successful phishing compromises, demonstrating that users are now properly identifying and avoiding phishing attempts.
Why the other options are wrong
- A. Secure connections to email servers relate to technical controls, not awareness training effectiveness.
- B. More reported phishing attempts could indicate better detection, but without context about successful compromises, this doesn't prove training effectiveness.
- D. Database server connections relate to technical security configurations, not user awareness training.
Question 19
An organization is setting a security assessment scope with the goal of developing a Security Management Program (SMP). The next step is to select an approach for conducting the risk assessment. Which of the following approaches is MOST effective for the SMP?
Show answer and explanation
Correct answer: B. Business processes based risk assessment with a focus on business goals
A business processes based risk assessment with focus on business goals is most effective for developing a Security Management Program because it aligns security controls and risk mitigation directly with organizational objectives. This ensures that security investments protect what matters most to the business and supports strategic decision-making. While other approaches address specific domains (controls, assets, or data), a business-centric approach provides the holistic foundation needed for a comprehensive SMP that balances security with business enablement.
Why the other options are wrong
- A. Controls-driven assessment focuses on implementation details rather than business alignment needed for SMP development.
- C. Asset-driven assessment is too narrow and doesn't address the broader business context and goals.
- D. Data-driven assessment addresses only one data dimension and lacks the comprehensive business process perspective required for SMP.
Question 20
The acquisition of personal data being obtained by a lawful and fair means is an example of what principle?
Show answer and explanation
Correct answer: A. Collection Limitation Principle
The Collection Limitation Principle is the correct answer. This principle, foundational to data protection frameworks like the OECD Guidelines and GDPR, establishes that personal data should be obtained lawfully and fairly, with appropriate consent and transparency. It restricts the collection of personal data to what is necessary and requires that collection methods be legitimate, directly addressing the scenario of obtaining personal data through lawful and fair means.
Why the other options are wrong
- B. The Openness Principle concerns transparency about data practices, not the lawful and fair means of collection itself.
- C. The Purpose Specification Principle addresses what data will be used for, not the method of obtaining it.
- D. The Data Quality Principle ensures accuracy and relevance of collected data, not the fairness of the collection process.
Question 21
What is a security concern when considering implementing software-defined networking (SDN)?
Show answer and explanation
Correct answer: B. It increases the attack footprint.
A primary security concern with Software-Defined Networking (SDN) is that it increases the attack footprint. SDN separates the control plane from the data plane and centralizes network control, creating new potential attack vectors. The SDN controller becomes a high-value target, and vulnerabilities in the control plane can affect the entire network. Additionally, the APIs and communication channels between components introduce new security risks.
Why the other options are wrong
- A. SDN actually features a centralized control architecture (not decentralized), which is itself part of the security concern as it creates a single point of control and potential failure.
- C. While SDN may use open standards, the use of open source protocols is not inherently a security concern; proper implementation and patching address any vulnerabilities.
- D. SDN is not inherently cloud-based; it can be deployed on-premises, and cloud deployment is not the primary security concern associated with SDN architecture.
Question 22
A subscription service which provides power, climate control, raised flooring, and telephone wiring but NOT the computer and peripheral equipment is BEST described as a:
Show answer and explanation
Correct answer: A. cold site.
A cold site is a facility that supplies the basic environment (power, climate control, raised flooring and telephone wiring) but none of the computer or peripheral equipment, which the organization must bring in and install after a disaster. The question describes exactly this, so it is a cold site. A warm site would already hold some hardware, and a hot site would hold a full working copy of the systems.
Why the other options are wrong
- B. A warm site includes some of the computer equipment and connectivity; this service supplies none of the equipment.
- C. A hot site is fully equipped and nearly ready to run; this service has no computer or peripheral equipment.
- D. A reciprocal site is a mutual-aid agreement between two organizations to use each other's facilities; this is a subscription service.
Question 23
Which type of access control includes a system that allows only users that are type=managers and department=sales to access employee records?
Show answer and explanation
Correct answer: B. Attribute-based access control (ABAC)
Attribute-based access control (ABAC) makes access decisions based on attributes of the user (type=managers), attributes of the resource (department=sales), and environmental conditions. The system evaluates multiple attributes and their combinations to determine access. RBAC is based on predefined roles but would not typically reference specific attribute values like type and department in this manner. DAC and MAC are older models that do not support fine-grained attribute-based policies.
Why the other options are wrong
- A. RBAC uses predefined roles but does not typically evaluate multiple user and resource attributes in combination like this example.
- C. DAC grants permissions at the discretion of the resource owner but does not use attribute-based policy evaluation.
- D. MAC enforces access based on security labels and clearances, not user and resource attributes.
Question 24
A hospital enforces the Code of Fair Information Practices. What practice applies to a patient requesting their medical records from a web portal?
Show answer and explanation
Correct answer: D. Individual participation
Individual participation is the principle that allows individuals to access and review personal information held about them. When a patient requests their medical records from a web portal, they are directly exercising their right to view personal information maintained by the organization, which is a core tenet of Fair Information Practices.
Why the other options are wrong
- A. Purpose specification defines why data is collected, not how individuals access their own data.
- B. Collection limitation concerns what data is gathered, not patient access rights.
- C. Use limitation restricts how collected data is used, not the ability to access personal records.
Question 25
What is the MOST effective method to enhance security of a single sign-on (SSO) solution that interfaces with critical systems?
Show answer and explanation
Correct answer: A. Two-factor authentication
Two-factor authentication is the most effective method to enhance SSO security for critical systems because it adds an additional authentication layer beyond the password or primary credential. Even if an attacker compromises the SSO credentials, they would still need to bypass the second factor (such as a hardware token, biometric, or SMS code), making unauthorized access significantly more difficult. This is especially critical for SSO systems that provide access to multiple critical systems with a single compromise point.
Why the other options are wrong
- B. Reusable tokens actually weaken security by creating persistent credentials that can be intercepted or replayed.
- C. High performance encryption algorithms do not directly address authentication security or prevent credential compromise.
- D. While SSL protects data in transit, it does not prevent credential theft or unauthorized access to the SSO system itself.
Question 26
Which of the following is MOST important to follow when developing information security controls for an organization?
Show answer and explanation
Correct answer: B. Exercise due diligence with regard to all risk management information to tailor appropriate controls.
Exercising due diligence with regard to all risk management information allows organizations to tailor controls appropriately to their specific risks, environment, and requirements. This risk-based approach is more effective than blindly following standards or choosing controls based on stringency alone, as it ensures controls address the organization's actual threat landscape and risk profile.
Why the other options are wrong
- A. Using only industry best practices without customization may not address organization-specific risks.
- C. Choosing the most stringent standard based on location can result in unnecessary costs and controls that don't fit the organization's actual risk.
- D. While risk assessment is important, this option doesn't emphasize the due diligence process of analyzing all risk management information to tailor controls.
Question 27
A company is attempting to enhance the security of its user authentication processes. After evaluating several options, the company has decided to utilize Identity as a Service (IDaaS). Which of the following factors leads the company to choose an IDaaS as their solution?
Show answer and explanation
Correct answer: A. In-house team lacks resources to support an on-premise solution.
Companies choose IDaaS solutions primarily because their in-house teams lack the resources, expertise, or capacity to support an on-premise identity management solution. IDaaS outsources the burden to a specialized vendor, reducing operational overhead. Option B is false (third-party solutions aren't inherently more secure), C is incorrect (vendors don't eliminate risk, they share it), and D contradicts the reason for choosing a cloud solution.
Why the other options are wrong
- B. Third-party solutions are not inherently more secure than well-implemented on-premise solutions.
- C. IDaaS transfers some risk to the vendor but doesn't eliminate organizational responsibility for security.
- D. In-house development provides more control but requires more resources, which contradicts the typical reason for choosing IDaaS.
Question 28
An application developer receives a report back from the security team showing their automated tools were able to successfully enter unexpected data into the organization's customer service portal, causing the site to crash. This is an example of which type of testing?
Show answer and explanation
Correct answer: D. Negative
Negative testing involves sending unexpected, invalid, or malformed data to the application to verify it handles errors gracefully. The scenario describes entering unexpected data that caused a crash, which is exactly what negative testing identifies, how the application behaves with invalid inputs.
Why the other options are wrong
- A. Performance testing measures response times and throughput, not error handling with invalid data.
- B. Positive testing validates that the application works correctly with valid inputs.
- C. Non-functional testing is a broad category covering performance, security, and usability, but negative testing is the specific technique being demonstrated.
Question 29
In the "Do" phase of the Plan-Do-Check-Act model, which of the following is performed?
Show answer and explanation
Correct answer: C. Ensure the business continuity policy, controls, processes, and procedures have been implemented.
In the Do phase of PDCA, the organization implements and executes the business continuity policy, controls, processes, and procedures that were planned in the Plan phase. This is the execution/implementation phase where the documented strategies and frameworks are actually deployed operationally across the organization.
Why the other options are wrong
- A. This describes the Act phase, which involves corrective actions and improvements based on review results.
- B. This describes the Check phase, which monitors performance and reports results to management.
- D. This describes the Plan phase, where objectives and procedures are initially established.
Question 30
Which of the following is the strongest physical access control?
Show answer and explanation
Correct answer: D. Biometrics, a password, and badge reader
The strongest physical access control uses multiple independent factors: biometrics (something you are), a password (something you know), and a badge reader (something you have). This three-factor authentication approach provides defense in depth, an attacker would need to compromise all three authentication methods simultaneously to gain unauthorized access, making it significantly more robust than any two-factor combination.
Why the other options are wrong
- A. While biometrics plus password and PIN offer three factors, a PIN is typically the same as a password (both 'something you know'), reducing the effective factor diversity compared to option D.
- B. Individual passwords for each user address key management but do not represent multi-factor authentication, making this weaker than biometric-based solutions.
- C. Biometrics and badge reader offer only two factors (something you are and something you have), lacking the knowledge factor that adds security.
Question 31
Why is it important that senior management clearly communicates the formal Maximum Tolerable Downtime (MTD) decision?
Show answer and explanation
Correct answer: A. To provide each manager with precise direction on selecting an appropriate recovery alternative
Maximum Tolerable Downtime (MTD) is a critical metric that senior management must formally communicate because it directly guides all recovery strategy decisions. MTD represents the maximum duration a business function can be unavailable before causing unacceptable damage. When clearly communicated by senior management, it provides each manager with the quantitative threshold needed to select appropriate recovery alternatives, determining whether to invest in hot sites, cold sites, or other recovery mechanisms. This is the fundamental purpose of establishing and communicating MTD in business continuity planning.
Why the other options are wrong
- B. While demonstrating commitment to the board may be a secondary benefit, it is not the primary operational reason for communicating MTD.
- C. Internal audit requirements are administrative considerations, not the core business reason for establishing MTD.
- D. Regulatory compliance is important but is a downstream benefit of having a sound BCP; the direct purpose of communicating MTD is operational guidance for recovery decisions.
Question 32
What is the PRIMARY benefit of relying on Security Content Automation Protocol (SCAP)?
Show answer and explanation
Correct answer: A. Standardize specifications between software security products.
The Security Content Automation Protocol (SCAP) is fundamentally a standardization framework that enables interoperability and consistency in how security specifications, vulnerability information, and compliance configurations are expressed across different software security products and tools. Its primary benefit is standardizing specifications so that different vendors' tools can communicate and share security data in a common format.
Why the other options are wrong
- B. While SCAP can support compliance with international standards, this is an application of the standardization benefit, not the primary benefit itself.
- C. SCAP supports vulnerability assessment but primarily through standardization; it doesn't inherently improve capabilities beyond what tools already provide.
- D. Cost savings may result from standardization but is not the primary benefit; the core value is standardization and interoperability.
Question 33
Which of the following would an information security professional use to recognize changes to content, particularly unauthorized changes?
Show answer and explanation
Correct answer: A. File Integrity Checker
A File Integrity Checker specifically monitors and detects changes to files by comparing current file attributes (hash values, timestamps, permissions) against baseline records. This is the primary tool designed to recognize and alert on unauthorized modifications to content, making it the best answer for detecting unauthorized changes.
Why the other options are wrong
- B. While a SIEM system can aggregate log data about changes, it is not specifically designed to detect file content modifications.
- C. Audit logs record events but require manual review and don't automatically detect unauthorized file changes.
- D. An IDS detects network-based attacks and intrusions, not file content modifications on storage systems.
Question 34
Which of the following departments initiates the request, approval, and provisioning business process?
Show answer and explanation
Correct answer: C. Human resources (HR)
Human Resources (HR) initiates the request, approval, and provisioning business process for user access. HR is responsible for onboarding new employees, managing employment changes, and terminations, which triggers the formal access request process. HR initiates these requests based on job requirements, and the requests flow through approval workflows to IT for actual provisioning of systems and accounts.
Why the other options are wrong
- A. Operations manages system availability but does not initiate the user access request process.
- B. Security reviews and approves access but does not initiate the request process.
- D. IT provisions and manages accounts but receives initiated requests from HR rather than initiating them.
Question 35
A developer is creating an application that requires secure logging of all user activity. What is the BEST permission the developer should assign to the log file to ensure requirements are met?
Show answer and explanation
Correct answer: D. Append
The Append permission is the best choice for secure logging. Append allows applications to add new log entries without the ability to modify, delete, or read existing log entries. This ensures that once logs are written, they cannot be tampered with or altered by the application, maintaining the integrity and non-repudiation of the audit trail while still allowing ongoing logging functionality.
Why the other options are wrong
- A. Execute permission is not relevant to log file operations; logging does not require execution privileges.
- B. Read permission would allow the application to view log contents, which is unnecessary for logging and creates a security risk.
- C. Write permission allows modification and overwriting of existing log entries, enabling an attacker or compromised application to tamper with historical logs.
Question 36
Why is data classification control important to an organization?
Show answer and explanation
Correct answer: B. To ensure security controls align with organizational risk appetite
Data classification control is important because it enables an organization to align appropriate security controls with its risk appetite and business objectives. By classifying data according to sensitivity and criticality levels, the organization can apply proportionate protections that match the value and risk profile of each data category, ensuring resources are allocated efficiently and controls are appropriate to organizational priorities.
Why the other options are wrong
- A. While data classification can support data discovery efforts, enabling discovery is a secondary benefit rather than the primary importance of classification controls.
- C. Ensuring integrity, confidentiality, and availability is accomplished through the application of security controls guided by classification, not by the classification control itself.
- D. While data classification can inform retention policies, controlling retention specifically is a data governance function; the primary importance of classification is aligning controls to risk.
Question 37
When designing a business continuity plan (BCP), what is the formula to determine the Maximum Tolerable Downtime (MTD)?
Show answer and explanation
Correct answer: D. Recovery Time Objective (RTO) + Work Recovery Time (WRT)
Maximum Tolerable Downtime (MTD) is calculated as the sum of Recovery Time Objective (RTO) and Work Recovery Time (WRT). RTO is the time needed to restore the system to operational status, while WRT is the additional time required to verify data integrity, rebuild databases, and conduct other post-recovery activities. Together, RTO + WRT = MTD, representing the total time the business can tolerate being without the service.
Why the other options are wrong
- A. Estimated Maximum Loss (EML) is a financial metric that measures potential losses, not a component of the MTD formula.
- B. Business Impact Analysis (BIA) and Recovery Point Objective (RPO) are important planning elements but are not the formula for MTD; RPO relates to data loss tolerance, not downtime duration.
- C. Annual Loss Expectancy (ALE) is a risk calculation metric and Work Recovery Time is only half of the MTD equation; this pairing is incorrect.
Question 38
When auditing the Software Development Life Cycle (SDLC) which of the following is one of the high-level audit phases?
Show answer and explanation
Correct answer: A. Planning
Planning is a recognized high-level phase in SDLC auditing that forms the foundation for all subsequent audit activities. It involves defining audit scope, objectives, timelines, and resources. While risk assessment, due diligence, and requirements are important activities, Planning is the primary high-level phase that initiates the audit process in SDLC.
Why the other options are wrong
- B. Risk assessment is typically a component within planning or analysis phases, not a primary high-level SDLC audit phase.
- C. Due diligence is a general principle rather than a specific high-level audit phase.
- D. Requirements are part of the SDLC itself, not a high-level audit phase for auditing the SDLC.
Question 39
Which of the following is the MOST appropriate control for asset data labeling procedures?
Show answer and explanation
Correct answer: A. Categorizing the types of media being used
Categorizing the types of media being used is the most appropriate control for asset data labeling procedures. This establishes a classification scheme that enables proper identification, handling, and protection of different media types according to their sensitivity and requirements. This categorization is fundamental to implementing effective labeling procedures and ensures consistent asset management across the organization.
Why the other options are wrong
- B. Physical inventory logging is important but is a separate inventory control process rather than a labeling procedure control.
- C. Reviewing off-site storage access controls addresses access management, not the labeling procedure itself.
- D. Reviewing audit trails is a monitoring activity that does not establish labeling procedures or controls.
Question 40
Which of the following would qualify as an exception to the "right to be forgotten" of the General Data Protection Regulation (GDPR)?
Show answer and explanation
Correct answer: A. For the establishment, exercise, or defense of legal claims
Under GDPR, the right to be forgotten can be restricted when personal data is necessary for the establishment, exercise, or defense of legal claims. This exception recognizes that organizations must retain data when required by law or to protect their legal interests in ongoing or potential litigation, balancing privacy rights against legal obligations.
Why the other options are wrong
- B. Lawful processing and collection alone do not create an exception to the right to be forgotten under GDPR.
- C. Private interest is not an established exception under GDPR's right to be forgotten provisions.
- D. While data necessity is relevant, the specific exception cited in GDPR pertains to legal claims rather than general necessity for original purposes.
Question 41
A Simple Power Analysis (SPA) attack against a device directly observes which of the following?
Show answer and explanation
Correct answer: C. Consumption
Simple Power Analysis (SPA) is a side-channel attack technique that directly measures and analyzes the power consumption of a cryptographic device as it performs operations. By observing fluctuations in electrical current draw during cryptographic processing, attackers can infer information about the operations being performed and the data being processed. This is fundamentally different from analyzing magnetism, generation, or static discharge, SPA specifically targets the energy consumption patterns of the device.
Why the other options are wrong
- A. Magnetism is not the primary target of SPA; differential power analysis focuses on electromagnetic emissions, which is a separate attack vector.
- B. Generation is not what SPA measures; the analysis focuses on consumption of power, not its production.
- D. Static discharge is an environmental effect, not what SPA directly observes during cryptographic operations.
Question 42
Which of the following ensures old log data is not overwritten?
Show answer and explanation
Correct answer: A. Log retention
Log retention is the correct mechanism that ensures old log data is not overwritten by establishing policies for how long logs must be kept before deletion. It defines retention periods to preserve historical log data for compliance, forensics, and analysis purposes.
Why the other options are wrong
- B. Syslog is a protocol for log transmission and aggregation, not a method that prevents log overwriting.
- C. Increasing log file size allows more data before rotation occurs, but doesn't prevent overwriting without retention policies.
- D. Log preservation is a general concept but log retention is the specific technical control that prevents overwriting.
Question 43
Which of the following is MOST appropriate to collect evidence of a zero-day attack?
Show answer and explanation
Correct answer: A. Honeypot
A honeypot is the most appropriate tool to collect evidence of a zero-day attack because it is a deliberately vulnerable system designed to attract and deceive attackers while capturing detailed information about their methods, tools, and techniques. Since zero-day vulnerabilities are previously unknown, traditional signature-based detection tools like antivirus or firewalls cannot detect them. A honeypot allows security teams to observe the attack in a controlled environment, document the exploit mechanism, and gather intelligence about the vulnerability before it becomes widely known.
Why the other options are wrong
- B. Antispam is designed to filter email-based threats and has no capability to detect or analyze zero-day exploits.
- C. Antivirus relies on signature databases and cannot detect zero-day attacks by definition since the vulnerability is unknown.
- D. Firewalls can block network traffic based on rules but cannot detect zero-day exploits as they have no prior knowledge of the vulnerability.
Question 44
An organization is implementing security review as part of system development. Which of the following is the BEST technique to follow?
Show answer and explanation
Correct answer: A. Perform incremental assessments.
Performing incremental assessments is the best technique for security review as part of system development. This approach integrates security throughout the development lifecycle rather than as an afterthought, allowing vulnerabilities to be identified and remediated early, continuously improving security posture as the system evolves.
Why the other options are wrong
- B. Engaging a third-party auditor is important but is not the primary technique for ongoing security reviews during development.
- C. Reviewing security architecture is a component of assessment but is not itself the best overarching technique for continuous security review.
- D. Penetration testing is a valuable assessment method but typically occurs after development and is not the primary technique for continuous review during system development.
Question 45
What is the BEST method to use for assessing the security impact of acquired software?
Show answer and explanation
Correct answer: A. Threat modeling
Threat modeling is the best method for assessing security impact of acquired software because it systematically identifies potential threats, vulnerabilities, and attack vectors specific to the software's architecture and data flows. It provides a comprehensive view of security risks before deployment, which is essential when evaluating third-party or acquired software.
Why the other options are wrong
- B. Common vulnerability review only checks for known vulnerabilities without understanding the software's specific threat landscape.
- C. Software security compliance validation focuses on regulatory adherence rather than actual security risk assessment.
- D. Vendor assessment evaluates the vendor's practices but doesn't directly assess the security impact of the acquired software itself.
Question 46
What Hypertext Transfer Protocol (HTTP) response header can be used to disable the execution of inline JavaScript and the execution of eval() type functions?
Show answer and explanation
Correct answer: B. Content-Security-Policy
The Content-Security-Policy (CSP) header is specifically designed to disable the execution of inline JavaScript and prevent eval() function execution. CSP allows organizations to specify which sources of content are trusted and can be executed, effectively mitigating XSS attacks by restricting script execution.
Why the other options are wrong
- A. X-XSS-Protection is an older browser feature that attempts to detect and block XSS attacks but does not specifically prevent inline JavaScript execution.
- C. X-Frame-Options controls whether a page can be displayed in a frame and prevents clickjacking attacks, not inline JavaScript execution.
- D. Strict-Transport-Security enforces HTTPS connections and does not address JavaScript execution or eval() functions.
Question 47
Which of the following outsourcing agreement provisions has the HIGHEST priority from a security operations perspective?
Show answer and explanation
Correct answer: D. Escalation process for problem resolution during incidents
From a security operations perspective, establishing a clear escalation process for problem resolution during incidents is highest priority. This ensures that security issues and incidents are rapidly communicated, properly prioritized, and escalated to appropriate decision-makers, which is critical for minimizing incident impact and response time.
Why the other options are wrong
- A. Preventing subcontractor use is restrictive and not always practical; it's less critical than ensuring incident response procedures.
- B. Contract renegotiation terms address disaster recovery planning but are less immediately critical than active incident response procedures.
- C. Root cause analysis for application performance is important for operational improvement but is lower priority than real-time incident escalation processes.
Question 48
Which of the following is TRUE for an organization that is using a third-party federated identity service?
Show answer and explanation
Correct answer: C. The organization establishes a trust relationship with the other organizations
When using a third-party federated identity service, organizations establish a trust relationship with other organizations participating in the federation. This trust relationship enables the exchange and recognition of identity information across organizational boundaries without each organization having to manage authentication for external users independently.
Why the other options are wrong
- A. In federated identity, each organization retains control over authenticating its own users; they do not unilaterally specify authentication methods for other organizations.
- B. While organizations define internal identification standards, federated identity specifically involves establishing cross-organizational trust, not just internal standards.
- D. Organizations cannot enforce their user provisioning rules on other organizations in a federated relationship; each maintains autonomy over their own user management.
Question 49
A web developer is completing a new web application security checklist before releasing the application to production. The task of disabling unnecessary services is on the checklist. Which web application threat is being mitigated by this action?
Show answer and explanation
Correct answer: B. Security misconfiguration
Disabling unnecessary services directly mitigates security misconfiguration vulnerabilities. Unnecessary services represent attack surface that shouldn't exist and often have default configurations that are insecure. By removing them, the application reduces configuration complexity and potential exploitation points related to misconfigured or unused features.
Why the other options are wrong
- A. Session hijacking is addressed through session management controls, not service disabling.
- C. Broken access control is mitigated through proper authorization mechanisms, not by disabling services.
- D. Sensitive data exposure is addressed through encryption and data protection controls, not service disabling.
Question 50
Information security practitioners are in the midst of implementing a new firewall. Which of the following failure methods would BEST prioritize security in the event of failure?
Show answer and explanation
Correct answer: B. Fail-Closed
Fail-Closed is the security-prioritizing failure mode for firewalls. When a firewall fails in a closed state, all traffic is blocked by default, denying access until the firewall is restored. This conservative approach ensures that no unauthorized traffic can pass through during the failure, maintaining the security posture even at the cost of availability. This is the opposite of fail-open, which would allow all traffic through during failure, a dangerous scenario for security.
Why the other options are wrong
- A. Failover transfers control to a backup system but doesn't specify whether that system defaults to allowing or blocking traffic.
- C. Fail-safe is a general term for safe failure but doesn't guarantee security prioritization; it may prioritize safety differently than security.
- D. Fail-open allows all traffic through during failure, which prioritizes availability over security, the opposite of what's needed here.
Question 51
A cloud hosting provider would like to provide a Service Organization Control (SOC) report relevant to its security program. This report should an abbreviated report that can be freely distributed. Which type of report BEST meets this requirement?
Show answer and explanation
Correct answer: D. SOC 3
SOC 3 reports are designed for general distribution to the public and interested parties without restriction. They provide an abbreviated, summary-level report on the service organization's controls relevant to security, availability, and confidentiality. This is the only SOC report type intended for unrestricted public distribution.
Why the other options are wrong
- A. SOC 1 reports address internal controls relevant to financial reporting and are not security-focused.
- B. SOC 2 Type 1 reports contain detailed control descriptions and are restricted to authorized users under confidentiality agreements, not freely distributable.
- C. SOC 2 Type 2 reports contain extensive detail about control operation over time and are confidential, not for free public distribution.
Question 52
A large organization's human resources and security teams are planning on implementing technology to eliminate manual user access reviews and improve compliance. Which of the following options is MOST likely to resolve the issues associated with user access?
Show answer and explanation
Correct answer: C. Implement identity and access management (IAM) platform.
An IAM platform is the comprehensive solution for eliminating manual user access reviews and improving compliance. IAM systems provide automated provisioning, deprovisioning, access governance, and continuous compliance monitoring across all systems and applications. While PAM focuses on privileged accounts, RBAC is an access control model, and SSO handles authentication only, IAM encompasses the full lifecycle of identity and access management needed to automate reviews and compliance.
Why the other options are wrong
- A. PAM focuses specifically on privileged access management, not the full spectrum of user access reviews and compliance needed organization-wide.
- B. RBAC is an access control model but does not provide automated access reviews or compliance monitoring capabilities.
- D. SSO only addresses authentication and single login, not the comprehensive access governance and compliance review requirements.
Question 53
Which of the following factors should be considered characteristics of Attribute Based Access Control (ABAC) in terms of the attributes used?
Show answer and explanation
Correct answer: D. Role Based Access Control (RBAC) and Access Control List (ACL)
ABAC uses attributes and rules to make access decisions, combining characteristics of both Role-Based Access Control (RBAC) and Access Control Lists (ACL). RBAC attributes include roles, while ACL attributes include specific subject-object-permission relationships. ABAC is more granular and flexible than RBAC or DAC alone, incorporating both role-based elements and explicit permission lists based on various attributes (user, resource, environment, etc.).
Why the other options are wrong
- A. While ABAC can incorporate MAC principles, MAC is typically used in high-security environments with labels and clearances, which is not the primary characteristic framework for ABAC.
- B. DAC and ACL overlap significantly in function; ABAC is not primarily defined as a combination of these two traditional models.
- C. MAC is label-based and clearance-based, representing a different philosophy than ABAC's flexible attribute approach.
Question 54
What type of investigation applies when malicious behavior is suspected between two organizations?
Show answer and explanation
Correct answer: C. Civil
When malicious behavior occurs between two organizations, it typically falls under civil investigation where one organization pursues legal remedies against the other through civil courts. This differs from criminal investigation which involves law enforcement and the state, regulatory investigation which involves compliance bodies, or operational investigation which is internal.
Why the other options are wrong
- A. Regulatory investigations are conducted by regulatory bodies for compliance violations, not inter-organizational disputes.
- B. Operational investigations are internal to an organization for internal issues.
- D. Criminal investigations are conducted by law enforcement and the state, not initiated by one organization against another.
Question 55
When network management is outsourced to third parties, which of the following is the MOST effective method of protecting critical data assets?
Show answer and explanation
Correct answer: B. Employ strong access controls
When outsourcing network management, strong access controls are the most effective technical measure for protecting critical data assets. Access controls directly prevent unauthorized access by third-party personnel and limit what each user can do, following the principle of least privilege. While confidentiality agreements (A) and activity logging (C) are important, they are preventive/detective after the fact rather than preventive at the point of access. Policies (D) are guidance documents without enforcement mechanisms. Access controls actively restrict who can access what data, making them the most effective protective measure.
Why the other options are wrong
- A. Confidentiality agreements are legal protections but lack technical enforcement and do not prevent unauthorized access.
- C. Logging is a detective control that records what happened but does not prevent unauthorized access in the first place.
- D. Policy documents provide guidance but have no technical enforcement capability to actually prevent data access.
Question 56
A security professional was tasked with rebuilding a company's wireless infrastructure. Which of the following are the MOST important factors to consider while making a decision on which wireless spectrum to deploy?
Show answer and explanation
Correct answer: B. Performance, geographic location, and radio signal interference
When deploying wireless infrastructure, the most important factors are performance, geographic location, and radio signal interference. These factors directly impact the effectiveness and reliability of the wireless network. Geographic location determines available spectrum regulations, performance requirements must meet business needs, and interference management is critical for maintaining signal quality and coverage.
Why the other options are wrong
- A. Direct satellite service is not a relevant factor in wireless spectrum selection; intermodulation is a concern but facility size and satellite service are not primary spectrum decision factors.
- C. While client devices and manufacturer reputation matter, these are secondary to spectrum performance and environmental factors; electrical interference is less critical than radio signal interference.
- D. SSID is a network naming function unrelated to spectrum selection; hybrid frequency and interpolation are not standard spectrum selection criteria.
Question 57
Which of the following BEST describes centralized identity management?
Show answer and explanation
Correct answer: D. Service providers rely on a trusted third party (TTP) to provide requestors with both credentials and identifiers.
Centralized identity management is best described as relying on a trusted third party (TTP) to provide both credentials and identifiers to requestors. This approach consolidates identity and credential issuance in a single trusted authority, enabling consistent authentication and authorization across systems and organizations. The TTP acts as the authoritative source, reducing duplication and improving consistency compared to distributed identity management where each service provider manages its own credentials.
Why the other options are wrong
- A. This describes federated identity where each provider acts independently, not centralized management.
- B. This describes behavioral analysis or risk-based authentication, which is orthogonal to centralization of identity management.
- C. This describes federated identity across organizational boundaries, not the centralization model where a single TTP is authoritative.
Question 58
Which of the following is the PRIMARY purpose of installing a mantrap within a facility?
Show answer and explanation
Correct answer: C. Prevent piggybacking
A mantrap (also called a mantrap or turnstile) is a physical security control specifically designed to prevent piggybacking, the unauthorized entry of unauthorized persons by following an authorized person through a secured access point. It allows only one person per authentication event to pass through, making it impossible for someone to slip through behind an authorized user.
Why the other options are wrong
- A. While mantraps do control traffic flow, that is a secondary effect, not the primary security purpose.
- B. Mantraps have no relevance to air flow control in facilities.
- D. Preventing rapid movement is not the purpose; controlled, single-person entry is the goal.
Question 59
Which of the following is the PRIMARY goal of logical access controls?
Show answer and explanation
Correct answer: A. Restrict access to an information asset.
The primary goal of logical access controls is to restrict access to information assets. Logical access controls use authentication and authorization mechanisms (passwords, tokens, role-based access) to ensure that only authorized users can access specific data and systems. This directly addresses confidentiality by preventing unauthorized access.
Why the other options are wrong
- B. Ensuring availability is addressed through availability controls and redundancy mechanisms, not the primary goal of logical access controls.
- C. Restricting physical access is the role of physical access controls, not logical access controls.
- D. Ensuring integrity is addressed through integrity controls and change management, not the primary function of logical access controls.
Question 60
The security team plans on using automated account reconciliation in the corporate user access review process. Which of the following must be implemented for the BEST results with fewest errors when running the audit?
Show answer and explanation
Correct answer: D. Clear provisioning policies
Clear provisioning policies are essential for automated account reconciliation to work with minimal errors. When policies are well-defined and documented, the automated system can accurately match accounts to authorized roles and responsibilities, identify inconsistencies, and validate access without manual interpretation. This foundation ensures accuracy and consistency in the audit process.
Why the other options are wrong
- A. Frequency of audits improves detection but does not reduce errors in individual audit runs.
- B. Segregation of Duties is important for access control design but does not directly improve automated reconciliation accuracy.
- C. While service accounts may need special handling, removing them entirely from review would leave gaps; clear policies about their treatment is better than exclusion.
Question 61
An enterprise is developing a baseline cybersecurity standard its suppliers must meet before being awarded a contract. Which of the following statements is TRUE about the baseline cybersecurity standard?
Show answer and explanation
Correct answer: B. It should be expressed as technical requirements.
Baseline cybersecurity standards for suppliers should be expressed as technical requirements that specify concrete security controls, configurations, and capabilities suppliers must implement. Technical requirements provide clear, measurable, and verifiable standards that suppliers can implement and that the enterprise can audit, ensuring consistent security across the supply chain.
Why the other options are wrong
- A. General requirements lack the specificity and measurability needed for suppliers to understand exactly what must be implemented and for the enterprise to verify compliance.
- C. Business terminology alone does not provide the technical clarity necessary for implementation and verification of security controls.
- D. Legal terminology is appropriate for contractual frameworks but does not address the specific technical security controls and standards suppliers must meet.
Question 62
Using the cipher text and resultant cleartext message to derive the monoalphabetic cipher key is an example of which method of cryptanalytic attack?
Show answer and explanation
Correct answer: A. Known-plaintext attack
A known-plaintext attack occurs when an attacker has access to both the plaintext and corresponding ciphertext and uses this information to derive the cryptographic key. The scenario describes having both the ciphertext and the resultant cleartext message, which is precisely the definition of a known-plaintext attack. This is the most direct classification for the attack method described.
Why the other options are wrong
- B. Ciphertext-only attacks work with only encrypted data; this scenario includes plaintext.
- C. Frequency analysis examines letter frequency patterns but doesn't require paired plaintext-ciphertext pairs.
- D. Probable-plaintext attacks guess likely plaintext content; this scenario has confirmed cleartext, not probable guesses.
Question 63
What is the MINIMUM standard for testing a disaster recovery plan (DRP)?
Show answer and explanation
Correct answer: B. As often as necessary depending upon the stability of the environment and business requirements
The minimum standard for testing a disaster recovery plan is to test as often as necessary depending upon the stability of the environment and business requirements. There is no universal fixed frequency; testing frequency should be determined by risk assessment, environmental changes, and business criticality. Some organizations may need quarterly or more frequent testing, while others may require less frequent testing based on their specific circumstances.
Why the other options are wrong
- A. While quarterly testing may be appropriate for some organizations, it is not universally applicable as the minimum standard.
- C. Annual testing is typically too infrequent for business-critical systems and does not align with best practices for most organizations.
- D. Semi-annual testing tied to fiscal cycles is arbitrary and does not account for actual business requirements or environmental stability factors.
Question 64
While dealing with the consequences of a security incident, which of the following security controls are MOST appropriate?
Show answer and explanation
Correct answer: B. Corrective and recovery controls
When dealing with the consequences of a security incident, the organization must focus on stopping the damage and restoring normal operations. Corrective controls address and fix the issues caused by the incident, while recovery controls restore systems and data to their normal state. These are the most appropriate controls for the post-incident phase.
Why the other options are wrong
- A. Detective controls are used to identify incidents, not address their consequences; recovery controls alone lack the corrective measures needed to fix root causes.
- C. Preventative controls are proactive measures to stop incidents before they occur, not appropriate for handling current incident consequences.
- D. Proactive controls are forward-looking rather than focused on addressing current incident damage and restoration needs.
Question 65
Which of the following is the PRIMARY type of cryptography required to support non-repudiation of a digitally signed document?
Show answer and explanation
Correct answer: D. Asymmetric
Non-repudiation requires asymmetric cryptography because it depends on the mathematical properties of public and private key pairs. When a document is digitally signed using a private key, only the holder of that private key could have created the signature, and this can be verified using the corresponding public key. This creates undeniable proof of origin and prevents the signer from denying they created the signature. While hashing and message digests are components of digital signature schemes, asymmetric cryptography is the primary cryptographic type that enables non-repudiation.
Why the other options are wrong
- A. Hashing alone does not provide non-repudiation; it only ensures integrity without proving who created the hash.
- B. Message digest is a hashing function that provides integrity but not authentication or non-repudiation by itself.
- C. Symmetric cryptography cannot support non-repudiation because both parties share the same key, so either party could claim the other created the signature.
Question 66
Which of the following is an example of a vulnerability of full-disk encryption (FDE)?
Show answer and explanation
Correct answer: D. Data at rest has been compromised when the user has authenticated to the device.
A key vulnerability of full-disk encryption is that once a user authenticates and the disk is decrypted, data at rest becomes accessible in plaintext in memory and during use. An attacker with access to the unlocked device can compromise the data, and the protection is only effective when the device is locked. This represents the window of exposure after authentication.
Why the other options are wrong
- A. FDE does not prevent data restoration from backups; encrypted backups can be restored.
- B. FDE does not prevent backups; encrypted data can be backed up.
- C. Data in transit (network transmission) is a separate concern from FDE; FDE specifically protects data at rest on the disk.
Question 67
A company is planning to implement a private cloud infrastructure. Which of the following recommendations will support the move to a cloud infrastructure?
Show answer and explanation
Correct answer: A. Implement software-defined networking (SDN) to provide the ability to apply high-level policies to shape and reorder network traffic based on users, devices and applications.
Option A correctly describes how SDN supports cloud infrastructure by enabling high-level policy implementation to manage network traffic dynamically based on users, devices, and applications. This flexibility and programmability is essential for cloud environments where resources scale elastically and traffic patterns change rapidly. SDN's ability to apply policies without manual hardware reconfigurations makes it ideal for private cloud implementations.
Why the other options are wrong
- B. VLANs for departmental separation are traditional network segmentation, not cloud-optimized infrastructure design.
- C. While technically accurate about SDN's control/data plane separation, this describes SDN architecture rather than its specific benefit for cloud implementation.
- D. VLANs logically separate LANs but represent traditional networking approaches, not cloud infrastructure recommendations.
Question 68
What is the FIRST step in reducing the exposure of a network to Internet Control Message Protocol (ICMP) based attacks?
Show answer and explanation
Correct answer: A. Implement network access control lists (ACL).
The FIRST step in reducing ICMP-based attack exposure is to implement network access control lists (ACLs) that filter or rate-limit ICMP traffic at network boundaries and on interfaces. ACLs are fundamental, cost-effective controls that can immediately restrict ICMP packets (ping, traceroute, etc.) before more complex solutions are deployed. This provides baseline protection without requiring additional infrastructure.
Why the other options are wrong
- B. An IPS detects and prevents attacks but is a more sophisticated solution that comes after basic ACL filtering.
- C. A WAF protects web applications but is not designed for ICMP protocol attacks.
- D. Egress filtering addresses outbound traffic but the primary exposure to ICMP attacks typically comes from inbound traffic; ACLs at the boundary are the foundational first step.
Question 69
In a disaster recovery (DR) test, which of the following would be a trait of crisis management?
Show answer and explanation
Correct answer: A. Process
Process is the key trait of crisis management in a DR test context, as crisis management requires following structured, documented processes and procedures to respond effectively to incidents during the disaster recovery exercise. Crisis management depends on predetermined, well-defined processes rather than anticipation alone. Strategic (C) and wide focus (D) relate more to planning phases, while anticipate (B) is preparatory rather than a crisis management trait.
Why the other options are wrong
- B. Anticipate is a planning activity that occurs before crisis situations, not a trait of crisis management itself.
- C. Strategic thinking involves planning and scope, not the tactical execution needed during active crisis management.
- D. Wide focus applies to overall DR planning, not the focused, process-driven response during crisis management.
Question 70
Which one of the following BEST protects vendor accounts that are used for emergency maintenance?
Show answer and explanation
Correct answer: A. Vendor access should be disabled until needed
Disabling vendor access until it is actually needed for emergency maintenance is the most effective protective measure. This eliminates the attack surface by ensuring vendor credentials cannot be compromised or misused during normal operations. Access is only enabled when required and presumably monitored or time-limited during actual use.
Why the other options are wrong
- B. Monitoring access helps detect misuse but does not prevent compromise of inactive accounts.
- C. RBAC limits what actions vendors can perform but does not prevent unauthorized use of their accounts.
- D. Encryption of routing tables is unrelated to vendor account protection.
Question 71
An international organization has decided to use a Software as a Service (SaaS) solution to support its business operations. Which of the following compliance standards should the organization use to assess the international code security and data privacy of the solution?
Show answer and explanation
Correct answer: A. Service Organization Control (SOC) 2
Service Organization Control (SOC) 2 is the appropriate standard for assessing security, availability, and data protection of SaaS solutions across international boundaries. SOC 2 specifically addresses controls relevant to service providers and their handling of customer data, making it ideal for evaluating cloud-based service providers' security and privacy posture.
Why the other options are wrong
- B. IATF is focused on information assurance technical implementation details rather than comprehensive SaaS vendor assessment.
- C. HIPAA applies specifically to healthcare organizations and is not a general compliance standard for international SaaS security assessment.
- D. PCI DSS applies specifically to payment card data processors and is not appropriate for general international SaaS security compliance evaluation.
Question 72
Which of the following would be the BEST guideline to follow when attempting to avoid the exposure of sensitive data?
Show answer and explanation
Correct answer: D. Store sensitive data only when necessary.
The best guideline to avoid sensitive data exposure is to store sensitive data only when necessary. This principle of data minimization directly reduces risk by limiting the amount of sensitive data in the environment. Fewer copies of sensitive data means fewer exposure points, lower breach impact, and reduced compliance burden. This preventive approach is more effective than reactive monitoring or detection mechanisms.
Why the other options are wrong
- A. Monitoring mail servers for exfiltration is a detection control that only identifies breaches after they occur rather than preventing exposure.
- B. User education is important but is secondary to the foundational practice of not collecting and storing unnecessary sensitive data.
- C. Establishing report parameters helps track data but does not prevent exposure; it is a monitoring measure rather than a prevention measure.
Question 73
An organization is looking to include mobile devices in its asset management system for better tracking. In which system tier of the reference architecture would mobile devices be tracked?
Show answer and explanation
Correct answer: B. 1
In NIST and similar reference architectures, mobile devices are typically tracked in Tier 1, which represents edge devices and endpoints that connect to the organization's network. Tier 0 is usually reserved for the core data center/cloud infrastructure, while Tiers 2 and 3 represent increasingly remote or specialized systems. Mobile devices as user-accessible endpoints fit squarely within Tier 1's scope.
Why the other options are wrong
- A. Tier 0 typically represents core infrastructure and data centers, not mobile endpoint devices.
- C. Tier 2 usually represents intermediate systems and processing layers, not individual user devices.
- D. Tier 3 is typically the outermost or specialized tier, not the primary endpoint tracking tier.
Question 74
What is the PRIMARY consideration when testing industrial control systems (ICS) for security weaknesses?
Show answer and explanation
Correct answer: C. ICS are often sensitive to unexpected traffic.
The primary consideration when testing ICS for security is that they are often sensitive to unexpected traffic. ICS environments are designed for continuous operation and stability; introducing unexpected network traffic or security testing can disrupt critical operations, cause equipment damage, or trigger safety systems. This sensitivity requires careful, controlled testing approaches unlike typical IT systems.
Why the other options are wrong
- A. While some ICS run on specialized systems, many do not exclusively run UNIX, and this is not the primary security testing consideration.
- B. ICS actually have very high availability requirements; they cannot tolerate downtime for critical infrastructure.
- D. Although ICS may be isolated, this describes a characteristic but not the primary consideration for security testing methodology.
Question 75
Which access control method is based on users issuing access requests on system resources, features assigned to those resources, the operational or situational context, and a set of policies specified in terms of those features and context?
Show answer and explanation
Correct answer: B. Attribute Based Access Control (ABAC)
Attribute-Based Access Control (ABAC) is an access control method that makes authorization decisions based on attributes of users, resources, features assigned to those resources, operational or situational context, and a set of policies expressed in terms of those attributes and context. ABAC is highly flexible and allows fine-grained, context-aware access decisions beyond traditional role or identity-based approaches.
Why the other options are wrong
- A. Mandatory Access Control (MAC) uses centrally defined security labels and clearance levels set by administrators, not user requests or attribute-based policies.
- C. Role-Based Access Control (RBAC) grants access based on assigned user roles rather than attributes, features, and contextual conditions.
- D. Discretionary Access Control (DAC) allows resource owners to determine access, not policy-based decisions based on attributes and operational context.
Question 76
A network security engineer needs to ensure that a security solution analyzes traffic for protocol manipulation and various sorts of common attacks. In addition, all Uniform Resource Locator (URL) traffic must be inspected and users prevented from browsing inappropriate websites. Which of the following solutions should be implemented to enable administrators the capability to analyze traffic, blacklist external sites, and log user traffic for later analysis?
Show answer and explanation
Correct answer: A. Application-Level Proxy
An Application-Level Proxy operates at Layer 7 (application layer) and can inspect URL traffic, analyze application-level protocols for attacks, enforce web content policies by blacklisting sites, and log detailed application traffic. This matches all three requirements: analyzing traffic for attacks, inspecting URLs, and preventing inappropriate browsing while logging activity.
Why the other options are wrong
- B. IDS can detect attacks but cannot blacklist external sites or control user web browsing.
- C. Host-based firewalls operate at the host level and cannot comprehensively manage URL filtering and web content policies.
- D. Circuit-level proxies work at the transport layer and cannot inspect application-level content like URLs or prevent browsing to specific websites.
Question 77
Which evidence collecting technique would be utilized when it is believed an attacker is employing a rootkit and a quick analysis is needed?
Show answer and explanation
Correct answer: C. Memory collection
Memory collection is the appropriate technique when a rootkit is suspected and quick analysis is needed. Rootkits operate in kernel memory and may not be visible on disk; capturing memory preserves volatile evidence of the rootkit's presence and behavior before it is lost. This enables rapid analysis of the running malware. Live response (B) is broader but less specific; forensic disk imaging (A) focuses on disk artifacts that rootkits often hide; malware analysis (D) is the downstream process using collected evidence.
Why the other options are wrong
- A. Forensic disk imaging is thorough but time-consuming and may miss rootkit artifacts that reside primarily in memory.
- B. Live response is a general collection method that may not prioritize memory where rootkits operate.
- D. Malware analysis is the analytical process applied to collected evidence, not the collection technique itself.
Question 78
The Chief Information Security Officer (CISO) of a small organization is making a case for building a security operations center (SOC). While debating between an in-house, fully outsourced, or a hybrid capability, which of the following would be the MAIN consideration, regardless of the model?
Show answer and explanation
Correct answer: B. Scope and service catalog
Regardless of whether a SOC is built in-house, fully outsourced, or hybrid, the primary consideration must be scope and service catalog, defining what services the SOC will provide, what threats it will monitor, what incident response capabilities it will have, and what systems it will cover. This scope definition must be established first before evaluating any operational model. Headcount, skill sets, and tools are all dependent on first determining what the SOC's scope and service offerings will be.
Why the other options are wrong
- A. Headcount and capacity are implementation details that depend on scope; they cannot be the main consideration before defining what services are needed.
- C. Skill sets and training are important but are secondary to defining scope; outsourced models can address skill gaps differently than in-house models.
- D. Tools and technologies are implementation choices that follow from scope definition, not the primary consideration.
Question 79
In software development, developers should use which type of queries to prevent a Structured Query Language (SQL) injection?
Show answer and explanation
Correct answer: A. Parameterised
Parameterised queries (also called prepared statements) prevent SQL injection by separating the SQL code structure from user input data. The database engine treats input as data only, not as executable code, making it impossible to inject malicious SQL commands. This is the industry-standard, proven defense against SQL injection attacks. Dynamic queries allow input to be interpreted as code (the vulnerability), static queries are inflexible, and controlled queries is not a recognized security term for this purpose.
Why the other options are wrong
- B. Controlled queries is not a recognized technique for SQL injection prevention.
- C. Dynamic queries are vulnerable to SQL injection because they interpret user input as code.
- D. Static queries cannot accommodate legitimate variable input and are not a practical solution.
Question 80
When assessing web vulnerabilities, how can navigating the dark web add value to a penetration test?
Show answer and explanation
Correct answer: C. Information may be found on related breaches and hacking.
Navigating the dark web during a penetration test adds value by providing access to information about related breaches, hacking techniques, and emerging threats that may be relevant to the tested organization. Security researchers and penetration testers can find evidence of previous compromises, exploit kits, and threat actor discussions that inform the assessment of vulnerabilities and risk. This threat intelligence helps identify which vulnerabilities are actively exploited and what techniques attackers are using against similar organizations.
Why the other options are wrong
- A. Hidden vendor patches are not typically found on the dark web; patches are publicly released through official channels.
- B. Hiding the origin and tools of a penetration test is ethically and legally problematic and not a legitimate security value.
- D. Vulnerabilities must be tested in the actual environment; testing vulnerabilities without impact defeats the purpose of understanding real-world risk.
Question 81
Which of the following regulations dictates how data breaches are handled?
Show answer and explanation
Correct answer: D. General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) is the regulation that specifically dictates how data breaches must be handled, including mandatory breach notification requirements (notification within 72 hours to supervisory authorities under Article 33), documentation of breach details, and communication to affected individuals. While PCI-DSS addresses payment card security, NIST provides standards and guidelines, and SOX addresses financial reporting controls, none of these specifically mandate data breach handling procedures in the comprehensive way GDPR does.
Why the other options are wrong
- A. PCI-DSS focuses on payment card data security standards but does not comprehensively dictate overall data breach handling procedures.
- B. NIST provides security frameworks and guidelines but is not a regulation that dictates mandatory breach handling.
- C. Sarbanes-Oxley addresses financial reporting and internal controls, not data breach notification procedures.
Question 82
What is the PRIMARY purpose of creating and reporting metrics for a security awareness, training, and education program?
Show answer and explanation
Correct answer: A. Measure the effect of the program on the organization's workforce.
The primary purpose of creating and reporting metrics for security awareness, training, and education programs is to measure the program's effectiveness and impact on organizational behavior and security posture. Metrics demonstrate whether the program is achieving its goals of improving security awareness and reducing security incidents caused by human error.
Why the other options are wrong
- B. While stakeholder communication is important, it is a secondary purpose; the primary focus is on measuring actual program effectiveness.
- C. Supervising periodic training events is a program administration task, not the primary purpose of metrics and reporting.
- D. Compliance documentation is a byproduct, not the primary purpose of metrics, which should focus on measuring behavioral and organizational impact.
Question 83
Which of the following is the PRIMARY reason for selecting the appropriate level of detail for audit record generation?
Show answer and explanation
Correct answer: C. Facilitate a root cause analysis (RCA)
The primary reason for selecting appropriate audit record detail levels is to facilitate root cause analysis (RCA). RCA requires sufficient granularity in audit logs to trace back through events and understand how a security incident or system failure occurred. Without the right level of detail, investigators cannot reconstruct the sequence of events needed to identify the underlying causes of problems.
Why the other options are wrong
- A. Avoiding lengthy reports is a secondary operational concern, not the primary purpose of audit detail selection.
- B. While corrective actions benefit from audit data, this is a downstream use rather than the primary reason for selecting detail levels.
- D. Cost reduction across the SDLC is not the primary driver for audit record detail; compliance and investigative needs take precedence.
Question 84
In a DevOps environment, which of the following actions is MOST necessary to have confidence in the quality of the changes being made?
Show answer and explanation
Correct answer: B. Automate functionality testing.
Automating functionality testing is most necessary to have confidence in change quality in DevOps environments. Continuous automated testing validates that changes meet functional requirements and do not introduce regressions, providing immediate feedback on code quality and reducing the risk of defects reaching production in the rapid deployment cycles characteristic of DevOps.
Why the other options are wrong
- A. Corrective action preparation is reactive and addresses problems after they occur, rather than providing confidence in change quality beforehand.
- C. Reviewing logs for anomalies occurs after deployment and detects problems post-fact rather than ensuring quality before release.
- D. Change review boards introduce delays incompatible with DevOps principles and do not directly validate the technical functionality of changes.
Question 85
Which of the following is a common term for log reviews, synthetic transactions, and code reviews?
Show answer and explanation
Correct answer: C. Security control testing
Security control testing is the common term encompassing log reviews, synthetic transactions, and code reviews. These are all validation and verification techniques used to assess whether security controls are functioning effectively and whether code meets security standards. This testing approach validates that controls operate as designed and that applications are free from vulnerabilities.
Why the other options are wrong
- A. Application development is the broader process of creating applications, not the specific testing methods listed.
- B. Spiral development functional testing refers to a development methodology and general functional testing, not these specific security-focused activities.
- D. DevOps IPT development is an organizational structure and process model, not a testing methodology.
Question 86
Which service management process BEST helps information technology (IT) organizations with reducing cost, mitigating risk, and improving customer service?
Show answer and explanation
Correct answer: D. Information Technology Infrastructure Library (ITIL)
ITIL (Information Technology Infrastructure Library) is the comprehensive service management framework best designed to help IT organizations reduce costs, mitigate risk, and improve customer service through standardized best practices across the entire IT lifecycle. While Lean Six Sigma (B) and ITSM (C) focus on improvement and management respectively, ITIL provides the complete framework. Kanban (A) is primarily a workflow visualization tool.
Why the other options are wrong
- A. Kanban is a workflow management tool, not a comprehensive service management framework.
- B. Lean Six Sigma focuses on process improvement and efficiency but isn't a complete service management framework.
- C. ITSM is a general category; ITIL is the specific best-practice library that implements ITSM principles.
Question 87
An organization has implemented a protection strategy to secure the network from unauthorized external access. The new Chief Information Security Officer (CISO) wants to increase security by better protecting the network from unauthorized internal access. Which Network Access Control (NAC) capability BEST meets this objective?
Show answer and explanation
Correct answer: A. Port security
Port security is a Network Access Control capability that restricts unauthorized internal access by controlling which devices can connect to specific network ports. It operates at Layer 2 and can prevent unauthorized devices or users from gaining network access internally, directly addressing the CISO's objective to protect against unauthorized internal access. This is a foundational NAC control that works at the network interface level.
Why the other options are wrong
- B. Two-factor authentication primarily addresses user identity verification rather than preventing unauthorized device or network access at the port/connection level.
- C. Strong passwords alone do not constitute a NAC capability; they are an authentication measure that does not control network access at the device level.
- D. An application firewall operates at the application layer and is more focused on content filtering and application-level threats rather than controlling network access for internal devices.
Question 88
Which of the following criteria ensures information is protected relative to its importance to the organization?
Show answer and explanation
Correct answer: A. Legal requirements, value, criticality, and sensitivity to unauthorized disclosure or modification
Information protection relative to its importance to the organization is ensured by considering legal requirements, value, criticality, and sensitivity to unauthorized disclosure or modification. These criteria form the foundation of a comprehensive data classification scheme that determines appropriate protection levels. Legal requirements establish mandatory safeguards, value indicates business impact, criticality reflects operational necessity, and sensitivity to disclosure or modification determines what types of protection are needed. Together, these factors enable organizations to allocate security resources proportionally to actual risk.
Why the other options are wrong
- B. Basing classification solely on value to senior management ignores legal requirements, criticality, and sensitivity factors that may require protection regardless of perceived management value.
- C. While stakeholder input and management approval are part of implementation, this option omits the specific technical criteria (legal requirements, value, criticality, sensitivity) that drive classification decisions.
- D. Legal requirements vary by the type of data and applicable regulations, not just by headquarters location; this approach is too narrow and incomplete.
Question 89
A Chief Information Security Officer (CISO) of a firm which decided to migrate to cloud has been tasked with ensuring an optimal level of security. Which of the following would be the FIRST consideration?
Show answer and explanation
Correct answer: A. Analyze the firm's applications and data repositories to determine the relevant control requirements.
The first critical step in cloud migration security is to analyze the firm's applications and data repositories to determine relevant control requirements. This foundational analysis drives all subsequent decisions, it identifies what needs protection, which informs the roadmap, vendor selection criteria, and contractual requirements. Without understanding control requirements first, the CISO cannot effectively plan the migration or evaluate vendors.
Why the other options are wrong
- B. Third-party vendor assessments are important but should follow once you understand your own control requirements.
- C. While a roadmap is necessary, it should be built upon the foundation of understanding control requirements for applications and data.
- D. Contract definition comes after understanding requirements and evaluating the vendor's capability to meet those requirements.
Question 90
Which of the following BEST describes the purpose of software forensics?
Show answer and explanation
Correct answer: C. To determine the author and behavior of the code
Software forensics encompasses analyzing code to determine its author, origin, and behavioral characteristics. This comprehensive approach covers identifying who created the code, where it came from, and what it does. While option D focuses narrowly on one aspect (backdoors), option C describes the broader purpose of understanding code authorship and behavior.
Why the other options are wrong
- A. Analyzing malicious intent is part of malware analysis, not specifically software forensics.
- B. CRC verification detects file changes but is file integrity checking, not forensic analysis of code behavior.
- D. Detecting backdoors is one narrow application, not the overall best description of software forensics purpose.
Question 91
Which of the following is a covert channel type?
Show answer and explanation
Correct answer: C. Storage
Storage covert channels are a recognized type of covert channel used to transmit information by modulating the use of shared storage resources. Data can be hidden by altering storage states or timing of storage access in ways that are detectable by another process but hidden from normal observation. This is a well-documented covert channel type in security literature.
Why the other options are wrong
- A. Pipe refers to inter-process communication mechanisms, not a covert channel type.
- B. Memory is not formally classified as a type of covert channel; timing channels use memory access patterns but the category is timing, not memory.
- D. Monitoring is a security function, not a covert channel type.
Question 92
What is the MOST effective response to a hacker who has already gained access to a network and will attempt to pivot to other resources?
Show answer and explanation
Correct answer: C. Segment the network.
Network segmentation is the most effective immediate response to prevent lateral movement (pivoting) by an attacker who has already gained access. By dividing the network into isolated segments with controlled access between them, the organization limits the attacker's ability to move from the compromised area to other critical resources, even if they escalate privileges or compromise additional systems.
Why the other options are wrong
- A. Warning users alone does not prevent the attacker from moving laterally through the network.
- B. Resetting passwords may help but does not prevent pivoting if the attacker already has elevated access or exploits.
- D. Shutting down the network is disruptive and not the most effective preventive measure; segmentation allows continued operations while containing threats.
Question 93
Which of the following is the MOST effective way to ensure the endpoint devices used by remote users are compliant with an organization's approved policies before being allowed on the network?
Show answer and explanation
Correct answer: A. Network Access Control (NAC)
Network Access Control (NAC) is specifically designed to enforce compliance policies before allowing devices to connect to the network. NAC checks device health status, security posture, and policy compliance before granting access, making it the most effective mechanism for ensuring remote endpoint devices meet organizational standards. It acts as a gatekeeper at the network perimeter.
Why the other options are wrong
- B. PAM manages privileged user accounts, not general endpoint compliance.
- C. GPO applies policies to domain-joined devices only, not all remote endpoints.
- D. MDM manages mobile devices but is less comprehensive for general endpoint compliance verification.
Question 94
Which of the following describes the BEST method of maintaining the inventory of software and hardware within the organization?
Show answer and explanation
Correct answer: D. Maintaining the inventory through a combination of system configuration, network management, and license management tools
The best method for maintaining accurate software and hardware inventory combines system configuration management (to track what is installed), network management tools (to discover and monitor connected devices), and license management tools (to ensure compliance and track software assets). These three approaches together provide comprehensive coverage of both hardware and software assets.
Why the other options are wrong
- A. While interviews and open-source tools can contribute, relying heavily on interviews is not scalable and open-source tools alone may lack enterprise features.
- B. Desktop configuration and administration are important but license management is more critical than generic 'procurement management' for comprehensive inventory.
- C. On-premises storage and partner management are not primary inventory mechanisms; this approach lacks focus on the core tracking systems needed.
Question 95
A security professional needs to find a secure and efficient method of encrypting data on an endpoint. Which solution includes a root key?
Show answer and explanation
Correct answer: B. Trusted Platform Module (TPM)
Trusted Platform Module (TPM) is a secure hardware component on endpoints that includes a root key (endorsement key) used for cryptographic operations and key storage. TPM provides secure key management for endpoint encryption solutions like BitLocker integration and meets the requirement of including a root key for secure encryption.
Why the other options are wrong
- A. BitLocker uses TPM for key storage but is software-based encryption rather than a solution that includes a root key itself.
- C. Virtual storage array network (VSAN) is a storage architecture solution, not an endpoint encryption method with a root key.
- D. Hardware security modules are typically external devices for enterprise key management, not integrated endpoint encryption solutions with built-in root keys.
Question 96
What is considered a compensating control for not having electrical surge protectors installed?
Show answer and explanation
Correct answer: B. Having a hot disaster recovery (DR) environment for the site
A hot disaster recovery environment serves as a compensating control for the absence of surge protectors by ensuring business continuity despite electrical failures. If a surge damages equipment at the primary site, the hot DR site can immediately assume operations, minimizing downtime and data loss. This maintains availability and recovery capability without the surge protection itself, compensating for the missing preventive control.
Why the other options are wrong
- A. Dual lines to service providers address network connectivity redundancy, not electrical surge damage to on-site equipment.
- C. Active-active clusters provide availability redundancy but don't compensate for surge damage, as the surge would affect both cluster nodes at the same site.
- D. Backup diesel generators address power loss but not electrical surge damage; they would operate after a surge has already damaged equipment.
Question 97
Which change management role is responsible for the overall success of the project and supporting the change throughout the organization?
Show answer and explanation
Correct answer: C. Program sponsor
The program sponsor holds ultimate accountability for the overall success of a project and ensures organizational support and resources are available throughout implementation. They provide executive backing and drive organizational alignment necessary for successful change adoption.
Why the other options are wrong
- A. A change driver promotes the change but is not responsible for overall project success.
- B. A project manager handles execution and coordination but reports to and derives authority from the sponsor.
- D. A change implementer executes specific change activities but is not accountable for overall success.
Question 98
What is the FIRST step that should be considered in a Data Loss Prevention (DLP) program?
Show answer and explanation
Correct answer: C. Data classification
Data classification is the first step in a DLP program because you must identify and understand what data exists, where it resides, and how sensitive it is before you can create policies or implement controls. Without classification, you cannot effectively prioritize protection efforts or determine what rules to enforce.
Why the other options are wrong
- A. Policy creation comes after classification because policies must be based on the data's sensitivity levels.
- B. IRM implementation occurs downstream once you understand what data requires rights management.
- D. Configuration management is a process for managing the DLP solution after policies are established.
Question 99
Which of the following should be done at a disaster site before any item is removed, repaired, or replaced?
Show answer and explanation
Correct answer: C. Take photos of the damage
Taking photos of the damage at a disaster site before any items are removed, repaired, or replaced is a critical first step. This documentation preserves evidence, supports insurance claims, validates the disaster recovery plan, and provides a record for post-incident analysis.
Why the other options are wrong
- A. Press communication should follow proper protocols but is not the immediate priority at the disaster site.
- B. Dispatching to the DR site occurs during recovery operations, not before documenting the damage.
- D. While notification is important, it should occur through proper channels and doesn't require presence at the disaster site before documentation.
Question 100
What industry-recognized document could be used as a baseline reference that is related to data security and business operations or conducting a security assessment?
Show answer and explanation
Correct answer: C. Service Organization Control (SOC) 2 Type 2
SOC 2 Type 2 is the industry-recognized document used as a baseline reference for data security and business operations assessments. SOC 2 reports address security, availability, processing integrity, confidentiality, and privacy controls. Type 2 includes testing over a period of time, making it more comprehensive for security assessments than Type 1. This is the standard used for evaluating service provider controls over sensitive business operations.
Why the other options are wrong
- A. SOC 1 Type 2 focuses on financial reporting controls, not data security and general business operations.
- B. SOC 1 Type 1 is limited in scope and time period, and addresses financial controls specifically.
- D. SOC 2 Type 1 is a point-in-time report and less comprehensive than Type 2 for ongoing assessment purposes.
Question 101
In Federated Identity Management (FIM), which of the following represents the concept of federation?
Show answer and explanation
Correct answer: D. Collection of domains that have established trust among themselves
Federation in FIM specifically refers to the establishment of trust relationships between multiple independent domains or organizations. This enables users from one domain to authenticate and access resources in partner domains through agreed-upon standards and trust arrangements. The concept is fundamentally about creating trust boundaries between separate security domains, not about user object management or information grouping within a single system.
Why the other options are wrong
- A. This describes user provisioning and lifecycle management, which is a component of FIM but not the concept of federation itself.
- B. This is too vague and doesn't capture the inter-organizational trust relationship aspect of federation.
- C. This describes identity management within a single system rather than the federation of multiple domains.
Question 102
An application is used for funds transfers between an organization and a third-party. During a security audit, an auditor has found an issue with the business continuity disaster recovery policy and procedures for this application. Which of the following reports should the auditor file with the organization?
Show answer and explanation
Correct answer: C. Service Organization Control (SOC) 1
Service Organization Control (SOC) 1 reports are used to audit controls at service organizations (third parties) that affect the financial reporting of their clients. This applies to the third-party funds transfer application because its controls impact the client organization's financial statements and continuity. SOC 1 specifically addresses controls relevant to financial reporting. SOC 2 addresses broader security, availability, and confidentiality controls. SAS 70 is the predecessor framework to SOC reports and is outdated.
Why the other options are wrong
- A. SAS 70-1 does not exist as a standard report type.
- B. SAS 70 is the obsolete predecessor to SOC reports and is no longer the current standard.
- D. SOC 2 addresses security and operational effectiveness but is not the primary report for financial application controls.
Question 103
Which organizational department is ultimately responsible for information governance related to e-mail and other e-records?
Show answer and explanation
Correct answer: A. Legal
The Legal department is ultimately responsible for information governance related to email and other electronic records. Legal has authority over records retention, legal holds, discovery obligations, and compliance with regulations governing electronic records, making it the department accountable for e-records governance across the organization.
Why the other options are wrong
- B. Audit reviews and assesses governance compliance but is not ultimately responsible for establishing and managing records governance.
- C. Compliance ensures adherence to policies but typically operates under direction from Legal for records and e-records governance.
- D. Security manages technical controls and protection mechanisms but is not ultimately responsible for records governance decisions and legal obligations.
Question 104
Which of the following threats would be MOST likely mitigated by monitoring assets containing open source libraries for vulnerabilities?
Show answer and explanation
Correct answer: C. Zero-day attack
Zero-day attacks exploit previously unknown vulnerabilities in software components, including open source libraries. Monitoring assets for vulnerabilities in open source libraries specifically addresses this threat by identifying vulnerable code before attackers discover it. While APTs might use open source vulnerabilities, zero-day is the most direct match since monitoring enables detection of unknown vulnerabilities before public disclosure.
Why the other options are wrong
- A. DDoS attacks target availability through traffic flooding, not software vulnerabilities.
- B. APTs use multiple attack vectors and are not specifically mitigated by library vulnerability monitoring alone.
- D. Phishing attacks target user behavior and email, not software vulnerabilities.
Question 105
Which combination of cryptographic algorithms are compliant with Federal Information Processing Standard (FIPS) Publication 140-2 for non-legacy systems?
Show answer and explanation
Correct answer: A. Diffie-hellman (DH) key exchange: DH (>=2048 bits) Symmetric Key: Advanced Encryption Standard (AES) > 128 bits Digital Signature: Digital Signature Algorithm (DSA) (>=2048 bits)
Option A correctly specifies FIPS 140-2 compliant algorithms for nonlegacy systems: DH with ≥2048 bits (meets key exchange requirements), AES with >128 bits (meets symmetric encryption requirements), and DSA with ≥2048 bits (meets digital signature requirements). All three components meet or exceed the minimum security standards required by FIPS 140-2 for modern systems.
Why the other options are wrong
- B. RSA with only 1024 bits does not meet FIPS 140-2 requirements for nonlegacy systems, which require at least 2048 bits for RSA digital signatures.
- C. DH with ≤1024 bits is insufficient, and Blowfish is not approved for FIPS 140-2 compliance; only AES meets the standard for symmetric encryption.
- D. AES < 128 bits fails the symmetric key strength requirement, which specifies minimum 128 bits for FIPS 140-2 compliance.
Question 106
Which of the following is the BEST method to validate secure coding techniques against injection and overflow attacks?
Show answer and explanation
Correct answer: C. Using automated programs to test for the latest known vulnerability patterns
Automated programs that test for known vulnerability patterns are the best method for validating code against injection and overflow attacks because they can comprehensively scan all code, identify known vulnerabilities quickly, and be run continuously throughout development. Manual team reviews (A) are labor-intensive and may miss vulnerabilities, reusing production code (B) doesn't validate new code for vulnerabilities, and updating code editing tools (D) is preventative but doesn't validate existing code.
Why the other options are wrong
- A. Manual reviews are slower, less comprehensive, and more prone to human error than automated scanning.
- B. Reusing existing code doesn't validate it against injection and overflow vulnerabilities.
- D. Updating tools is preventative but doesn't actively test or validate code for known vulnerabilities.
Question 107
What is the BEST approach to anonymizing personally identifiable information (PII) in a test environment?
Show answer and explanation
Correct answer: B. Randomizing data
Randomizing data is the best approach to anonymizing personally identifiable information in a test environment. Randomization replaces real PII with fictitious but realistic values that maintain data structure and relationships while removing personal identifiers. This allows testing with data that looks and behaves like production data without exposing real individuals' information, and it ensures true anonymization that cannot be reversed.
Why the other options are wrong
- A. Swapping data between records does not truly anonymize since original PII still exists in the dataset.
- C. Encoding data is reversible and does not provide true anonymization; the original data can be decoded.
- D. Encrypting data is reversible and requires key management; it protects data but does not achieve true anonymization.
Question 108
Which security audit standard provides the BEST way for an organization to understand a vendor's Information Systems (IS) in relation to confidentiality, integrity, and availability?
Show answer and explanation
Correct answer: A. Service Organization Control (SOC) 2
SOC 2 is specifically designed to evaluate a service organization's controls relevant to security, availability, processing integrity, confidentiality, and privacy. It provides the most comprehensive assessment of a vendor's information systems across all three dimensions mentioned (confidentiality, integrity, and availability). SOC 2 reports are the industry standard for understanding vendor security postures and are widely requested by organizations evaluating cloud and managed service providers.
Why the other options are wrong
- B. SSAE 18 is the standard under which SOC reports are prepared, but it is not itself the audit report that addresses IS controls.
- C. SAS 70 is an outdated standard replaced by SOC reports and does not specifically address the three security dimensions in the context of vendor evaluation.
- D. SOC 1 focuses on internal controls relevant to financial reporting, not on the security, availability, and confidentiality concerns needed to evaluate vendor IS controls.
Question 109
A software development company has a short timeline in which to deliver a software product. The software development team decides to use open-source software libraries to reduce the development time. What concept should software developers consider when using open-source software libraries?
Show answer and explanation
Correct answer: A. Open source libraries contain known vulnerabilities, and adversaries regularly exploit those vulnerabilities in the wild.
Open-source libraries contain known vulnerabilities that are actively exploited by adversaries. While open-source code is transparent and often well-maintained, vulnerabilities are regularly discovered and documented in databases like CVE. Developers must consider that attackers actively exploit known vulnerabilities in open-source libraries, making vulnerability scanning and dependency management critical during development.
Why the other options are wrong
- B. The assumption that vulnerabilities in open-source libraries won't be exploited is dangerously incorrect; known vulnerabilities are regularly exploited in the wild.
- C. Open-source libraries can and should be used with proper security practices; rejecting all open-source code is impractical and not industry best practice.
- D. While updates help, constant updates do not guarantee the absence of vulnerabilities; newly discovered vulnerabilities may affect deployed versions before patches are available.
Question 110
As a design principle, which one of the following actors is responsible for identifying and approving data security requirement in a cloud ecosystem?
Show answer and explanation
Correct answer: D. Cloud consumer
The cloud consumer (the organization using cloud services) is responsible for identifying and approving data security requirements based on their business needs, compliance obligations, and risk tolerance. They define what security controls and protections are needed for their specific use case. The cloud provider implements these requirements, but the consumer determines what they are.
Why the other options are wrong
- A. Cloud auditors verify compliance but do not identify or approve requirements.
- B. Cloud brokers facilitate services between consumers and providers but don't set security requirements.
- C. Cloud providers implement security controls as required by the consumer, but the consumer specifies the requirements.
Question 111
What is the MOST common security risk of a mobile device?
Show answer and explanation
Correct answer: D. Data leakage
Data leakage is the most common security risk for mobile devices due to their portability, frequent connectivity to unsecured networks, and ability to store sensitive data. Mobile devices are easily lost or stolen, users often install untrusted applications, and data can be transmitted insecurely or accessed by malicious apps. While malware is a significant threat, data leakage encompasses a broader range of scenarios (loss, theft, unauthorized access, insecure transmission) making it statistically the most common realized risk in mobile device deployments.
Why the other options are wrong
- A. Data spoofing is not a primary mobile device risk; mobile devices are targets of spoofing attacks but this is not the most common risk.
- B. Malware is a significant risk but data leakage is more prevalent and common in real-world mobile device incidents.
- C. Insecure communications links are a vulnerability but represent only one vector; data leakage encompasses more scenarios and is more commonly realized.
Question 112
What are the three key benefits that application developers should derive from the northbound application programming interface (API) of software defined networking (SDN)?
Show answer and explanation
Correct answer: D. Familiar syntax, abstraction of network topology, and abstraction of network protocols
The northbound API of Software Defined Networking provides three key benefits to application developers: familiar syntax (using standard programming languages and interfaces rather than low-level network commands), abstraction of network topology (applications don't need to know the underlying physical network structure), and abstraction of network protocols (applications can work with high-level network services without managing protocol details). These abstractions enable developers to focus on application logic rather than network complexity.
Why the other options are wrong
- A. 'Network syntax' is not a benefit; 'familiar syntax' is the actual benefit, and 'abstraction of network flow' is less standard than abstraction of network topology.
- B. 'Abstraction of network commands' is not standard phrasing; the benefit is abstraction of topology and protocols, not commands.
- C. 'Definition of network protocols' is incorrect; the benefit is abstraction of protocols so developers don't define them, and the other benefits don't align with standard SDN benefits.
Question 113
What term is commonly used to describe hardware and software assets that are stored in a configuration management database (CMDB)?
Show answer and explanation
Correct answer: A. Configuration item
Configuration item (CI) is the standard term used in IT service management and configuration management to describe any hardware or software asset stored in a configuration management database. CIs are the fundamental building blocks tracked by a CMDB and represent any component that needs to be managed, including servers, software licenses, network devices, and applications.
Why the other options are wrong
- B. Configuration element is not the standard ITIL or industry terminology for CMDB entries.
- C. Ledger item refers to accounting records, not IT asset management.
- D. Asset register is a broader term for asset inventory but not the specific CMDB-related terminology.
Question 114
When designing a new Voice over Internet Protocol (VoIP) network, an organization's top concern is preventing unauthorized users accessing the VoIP network. Which of the following will BEST help secure the VoIP network?
Show answer and explanation
Correct answer: D. 802.1x
802.1X port-based network access control provides authentication and authorization at the network layer, preventing unauthorized users from accessing the VoIP network. It ensures only authenticated and authorized devices can connect to network ports, making it the best control for preventing unauthorized access.
Why the other options are wrong
- A. 802.11g is a wireless standard and doesn't provide authentication or access control for wired VoIP networks.
- B. Web application firewall protects web applications, not VoIP network access.
- C. TLS encrypts data in transit but doesn't prevent unauthorized users from initially accessing the network itself.
Question 115
What is the PRIMARY benefit of incident reporting and computer crime investigations?
Show answer and explanation
Correct answer: B. Repairing the damage and preventing future occurrences
The primary benefit of incident reporting and computer crime investigations is to repair damage caused by the incident and implement preventive measures to avoid future occurrences. While compliance, evidence gathering, and team appointment are important secondary outcomes, the fundamental purpose is remediation and prevention. This aligns with the overall goal of incident management, to restore systems to normal operation and strengthen defenses.
Why the other options are wrong
- A. Complying with security policy is a consequence of proper incident handling, not the primary benefit.
- C. Providing evidence to law enforcement is important for prosecution but is not the primary operational benefit to the organization.
- D. Appointing a response team is a preparatory step, not a benefit derived from investigating incidents.
Question 116
When developing an external facing web-based system, which of the following would be the MAIN focus of the security assessment prior to implementation and production?
Show answer and explanation
Correct answer: D. Ensuring that input validation is enforced
Input validation is the MAIN focus for external-facing web systems because improper input handling is the root cause of the most common and critical vulnerabilities (SQL injection, XSS, command injection, etc.). While SSL certificates are important for transport security, input validation directly prevents attackers from exploiting the application itself. The choice between internal vs. externally-signed certificates is less critical than enforcing input validation, and URL assessment alone doesn't address the fundamental security threats to web applications.
Why the other options are wrong
- A. While SSL certificates from a CA are important for authentication and encryption, input validation addresses more critical vulnerabilities in web applications.
- B. Internally-signed certificates lack third-party validation and are inappropriate for external-facing systems.
- C. Assessing URLs is insufficient; it doesn't address the primary attack vectors against web applications.
Question 117
An organization contracts with a consultant to perform a System Organization Control (SOC) 2 audit on their internal security controls. An auditor documents a finding a related to an Application Programming Interface (API) performing an action that is not aligned with the scope or objective of the system. Which trust service principle would be MOST applicable in th is situation?
Show answer and explanation
Correct answer: B. Processing Integrity
Processing Integrity is the most applicable trust service principle when an API performs an action outside its defined scope or objective. Processing Integrity addresses whether the system processes, records, and reports information completely, accurately, and in a timely manner within the defined scope. An API acting beyond its intended scope violates the processing integrity principle. Confidentiality concerns data protection, Security covers overall controls, and Availability addresses uptime, none directly address the core issue of an application component acting outside its intended scope.
Why the other options are wrong
- A. Confidentiality relates to unauthorized access to data, not to a function operating outside its defined scope.
- C. Security is a broad principle; Processing Integrity more specifically addresses correct, authorized processing within defined objectives.
- D. Availability concerns uptime and accessibility, not whether a function operates within its intended scope.
Question 118
The Industrial Control System (ICS) Computer Emergency Response Team (CERT) has released an alert regarding ICS-focused malware specifically propagating through Windows-based business networks. Technicians at a local water utility note that their dams, canals, and locks controlled by an internal Supervisory Control and Data Acquisition (SCADA) system have been malfunctioning. A digital forensics professional is consulted in the Incident Response (IR) and recovery. Which of the following is the MOST challenging aspect of this investigation?
Show answer and explanation
Correct answer: D. Volatility of data
The volatility of data is the most challenging aspect of SCADA forensics. SCADA systems typically have minimal RAM and limited storage, causing evidence to be lost quickly when systems are powered down or restarted. Additionally, SCADA systems often cannot be safely shut down for traditional forensic imaging due to their critical operational nature, making it extremely difficult to preserve volatile evidence such as memory contents and active network connections.
Why the other options are wrong
- A. Group policy implementation is not specifically a challenge unique to SCADA forensic investigations.
- B. SCADA network latency may be a technical characteristic but is not the primary forensic challenge.
- C. Physical access to SCADA systems at a water utility is challenging but secondary to the inability to safely preserve volatile evidence without disrupting critical infrastructure.
Question 119
Which of the following statements is TRUE about Secure Shell (SSH)?
Show answer and explanation
Correct answer: A. SSH supports port forwarding, which can be used to protect less secured protocols.
SSH supports port forwarding (tunneling), which allows less secure protocols to be encapsulated and transmitted securely through the SSH tunnel, protecting them from interception. This is a legitimate and commonly used feature of SSH that enhances security for protocols that lack built-in encryption.
Why the other options are wrong
- B. SSH does protect against MITM attacks through cryptographic key exchange and authentication mechanisms.
- C. SSH is not a web-based protocol and does not require or use a web browser; it operates on port 22 with dedicated SSH clients.
- D. SSH is connection-oriented and protocol-specific, not circuit-oriented, and its usefulness depends on application support, not universal applicability.
Question 120
Which event magnitude is defined as deadly, destructive, and disruptive when a hazard interacts with human vulnerability?
Show answer and explanation
Correct answer: D. Disaster
A disaster is formally defined as an event of significant magnitude that is deadly, destructive, and disruptive when a hazard interacts with human vulnerability. This definition captures the severity and multi-faceted impact characteristic of disasters in disaster management and business continuity frameworks.
Why the other options are wrong
- A. A crisis is a critical situation requiring immediate action but lacks the specific deadly/destructive/disruptive magnitude definition.
- B. A catastrophe is extremely severe but is a separate classification from the specific definition provided.
- C. An accident is typically unintentional and minor, not characterized as deadly, destructive, and disruptive.
Question 121
When determining data and information asset handling, regardless of the specific toolset being used, which of the following is one of the common components of big data?
Show answer and explanation
Correct answer: C. Distributed data collection
Distributed data collection is a fundamental characteristic of big data systems. Big data is typically collected from multiple sources across diverse locations (sensors, devices, applications) rather than consolidated into a single point. This distributed collection approach enables the volume, velocity, and variety that define big data, as opposed to traditional centralized data gathering methods.
Why the other options are wrong
- A. While big data may use distributed storage, this is a consequence of distribution rather than a defining component of data collection itself.
- B. Big data processing is typically distributed across multiple nodes, not centralized, to handle the scale and complexity efficiently.
- D. Consolidated data collection contradicts the fundamental nature of big data, which is inherently distributed across multiple sources.
That was 121 of 484.
The full ISC2 CISSP pack has all 484 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 242 free as one PDF by email. Get the Half Pack →