10 free ISC2 CSSLP practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 350 questions. Work through them, then open each answer to check your reasoning.
Get all 350 questions (US$39) · Download these 10 as a PDF
Question 1
You work as a Network Auditor for Net Perfect Inc. The company has a Windows-based network. While auditing the company's network, you are facing problems in searching the faults and other entities that belong to it.
Which of the following risks may occur due to the existence of these problems?
Show answer and explanation
Correct answer: C. Detection risk
Detection risk refers to the risk that an auditor will fail to detect faults, errors, or other entities during an audit examination. When an auditor faces problems searching for faults and other network entities, this directly describes detection risk, the possibility that control deficiencies or anomalies will not be discovered through the audit process.
Why the other options are wrong
- A. Residual risk is the risk remaining after controls have been implemented, not the risk of failing to find faults during an audit.
- B. Secondary risk refers to risks created as a consequence of implementing a control, unrelated to audit detection failures.
- D. Inherent risk is the risk that exists in the absence of controls, independent of the auditor's ability to search for problems.
Question 2
The National Information Assurance Certification and Accreditation Process (NIACAP) is the minimum standard process for the certification and accreditation of computer and telecommunications systems that handle U.S. national security information.
Which of the following participants are required in a NIACAP security assessment? Each correct answer represents a part of the solution.
Choose all that apply.
Show answer and explanation
Correct answer: A, B, C, E
A. Certification agent B. Designated Approving Authority C. IS program manager E. User representative The NIACAP security assessment requires specific participants to conduct the certification and accreditation of systems handling national security information. The Certification Agent leads the technical assessment, the Designated Approving Authority is responsible for accreditation decisions, the IS Program Manager represents the organization's information systems, and the User Representative ensures user needs and concerns are addressed. The Information Assurance Manager is not required as a distinct participant role in the standard NIACAP process.
Why the other options are wrong
- D. The Information Assurance Manager is not listed as a required participant in the standard NIACAP assessment process roles.
Question 3
Which of the following penetration testing techniques automatically tests every phone line in an exchange and tries to locate modems that are attached to the network?
Show answer and explanation
Correct answer: A. Demon dialing
Demon dialing is an automated penetration testing technique that systematically tests every telephone line in an exchange to identify and locate modems attached to the network. This technique was historically used to discover unauthorized or hidden modems that could serve as entry points into a network.
Why the other options are wrong
- B. Sniffing is a passive technique for capturing network traffic, not an automated method for testing phone lines.
- C. Social engineering is a non-technical attack that manipulates people into divulging information, not an automated phone line testing method.
- D. Dumpster diving is a physical security bypass technique involving searching through trash for sensitive information, unrelated to phone line testing.
Question 4
Which of the following roles is also known as the accreditor?
Show answer and explanation
Correct answer: D. Designated Approving Authority
The Designated Approving Authority (DAA) is the individual responsible for accrediting an information system and is therefore also known as the accreditor. The DAA has the authority to formally approve the operation of an information system based on the certification and risk assessment results.
Why the other options are wrong
- A. The Data Owner is responsible for classifying and managing data sensitivity, not for system accreditation.
- B. The Chief Risk Officer manages enterprise-wide risk but is not specifically known as the accreditor role.
- C. The Chief Information Officer oversees IT strategy and operations but does not hold the specific title of accreditor.
Question 5
DoD 8500.2 establishes IA controls for information systems according to the Mission Assurance Categories (MAC) and confidentiality levels.
Which of the following MAC levels requires high integrity and medium availability?
Show answer and explanation
Correct answer: D. MAC II
DoD 8500.2 defines three Mission Assurance Categories that set baseline integrity and availability requirements. MAC II applies to systems supporting important deployed or contingency forces and requires high integrity with medium availability, meaning the data must be absolutely accurate but short interruptions can be tolerated with additional safeguards. That combination of high integrity and medium availability points directly to MAC II.
Why the other options are wrong
- A. MAC III covers systems necessary for day to day business that require basic integrity and basic availability, not high integrity.
- B. DoD 8500.2 defines only MAC I, MAC II and MAC III, so there is no MAC IV level.
- C. MAC I is the most critical category and demands high integrity together with high availability.
Question 6
Microsoft software security expert Michael Howard defines some heuristics for determining code review in "A Process for Performing Security Code Reviews".
Which of the following heuristics increase the application's attack surface? Each correct answer represents a complete solution.
Choose all that apply.
Show answer and explanation
Correct answer: B, D, E, F
B. Code listening on a globally accessible network interface D. Anonymously accessible code E. Code that runs by default F. Code that runs in elevated context Michael Howard's heuristics identify factors that increase attack surface. Code listening on globally accessible network interfaces increases exposure, anonymously accessible code removes authentication barriers, code running by default is automatically available to attackers, and code running in elevated context provides higher privilege access if compromised. Code written in C/C++/assembly increases vulnerability risk but doesn't directly increase attack surface, and code that changes frequently relates more to stability than attack surface expansion.
Why the other options are wrong
- A. Code language choice affects vulnerability likelihood but not the attack surface itself.
- C. Code change frequency relates to maintenance and stability risks rather than attack surface size.
Question 7
Which of the following cryptographic system services ensures that information will not be disclosed to any unauthorized person on a local network?
Show answer and explanation
Correct answer: D. Confidentiality
Confidentiality is the cryptographic service that ensures information will not be disclosed to unauthorized persons. It protects data from being accessed or viewed by anyone except those with proper authorization, using encryption and related mechanisms to keep information secret.
Why the other options are wrong
- A. Authentication verifies the identity of users and systems, not preventing disclosure.
- B. Integrity ensures data has not been modified, but does not prevent unauthorized viewing.
- C. Non-repudiation prevents denial of actions taken, not unauthorized disclosure.
Question 8
What are the various activities performed in the planning phase of the Software Assurance Acquisition process? Each correct answer represents a complete solution.
Choose all that apply.
Show answer and explanation
Correct answer: A, C, D
A. Develop software requirements. C. Develop evaluation criteria and evaluation plan. D. Create acquisition strategy. The planning phase of the Software Assurance Acquisition process is where the buyer defines the need and prepares to go to market. That work includes developing the software requirements, building the evaluation criteria and evaluation plan used to judge supplier responses, and creating the overall acquisition strategy. The remaining phases, Contracting, Monitoring and Acceptance, and Follow-on, carry out and sustain what planning defines.
Why the other options are wrong
- B. Change control procedures are established during the Monitoring and Acceptance phase, after a contract is in place and deliverables are being managed.
Question 9
You work as a project manager for BlueWell Inc. You are working on a project and the management wants a rapid and cost-effective means for establishing priorities for planning risk responses in your project.
Which risk management process can satisfy management's objective for your project?
Show answer and explanation
Correct answer: A. Qualitative risk analysis
Qualitative risk analysis is the rapid and cost-effective process for establishing priorities for planning risk responses. It uses subjective assessment techniques like probability-impact matrices to quickly prioritize risks without extensive numerical analysis. Historical information is a data source rather than a process, rolling wave planning is a planning technique not specific to risk prioritization, and quantitative analysis requires detailed data and is more time-consuming and costly.
Why the other options are wrong
- B. Historical information is a data source used to inform risk analysis, not the process itself for establishing priorities.
- C. Rolling wave planning is a progressive elaboration technique for planning, not a risk response prioritization method.
- D. Quantitative analysis is time-intensive and expensive, the opposite of what management requested for rapid and cost-effective prioritization.
Question 10
Which of the following models uses a directed graph to specify the rights that a subject can transfer to an object or that a subject can take from another subject?
Show answer and explanation
Correct answer: A. Take-Grant Protection Model
The Take-Grant Protection Model uses a directed graph to represent subjects, objects, and the rights that can be transferred between them. Rights are shown as labeled edges in the graph, and the model defines rules for how subjects can take or grant rights. The Biba and Bell-LaPadula models use different representations focused on integrity and confidentiality levels respectively, while the Access Matrix is a two-dimensional table rather than a directed graph.
Why the other options are wrong
- B. The Biba Integrity Model uses security levels and integrity rules, not directed graphs for rights transfer.
- C. The Bell-LaPadula Model uses security clearances and classifications in a lattice structure, not directed graphs for rights specification.
- D. The Access Matrix represents access control as a two-dimensional table of subjects and objects, not as a directed graph.
That was 10 of 350.
The full ISC2 CSSLP pack has all 350 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.