CISSP Practice Test.

Answer: C
RTO is the targeted duration within which a business process must be restored after a disruption to avoid unacceptable consequences, which matches the 4-hour figure derived during BIA. RPO instead measures acceptable data loss in time (how much data, not downtime, can be lost). MTTR is an operational/technical repair-time metric, not a business-impact-derived target. MTD is the absolute outer limit of tolerable downtime and is typically larger than or equal to the RTO, not the target itself the question describes.

Answer: B
Single Loss Expectancy (SLE) = AV x EF = $500,000 x 0.40 = $200,000. ARO for an event occurring once every 4 years is 1/4 = 0.25. ALE = SLE x ARO = $200,000 x 0.25 = $50,000, matching option B. Option A inverts the ARO (using 4 instead of 0.25) and incorrectly reports SLE as if it were the ALE. Option C misstates both values entirely. Option D miscalculates SLE and pairs it with the wrong (inverted) ARO.

Answer: B
A candidate who passes the exam without the full experience requirement becomes an Associate of ISC2 and is given 6 years to earn the required five years of qualifying experience before being awarded the full CISSP credential. The exam can be taken before experience is completed, so option A is false. There is no requirement to retake the exam once experience is completed. Full CISSP status requires both passing the exam and verifying the experience, so it is not granted immediately without experience.

Answer: B
Minimizing retention of sensitive data to only what is legally and operationally required, followed by secure destruction, reduces the attack surface and liability exposure—this is a core asset security and data lifecycle principle. Indefinite or permanent retention increases breach impact and often violates data minimization requirements under privacy law. Distributing sensitive data to every workstation for 'redundancy' dramatically increases exposure and violates least-privilege and data-minimization principles rather than protecting the data.

Answer: D
The data owner (often a business-unit executive) has ultimate accountability for a dataset, including assigning its classification level and approving access decisions, because they best understand its business value and sensitivity. The data custodian implements technical controls (backups, access provisioning) on the owner's behalf but does not decide classification. System administrators perform operational tasks per established policy. End users merely consume data according to granted permissions and have no classification authority.

Answer: C
Physical destruction, such as shredding or degaussing a drive to the point it is no longer usable, provides the highest assurance against recovery, including forensic techniques, which is appropriate when media cannot be reused. Deleting files or emptying the recycle bin only removes directory pointers, leaving data recoverable with common tools. Quick-formatting similarly leaves most data intact and recoverable. Moving files to another folder does not remove or sanitize the underlying data at all.

Answer: B
Need to know further restricts access within an already-authorized role so that a subject can only access the specific information required to perform their current task, which is why the accounts-payable employee is denied payroll data despite having general financial-system access. Separation of duties splits a sensitive process across multiple people to prevent fraud, which is a different control from restricting information access scope. 'Mandatory vesting' is not a security access-control concept. Due diligence refers to the reasonable care an organization exercises in managing risk, not an access-restriction mechanism.

Answer: A
Bell-LaPadula is a confidentiality-focused model (no read up, no write down) designed to prevent unauthorized disclosure, while Biba is an integrity-focused model (no read down, no write up) designed to prevent unauthorized or improper modification of data. Reversing these goals (option B) describes the models backward. Neither model addresses availability as its primary goal. The two models use opposite rule structures and are not interchangeable, since they protect different security properties.

Answer: B
The ring model enforces process isolation by assigning privilege levels, ensuring that less-trusted code (Ring 3 applications) cannot directly execute privileged instructions or access kernel memory reserved for Ring 0, reducing the impact of a compromised application. Rings have nothing to do with network throughput, encryption of transmitted data, or storage redundancy—those are unrelated architectural concerns handled by other mechanisms entirely.

Answer: A
A TPM is a dedicated, tamper-resistant hardware chip that securely generates and stores cryptographic keys and can measure and attest to the integrity of the boot process, matching the scenario exactly. A software-based key file lacks hardware tamper resistance and can be copied or exfiltrated more easily. A generic USB drive provides no cryptographic attestation or tamper protection. An unencrypted configuration file offers no protection for keys at all and is the opposite of a secure solution.

Answer: B
Clean-agent gaseous systems (e.g., FM-200, Novec 1230) suppress fire without leaving conductive residue or causing the water damage that would destroy live electrical equipment, making them the preferred choice for server rooms. Water sprinklers can cause severe additional damage to energized equipment and are not preferred despite lower cost. Redundant power supplies address power failure, not fire risk, so suppression is still necessary. CO2 systems displace oxygen and pose asphyxiation risk, requiring evacuation procedures before discharge, not safe discharge with staff present.

Answer: C
Stateful firewalls primarily track connection state using Transport-layer (Layer 4) information such as TCP sequence numbers, flags (SYN/ACK/FIN), and port pairs to determine whether a packet belongs to an established session. Layer 1 deals with physical signaling and has no session concept. Layer 2 deals with MAC addressing and frames, not session state. While some stateful and next-gen firewalls incorporate application-layer awareness, classic stateful inspection is defined by its Layer 4 state-tracking, not exclusive Layer 7 operation.

Answer: B
WPA3 provides stronger encryption (e.g., SAE replacing the vulnerable 4-way handshake exploited under WPA2/WPA) and, in enterprise mode, integrates with 802.1X authentication, making it the current best-practice choice over deprecated protocols. WEP has well-known cryptographic weaknesses (weak IV usage, RC4 flaws) and should never be used. Disabling encryption entirely removes confidentiality and integrity protection completely. SSID hiding is a weak, easily bypassed obscurity measure, not a real access control, and should not be relied upon as a primary defense.

Answer: B
Hybrid cryptosystems exploit the strengths of each algorithm type: symmetric ciphers like AES are computationally efficient for encrypting large volumes of data, while asymmetric RSA—though much slower for bulk data—solves the key-distribution problem by letting the session key be exchanged securely without a pre-shared secret, since only Party B's private key can decrypt it. Option A reverses reality: RSA is significantly slower than AES for bulk encryption, not faster, which is precisely why it's reserved for the small key exchange. Party B still must securely manage their RSA private key, so key management is not eliminated. RSA can mathematically encrypt data blocks larger than one bit (up to its modulus size), so that claim is false; the real constraint is RSA's poor performance and message-size limits relative to symmetric ciphers for bulk data, not an inability to exceed one bit.

Answer: A
DNS amplification/reflection attacks spoof the victim's IP address in queries sent to open resolvers, causing large responses to flood the victim, which matches the described bandwidth-overwhelming behavior from unsolicited DNS responses. A man-in-the-middle attack involves intercepting and possibly altering communications between two parties, not flooding via spoofed queries. SQL injection targets database-backed applications with malicious input, unrelated to DNS traffic floods. Cross-site scripting targets web application users via injected scripts, also unrelated to network-layer DDoS traffic.

Answer: A
VLANs logically segment a physical switch into separate broadcast domains, and combined with access control (e.g., ACLs or a firewall between VLANs), they prevent devices on a guest VLAN from directly reaching internal servers on a finance VLAN, even on shared physical infrastructure. Port speed affects throughput, not logical segmentation. MAC address table size affects switch capacity/performance, not access separation between segments. Cable length is a purely physical consideration with no bearing on logical network segmentation or security.

Answer: C
True multifactor authentication requires factors from distinct categories—something you know, something you have, or something you are—so a password combined with a hardware token satisfies this by pairing 'know' with 'have.' A password plus a security question are both 'something you know,' making that combination single-factor despite using two credentials. A password plus PIN is likewise two 'something you know' factors. Two passwords in sequence is still only the knowledge factor repeated, not multifactor authentication.

Answer: B
In SAML federation, the identity provider authenticates the user against corporate credentials and issues a digitally signed assertion that the service provider (the SaaS app) trusts and uses to grant access, which is the core mechanism enabling single sign-on across domains. The SaaS application, not the IdP, is the relying party/service provider consuming the assertion. The IdP does not store the SaaS vendor's business data—that remains within the SaaS provider's own systems. The IdP's role is essential up front (issuing the assertion) even though it typically isn't involved in every subsequent in-session action.

Answer: A
ABAC evaluates multiple contextual attributes—user, resource, environment (time, device state), and action—through policy rules to make dynamic access decisions, matching the scenario's combination of department, classification, time, and device compliance. DAC lets resource owners grant access at their discretion, without this rule-based attribute evaluation. RBAC assigns permissions based on fixed roles rather than combining multiple dynamic attributes. Pure MAC relies on classification labels and clearance levels alone, not the broader attribute set (time, device compliance) described here.

Answer: B
RBAC's core administrative benefit is that permissions are bundled into roles tied to job functions, so provisioning and de-provisioning access at scale means assigning or removing a role rather than managing dozens of individual permissions per person, which directly reduces review overhead in large organizations. DAC would push permission decisions to individual data owners, not standardized bundles, and doesn't address the scaling problem described. Rule-based access control applies global if-then rules (e.g., firewall ACLs) rather than job-function bundles. MAC relies on clearance/label comparisons for every request, which is a different mechanism than grouping permissions by role and doesn't inherently reduce the described per-user administrative burden.

Answer: B
Time-limited, checked-out credentials minimize how long privileged access exists and how widely it can be exploited if compromised, directly supporting least-privilege and just-in-time access principles. Logging is still necessary and typically enhanced, not eliminated, under PAM solutions—it's a separate control. No access control model can guarantee human error is eliminated. Authentication is still required to check out and use the credentials; PAM does not remove authentication requirements.

Answer: B
Black-box testing simulates an external attacker who has no prior internal knowledge of the target system's architecture, source code, or credentials, matching the scenario exactly. White-box testing provides the tester full internal knowledge, including architecture and source code, which contradicts the 'no prior system knowledge' condition. Gray-box testing gives partial knowledge, and explicitly having 'full source code access' would actually make it white-box, not gray-box. Static code analysis examines source code without executing it and is a different technique from a simulated external attack.

Answer: B
A false positive occurs when a scanner flags a vulnerability that does not actually pose exploitable risk in the real deployed environment, exactly as described when manual verification shows the code path is unreachable. A true positive would mean the vulnerability is confirmed as genuinely exploitable, which is the opposite of what verification found. A false negative is a missed vulnerability that actually exists but wasn't detected, not a finding that was detected but doesn't apply. A true negative would mean no vulnerability was reported and none exists, which doesn't match this scenario where a finding WAS reported.

Answer: B
SOC 2 Type II specifically evaluates operating effectiveness of controls by sampling evidence across an extended review period, which is exactly what's needed to confirm sustained, real-world control performance rather than mere existence. Reviewing only written policy verifies design, not operation. A single employee interview provides limited, subjective, and non-representative evidence. Confirming design at a single point in time describes a Type I assessment, which addresses design suitability but not sustained operating effectiveness.

Answer: A
A SIEM platform is purpose-built to aggregate, normalize, and correlate log data from diverse sources (authentication systems, firewalls, endpoints) in near real time to detect patterns indicative of multi-stage attacks, matching the described requirement. A single antivirus console only reports on its own host-based detections, not enterprise-wide correlation. A manually updated spreadsheet cannot provide near-real-time correlation and doesn't scale to enterprise log volumes. A badge reader log viewer covers only physical access events, a narrow subset of the required data sources.

Answer: B
Containment is the phase focused on limiting the scope and impact of an incident, such as isolating a compromised server from the network to stop ongoing exfiltration, which is exactly what's described. Preparation involves proactive readiness activities (plans, tooling, training) performed before an incident occurs. Detection and analysis involves identifying and scoping the incident, which has already occurred by the time isolation is triggered. Lessons learned is the post-incident review phase used to improve future response, not an active response action.

Answer: C
A hot site is a fully operational, continuously synchronized duplicate environment capable of near-immediate failover, matching the minutes-long recovery described. A cold site provides only basic infrastructure (power, space, cooling) with no pre-installed systems or data, requiring days to weeks to become operational. A warm site has some equipment and partial data replication but requires additional setup and typically takes hours, not minutes, to fully activate. A mobile trailer with no pre-installed equipment is essentially a portable cold site and would not support minutes-long recovery.

Answer: A
SOAR platforms are designed to orchestrate and automate response playbooks—such as isolating a host or disabling an account—triggered by specific alert conditions, directly reducing analyst workload for well-understood, repeatable incidents. A packet sniffer only captures and displays traffic; it has no automation or orchestration capability. A manual paper runbook still requires a human to read and execute each step, which does not reduce triage burden through automation. An offline vulnerability scanner report is a static assessment output, not an active response automation tool.

Answer: B
The order of volatility principle dictates collecting the most transient evidence first: CPU registers and cache change constantly and are lost the instant power/process state shifts, followed by RAM (lost on reboot/power-off), then network connection state (changes as sessions open/close), with disk contents being comparatively persistent and collected last. Option A reverses the entire order, starting with the most persistent artifact (disk) and ending with the most volatile (registers), which risks losing the most fragile evidence first. Option C and D scramble the sequence in ways that place persistent disk data ahead of more volatile network or register state, violating OOV and risking loss of transient evidence during collection.

Answer: B
A well-designed change management program includes an expedited emergency-change path that still requires documented (even if abbreviated) approval and a post-implementation review, balancing the need for speed against accountability and rollback planning. Skipping all documentation removes accountability and traceability, increasing risk of undetected failures. Waiting for a routine monthly window ignores the active-exploitation urgency and leaves systems exposed unnecessarily. Patching only an executive's workstation does not address the organization-wide risk posed by active exploitation.

Answer: B
Parameterized queries separate SQL code from user-supplied data by binding input as parameters rather than concatenating it into the query string, which is the most effective and industry-standard defense against SQL injection. Client-side validation can be bypassed entirely since it runs in the untrusted browser and provides no server-side protection. Blacklisting specific keywords is easily evaded through encoding, case variation, or alternate syntax and is widely considered an unreliable defense. Connection timeout settings affect performance/availability handling, not injection prevention.

Answer: B
Threat modeling performed during the design phase identifies potential attack vectors and required countermeasures before code is written, making remediation far cheaper than fixing issues discovered later; this reflects the well-established principle that security defects cost progressively more to fix the later they're found. Waiting until incident response means a real compromise may have already occurred. Relying solely on a final penetration test misses the opportunity to influence architecture and catches only a subset of design-level flaws late in the cycle. Decommissioning is the end of the lifecycle and offers no opportunity to prevent flaws in the now-retired system.

Answer: B
Client-side code, including JavaScript delivered to the browser, is fully visible and extractable by any user via view-source or developer tools, so embedding plaintext database credentials there exposes them to anyone who loads the page—a critical confidentiality failure enabling direct unauthorized database access. Page load time is a negligible, unrelated performance concern compared to full credential exposure. This is a substantive security defect, not merely a cosmetic style issue. The JavaScript sandbox restricts what a script can do to the browser/OS, but it does not hide the script's own source code from the user, so the sandbox claim doesn't mitigate this exposure.

Answer: B
The CISSP exam outline is organized into 8 domains, and Domain 1, Security and Risk Management, carries the largest individual weighting at 16%, making it the highest-priority study area by exam weight. There are not 6 or 10 domains, ruling out those options. Asset Security is weighted at 10%, not 25%, and is not the largest domain, so that option misstates both the count context and the specific weight.

Answer: B
The English CISSP exam uses Computerized Adaptive Testing, which contains 100 to 150 questions per attempt, with a passing threshold of 700 out of 1000 scaled points. It is not a fixed-form paper exam, so option A is wrong on format and scoring scale. Option C is wrong because CAT delivers a variable, not always-150, question count, and there is a defined passing score, not an absence of one. It is administered at proctored test centers, not as an untimed take-home exam.

Answer: A
After registering with ISC2, candidates are redirected to the Pearson VUE website to finalize their exam appointment, and the exam itself is administered at Pearson VUE test centers, making this the accurate description of the process. There is no university testing office intermediary in this process. The CISSP exam is proctored at physical test centers rather than delivered as an unproctored at-home exam. Scheduling is done online via Pearson VUE, not by mail.

Answer: A
The simple security property prevents reading above one's clearance and the star property prevents writing to a lower level, which would leak classified content downward. Biba inverts these for integrity with no read down and no write up, protecting data from contamination by lower-integrity sources.

Answer: C
Clark-Wilson introduces the access triple of subject, program and data, so users never manipulate constrained data items directly and every change occurs through a certified transformation procedure. This commercial integrity model maps closely to how business applications actually enforce integrity, unlike the lattice-based labelling of Biba.

Answer: A
A higher assurance level means the claimed security functions were examined more rigorously, so a product with a modest security target evaluated at a high level is not more secure than one with a strong target at a lower level. Reading the security target and protection profile is therefore essential to interpreting the rating at all.

Answer: A
Anything in the trusted computing base can subvert the security policy if it fails or is compromised, which is why minimizing it is a core architectural objective. The reference monitor concept sits within it, mediating all access and requiring tamper resistance, invocation on every access and small enough size to be verifiable.

Answer: A
Ephemeral key exchange means each session's key is discarded and cannot be reconstructed from the long-term key, defeating the record-now-decrypt-later strategy. Without forward secrecy, a single key compromise retroactively exposes every session ever captured, which is why ephemeral modes became the default in modern transport security.

Answer: A
A signature is produced by encrypting a hash with the signer's private key, so verification with the public key proves both that the content is unchanged and that the holder of the private key signed it. The document itself remains readable, which is why signing and encrypting are separate operations frequently applied together.

Answer: A
Revocation exists precisely because expiry is too slow a remedy for a compromised key, and relying parties must actually check status for the mechanism to work. Revocation list distribution latency and the availability and privacy characteristics of online status checking are the practical weaknesses, which stapling and short-lived certificates address in different ways.

Answer: A
Side channels leak information about secret values through observable physical behaviour, which is why a mathematically sound algorithm can still be broken as implemented. Constant-time implementations, blinding and physical shielding are the countermeasures, and none of them involves changing the algorithm.

Answer: D
Data sovereignty means the same dataset can be simultaneously subject to conflicting access, retention and disclosure obligations depending on where it physically resides. That is why data residency controls and jurisdiction-aware architecture matter more in cloud deployments than in single-country data centres.

Answer: A
The difference in standard explains why conduct may fail to sustain a criminal conviction yet support civil liability on the same facts, which matters when deciding whether to pursue prosecution or civil remedy. It also shapes how much evidentiary rigour an investigation needs from the outset, since criminal referral demands the stricter chain of custody.

Answer: A
Copyright attaches automatically to the expression, patents protect novel inventions and functional methods through registration, trademarks protect brand identifiers, and trade secrets protect information deriving value from secrecy and requiring reasonable protective measures. Choosing patent over trade secret trades disclosure for a time-limited monopoly, which is a strategic rather than a legal question.

Answer: B
The pair is often summarized as knowing and doing: diligence establishes what a reasonable organization would know, and care is the reasonable response. Negligence claims typically allege failure of one or both, so an organization that identified a risk and then took no proportionate action has diligence without care.

Answer: B
Ownership sits with the business function that understands the data's value and consequence of exposure, while custody sits with IT operations that run the systems holding it. Assigning ownership to IT is the common failure, since IT can implement controls but cannot determine what the data is worth to the business.

Answer: D
Because the token carries no derivable relationship to the original, systems handling tokens can be removed from the compliance scope that would apply to the real data. The security then depends entirely on protecting the vault holding the mapping, which concentrates rather than eliminates the risk.

Answer: B
The distinction determines whether the obligations of a privacy regime continue to apply, which is why organizations frequently overstate what they have achieved. True anonymization is difficult, since auxiliary data and unique combinations of attributes can re-identify individuals in datasets believed anonymous.

Answer: A
Logical segmentation rests on the switch enforcing tags correctly, so trunk misconfiguration, double tagging and switch compromise all create paths between segments that the design assumed impossible. VLANs also carry no encryption, so traffic within a segment remains observable to anything on that segment.

Answer: B
Zero trust abandons the assumption that being inside the perimeter confers trust, which is the assumption lateral movement after an initial compromise exploits. Continuous evaluation against device posture, identity and context replaces the single perimeter check, and microsegmentation limits what any compromised identity can reach.

Answer: B
An interception attack succeeds by establishing two separately encrypted channels, so encryption alone does not defeat it, and key length is irrelevant when the attacker holds valid keys for both legs. Verifying the peer's certificate against a trusted authority, and pinning where appropriate, is what breaks the attack.

Answer: B
Posture assessment addresses the gap left by user authentication alone, since an authorized user on a compromised or unpatched device introduces the same risk as an unauthorized one. Non-compliant devices are typically placed in a remediation network rather than denied outright, which keeps the control from becoming an availability problem.

Answer: A
Federation lets the service provider trust an authentication it did not perform, which is what removes credential handling from every application. The trust relationship and assertion validation become the critical controls, since a service provider accepting improperly validated assertions can be authenticated as any user.

Answer: A
Using OAuth alone for authentication is a well-documented anti-pattern, because an access token proves the holder was granted access to a resource rather than proving who they are. OpenID Connect adds the ID token carrying authenticated identity claims, which is the piece OAuth deliberately does not provide.

Answer: A
Privileged accounts are the highest-value target because they can disable controls and erase evidence, so the goal is to eliminate standing privilege in favour of brokered, time-bounded and recorded elevation. Session recording matters particularly because privileged actions are otherwise attributable only to a shared administrative account.

Answer: A
Sensitivity can be tuned to trade false acceptances against false rejections, so the crossover point provides a sensitivity-independent basis for comparing systems. In deployment the two errors carry very different costs, so a high-security environment deliberately tunes away from the crossover to minimize false acceptance.

Answer: A
Breadth versus depth is the trade: an assessment enumerates many potential issues without confirming exploitability, while a test proves a smaller number of paths actually work and shows what they reach. Rules of engagement and authorization are essential for the test specifically, because the activity is otherwise indistinguishable from an attack.

Answer: B
Static analysis finds flaws early and can point to the exact line, but produces false positives for code paths that are unreachable at runtime. Dynamic testing confirms exploitability in the running system and catches configuration and environment issues code analysis cannot see, which is why mature programmes use both.

Answer: A
The measured outcome is whether the defenders detected and responded, so the exercise is typically unannounced beyond a small control group and pursues a specific objective by whatever path works. A purple team arrangement instead has attackers and defenders working together to improve detection directly, trading realism for learning speed.

Answer: C
Correlation reveals the multi-host sequence that is the signature of lateral movement, where each individual event is unremarkable in isolation. Aggregation also protects log integrity by moving records off the systems that generated them, so an attacker who compromises a host cannot erase the evidence already forwarded.

Answer: A
Threat modelling identifies what can go wrong while the design can still change, and the cost of remediating a flaw rises sharply with each subsequent phase. Structured approaches such as STRIDE give coverage across spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege rather than relying on ad hoc brainstorming.

Answer: B
Parameterization makes injection structurally impossible because the query plan is fixed before the input is bound, whereas blacklisting is a losing arms race against encoding and alternative syntax. Least-privilege database accounts and input validation remain valuable as defence in depth but do not address the root cause.

Answer: A
The attack abuses ambient authority, since the browser attaches session cookies to a request regardless of what caused it, so the server sees a valid authenticated action. Anti-forgery tokens tied to the session and appropriate cookie same-site attributes are the defences, and stored malicious script is cross-site scripting, a different vulnerability.

Answer: A
A dependency safe at selection becomes vulnerable when a flaw is disclosed years later, so the risk is continuous rather than a one-time assessment. A bill of materials is what makes it possible to answer which applications are affected when a widely used library is found vulnerable, which is otherwise an archaeology exercise under time pressure.

Answer: A
Automation moves code to production faster than manual review can keep pace, so controls must run at pipeline speed and be capable of blocking rather than merely reporting. The pipeline itself also becomes a high-value target with production access, which is why its credentials should be scoped and short-lived rather than standing and unrestricted.

Answer: A
Maximum tolerable downtime is the business's limit and the recovery time objective is the engineering target set inside it, so a target equal to the limit leaves no margin for the recovery running long. Work recovery time, the period needed to restore data currency and resume normal processing after systems are back, must also fit within the same envelope.

Answer: A
Forensic imaging usually resolves the apparent conflict by capturing state quickly so restoration can proceed while analysis continues on the images. Restoring without understanding the intrusion risks reinstating the vulnerability or the attacker's persistence, so the decision requires business and legal input rather than being purely technical.