ISC2 CISSP — Certified Information Systems Security Professional

Question 1

A hospital's wireless network keeps dropping clinical tablets from its access points. Analysis of captured traffic shows a steady stream of spoofed 802.11 deauthentication frames sourced from the legitimate AP's BSSID, forcing clients to disconnect repeatedly. The security team wants a standards-based control that prevents attackers from forging these management frames. Which measure most directly addresses this attack?

Accepted Answer

Enable 802.11w Management Frame Protection (Protected Management Frames) on the WLAN

Answer

Migrate all clients from WPA2-PSK to WPA2-Enterprise with RADIUS authentication

Answer

Reduce AP transmit power and increase the number of access points for better coverage

Answer

Configure MAC address filtering to allow only registered clinical tablets

Question 2

A retail chain offers free customer Wi-Fi using an open (unencrypted) SSID for convenience. Security notices that attackers are setting up rogue access points broadcasting the same SSID with stronger signal to lure customers into connecting, then intercepting their traffic and harvesting credentials from login portals. The business insists the guest network must remain frictionless with no pre-shared key or 802.1X. Which control BEST reduces the risk of these evil twin attacks while preserving open access?

Accepted Answer

Deploy Opportunistic Wireless Encryption (WPA3-OWE) on the guest SSID and enforce HTTPS with HSTS on the captive portal and all customer-facing services

Answer

Increase the transmit power of the legitimate access points so their signal always overpowers rogue APs

Answer

Change the guest SSID to a hidden (non-broadcast) network so attackers cannot clone the network name

Answer

Enable MAC address filtering on the guest network to block unrecognized client devices

Question 3

A hospital's network team discovers that unauthorized laptops are being plugged into wall jacks in patient waiting areas and gaining access to the internal LAN. The team wants a solution that authenticates each device at the moment it connects to a switch port, before granting any network access, and can dynamically assign the device to an appropriate VLAN based on identity. Which control BEST meets this requirement?

Accepted Answer

Configure 802.1X port-based network access control on the switches with a RADIUS authentication server

Answer

Deploy static MAC address filtering on each access switch port

Answer

Implement a host-based firewall on all managed endpoints

Answer

Enable DHCP snooping and dynamic ARP inspection on the switches

Question 4

A global engineering firm needs an access control model for a new document repository. Access decisions must consider a combination of the user's department, project assignment, the sensitivity label of the document, the time of day, and whether the connection originates from a managed device on the corporate network. Requirements change frequently, and administrators want to express rules using these attributes without creating a new role for every combination. Which access control model BEST meets these requirements?

Accepted Answer

Attribute-Based Access Control (ABAC) using policy rules over subject, object, and environmental attributes

Answer

Role-Based Access Control (RBAC) with hierarchical role inheritance

Answer

Discretionary Access Control (DAC) with owner-managed access control lists

Answer

Mandatory Access Control (MAC) with fixed security labels and clearances

Question 5

A financial services firm has employees who frequently transfer between departments. An internal audit reveals that many long-tenured staff retain access permissions from previous roles they no longer need, even though their accounts are active and legitimately used. Which identity lifecycle control most directly addresses this specific finding?

Accepted Answer

Periodic access recertification (entitlement review) by resource and manager owners

Answer

Automated deprovisioning triggered by HR termination events

Answer

Enforcing multi-factor authentication on all privileged accounts

Answer

Implementing single sign-on to consolidate authentication

Question 6

During a security audit of a financial services firm, the auditor finds that three database administrators all log into production systems using a single shared 'dbadmin' account whose password is stored in a team password vault. Management insists this is efficient and that the vault logs who checked out the credential. Which principle of identity and access management is most fundamentally violated by this arrangement?

Accepted Answer

Accountability, because actions performed in the database cannot be reliably attributed to a specific individual

Answer

Least privilege, because all three administrators receive identical database permissions

Answer

Authentication, because the password vault does not enforce multi-factor authentication

Answer

Separation of duties, because one administrator can both check out and use the credential

Question 7

A financial services firm is purchasing a specialized loan-origination application from a small vendor. Because the software will process sensitive customer data and become business-critical, the security team wants assurance that the firm can maintain and remediate the code if the vendor goes out of business or fails to patch discovered vulnerabilities. Which contractual provision BEST addresses this specific concern?

Accepted Answer

A source code escrow agreement with defined release conditions

Answer

A service level agreement (SLA) specifying 99.9% application uptime

Answer

A mutual non-disclosure agreement covering shared data

Answer

A right-to-audit clause permitting annual vendor security reviews

Question 8

A retailer's e-commerce platform experiences credential-stuffing attacks. Currently, each successful breach costs an average of $50,000, and the company suffers about 6 successful breaches per year. A proposed multi-factor authentication and bot-mitigation solution costs $120,000 annually and is expected to reduce the frequency of successful breaches to 1 per year. Based purely on a quantitative cost-benefit analysis, what should the risk manager recommend?

Accepted Answer

Implement the solution, because it produces a net annual benefit of $130,000

Answer

Reject the solution, because its annual cost of $120,000 exceeds the single loss expectancy of $50,000

Answer

Reject the solution, because the residual ALE of $50,000 still represents unacceptable risk

Answer

Implement the solution, because it reduces the annualized rate of occurrence to zero

Question 9

A financial services firm is performing a quantitative risk assessment on its data center. Historical records and industry data show that a major power outage affecting the facility has occurred roughly twice over the past ten years, and each event causes losses estimated at $150,000. The single loss expectancy (SLE) is already documented at $150,000. Which value should the risk analyst use for the annualized rate of occurrence (ARO) when calculating the annualized loss expectancy (ALE)?

Accepted Answer

0.2

Answer

2.0

Answer

0.5

Answer

10.0

Question 10

A security tester reviewing a company's REST API discovers that changing the numeric account ID in the URL path /api/v1/accounts/1042/statements to /api/v1/accounts/1043/statements returns another customer's statements. The request carried a valid, authenticated bearer token belonging to the tester. Which underlying flaw most accurately describes this finding, and what is the correct remediation?

Accepted Answer

Broken object-level authorization; enforce server-side checks that the authenticated principal owns or is permitted to access the requested object for every request

Answer

Broken authentication; require multi-factor authentication before issuing bearer tokens to API clients

Answer

Injection; apply parameterized queries and input validation on the account ID field

Answer

Security misconfiguration; disable verbose error messages and enable TLS on the API endpoint

Question 11

A public-facing REST API exposes a customer-lookup endpoint that requires authentication. Security monitoring reveals that a small number of valid API keys are issuing thousands of sequential requests per minute, systematically enumerating account identifiers. Authorization checks are correctly enforced, and no single request is malformed. Which control would MOST directly mitigate this abuse while allowing legitimate clients to continue operating?

Accepted Answer

Enforce per-client rate limiting and throttling at the API gateway

Answer

Require mutual TLS for all API clients

Answer

Add stronger input validation and output encoding on the endpoint

Answer

Rotate all issued API keys on a shorter schedule

Question 12

A security analyst investigating intermittent session hijacking on a corporate LAN discovers that a rogue host is answering ARP requests for the default gateway's IP address, causing traffic destined for the gateway to be redirected through the attacker's machine. Which switch-based control would most effectively prevent this attack on the access layer?

Accepted Answer

Enable Dynamic ARP Inspection (DAI) validated against DHCP snooping bindings

Answer

Configure port security to limit each port to a single MAC address

Answer

Segment the VLAN using private VLANs (isolated ports)

Answer

Deploy 802.1X port-based authentication on all access ports

Question 13

A software company must digitally sign its release binaries so that customers can verify both the authenticity and integrity of downloads, and so the company cannot later deny having produced a given release. Which key should be used to create the signature, and what property does this primarily provide?

Accepted Answer

The company's private key, providing non-repudiation

Answer

The customer's public key, providing confidentiality

Answer

A shared symmetric key, providing authentication

Answer

The company's public key, providing integrity

Question 14

A security analyst is establishing a recurring log review process for a financial application. Management wants the review to reliably surface privileged-account misuse without generating overwhelming volumes of raw event data for humans to read manually. Which approach BEST meets this requirement?

Accepted Answer

Configure the SIEM to correlate privileged-account events against defined baselines and alert only on deviations, then have analysts review the flagged anomalies

Answer

Export all privileged-account log entries daily to a spreadsheet for a manual line-by-line reviewer

Answer

Increase log retention to seven years so that all privileged activity is available for future forensic reconstruction

Answer

Disable verbose logging on privileged accounts to reduce the data volume that must be reviewed

Question 15

A SaaS provider's enterprise customers increasingly demand independent assurance that the provider's controls over customer data are designed and operating effectively over a period of time. The provider's internal audit team already performs quarterly control reviews, but customers state that internal reports are insufficient for their own vendor risk programs. Which assessment approach BEST satisfies the customers' requirement?

Accepted Answer

Engage a qualified independent audit firm to produce a SOC 2 Type II report covering the relevant Trust Services Criteria

Answer

Expand the internal audit schedule to monthly and publish the internal findings to customers

Answer

Commission an external penetration test and share the executive summary with customers

Answer

Complete a self-assessment questionnaire and have the CISO formally attest to its accuracy

Question 16

An e-commerce company earns nearly all its revenue during a two-week holiday sales window. During last year's window, a volumetric distributed denial-of-service (DDoS) attack made the storefront unreachable for several hours, causing significant lost sales. The CISO wants to prioritize a control that most directly addresses the property of the CIA triad that failed in this incident. Which control should the CISO prioritize?

Accepted Answer

Contract a cloud-based DDoS mitigation and traffic-scrubbing service with elastic scaling

Answer

Deploy end-to-end TLS encryption for all customer transactions

Answer

Implement file-integrity monitoring and cryptographic hashing of the product catalog

Answer

Enforce multifactor authentication for all customer and administrator accounts

Question 17

A security architect adopts a vendor-published security baseline for the organization's Windows servers. During implementation, she discovers that 12 legacy application servers cannot support one of the baseline's mandatory controls (a modern TLS cipher configuration) because doing so would break a critical business application that the vendor no longer updates. Management insists the application must remain operational. What is the MOST appropriate action for the architect to take regarding the baseline?

Accepted Answer

Tailor the baseline for those systems by documenting the deviation and applying compensating controls

Answer

Scope out the 12 legacy servers entirely so no baseline controls apply to them

Answer

Abandon the baseline and allow each server owner to define their own controls

Answer

Force the mandatory control on all servers to maintain a uniform baseline regardless of business impact

Question 18

A defense contractor deploys a multilevel security system enforcing the Bell-LaPadula model. An analyst holding a Secret clearance is logged in at the Secret level and attempts to save a newly authored file classified as Confidential into a Confidential-level repository. According to the model's rules, how should the system respond to this action?

Accepted Answer

Deny the write, because the star property (*-property) prohibits writing to a lower classification level

Answer

Allow the write, because the simple security property permits reading down to Confidential

Answer

Allow the write, because the analyst's clearance dominates the object's classification

Answer

Deny the write, because the strong tranquility property forbids changing an object's label after creation

Question 19

A financial services firm deploys an integrity-focused security model to protect a critical ledger system. A batch process running at the 'Medium Integrity' level attempts to write records into a data store classified at 'High Integrity.' Under the Biba model, how should the system respond to this write attempt?

Accepted Answer

Deny the write, because a subject cannot write to an object of higher integrity than itself

Answer

Allow the write, because a subject may write to any object at or below its own integrity level

Answer

Allow the write, but log it for later review by the integrity verification process

Answer

Deny the write, because a subject cannot read data of lower integrity than itself

Question 20

A development team is building an API gateway that must encrypt session tokens in transit between microservices. They require both confidentiality and assurance that ciphertext has not been tampered with, without bolting on a separate MAC computation. Which block cipher mode of operation should the security architect recommend?

Accepted Answer

AES in Galois/Counter Mode (GCM)

Answer

AES in Electronic Codebook (ECB) mode

Answer

AES in Cipher Block Chaining (CBC) mode

Answer

AES in Counter (CTR) mode

Question 21

A regional bank's executive team asks the security manager to clarify the difference between the organization's Business Continuity Plan (BCP) and its Disaster Recovery Plan (DRP) before approving budget for both. The manager needs to explain how the two efforts relate. Which statement most accurately describes the relationship and scope of these plans?

Accepted Answer

The BCP is a broad, business-focused strategy for sustaining critical operations during a disruption, while the DRP is a subordinate, technical plan focused on restoring IT systems and infrastructure.

Answer

The DRP is the overarching business strategy, and the BCP is the technical subset that recovers servers, networks, and applications after an outage.

Answer

The BCP and DRP are interchangeable terms for the same document and only one needs to be funded to satisfy regulatory requirements.

Answer

The DRP addresses long-term relocation of the entire business, while the BCP is limited to backing up and restoring data files.

Question 22

A security team at a defense contractor discovers that executives traveling internationally are being targeted by rogue base stations that force their smartphones to downgrade from 5G/LTE to 2G, enabling interception of voice and SMS traffic. Which control most directly mitigates this IMSI-catcher (Stingray) attack technique?

Accepted Answer

Configure devices to disable legacy 2G/GSM fallback and enforce mutual authentication over VPN for all voice and messaging

Answer

Require executives to use full-disk encryption on their mobile devices

Answer

Deploy a mobile device management (MDM) policy that enforces strong screen-lock passcodes

Answer

Enable SIM PIN protection and require biometric unlock on each device

Question 23

During a fraud investigation, a forensic analyst images a suspect's hard drive and later hands the copy to a second analyst for review. Weeks afterward, the defense challenges whether the evidence was altered while in storage. Which practice would MOST directly refute this challenge and support the evidence's admissibility in court?

Accepted Answer

A complete chain-of-custody log documenting every person who handled the evidence, along with dates, times, and purposes

Answer

A signed nondisclosure agreement from both analysts covering the case data

Answer

Encryption of the forensic image with a key held by the lead investigator

Answer

A written incident response plan approved by senior management before the investigation began

Question 24

A DevSecOps team wants to prevent developers from committing hardcoded API keys and database passwords into the source repository. Occasionally these secrets are discovered only after they have been deployed to production, forcing emergency credential rotation. Which control most effectively addresses this problem as early as possible in the pipeline?

Accepted Answer

Integrate automated secret-scanning with pre-commit hooks and a pipeline gate that blocks builds when secrets are detected

Answer

Deploy a runtime web application firewall (WAF) that inspects outbound traffic for credential patterns

Answer

Require quarterly manual code reviews by the security team before any release to production

Answer

Encrypt the entire source code repository at rest and restrict access to authorized developers

Question 25

A financial services company is designing a new accounts-payable system. Regulators require that clerks cannot directly manipulate ledger balances; instead, all changes must occur through approved programs that validate each entry, and the person who initiates a payment must not be the same person who approves it. Which security model most directly addresses these requirements?

Accepted Answer

Clark-Wilson model

Answer

Bell-LaPadula model

Answer

Biba integrity model

Answer

Brewer-Nash (Chinese Wall) model

Question 26

A development team is preparing a web application for release. Security wants to identify insecure coding patterns such as improper input validation and use of deprecated cryptographic functions across the entire codebase, including code paths that may rarely execute at runtime. The team has full access to the source code and wants the earliest possible feedback in the development pipeline. Which testing approach best meets these requirements?

Accepted Answer

Static application security testing (SAST) using automated source code analysis

Answer

Dynamic application security testing (DAST) against the running application

Answer

Interactive fuzz testing of exposed API endpoints

Answer

Black-box penetration testing performed just before production release

Question 27

A financial services firm is acquiring a packaged desktop application from a vendor and plans to deploy it across thousands of employee workstations. The security team wants assurance that the executables installed have not been altered between the vendor's build process and the endpoints, and that they genuinely originate from the named vendor. Which control most directly provides this assurance?

Accepted Answer

Requiring the vendor to digitally sign the code and verifying the signature and certificate chain at installation

Answer

Encrypting the installer package with a symmetric key shared between the vendor and the firm

Answer

Running the installer through an authenticated vulnerability scan before deployment

Answer

Placing the vendor's source code in a third-party software escrow arrangement

Question 28

A government procurement team is evaluating two firewall products. Vendor A advertises that its product achieved EAL4+ certification. Vendor B states its product was certified against a specific network device Protection Profile (PP). The procurement officer asks the security architect which certification best assures that the product's security functions meet the government's actual operational security requirements. What should the architect explain?

Accepted Answer

A Protection Profile defines the functional and assurance requirements for a category of products, so certification against the relevant PP better demonstrates the product meets stated security needs.

Answer

The EAL rating alone guarantees the product meets the government's security functional requirements because higher EALs include more functions.

Answer

Both certifications are interchangeable, so the officer should simply choose the product with the higher assurance number.

Answer

The Security Target is irrelevant to procurement decisions and only the EAL number should be compared between vendors.

Question 29

A multinational manufacturer has no formal data classification program. Engineering blueprints, employee health records, and public marketing brochures are all stored together with identical access controls. The CISO wants to ensure that protection efforts and costs are proportional to the value and sensitivity of each information asset. Which action should the CISO take FIRST to address this problem?

Accepted Answer

Establish a data classification scheme and require information owners to assign classification levels to assets

Answer

Deploy data loss prevention (DLP) technology across all file repositories to block unauthorized transfers

Answer

Encrypt all stored data at rest using AES-256 to guarantee confidentiality regardless of sensitivity

Answer

Grant access to all data on a least-privilege basis determined by the IT department

Question 30

A media company distributes premium video through a global content-distribution network (CDN). Analytics reveal that paying subscribers' video URLs are being shared and embedded on third-party sites, allowing non-subscribers to stream content for free (hotlinking). The origin server load is minimal because the CDN caches everything, but revenue is leaking. Which CDN-layer control most directly stops unauthorized reuse of the content URLs?

Accepted Answer

Enable signed/tokenized URLs with short expiration and client-IP or referrer binding at the CDN edge

Answer

Force TLS 1.3 on all edge connections and disable older cipher suites

Answer

Increase the CDN cache TTL so content is served faster to legitimate users

Answer

Deploy a rate-limiting rule on the origin server to throttle excessive requests

Question 31

A banking web application allows authenticated users to transfer funds via a POST request. Security testing reveals that an attacker can host a malicious page that automatically submits a fund-transfer form to the bank's endpoint; if a logged-in victim visits the page, the transfer executes using the victim's active session cookie. The application relies solely on the session cookie to authorize the request. Which control most directly mitigates this vulnerability?

Accepted Answer

Require a per-session, unpredictable anti-CSRF token that must be included in and validated on each state-changing request

Answer

Apply output encoding to all user-supplied data rendered in the transfer confirmation page

Answer

Enforce TLS 1.3 with HSTS to protect the session cookie in transit

Answer

Use parameterized queries for the database call that records the fund transfer

Question 32

A research firm allows the creator of each project document to decide who may read or edit it, and to pass those permissions on to colleagues as they see fit. The security team notices that files are being freely shared between team members based solely on the file creators' judgment, with no central authority validating each grant. Which access control model is in use, and what is its inherent weakness in this scenario?

Accepted Answer

Discretionary Access Control (DAC); permissions propagate at owners' discretion, making enterprise-wide consistency and confidentiality hard to enforce

Answer

Mandatory Access Control (MAC); labels are assigned by the system, so owners cannot control sharing

Answer

Role-Based Access Control (RBAC); access is tied to job functions, preventing individual sharing decisions

Answer

Rule-Based Access Control; a global ruleset uniformly governs every access decision regardless of owner

Question 33

A multinational retailer headquartered in the United States discovers that a database containing personal data of customers residing in several European Union countries has been breached. The Chief Privacy Officer is determining the organization's legal notification obligations. Which factor most directly determines which breach notification laws the retailer must comply with for the affected EU customers?

Accepted Answer

The residency of the data subjects whose personal data was affected

Answer

The physical location of the company's headquarters and primary incorporation

Answer

The country where the breached database server was physically hosted

Answer

The nationality of the executive who signs the notification letters

Question 34

A hospital is consolidating three legacy databases into a single data warehouse. The combined dataset will contain patient names and addresses (classified Internal), appointment schedules (classified Internal), and diagnosis codes with treatment histories (classified Restricted). The data warehouse team asks the data owner what classification and handling requirements should apply to the consolidated repository. What is the MOST appropriate guidance?

Accepted Answer

Apply the highest classification level (Restricted) and its handling requirements to the entire consolidated repository

Answer

Apply the classification of the largest volume of records, which is Internal, to reduce operational overhead

Answer

Average the classification levels of the source datasets to arrive at a balanced control set

Answer

Retain each dataset's original classification and apply controls only when that specific field is accessed

Question 35

A hospital is rolling out a new patient-portal system that stores electronic health records. Leadership asks who should be formally accountable for assigning the classification level of the patient data and approving who may access it. The IT infrastructure team manages the servers and encryption, while the compliance office monitors regulatory requirements. Which party should hold this accountability?

Accepted Answer

The head of the clinical department that generates and uses the patient records, acting as the data owner

Answer

The IT infrastructure team that maintains the servers and encryption keys

Answer

The compliance office responsible for tracking regulatory obligations

Answer

The external cloud vendor hosting the patient-portal application

Question 36

A product team is launching a new mobile fitness app. During design, they propose collecting the user's precise GPS location, full contact list, and device advertising ID, even though the core feature only requires the user's step count and general activity level. The privacy officer reviews the design before development begins. Which principle should the privacy officer invoke to challenge the proposed data collection?

Accepted Answer

Data minimization — collect only the personal data necessary for the stated purpose

Answer

Data remanence — ensure residual data is unrecoverable after deletion

Answer

Separation of duties — split collection responsibilities among multiple staff

Answer

Defensible destruction — dispose of data per a documented retention schedule

Question 37

A retail company collects customer purchase data and decides how and why it will be used for marketing analytics. It contracts a cloud analytics vendor to run the computations strictly according to the retailer's documented instructions. The vendor's operations team also manages the day-to-day storage, backups, and access controls for the hosted datasets. Under a privacy framework such as GDPR, how should the retailer and the vendor's operations team be classified?

Accepted Answer

The retailer is the data controller; the vendor is the data processor

Answer

The retailer is the data processor; the vendor is the data controller

Answer

Both the retailer and the vendor are joint data controllers

Answer

The retailer is the data owner; the vendor is the data controller

Question 38

A hospital's Chief Medical Officer is formally accountable for the classification and permissible uses of patient health records. She has directed that these records be classified as 'Highly Confidential.' A database administrator on the IT operations team is tasked with configuring nightly backups, applying encryption, and managing access control lists on the storage array that holds these records. During an audit, a reviewer asks who is filling the data custodian role for these records. Who is the data custodian in this scenario?

Accepted Answer

The database administrator who implements backups, encryption, and access controls

Answer

The Chief Medical Officer who classifies the records and defines permissible uses

Answer

The patients whose health information is stored in the records

Answer

The external auditor who reviews the safeguards during the assessment

Question 39

A financial analytics firm encrypts customer records at rest using AES-256 and secures all transfers with TLS 1.3. During a security review, an auditor notes that sensitive data is decrypted into system memory and processed in plaintext while running complex analytics workloads on shared virtualization hosts. Which technology BEST addresses the protection gap the auditor has identified?

Accepted Answer

A confidential computing environment using hardware-based trusted execution environments (enclaves)

Answer

Full-disk encryption on all analytics servers

Answer

Mutual TLS authentication between analytics microservices

Answer

Tokenization of records in the backend database

Question 40

A pharmaceutical company recently classified its drug formulation research as its most sensitive intellectual property. Investigators discovered that a departing researcher emailed several formulation spreadsheets to a personal cloud storage account over the previous month, and the activity went completely unnoticed. Management wants a technical control that will detect and block sensitive data leaving the organization through channels such as email, web uploads, and removable media in the future. Which control best meets this requirement?

Accepted Answer

Deploy a data loss prevention (DLP) solution configured with content-inspection policies for the classified formulation data

Answer

Implement full-disk encryption on all researcher workstations and laptops

Answer

Require multifactor authentication for access to the research file shares

Answer

Establish a data retention schedule that purges formulation files after project completion

Question 41

A hospital is deploying a new electronic health records (EHR) system. The Chief Medical Officer decides which staff roles may view patient records and sets the sensitivity level for the data. The IT operations team configures the database access control lists, runs nightly backups, and applies encryption at rest per policy. During an audit, a reviewer asks who is accountable for defining the appropriate protection requirements for the patient data. Which party holds this responsibility?

Accepted Answer

The Chief Medical Officer, acting as the data owner who classifies the data and defines protection requirements

Answer

The IT operations team, because they implement the encryption and backups that protect the data

Answer

The database administrator, as the data custodian who maintains day-to-day access controls

Answer

The audit reviewer, who validates that protection requirements are adequate

Question 42

A hospital plans to reassign a set of storage arrays that previously held highly sensitive patient records to a lower-sensitivity internal training environment. The arrays will remain within the organization and continue in service. The security team must ensure the previously stored patient data cannot be recovered while allowing the media to be reused. Which term best describes the process the team should perform on these arrays before reuse?

Accepted Answer

Purging

Answer

Clearing

Answer

Destruction

Answer

Declassification

Question 43

A hospital is decommissioning several servers that stored patient records on self-encrypting solid-state drives (SSDs). The drives will be returned to a leasing company at the end of the contract, so physical destruction is not permitted. The security team must ensure the sensitive data cannot be recovered before the drives leave the organization's control. Which method most reliably addresses data remanence for these SSDs?

Accepted Answer

Execute a cryptographic erase by destroying the drive's stored encryption key

Answer

Perform a single-pass overwrite of all addressable blocks using a zero-fill utility

Answer

Degauss each drive with a strong magnetic field before returning them

Answer

Delete the partitions and reformat each drive with the operating system's quick format

Question 44

A healthcare organization's legal team discovers that patient records from a closed clinic have been kept indefinitely on backup tapes, well beyond the 7-year period required by regulation. The chief privacy officer wants to reduce the organization's exposure from holding this excess data. Which practice, if it had been enforced, would MOST directly have prevented this situation?

Accepted Answer

A data retention schedule that mandates disposal of records once their required retention period expires

Answer

A stronger encryption baseline applied to all archived backup tapes

Answer

A data loss prevention (DLP) solution monitoring outbound email for patient identifiers

Answer

Role-based access controls restricting who can read archived patient records

Question 45

A hospital's radiology department burns patient MRI images and reports onto DVDs and ships them via courier to a partner clinic for a second opinion. The security team is defining handling requirements for this workflow. Which control most directly addresses the classification level of the data while it is being physically transported on the DVDs?

Accepted Answer

Apply external and internal media labels reflecting the classification and encrypt the DVD contents before shipment

Answer

Require the courier to sign a non-disclosure agreement covering the delivery route

Answer

Configure full-disk encryption on the radiology workstation that authored the DVDs

Answer

Deploy a network DLP appliance to inspect traffic leaving the radiology subnet

Question 46

A defense contractor's data warehouse allows analysts to run aggregate queries (counts, averages) over classified personnel records. A security review discovers that by combining several narrowly-scoped aggregate queries, an analyst can deduce the identity and clearance status of a specific individual—information they are not authorized to see directly. Which database security control BEST addresses this specific weakness?

Accepted Answer

Implement query set size restrictions and result perturbation to prevent inference from combined aggregate results

Answer

Encrypt the underlying tables at rest using transparent data encryption (TDE)

Answer

Require TLS for all client connections to the data warehouse

Answer

Enforce parameterized queries to eliminate SQL injection in the reporting interface

Question 47

A financial services firm must validate its disaster recovery plan for a core transaction-processing system. The CISO wants the highest-confidence test that proves the recovery site can handle real production workloads, but the business absolutely cannot tolerate any downtime or risk to the live production environment during the exercise. Which DR test type best satisfies these competing requirements?

Accepted Answer

Parallel test, where recovery systems are brought online and process real workloads alongside production without shutting production down

Answer

Full-interruption test, where production is shut down and operations fail over entirely to the recovery site

Answer

Structured walkthrough, where recovery team members review the plan step-by-step in a conference room

Answer

Simulation test, where the team responds to a scripted scenario without activating any recovery systems

Question 48

A financial services company discovers that some internal users were silently redirected to a fraudulent banking portal even though they typed the correct domain name. Investigation shows an attacker injected forged responses into the organization's recursive DNS resolver, causing it to store an incorrect IP-to-hostname mapping for a legitimate domain. Which control would most directly prevent this class of attack going forward?

Accepted Answer

Deploy DNSSEC so resolvers can cryptographically validate the authenticity and integrity of DNS responses

Answer

Enforce TLS 1.3 on all web servers hosting the banking portal

Answer

Require multi-factor authentication for all users accessing the banking portal

Answer

Enable full-disk encryption on the recursive DNS resolver servers

Question 49

A security architect discovers that several endpoints on the corporate network are using DNS over HTTPS (DoH) configured directly in their browsers, bypassing the organization's internal DNS resolvers. The security team relies on those resolvers to log queries, block known malicious domains, and detect DNS-based command-and-control traffic. Which consequence represents the MOST significant security concern the architect should address?

Accepted Answer

DoH encrypts DNS queries to external resolvers, blinding the organization's DNS-based monitoring and domain-filtering controls and enabling covert C2 and exfiltration channels

Answer

DoH increases DNS resolution latency, degrading application performance for cloud-hosted services

Answer

DoH prevents the use of DNSSEC, allowing cache-poisoning attacks against endpoint resolvers

Answer

DoH forces all endpoints to fall back to plaintext DNS on port 53, exposing queries to on-path interception

Question 50

A regional insurance company must ensure its claims-processing application can resume within 8 hours of a data center outage. The application changes frequently, and business impact analysis sets an RPO of 4 hours. Leadership wants to minimize ongoing costs while still meeting these targets. The IT team is choosing between recovery site strategies. Which option BEST balances the recovery objectives with cost efficiency?

Accepted Answer

A warm site with pre-installed hardware and network connectivity, requiring data restoration and application configuration before use

Answer

A cold site with hardware ordered and configured after a disaster is declared

Answer

A hot site running fully mirrored, real-time synchronized systems ready for immediate cutover

Answer

A reciprocal agreement with a peer company to share spare capacity during emergencies

Question 51

A financial services firm suffers a data breach. During litigation, plaintiffs argue the company failed to act as a reasonable organization would. Investigators find the firm had conducted thorough vendor assessments, performed risk analyses, and documented security requirements — but never actually implemented the patching and monitoring controls those assessments recommended. Which concept did the firm MOST clearly fail to satisfy, exposing it to negligence liability?

Accepted Answer

Due care

Answer

Due diligence

Answer

Prudent person disclosure

Answer

Separation of duties

Question 52

A hospital is deploying 802.1X authentication for its enterprise Wi-Fi network. Security requires that both the client devices and the RADIUS server mutually authenticate using X.509 certificates, eliminating any reliance on user passwords traversing the wireless link. Managed laptops already have client certificates provisioned via the corporate PKI. Which EAP method best satisfies these requirements?

Accepted Answer

EAP-TLS

Answer

PEAP with MSCHAPv2

Answer

EAP-MD5

Answer

EAP-FAST with anonymous provisioning

Question 53

During a critical outage at 2 a.m., an on-call systems administrator applies an unapproved firewall rule change to restore a failed VPN concentrator that thousands of remote employees depend on. The change works and service is restored. Following the organization's change management process, what should the administrator do next?

Accepted Answer

Document the emergency change and submit it for retroactive review and approval by the change advisory board

Answer

Nothing further, since the change was successful and the outage is resolved

Answer

Immediately roll back the change and wait for normal change approval during business hours

Answer

Delete the associated log entries to avoid triggering a policy-violation alert for the unapproved change

Question 54

A financial services company is hardening its TLS configuration. Security architects want to ensure that if an attacker later obtains the server's long-term private key, they still cannot decrypt previously captured TLS session traffic. Which cryptographic property, and its supporting mechanism, best achieves this requirement?

Accepted Answer

Perfect forward secrecy, achieved by using ephemeral Diffie-Hellman (DHE/ECDHE) key exchange

Answer

Non-repudiation, achieved by signing each session with the server's RSA private key

Answer

Confidentiality, achieved by using RSA key transport to encrypt the pre-master secret

Answer

Data integrity, achieved by applying HMAC to each record with a static shared key

Question 55

A financial services firm keeps suffering account takeovers despite mandating SMS one-time passcodes as a second factor. Attackers use convincing proxy phishing sites that capture the user's password and relay the OTP in real time. The security architect is asked to select an authentication method that will structurally defeat this real-time relay (adversary-in-the-middle) technique. Which approach best meets the requirement?

Accepted Answer

Deploy FIDO2/WebAuthn hardware security keys that bind the credential to the origin and use challenge-response public-key cryptography

Answer

Replace SMS OTP with time-based one-time passwords (TOTP) generated by an authenticator app

Answer

Add knowledge-based security questions as a third authentication factor

Answer

Increase the length of the SMS OTP from six to eight digits and shorten its validity window

Question 56

A forensic analyst must acquire the contents of a suspect's laptop hard drive for a potential litigation case. The analyst needs to ensure that the acquired image is an exact, verifiable copy and that the original evidence remains unaltered during the process. Which combination of practices BEST satisfies these requirements?

Accepted Answer

Attach the drive through a hardware write-blocker, create a bit-for-bit image, and generate/compare cryptographic hashes of the source and image

Answer

Boot the suspect laptop normally and copy the relevant files to an external drive, then note the copy timestamp

Answer

Run antivirus on the source drive first, then perform a logical file copy and zip the results for storage

Answer

Encrypt the source drive with a new key before imaging so the evidence cannot be tampered with afterward

Question 57

A responder arrives at a compromised but still-running Linux server that is actively communicating with an external IP. Management wants a forensically sound image before the system is taken offline. Which evidence should the responder collect FIRST to preserve the most fragile data?

Accepted Answer

The contents of RAM, running processes, and active network connections

Answer

A bit-for-bit image of the primary hard disk

Answer

Archived syslog files stored on a remote log server

Answer

A backup tape containing last night's full system snapshot

Question 58

A security tester is evaluating a newly developed API that parses uploaded XML documents. The tester wants to systematically feed the application large volumes of malformed, unexpected, and random input to discover crashes, memory faults, and unhandled exceptions before attackers do. Which testing technique BEST fits this objective?

Accepted Answer

Fuzz testing (fuzzing) with generated malformed inputs

Answer

Regression testing against the previous release baseline

Answer

Positive functional testing using valid, expected data

Answer

Interface testing to confirm modules exchange data correctly

Question 59

A European subsidiary of a US-based company plans to transfer employee personal data to its parent company's HR system hosted in a US data center. The company's legal team confirms the US recipient is not certified under any adequacy framework recognized by the EU. Which mechanism should the security and privacy team recommend to make this cross-border transfer lawful under GDPR while requiring the least dependence on future regulatory approval?

Accepted Answer

Execute Standard Contractual Clauses (SCCs) between the EU exporter and US importer, supplemented by a transfer impact assessment

Answer

Rely on the explicit consent of each employee as the sole legal basis for every transfer

Answer

Anonymize a subset of records and transfer the remaining identifiable data without additional safeguards

Answer

Delay all transfers until the EU issues a new adequacy decision covering the US recipient

Question 60

A financial services firm is upgrading fire suppression in a densely packed data center. The room houses expensive networking gear and must remain operational during and immediately after any incident. Staff occasionally work inside the room. Management wants a system that extinguishes fire without damaging electronics, leaves no residue, and is safe for occupants at design concentrations. Which fire suppression approach best meets these requirements?

Accepted Answer

A clean agent gaseous suppression system such as FM-200 or Novec 1230

Answer

A wet pipe sprinkler system charged with water throughout the room

Answer

A dry chemical (sodium bicarbonate) suppression system

Answer

A traditional Halon 1301 total-flooding system

Question 61

A financial services company is deploying a new payment processing platform that must generate and store the master encryption keys used to protect cardholder data. Regulators require that the private keys never exist in plaintext outside a tamper-resistant boundary, and that key operations be auditable. Which control best satisfies these requirements?

Accepted Answer

Generate and store the keys within a FIPS 140-2 Level 3 hardware security module (HSM)

Answer

Store the keys in an encrypted database column protected by the application's service account credentials

Answer

Use a software-based key vault running on a hardened virtual machine with full-disk encryption

Answer

Distribute the keys across multiple application servers using Shamir's Secret Sharing at the OS level

Question 62

A manufacturing company operates a plant floor with programmable logic controllers (PLCs) and legacy SCADA systems that cannot be patched without vendor recertification and use unauthenticated, cleartext industrial protocols. The corporate IT network needs occasional access to production data for reporting. As the security architect, which approach BEST protects the industrial control environment while meeting the business requirement?

Accepted Answer

Implement a segmented architecture with a demilitarized zone (DMZ) containing a data historian, allowing IT to query the historian rather than reaching the control network directly

Answer

Deploy modern endpoint antivirus and full-disk encryption directly on each PLC and SCADA node to compensate for the outdated protocols

Answer

Place the SCADA systems on the same VLAN as corporate workstations but require multifactor authentication for all users accessing the plant floor

Answer

Expose the SCADA systems to the internet through a VPN so remote engineers and IT reporting tools can access real-time data on demand

Question 63

A financial services firm is launching a fully remote customer onboarding portal. Regulators require strong assurance that each new account holder is a real, verified person before an account is opened, but no in-person branch visit is possible. Which activity in the identity lifecycle must the firm strengthen to meet this requirement?

Accepted Answer

Identity proofing, by validating government-issued evidence and binding it to the applicant during registration

Answer

Authentication, by requiring a FIDO2 hardware key at every login

Answer

Authorization, by applying least-privilege RBAC roles to new accounts

Answer

Session management, by shortening idle timeouts on the portal

Question 64

During an active intrusion, an analyst discovers that a compromised server is actively exfiltrating data to an external IP. Legal has stated they intend to pursue prosecution and require forensically sound evidence. Management is pressuring the team to stop the data loss immediately. What is the BEST containment action for the analyst to take?

Accepted Answer

Isolate the server from the network while keeping it running, and capture volatile memory before further action

Answer

Power off the server immediately to halt the exfiltration and preserve the disk in its exact state

Answer

Leave the server fully connected and continue monitoring to gather more evidence of attacker behavior

Answer

Re-image the server from a known-good backup to restore service as quickly as possible

Exam domain	Exam weight	Practice
Security and Risk Management	16%	Practice this topic
Asset Security	10%	Practice this topic
Security Architecture and Engineering	13%	Practice this topic
Communication and Network Security	13%	Practice this topic
Identity and Access Management (IAM)	13%	Practice this topic
Security Assessment and Testing	12%	Practice this topic
Security Operations	13%	Practice this topic
Software Development Security	10%	Practice this topic

ISC2 CISSP — Certified Information Systems Security Professional (CISSP) practice exam & study guide

Start studying CISSP

All CISSP study resources

CISSP exam domains

Sample CISSP questions

Key CISSP terms

CISSP frequently asked questions

Security and Risk Management (16%)

Asset Security (10%)

Security Architecture and Engineering (13%)

Communication and Network Security (13%)

Identity and Access Management (IAM) (13%)

Security Assessment and Testing (12%)

Security Operations (13%)

Software Development Security (10%)