Free CISSP practice questions, every option explained

A US federal agency follows the NIST Risk Management Framework for a new benefits system. The security and privacy controls have just been assessed and the report is ready. Which step comes NEXT?

• AImplement the controls
  Implementation happened before the assessment.
• BMonitor the controls
  Ongoing monitoring follows the authorization decision.
• CSelect the controls
  Selection is an earlier step, after categorization.
• DAuthorize the system
  Correct. After assessment, an authorizing official reviews the results and residual risk and decides whether to authorize operation. Monitoring follows.

A consumer electronics company labeled its new product's specifications Restricted during development. The product was launched publicly last week. What should happen to the classification of the specifications?

• AKeep them Restricted, since classification levels should never be lowered
  Keeping public data at a high level wastes controls and confuses users.
• BThe owner should reclassify them through the defined declassification process
  Correct. Sensitivity changes over time. The owner downgrades data through the formal process so protection matches its current value.
• CCopy the public parts into a new Public document and keep the original Restricted
  Duplicating content creates version and integrity problems and leaves stale labels; the owner should reclassify through the declassification process.
• DLet the marketing team relabel the documents as Public on its own initiative
  Only the owner, through the process, should change a classification.

A health system is designing a new outpatient campus in an area with a history of car break-ins and loitering. The architect wants to reduce crime through the layout itself before adding guards or cameras. Which approach BEST applies this principle?

• AHire additional guards for every shift and post them at each entrance to the outpatient campus
  Guards may help, but they are an operational cost added later, not a design choice that reduces crime by itself.
• BApply CPTED: clear sightlines, good lighting, defined entrances and landscaping that signals ownership
  Correct. Crime Prevention Through Environmental Design uses natural surveillance, natural access control and territorial reinforcement to discourage crime by design.
• CInstall cameras on every building corner and record the footage continuously for later review
  Cameras are mainly detective. CPTED aims to deter crime through layout before relying on technology.
• DSurround the entire campus with tall opaque walls topped with razor wire to keep everyone out
  This creates hidden areas, harms the welcoming feel a clinic needs and is target hardening rather than design-based prevention.

A utility uses 4G modems to connect remote pumping stations to its control center over a carrier network. A consultant points out that the carrier's encryption only protects the radio segment. What should the security manager do?

• ASwitch from 4G to 5G modems, since 5G encrypts traffic all the way to the control center
  5G improves several protections, but it still does not provide application end-to-end encryption to the utility's site.
• BAdd end-to-end encryption, such as an IPsec VPN, between the stations and the control center
  Correct. Cellular encryption protects the air interface only. End-to-end protection is needed across the carrier core and internet.
• CAssign public IP addresses to each modem so that the control center can reach them directly
  Public addressing exposes the stations to internet scanning and adds risk.
• DRely on the carrier's radio encryption, since cellular networks are encrypted from end to end
  Radio encryption stops at the base station or core; traffic beyond it is not protected by the carrier's air-interface crypto.

New hires at an engineering firm get access by IT copying the account of a colleague in the same team. Audits show new hires inherit years of accumulated permissions. What is the BEST provisioning approach?

• AGive new hires no access and let them request each permission as they discover they need it
  Starting with nothing delays productivity and creates many ad hoc requests.
• BProvision from defined role templates triggered by HR, with owner approval for any additions
  Correct. Role-based provisioning from an authoritative trigger gives new hires exactly the access their role needs, not a colleague's history.
• CCopy the manager's account, since managers know what their team members need to access
  Managers usually hold more access than staff, so copying them overprovisions.
• DCopy the newest team member's account instead, since newer accounts collect fewer permissions
  Copying any person's account still inherits their exceptions; the method is the problem.

A DR test met the RTO for every system. However, the team used an environment it had pre-staged and synchronized the day before, and it skipped validation of the restored data. How should the security manager interpret the results?

• AReadiness is proven, because every system was recovered within its RTO
  Meeting RTOs under artificial conditions does not prove the same result in a real disaster.
• BDR testing can move to once every three years given these strong results
  Results that overstate readiness are not a reason to test less often.
• CThe RTOs should be tightened, since they were met so easily in testing
  RTOs come from the BIA and business needs, not from how easy a staged test was.
• DResults likely overstate readiness; test under realistic conditions with data checks
  Correct. Pre-staging removes the hardest part of a real recovery, and unvalidated data may be incomplete or corrupt. The measured times are therefore optimistic.

Which sequence BEST describes a typical change management process?

• ARequest, implementation, approval, impact analysis, testing, documentation
  Implementing before approval and analysis defeats the purpose of change control.
• BRequest, approval, implementation, testing, impact analysis, documentation
  Impact analysis informs approval, and testing should precede production implementation.
• CRequest, impact analysis, approval, testing, implementation, documentation
  Correct. A change is requested, its impact analyzed, approved, tested, implemented and then documented, updating the baseline.
• DImpact analysis, request, testing, implementation, approval, documentation
  Approval must come before implementation, not after.

Match each cloud service model to the customer's main security responsibility. 1: SaaS. 2: PaaS. 3: IaaS. Which mapping is correct?

• A1 application code and data; 2 OS, applications and data; 3 users and data
  PaaS customers do not manage the OS, and IaaS customers manage far more than users.
• B1 OS, applications and data; 2 users and data; 3 application code and data
  SaaS customers do not manage the OS; IaaS customers do.
• C1 users and data; 2 application code and data; 3 OS, applications and data
  Correct. Customer responsibility grows from SaaS to PaaS to IaaS. In IaaS the customer manages the guest OS and everything above it.
• D1 users and data; 2 OS, applications and data; 3 application code and data
  PaaS hides the OS, while IaaS exposes it to the customer.

An engineering director at a manufacturer will travel to a trade show abroad, where border officers may inspect devices. Which TWO handling measures BEST protect the company's Restricted design files? (Choose TWO.)

• ATravel with a clean loaner laptop holding only the files needed
  Correct. Minimizing what travels limits what could be inspected, lost or copied.
• BKeep any files that must travel encrypted, per the handling rules
  Correct. Encryption protects files if the device is lost or stolen.
• CKeep the files in company cloud storage and download them at the hotel
  Downloading abroad still puts the files on the device over untrusted networks and during later inspections.
• DCopy all design files to a USB drive as a backup for the trip
  Extra copies on portable media add exposure rather than reducing it.
• EDisable the laptop's USB ports for the duration of the trip
  Port control helps against copying, but it does not protect the files if the laptop is inspected, seized or stolen.

Call detail records from a manufacturer's IP PBX show: 2:10 a.m. to 4:40 a.m. Sunday, 380 calls from voicemail extension 4100 to premium-rate international numbers; normal weekend volume, under 10 calls. What is MOST likely happening, and what should be done?

• ANormal after-hours activity by the night shift; no action is needed beyond reviewing next month's bill
  Hundreds of premium international calls from a voicemail extension at night are not normal activity.
• BVishing against employees; run a phishing awareness campaign focused on voice calls next quarter
  Vishing targets people through calls; these records show the PBX itself being used to place calls.
• CA VoIP denial-of-service attack; add bandwidth so that legitimate calls are not dropped on Monday
  The pattern is outbound billable calls, not a flood that degrades service.
• DToll fraud through a compromised voicemail account; restrict outbound dialing and enforce strong PINs
  Correct. Attackers abuse weak voicemail or PBX settings to place costly calls. Dialing restrictions, strong PINs and call monitoring stop it.