CISSP practice questions and exam guide

A manufacturer signs sensor telemetry so a plant operator can prove a reading came from the specific device that produced it and was not altered. Beyond integrity, which of the five pillars does this MOST directly support?

1. Availability, because signed readings can be replayed after an outage
2. Confidentiality, because the act of signing conceals the reading from intermediaries
3. Non-repudiation, because the originating device cannot credibly disown the reading
4. Authenticity alone, because the signature only proves the sender's identity

Answer: C — Non-repudiation, because the originating device cannot credibly disown the reading

C) Correct — the five pillars extend CIA with authenticity and non-repudiation; a device-bound signature makes disowning the reading untenable, which is the defining property of non-repudiation. A) tempts because signing supports safe replay, but availability concerns access to the data, not proof of origin. B) is a common misconception — signing binds origin and integrity, it does not encrypt or hide content. D) is half right: authenticity is served too, but the question asks what is MOST directly added beyond integrity, and non-repudiation is the stronger, distinctly named pillar here.

An organisation is onboarding a supplier that will process regulated customer data. Which contractual provision does the MOST to preserve the organisation's ability to manage this risk over time?

1. A right to audit the supplier and to receive independent assurance reports
2. A service credit schedule tied to monthly availability targets
3. A clause allowing the supplier to subcontract with prior written notice
4. A limitation of liability capped at twelve months of fees paid

Answer: A — A right to audit the supplier and to receive independent assurance reports

A) Correct — an ongoing right to audit or to receive independent assurance keeps visibility over control effectiveness for the life of the relationship rather than at onboarding only. B) protects availability commercially but reveals nothing about data protection controls. C) is a direction reversal — permitting subcontracting on notice extends the supply chain rather than controlling it. D) is a partial: liability caps allocate loss after failure, they do not help manage the risk.

Which describes the CIA triad?

1. Cryptography, integrity, and authentication of users
2. Centralization, identity, and authorization of access
3. Cost, importance, and access level of the data asset
4. Compliance, investigation, and audit of the systems
5. Confidentiality, integrity, and availability of data

Answer: E — Confidentiality, integrity, and availability of data

E states the three security objectives every control ultimately serves: no unauthorized disclosure, no unauthorized modification, and access for authorized users when needed. A tempts because cryptography and authentication are real controls, but they are mechanisms, not the objectives. B substitutes identity-management terms. C is an asset-valuation vocabulary, not a security model. D lists assurance activities. The inverse of the triad is the DAD model: disclosure, alteration, destruction.

A firm operates in several jurisdictions with conflicting obligations: one requires citizen data to remain in-country, another grants broad deletion rights. Which approach is MOST appropriate?

1. Apply the least restrictive requirement globally to keep operations simple
2. Apply the requirements of the jurisdiction where headquarters is located
3. Map obligations per data set and engineer to the strictest applicable
4. Store all data in a single jurisdiction chosen for its favourable privacy regime

Answer: C — Map obligations per data set and engineer to the strictest applicable

C) Correct — conflicting regimes are handled by mapping which obligations attach to which data and population, then designing controls to satisfy the strictest applicable requirement for each. A) guarantees non-compliance in the stricter jurisdiction. B) is a common misconception — the headquarters location does not displace obligations tied to where data subjects reside. D) directly violates the localisation requirement described in the stem.

Decommissioned solid-state drives that held confidential data must be reused in a lower-classification environment. Why is degaussing NOT an appropriate sanitisation method?

1. SSDs store data in flash cells that a magnetic field does not erase
2. Degaussing destroys the drive electronics, preventing any later reuse
3. Degaussing only removes file system pointers rather than the data itself
4. Degaussing requires the drive to be powered and mounted to take effect

Answer: A — SSDs store data in flash cells that a magnetic field does not erase

A) Correct — degaussing works by disrupting magnetic domains, and flash memory stores charge in cells, so the technique has no effect on an SSD. B) is true of magnetic hard drives, where degaussing does render the drive unusable, but that is not why it fails on an SSD. C) describes a simple delete or format, not degaussing. D) invents an operating requirement that does not exist.

An organization stores customer data in a cloud region located in another country. Which concern is MOST directly raised?

1. Data sovereignty — the data may fall under the laws of the country where it is physically stored
2. Data quality — records may degrade as network latency increases between the two regions involved
3. Key lifecycle — encryption keys may expire more quickly when held in foreign data centre facilities
4. Backup integrity — geographic separation may corrupt copies replicated to the distant region

Answer: A — Data sovereignty — the data may fall under the laws of the country where it is physically stored

A) Correct: storing data in another jurisdiction subjects it to that country's law, including government access powers, retention mandates and disclosure obligations, and may conflict with the obligations that apply at home. B) Latency affects performance and is measured in milliseconds; it does not alter stored records. C) Key validity periods are set by policy and the key management system, not by the geography of the data centre. D) Replication distance does not corrupt data; integrity is protected by checksums and verification regardless of distance.

A consultancy serves competing banks from one analyst pool. It needs an access model where an analyst's prior work dynamically restricts what they may open next. Which model BEST fits?

1. Brewer-Nash, where access history creates conflict-of-interest boundaries at run time
2. Clark-Wilson, where transformation procedures mediate all access to constrained data items
3. Lattice-based mandatory access control with a separate compartment per client
4. Role-based access control with one role defined per client engagement team

Answer: A — Brewer-Nash, where access history creates conflict-of-interest boundaries at run time

A) Correct — Brewer-Nash, the Chinese Wall model, makes permissions depend on what the subject has already accessed, which is exactly the dynamic conflict-of-interest requirement. B) enforces well-formed transactions for integrity, not competitor separation. C) is close and tempting but compartments are assigned statically; they do not adapt to access history. D) also assigns statically and requires an administrator to predict conflicts in advance.

In Bell-LaPadula, the *-property (star property) states that a subject:

1. Can read at the same or higher classification but not lower
2. Cannot read at any level different from its own
3. Cannot write to a lower classification level
4. Can write to any level if the subject's clearance permits

Answer: C — Cannot write to a lower classification level

C) Correct: *-property = no write down. Prevents leakage from higher to lower classifications. A) Direction reversal — simple security property is no read up (cannot read higher), not as stated. B) Strong star property restricts read/write to the same level — different rule. D) Ignores classification flow restrictions.

What is a primary advantage of a Hardware Security Module?

1. Tamper-resistant key generation, storage, and use
2. Inexpensive bulk storage of archived business files
3. Improved thermal management of heavily loaded CPUs
4. Faster boot sequencing for large fleets of servers
5. High-throughput switching between network segments

Answer: A — Tamper-resistant key generation, storage, and use

A is correct: cryptographic operations happen inside tamper-resistant hardware and private keys never leave it in plaintext, which is why certificate authority signing keys, payment processing, and code signing rely on them. B, C, D, and E describe storage, cooling, boot, and networking functions that an HSM does not perform and that would not justify its cost. FIPS 140-3 validation levels indicate the degree of physical and logical protection provided.

A data centre already separates tiers with VLANs and a perimeter firewall, yet an intrusion spread freely between application servers in one tier. Which approach BEST prevents recurrence?

1. Add a second firewall pair in high availability at the data centre edge
2. Move each application tier onto its own dedicated physical switch stack
3. Increase the number of VLANs so each application has a dedicated broadcast domain
4. Apply micro-segmentation with per-workload policy at the virtual interface

Answer: D — Apply micro-segmentation with per-workload policy at the virtual interface

D) Correct — micro-segmentation enforces policy at the individual workload, so east-west traffic between peers in the same tier is controlled rather than implicitly trusted. A) adds capacity at the perimeter, which the traffic never crossed. B) is expensive and still leaves peers within a tier able to talk freely. C) is the closest wrong answer: more VLANs subdivide broadcast domains but still permit unrestricted communication inside each one.

An IDS deployed on a switch SPAN port misses traffic during peak load. Which change BEST addresses the gap?

1. Reduce the number of source VLANs mirrored to the session so the port is not oversubscribed
2. Move the sensor inline so it can drop malicious traffic as well as observe it
3. Deploy a passive network tap on the monitored link to deliver a full copy of all traffic
4. Increase the retention period of the sensor's alert database to capture more history

Answer: C — Deploy a passive network tap on the monitored link to deliver a full copy of all traffic

C) Correct — a tap copies the link at line rate and does not compete with switching resources, which is the standard fix when a mirror port drops frames under load. A) helps but reduces coverage, trading one blind spot for another. B) changes the sensor's function to prevention and introduces an availability risk without guaranteeing the capture problem is solved. D) affects storage of alerts already generated, not the traffic that was never seen.

Why does an unauthenticated network time service materially weaken security controls elsewhere?

1. It permits amplification attacks that saturate the organisation's internet circuits
2. It prevents dynamic routing protocols from converging across the estate
3. It allows time manipulation that undermines certificate and token validity
4. It causes clock drift that degrades voice and video quality on converged links

Answer: C — It allows time manipulation that undermines certificate and token validity

C) Correct — time underpins certificate validity windows, ticket and token expiry, and the ordering of evidence, so an attacker who controls time undermines several controls at once. A) is a genuine NTP concern but describes availability abuse of a server, not the weakening of other controls. B) is false; routing convergence does not depend on synchronised clocks. D) confuses time-of-day synchronisation with media clocking and jitter buffering.

Which BEST distinguishes OAuth 2.0 from OpenID Connect (OIDC)?

1. OAuth 2.0 authenticates end users, while OIDC authorizes access to backend APIs
2. OAuth 2.0 issues access tokens for delegated authorization; OIDC adds ID tokens
3. They are interchangeable identity protocols that differ only in message encoding
4. OIDC is a legacy federation protocol that OAuth 2.0 was designed to replace

Answer: B — OAuth 2.0 issues access tokens for delegated authorization; OIDC adds ID tokens

B) Correct: OAuth 2.0 is a delegated authorization framework issuing access tokens; OIDC layers authentication on top of it, returning a signed ID token that asserts who the user is. A) The reversal — the most common candidate trap. C) Their purposes differ; encoding is not the distinction. D) OIDC is newer and is built on OAuth 2.0, not replaced by it.

The MOST important control to prevent former employees from retaining access to corporate systems is:

1. Annual access certification campaigns performed by each user's line manager
2. Strong multifactor authentication enforced on all remote access pathways
3. Quarterly password expiration enforced across all user and service accounts
4. HR-triggered joiner-mover-leaver deprovisioning executed at termination

Answer: D — HR-triggered joiner-mover-leaver deprovisioning executed at termination

D) Correct: Only an authoritative HR event feeding automated deprovisioning removes access at the moment employment ends, which is what the question asks for. A) An annual cycle can leave a departed user active for months. C) Expiration forces a password change but leaves the account usable. B) Multifactor authentication does not help when the still-valid account holds the second factor.

Users at one site cannot obtain Kerberos tickets, and the errors point to time. The MOST likely cause is that:

1. The site's clocks have drifted beyond the permitted skew for ticket validation
2. The ticket-granting ticket lifetime was configured longer than the session ticket
3. The key distribution centre is issuing tickets encrypted with an outdated cipher
4. The users' accounts were created after the last directory replication cycle

Answer: A — The site's clocks have drifted beyond the permitted skew for ticket validation

A) Correct — Kerberos relies on loosely synchronised clocks and rejects timestamps outside the allowed skew, which is the standard cause of a site-wide, time-related ticket failure. B) is a normal configuration relationship and does not by itself block issuance. C) would surface as cryptographic or negotiation errors, not skew errors, and is a real but wrong-for-this-scenario cause. D) tempts because replication lag breaks logons, but the symptom would be unknown principals rather than a time complaint.

A service organisation's report excludes a subservice cloud provider's controls from the description, stating that they are the user's responsibility to evaluate. This treatment is:

1. The inclusive method, requiring the subservice organisation's own attestation
2. A qualification of the auditor's opinion on the description
3. The carve-out method, leaving the user entity to obtain separate assurance
4. A scope limitation that invalidates the report for reliance purposes

Answer: C — The carve-out method, leaving the user entity to obtain separate assurance

C) Correct — carve-out omits the subservice organisation's controls from the description and testing, so the user entity must obtain assurance separately. A) reverses the definitions; inclusive brings those controls inside the engagement. B) is wrong because carve-out is a normal presentation choice, not an opinion modification. D) overstates it; the report remains usable once the reader accounts for the carved-out scope.

Which combination BEST describes the difference between static and interactive application security testing?

1. Static analyses source without running it; interactive instruments at runtime
2. Static runs against compiled binaries only; interactive runs against source code only
3. Static is performed by developers; interactive is performed exclusively by external testers
4. Static requires production data; interactive can operate entirely on synthetic data

Answer: A — Static analyses source without running it; interactive instruments at runtime

A) Correct — static analysis reasons about code without execution, while interactive testing uses runtime instrumentation to observe behaviour as the application is exercised. B) is a technical reversal of what each technique consumes. C) describes who commonly runs each, which is a workflow habit rather than a definition. D) invents a data dependency neither technique has.

Which testing approach simulates an external attacker with NO prior knowledge of the target environment?

1. Black-box testing conducted with no prior knowledge of the target environment
2. White-box testing performed with full architecture and source code knowledge
3. Manual source code review of the application's security-relevant functions
4. A compliance audit measuring adherence to a published control standard

Answer: A — Black-box testing conducted with no prior knowledge of the target environment

A) Correct: Black-box, or zero-knowledge, testing withholds internal detail so the tester must discover the environment the way an outsider would. B) White-box supplies design and source detail up front. C) Source review is inherently full-knowledge and non-adversarial. D) An audit measures conformance to a standard rather than simulating attack.

A threat intelligence program currently consumes only IP and hash indicator feeds. Management asks why detections keep going stale within days. The MOST accurate explanation is that the program lacks:

1. Sufficient feed volume, since more subscriptions raise coverage
2. Automated blocking, since indicators are reviewed manually before they are deployed
3. Adversary tactics, techniques and procedures, which change far more slowly
4. A confidence-scoring scheme, which would let stale indicators be aged out faster

Answer: C — Adversary tactics, techniques and procedures, which change far more slowly

C) Correct — atomic indicators sit at the bottom of the pyramid of pain and are trivially rotated; detections built on TTPs describe how the adversary must operate and therefore survive infrastructure churn. A) Adding feeds multiplies the same short-lived artifacts and increases noise rather than durability. B) Faster deployment shortens the lag but the indicator still expires quickly. D) Confidence scoring and aging improve hygiene, addressing the symptom of stale data rather than the absence of behavioral detection.

Which BEST describes the principle of least privilege?

1. Every user account is granted full administrative rights
2. All subjects receive an identical baseline of access rights
3. Senior staff automatically receive full access to all systems
4. Privileges are assigned at random and rotated frequently
5. Subjects hold only the permissions their function needs

Answer: E — Subjects hold only the permissions their function needs

E is the definition: a user, process, or service holds the minimum permissions required to perform its function, and nothing further, which bounds the damage from any compromised account. A and C are the common real-world violations, granting rights by convenience or seniority rather than need. B removes the tailoring that makes the principle work. D confuses privilege minimization with credential rotation. Least privilege pairs with need-to-know for data and separation of duties for processes.

A treasury group has never rotated staff between roles and grants no extended leave. An auditor flags this. The PRIMARY security concern is that:

1. Staff become over-specialized, weakening succession and cross-training
2. Individual workloads become uneven, which raises the risk of processing errors
3. Access reviews are harder because the assigned roles never change
4. A long-running scheme persists because no one else performs the duties

Answer: D — A long-running scheme persists because no one else performs the duties

D) Correct — job rotation and mandatory vacation are detective controls: when someone else must perform the work, concealed manipulation surfaces because the perpetrator is not there to maintain it. A) Reduced resilience and poor succession are genuine consequences, but they are operational rather than the security concern the auditor is raising. B) Workload imbalance is a management issue with no direct fraud-detection dimension. C) Static roles actually make entitlement review easier, not harder.

A team already runs static and dynamic analysis but keeps shipping known-vulnerable third-party packages. Which addition to the pipeline MOST directly closes this gap?

1. Software composition analysis matching dependencies to vulnerability data
2. Increased static analysis coverage across all first-party source repositories
3. Manual peer review of every pull request before it is merged to the main branch
4. Fuzz testing of the application's externally exposed network interfaces

Answer: A — Software composition analysis matching dependencies to vulnerability data

A) Correct — SCA is the control aimed at inherited risk: it identifies open source and third-party components, including transitive dependencies, and flags known vulnerabilities and license issues. B) Static analysis examines code the team wrote and typically has little visibility into packaged dependencies. C) Peer review catches logic and design problems but reviewers cannot know the vulnerability status of every transitive package. D) Fuzzing finds robustness defects at runtime and would only incidentally reveal a known component flaw.

A CI/CD pipeline holds long-lived cloud credentials in environment variables shared across all build jobs. Which remediation BEST reduces the risk?

1. Short-lived, scoped credentials issued per job from a secrets manager
2. Encrypting the environment variables at rest on the build server file system
3. Restricting build server console logins to the platform engineering group only
4. Rotating the shared credentials on a documented quarterly schedule

Answer: A — Short-lived, scoped credentials issued per job from a secrets manager

A) Correct — the underlying defects are longevity and excessive scope; ephemeral, job-scoped credentials mean a compromised build step yields little and expires quickly. B) Encryption at rest does not help because the build process must decrypt the value to use it. C) Limiting console access ignores that any job running in the pipeline can read the shared variable. D) Quarterly rotation shortens the window slightly while leaving broad, shared, long-lived secrets in place.

Which BEST describes a secure software development lifecycle?

1. Building the product first and adding security afterward
2. Security activities embedded in every lifecycle phase
3. Testing for security defects only in the final release phase
4. Documenting security requirements without implementing them
5. Outsourcing all testing to an external assurance vendor

Answer: B — Security activities embedded in every lifecycle phase

B is correct: threat modeling at requirements, security architecture at design, secure coding and static analysis at build, dynamic and interactive testing before release, hardened configuration at deploy, and monitoring in operation. A and C both defer security to the point where remediation costs the most and schedule pressure is highest. D produces paper assurance with no implemented control. E can supplement internal work but leaves design and build phases untouched. DevSecOps automates these gates in the pipeline.

What is the GLBA?

Gramm-Leach-Bliley Act — US law for financial institutions on protecting customer financial info. Key elements: Privacy Notice, Safeguards Rule.

What is the chain of trust?

Hierarchy of trust from root CA → intermediate CAs → end-entity certs. Trust anchors (root CAs) are pre-installed; signed downward.

As a named secure-design principle, what does zero trust require, and how does it relate to 'trust but verify'?

Zero trust removes implicit trust based on network location: every request is authenticated, authorised and encrypted per session, with access decided dynamically from identity, device posture and context, and continuously re-evaluated. It is often contrasted with 'trust but verify', which grants access first and inspects afterwards; zero trust verifies before granting and assumes breach. NIST SP 800-207 is the reference architecture.

What is a hardware security module (HSM)?

Dedicated hardware for cryptographic operations and key storage. FIPS 140-2/3 certified. Network-attached or PCIe. Used for code signing, PKI roots, payment processing.

What is a side-channel attack?

Extracting info from physical implementation: timing, power, electromagnetic, acoustic, cache. Examples: Spectre, Meltdown. Mitigations vary per attack.

What is biometric FAR vs. FRR vs. CER?

FAR: False Accept Rate (unauthorized accepted). FRR: False Reject Rate (legit rejected). CER: Crossover Error Rate (FAR=FRR). Lower CER = better biometric.