Security Architecture and Engineering — CISSP practice questions

A utility cannot patch a fleet of OT controllers because the vendor will void support and the outage window is annual. Which compensating approach is the MOST appropriate for management to fund?

1. Accept the risk formally and revisit it at the next annual maintenance window
2. Place the controllers in a segmented enclave with brokered, monitored access
3. Deploy endpoint detection agents onto the controllers to detect exploitation attempts
4. Replace the fleet with modern controllers as an emergency unbudgeted capital purchase

Answer: B — Place the controllers in a segmented enclave with brokered, monitored access

B) Correct — where patching is infeasible, architectural isolation with brokered and monitored access reduces exposure without disturbing the process, which is the standard OT compensating control. A) is risk acceptance with no mitigation and abandons a treatable exposure. C) is often unsupported on real-time controllers and can itself destabilise them. D) is disproportionate and bypasses the capital planning and change discipline a manager is expected to respect.

An organisation is designing custody for the root key of its internal certificate authority. Which control combination BEST reflects sound key management practice?

1. Store the key in an HSM and grant the PKI administrators individual recovery access
2. Escrow the key with the corporate cloud provider under a confidentiality agreement
3. Generate and hold the key in an HSM under split knowledge and dual control
4. Encrypt the key file with an administrator passphrase and back it up to two separate data centres

Answer: C — Generate and hold the key in an HSM under split knowledge and dual control

C) Correct — root keys should be generated in and never leave validated hardware, with split knowledge and dual control so no individual can activate the key alone. A) uses the right hardware but reintroduces single-person control, defeating the purpose. B) transfers custody of the trust anchor to a third party, which contracts alone cannot compensate for. D) reduces protection to a single human-chosen passphrase and multiplies the copies of the key.

A research database returns only statistical summaries, yet an analyst reconstructs an individual's salary by issuing a series of narrow queries. Which control MOST directly addresses this?

1. Applying transparent data encryption to the underlying tablespaces
2. Enforcing row-level security tied to the analyst's department attribute
3. Requiring a minimum result-set size and tracking query overlap
4. Replacing direct table grants with parameterised stored procedures

Answer: C — Requiring a minimum result-set size and tracking query overlap

C) Correct — this is an inference attack against aggregation; query-set size restrictions and overlap tracking are the classic database inference controls. A) protects data at rest and is irrelevant to an authorised query path. B) restricts which rows are visible but does not stop inference within the rows the analyst may legitimately aggregate. D) is an injection control and does nothing about legitimate statistical queries.

Which is the PRIMARY reason FIPS 140-3 validated cryptographic modules are required for many U.S. federal systems?

1. They have been independently validated against documented security requirements for such modules
2. They provide the fastest cryptographic implementations available for high-throughput workloads
3. They permit unlimited key lengths, exceeding what unvalidated commercial libraries can support
4. They are distributed as open source, allowing agencies to inspect the implementation for themselves

Answer: A — They have been independently validated against documented security requirements for such modules

A) Correct: validation is an independent laboratory assessment against a published standard, giving agencies documented assurance about the module's design, key management and self-tests rather than a vendor's own claim. B) Validation says nothing about performance, and validated modules are often slower because of mandated self-tests. C) Validated modules implement approved algorithms at defined key sizes; unlimited key length is not a concept the standard offers. D) Source availability is irrelevant to validation status; many validated modules are proprietary.

Which BEST describes a defense-in-depth strategy?

1. A single perimeter firewall inspecting all ingress traffic
2. One antivirus product deployed uniformly to every endpoint
3. Overlapping administrative, technical, and physical control layers
4. A strong password policy enforced across all user accounts
5. Network segmentation applied without any other safeguards

Answer: C — Overlapping administrative, technical, and physical control layers

C is correct because layering across control types means the failure or bypass of any one layer does not expose the asset. A, B, D, and E each name a legitimate control, and each is tempting because it is genuinely effective in its own lane, but every one of them is a single point of failure: a firewall does not stop an insider, antivirus misses novel code, passwords are phished, and segmentation alone does not authenticate the traffic crossing it.

In Bell-LaPadula, the *-property (star property) states that a subject:

1. Can read at the same or higher classification but not lower
2. Cannot read at any level different from its own
3. Cannot write to a lower classification level
4. Can write to any level if the subject's clearance permits

Answer: C — Cannot write to a lower classification level

C) Correct: *-property = no write down. Prevents leakage from higher to lower classifications. A) Direction reversal — simple security property is no read up (cannot read higher), not as stated. B) Strong star property restricts read/write to the same level — different rule. D) Ignores classification flow restrictions.

Which security model focuses on preventing unauthorized modification?

1. Bell-LaPadula, which addresses confidentiality of labeled data
2. Biba, which enforces no read down and no write up for integrity
3. Clark-Wilson, using well-formed transactions and duty separation
4. Chinese Wall, which blocks conflicts of interest between clients
5. Brewer-Nash, which dynamically partitions access by client dataset

Answer: B — Biba, which enforces no read down and no write up for integrity

B is correct: Biba protects integrity by preventing a subject from reading lower-integrity data or writing to a higher-integrity object, which stops contamination flowing upward. A is the mirror image, protecting confidentiality with no read up and no write down, and is the most common confusion. C is a genuine integrity model, but it works through certified transactions and duty separation rather than the simple lattice rules the question describes. D and E are the same conflict-of-interest model under two names.

An access review finds that long-tenured analysts hold entitlements from three prior roles. Management wants a durable fix rather than a one-time cleanup. Which action is the MOST appropriate?

1. Require managers to certify entitlements annually and remove anything not affirmatively re-approved
2. Reduce all analysts to a single shared role account with a documented break-glass procedure
3. Trigger automatic revocation of the prior role's entitlements whenever a transfer event is processed
4. Increase log retention so that misuse of legacy entitlements can be reconstructed after the fact

Answer: C — Trigger automatic revocation of the prior role's entitlements whenever a transfer event is processed

C) Correct — privilege creep originates at transfer, so binding revocation to the transfer event addresses the cause rather than the symptom, enforcing least privilege continuously. A) is a valid detective control but only corrects drift after it accumulates, so it is not the durable fix. B) destroys individual accountability and is a step backwards. D) is a plausible-sounding partial: detection after misuse does nothing to prevent it.

Which attack exploits speculative execution side channels in modern CPUs?

1. Rowhammer
2. KRACK
3. BlueBorne
4. Spectre

Answer: D — Spectre

D) Correct: Spectre (and Meltdown) exploit speculative execution to leak data via cache side channels. A) Rowhammer is a fault-injection attack on DRAM. C) BlueBorne targets Bluetooth stacks. B) KRACK targets the WPA2 4-way handshake.

A supplier sends a purchase order signed with its private key. Which property does the signature provide that encrypting the order with the buyer's public key would NOT?

1. Confidentiality of the order contents while in transit across untrusted networks
2. Assurance of integrity and origin that the buyer can show a third party
3. Guaranteed delivery of the order to the buyer's procurement mailbox
4. Protection of the order after receipt while it is stored in the buyer's archive

Answer: B — Assurance of integrity and origin that the buyer can show a third party

B) Correct — a digital signature binds the message to the signer's private key, giving integrity, authentication of origin and non-repudiation that a third party can verify. A) is what public-key encryption provides, and it is the property the signature does not deliver. C) is a transport or messaging assurance, not a cryptographic one. D) concerns data at rest, which neither operation addresses by itself.

What is post-quantum cryptography, and what are the standardized algorithms?

Cryptography designed to resist attack by a cryptographically relevant quantum computer, addressing the harvest-now-decrypt-later exposure of data with a long confidentiality life. NIST finalized three standards in August 2024: FIPS 203 ML-KEM for key encapsulation, FIPS 204 ML-DSA and FIPS 205 SLH-DSA for signatures, with HQC selected in March 2025 as a backup KEM. Cite the FIPS names, not the submission names, and start with a cryptographic inventory before planning migration.

What is fault injection / row hammer?

Inducing computational errors to bypass security. Row hammer: repeated DRAM access flips bits in adjacent rows. Mitigations: ECC, refresh tuning.

What is the Bell-LaPadula model?

Confidentiality model: 'no read up, no write down' (simple security + *-property). Multi-level military model. Strict: write at same level only.

What is secure boot?

UEFI feature verifying digital signatures of boot components. Prevents unsigned/malicious bootloaders. Combined with measured boot (TPM) for attestation.