View Full ISC CISSP Exam Dumps and Practice Test Dumps.

 

Question 181

Which security architecture principle requires multiple independent security controls so that the failure of one control does not necessarily compromise the entire system?

1. Separation of duties
2. Defense in depth
3. Data minimization
4. Open design

Correct Answer: 2

Explanation

Defense in depth uses multiple layers of security controls to protect systems and information. If one control fails or is bypassed, another control can continue providing protection. For example, an organization may combine firewalls, network segmentation, endpoint protection, access controls, encryption, monitoring, and security awareness. This layered approach reduces reliance on any single mechanism. Defense in depth should be designed so that controls complement one another rather than simply duplicating the same function. It is useful for addressing different attack stages and reducing overall security exposure.

Question 182

A company separates its development, testing, and production environments to prevent developers from directly modifying live systems. Which security objective is primarily supported?

1. Environment separation
2. Data aggregation
3. Risk acceptance
4. Mandatory vacation

Correct Answer: 1

Explanation

Separating development, testing, and production environments reduces the likelihood that development activities will accidentally or intentionally affect live systems. Production systems often contain sensitive information and support critical business operations, so changes should pass through appropriate testing and approval procedures before deployment. Environment separation also supports change management, separation of duties, and controlled software release processes. Access between environments should be restricted according to job responsibilities. This architecture helps reduce operational errors and limits the potential impact of compromised development accounts or untested software.

Question 183

Which security concept requires security controls to remain effective even when attackers know how the system operates?

1. Security through obscurity
2. Open design
3. Data masking
4. Job rotation

Correct Answer: 2

Explanation

Open design requires security mechanisms to remain secure even when their design and implementation are known. The protection should depend on properly managed secrets, such as cryptographic keys, rather than on hiding the architecture or algorithm. Public examination can allow researchers and security professionals to identify weaknesses and improve the design. Security through obscurity takes the opposite approach by relying heavily on secrecy of implementation details. Open design is particularly important in cryptography, where widely reviewed algorithms are generally preferred over secret proprietary algorithms whose security cannot be independently evaluated.

Question 184

Which control is most appropriate for detecting unauthorized changes to critical system files after they occur?

1. File integrity monitoring
2. Data classification
3. Network address translation
4. Password expiration

Correct Answer: 1

Explanation

File integrity monitoring detects changes to important files by establishing trusted baselines and comparing current file characteristics against those baselines. Depending on the implementation, it can monitor hashes, permissions, ownership, timestamps, or other attributes. Unexpected changes may indicate malware, unauthorized administrative activity, or accidental modification. File integrity monitoring is primarily a detective control because it identifies changes rather than necessarily preventing them. It is particularly useful for critical operating system files, configuration files, application components, and other resources where unauthorized modification could create significant security risk.

Question 185

Which security control is designed to restore a system to an acceptable operational state after a security incident or failure?

1. Deterrent control
2. Corrective control
3. Preventive control
4. Directive control

Correct Answer: 2

Explanation

A corrective control is designed to correct or restore a condition after an undesirable event has occurred. Examples include restoring systems from backups, removing malware, rebuilding compromised systems, and correcting security configurations. Corrective controls often work alongside detective controls that identify incidents and preventive controls that attempt to stop them. The objective is to reduce the duration and impact of the problem and return the affected system or process to an acceptable state. Organizations should document corrective procedures and test them periodically to ensure they work when needed.

Question 186

Which control type is primarily intended to stop an unwanted event before it occurs?

1. Preventive control
2. Detective control
3. Corrective control
4. Recovery control

Correct Answer: 1

Explanation

Preventive controls are designed to stop or reduce the likelihood of an unwanted event before it occurs. Examples include access controls, security guards, firewalls, secure configurations, encryption, and application allowlisting. Preventive controls are an important component of layered security, but they cannot guarantee that every threat will be blocked. Detective controls identify events that have occurred or are occurring, while corrective controls help restore systems afterward. Organizations should combine preventive controls with detection, response, and recovery capabilities to address threats throughout the security lifecycle.

Question 187

Which control is primarily responsible for identifying suspicious activity after or while it occurs?

1. Preventive control
2. Detective control
3. Deterrent control
4. Compensating control

Correct Answer: 2

Explanation

Detective controls identify security events, policy violations, or suspicious activity after they occur or while they are occurring. Examples include security monitoring, audit logs, intrusion detection systems, file integrity monitoring, and security cameras. Detective controls provide visibility that can support incident response and investigations. They generally do not prevent the original event by themselves, although rapid detection can reduce its impact. Organizations should define appropriate monitoring requirements, protect log data from unauthorized alteration, synchronize system clocks, and establish procedures for reviewing and responding to important alerts.

Question 188

A security team deploys a secondary control because the primary security mechanism cannot fully satisfy a particular security requirement. What type of control is this?

1. Compensating control
2. Directive control
3. Deterrent control
4. Recovery control

Correct Answer: 1

Explanation

A compensating control provides an alternative safeguard when a primary control cannot be implemented or does not fully satisfy a requirement. For example, if a legacy system cannot support a required technical authentication mechanism, an organization might introduce stronger network isolation, additional monitoring, or another safeguard to reduce the associated risk. A compensating control should address the relevant risk and provide an appropriate level of protection. Organizations should document why the alternative control is necessary, how it operates, and how its effectiveness will be evaluated.

Question 189

Which type of security control communicates expected behavior or directs individuals to perform a required security action?

1. Directive control
2. Detective control
3. Corrective control
4. Recovery control

Correct Answer: 1

Explanation

Directive controls instruct or guide individuals toward required security behavior. Security policies, procedures, standards, guidelines, warning banners, and security awareness requirements can serve directive purposes. These controls communicate organizational expectations and help employees understand what actions are permitted or required. Directive controls may not technically prevent an action, but they establish rules that can be enforced through additional controls and disciplinary processes. Effective security programs combine directives with technical and operational safeguards so that employees receive both clear expectations and appropriate mechanisms for following them.

Question 190

Which physical security control is designed to prevent vehicles from entering a protected area?

1. Mantrap
2. Bollard
3. Turnstile
4. Badge reader

Correct Answer: 2

Explanation

A bollard is a physical security barrier designed to restrict or prevent vehicle access to protected areas. Bollards can be fixed, removable, or retractable depending on the security and operational requirements of the location. They are commonly positioned around building entrances, pedestrian areas, or sensitive facilities where vehicle intrusion is a concern. A mantrap controls pedestrian entry through two interlocking doors, while a turnstile controls pedestrian movement. Badge readers authenticate users attempting to access restricted areas but do not primarily function as vehicle barriers.

Question 191

Which physical security mechanism uses two interlocking doors to ensure that one door closes before the other opens?

1. Turnstile
2. Mantrap
3. Fence
4. Bollard

Correct Answer: 2

Explanation

A mantrap is a physical access control mechanism consisting of two or more interlocking doors. It is designed so that one door must close before the next door can open, helping prevent unauthorized individuals from following an authorized person through a secured entrance. Mantraps can also support identity verification, biometric authentication, and security screening. They are commonly used in data centers, high-security facilities, and other sensitive environments. Unlike a fence or bollard, a mantrap controls pedestrian movement through a controlled entry or exit point.

Question 192

Which physical access control is specifically designed to prevent unauthorized individuals from following an authorized person through a secured doorway?

1. Tailgating prevention control
2. Data loss prevention
3. Network access control
4. Tokenization

Correct Answer: 1

Explanation

Tailgating prevention controls are designed to stop unauthorized individuals from entering a secured area by following an authorized person through a controlled entry point. Examples include mantraps, security personnel, turnstiles, access-controlled doors, and anti-tailgating sensors. Tailgating can bypass otherwise effective badge or biometric controls if the authorized person allows another individual to enter without verification. Security awareness is also important because employees should understand that they must not permit unknown individuals to follow them into restricted areas. Physical and procedural controls can work together to reduce this risk.

Question 193

Which physical security measure creates a controlled boundary around a facility and makes unauthorized entry more difficult?

1. Fence
2. Encryption
3. Hash function
4. SIEM

Correct Answer: 1

Explanation

A fence establishes a physical boundary around a facility and can deter or delay unauthorized entry. Fences may be combined with gates, locks, surveillance cameras, lighting, intrusion detection systems, and security personnel. The height, construction, location, and other characteristics should be selected according to the facility’s security requirements and threat environment. A fence is not necessarily sufficient by itself because determined attackers may climb, cut, or otherwise bypass it. Layered physical security combines boundary controls with detection, access control, monitoring, and response capabilities.

Question 194

Which environmental control is primarily used to maintain appropriate temperature and humidity levels in a data center?

1. HVAC system
2. Fire suppression
3. CCTV
4. Badge reader

Correct Answer: 1

Explanation

Heating, ventilation, and air conditioning, commonly referred to as HVAC, helps maintain temperature and humidity within appropriate ranges for data center equipment. Excessive heat can damage or shorten the lifespan of hardware, while inappropriate humidity can contribute to static electricity or condensation risks. Data centers often use monitoring systems to detect environmental conditions and generate alerts when thresholds are exceeded. HVAC should be supported by redundancy and appropriate maintenance for critical facilities. Environmental controls are an important part of protecting availability and physical infrastructure.

Question 195

Which fire suppression approach is generally preferred for sensitive electronic equipment because it can extinguish fires without leaving water residue on equipment?

1. Wet-pipe sprinkler system
2. Clean agent suppression system
3. Portable water hose
4. Open water reservoir

Correct Answer: 2

Explanation

Clean agent fire suppression systems are designed to extinguish fires while minimizing damage to sensitive electronic equipment and avoiding the residue associated with many traditional suppression methods. They may use specialized gaseous agents that interrupt combustion without introducing large quantities of water into equipment areas. Selection should consider applicable fire codes, environmental requirements, facility design, and safety considerations. Traditional wet-pipe systems can provide effective fire protection but may introduce water into equipment areas. Critical facilities should also maintain detection, alarm, evacuation, and emergency response procedures.

Question 196

Which physical security principle recommends using lighting to eliminate concealed areas around a facility and improve visibility?

1. Layered defense
2. Natural surveillance
3. Data minimization
4. Least privilege

Correct Answer: 2

Explanation

Natural surveillance uses environmental design and visibility to make suspicious activity easier to observe and less attractive to potential intruders. Appropriate lighting can reduce dark areas around entrances, parking facilities, walkways, fences, and other locations where unauthorized activity might otherwise remain concealed. Cameras, windows, landscaping, and facility layout can also support natural surveillance. The objective is to improve visibility and increase the likelihood that suspicious behavior will be noticed. Natural surveillance is most effective when combined with physical barriers, access controls, monitoring, and established response procedures.

Question 197

Which security assessment activity involves authorized professionals attempting to exploit identified weaknesses to determine whether they can actually be used?

1. Penetration testing
2. Vulnerability scanning
3. Log review
4. Configuration documentation

Correct Answer: 1

Explanation

Penetration testing is an authorized security assessment in which testers attempt to exploit vulnerabilities under defined rules of engagement. The goal is to determine whether identified weaknesses can be practically exploited and what impact successful exploitation could have. Penetration testing differs from vulnerability scanning, which primarily identifies and reports potential weaknesses without necessarily exploiting them. Testing should be carefully authorized, scoped, documented, and controlled to prevent unintended disruption. Results can help organizations prioritize remediation and validate whether security controls are functioning as expected.

Question 198

Which penetration testing approach provides the tester with little or no information about the target environment before testing begins?

1. White-box testing
2. Gray-box testing
3. Black-box testing
4. Source-code review

Correct Answer: 3

Explanation

Black-box penetration testing provides the tester with little or no internal information about the target environment before the assessment. This approach can simulate an external attacker who must discover systems, services, applications, and vulnerabilities independently. It can provide valuable insight into externally exposed attack surfaces. White-box testing gives testers extensive internal information, while gray-box testing provides partial knowledge. Black-box testing may require more time for reconnaissance and discovery, but it can reveal weaknesses that are visible from an attacker’s external perspective.

Question 199

Which penetration testing approach gives the tester partial knowledge of the target environment, such as limited credentials or architectural information?

1. Black-box testing
2. Gray-box testing
3. White-box testing
4. Blind auditing

Correct Answer: 2

Explanation

Gray-box testing provides testers with partial knowledge of the target environment. For example, testers may receive limited credentials, selected architectural information, or documentation while still being expected to identify additional weaknesses independently. This approach can balance the external perspective of black-box testing with some of the efficiency provided by white-box testing. Gray-box assessments can be useful when organizations want to simulate threats from users or attackers who possess some legitimate knowledge or access. The scope and information provided should be documented before testing begins.

Question 200

Which activity verifies that security requirements have been incorporated correctly into a system before it is placed into production?

1. Security validation and testing
2. Asset disposal
3. Data retention
4. Job rotation

Correct Answer: 1

Explanation

Security validation and testing verifies that a system implements its required security controls correctly before production deployment. Activities can include functional security testing, vulnerability assessment, penetration testing, code review, configuration validation, authentication testing, and authorization testing. The exact methods depend on the system’s architecture, sensitivity, and risk profile. Testing before deployment helps identify weaknesses while they are generally easier and less costly to address. Organizations should also document findings, track remediation, and obtain appropriate approval before moving systems into production.