View Full ISC CISSP Exam Dumps and Practice Test Dumps.

 

Question 201

Which process ensures that proposed changes to production systems are formally reviewed, approved, tested, and documented before implementation?

1. Data classification
2. Change management
3. Incident eradication
4. Asset disposal

Correct Answer: 2

Explanation

Change management provides a controlled process for modifying systems, applications, networks, and configurations. Proposed changes should normally be documented, assessed for security and operational impact, tested when appropriate, approved by authorized personnel, and implemented according to established procedures. Change management reduces the likelihood that unauthorized or poorly tested modifications will introduce vulnerabilities or disrupt critical services. Emergency changes may follow an expedited process but should still be documented and reviewed afterward. Effective change management also supports accountability, configuration control, and reliable system maintenance.

Question 202

A security administrator wants to ensure that only authorized personnel can modify firewall rules. Which control is most appropriate?

1. Role-based access control
2. Data retention
3. Network address translation
4. Environmental monitoring

Correct Answer: 1

Explanation

Role-based access control assigns permissions according to defined job responsibilities. Firewall administration can be restricted to an authorized network security role while preventing ordinary users from changing security rules. This supports least privilege and reduces the risk of unauthorized or accidental configuration changes. Administrative roles should receive only the permissions necessary for their responsibilities, and privileged actions should be logged and monitored. Organizations may also use multifactor authentication, separation of duties, approval workflows, and configuration management to provide additional protection for critical security infrastructure.

Question 203

Which security concept requires an organization to maintain accurate records showing who performed a particular administrative action?

1. Confidentiality
2. Availability
3. Accountability
4. Data minimization

Correct Answer: 3

Explanation

Accountability provides the ability to associate actions with identifiable users, systems, or processes. Organizations can support accountability through unique user accounts, strong authentication, authorization controls, audit logging, and monitoring. Shared administrative accounts can weaken accountability because actions cannot easily be attributed to a specific individual. Logs should record relevant details such as user identity, timestamp, action, and affected resource when appropriate. Protecting logs from unauthorized alteration is also important because audit records may be needed for investigations, compliance activities, and incident response.

Question 204

Which security architecture approach divides a network into separate zones to limit the movement of an attacker after a system is compromised?

1. Network segmentation
2. Data compression
3. Key escrow
4. Password synchronization

Correct Answer: 1

Explanation

Network segmentation divides a network into separate security zones or segments and controls communication between them. This can limit lateral movement when an attacker compromises one system. For example, user workstations, servers, databases, guest devices, and management systems can be placed into different segments with restrictive communication rules. Segmentation can also reduce the scope of security incidents and support regulatory requirements. It should be implemented with appropriate access controls and monitoring because poorly configured segmentation may provide a false sense of security.

Question 205

Which security control helps prevent sensitive information from leaving an organization through email, cloud storage, removable media, or other communication channels?

1. Data loss prevention
2. Network time protocol
3. RAID
4. Load balancing

Correct Answer: 1

Explanation

Data loss prevention, or DLP, helps identify and prevent unauthorized disclosure or transmission of sensitive information. DLP solutions can monitor endpoints, email, network traffic, cloud services, and removable storage for information matching defined policies. Organizations can create rules based on data classifications, patterns, keywords, file characteristics, or other indicators. Depending on the implementation, DLP may alert security teams, block transmission, quarantine content, or require user justification. Effective DLP requires accurate policies and should be balanced against legitimate business workflows to reduce false positives.

Question 206

Which protocol is commonly used to synchronize clocks across networked systems so that security logs have consistent timestamps?

1. DNS
2. NTP
3. LDAP
4. FTP

Correct Answer: 2

Explanation

Network Time Protocol, or NTP, synchronizes system clocks across networked devices. Accurate and consistent time is important for security monitoring because analysts often correlate events from multiple systems using timestamps. Incorrect system clocks can make incident timelines difficult to reconstruct and may interfere with authentication protocols or certificate validation. Organizations should use trusted time sources and protect time synchronization infrastructure appropriately. Security-sensitive environments may also monitor synchronization failures or significant clock deviations to identify operational problems and maintain reliable audit records.

Question 207

Which protocol commonly provides centralized authentication, authorization, and accounting services for network access?

1. RADIUS
2. SMTP
3. DNSSEC
4. SFTP

Correct Answer: 1

Explanation

RADIUS, or Remote Authentication Dial-In User Service, provides centralized authentication, authorization, and accounting for many types of network access. It is commonly used with wireless networks, VPN services, and network access control systems. Centralizing authentication can simplify administration and provide consistent access policies across multiple devices. RADIUS deployments should use appropriate security protections and strong authentication mechanisms. RADIUS is distinct from LDAP, which is primarily a directory access protocol, although the two technologies can work together in an authentication architecture.

Question 208

Which protocol provides secure directory access by protecting LDAP communications with TLS?

1. HTTP
2. LDAPS
3. Telnet
4. TFTP

Correct Answer: 2

Explanation

LDAPS refers to LDAP communication protected using TLS, providing encryption and protection against interception during directory operations. LDAP directories commonly store information such as user identities, groups, and organizational attributes and may participate in authentication and authorization processes. Protecting directory traffic is important because intercepted credentials or sensitive directory information could support further attacks. Organizations should use secure configurations, valid certificates, strong authentication, and appropriate access controls. LDAP itself should not be assumed to provide confidentiality unless an appropriate secure transport mechanism is implemented.

Question 209

Which technology provides a secure encrypted tunnel through an untrusted network such as the public Internet?

1. VPN
2. VLAN
3. NAT
4. Proxy ARP

Correct Answer: 1

Explanation

A virtual private network, or VPN, creates a protected communication path across an untrusted network. Depending on the technology, a VPN can provide confidentiality, integrity, authentication, and secure remote connectivity. Organizations commonly use VPNs to connect remote users or branch networks to corporate resources. Security depends on the underlying protocol, cryptographic configuration, authentication methods, endpoint security, and access policies. A VPN does not automatically make an endpoint trustworthy, so organizations should combine VPN access with least privilege, multifactor authentication, monitoring, and appropriate device security controls.

Question 210

Which technology translates private internal IP addresses into public addresses when systems communicate with external networks?

1. DNS
2. NAT
3. NTP
4. LDAP

Correct Answer: 2

Explanation

Network Address Translation, or NAT, translates IP addresses between different addressing domains. A common implementation allows multiple private internal systems to communicate with external networks by using one or more public IP addresses. NAT can reduce direct exposure of internal addresses, although it should not be considered a replacement for a firewall or other security controls. NAT may also conserve IPv4 address space. Organizations should understand that address translation alone does not provide comprehensive protection because applications and network services can still be attacked through permitted connections.

Question 211

Which security technology filters web application requests and can block attacks such as SQL injection and cross-site scripting?

1. Web application firewall
2. Network switch
3. Hardware security module
4. File integrity monitor

Correct Answer: 1

Explanation

A web application firewall, or WAF, monitors and filters HTTP or HTTPS traffic directed toward web applications. It can use rules and inspection techniques to identify and block common web attacks, including SQL injection, cross-site scripting, malicious requests, and certain application-layer abuse patterns. A WAF can provide an additional security layer but should not replace secure application development, input validation, authentication, authorization, and vulnerability management. Proper tuning is important because overly restrictive rules may block legitimate application traffic while insufficient rules may allow attacks through.

Question 212

Which security device is specifically designed to inspect network traffic and actively block detected malicious activity?

1. Intrusion detection system
2. Intrusion prevention system
3. Security information and event management system
4. Vulnerability scanner

Correct Answer: 2

Explanation

An intrusion prevention system, or IPS, monitors network activity and can automatically block traffic identified as malicious. It may use signatures, protocol analysis, anomaly detection, behavioral techniques, or combinations of these methods. An IPS differs from an intrusion detection system because an IDS generally generates alerts without directly blocking the traffic. IPS rules require appropriate configuration and tuning because false positives can disrupt legitimate operations. Organizations should also maintain updated detection signatures and review alerts to ensure the system continues to provide effective protection.

Question 213

Which endpoint security technology is designed to continuously monitor devices and provide detection and response capabilities for suspicious activity?

1. EDR
2. RAID
3. DNSSEC
4. NAT

Correct Answer: 1

Explanation

Endpoint Detection and Response, or EDR, continuously monitors endpoint activity and collects information that can help identify suspicious behavior. EDR solutions may observe processes, files, network connections, user activity, and other endpoint events. Security teams can investigate alerts and, depending on the product, isolate compromised devices, terminate malicious processes, or perform other response actions. EDR provides broader visibility than traditional antivirus alone, although organizations still need patch management, secure configurations, application controls, and other endpoint protections. Proper tuning and skilled monitoring are important for effective use.

Question 214

Which malware type is capable of independently spreading from one vulnerable system to another without requiring a user to manually execute it on each target?

1. Trojan horse
2. Worm
3. Spyware
4. Rootkit

Correct Answer: 2

Explanation

A worm is malware capable of self-propagation across systems, often by exploiting vulnerabilities or weaknesses in network services. Unlike a traditional virus, a worm does not necessarily require a user to execute an infected file on every new target. Worm outbreaks can spread rapidly and consume network resources while compromising large numbers of systems. Effective defenses include timely patching, network segmentation, endpoint protection, access controls, vulnerability management, and monitoring for abnormal network behavior. Organizations should also maintain incident response procedures for containing rapidly spreading malware.

Question 215

An attacker inserts malicious database commands into an application input field to manipulate backend database queries. What attack is being attempted?

1. Cross-site scripting
2. SQL injection
3. Buffer overflow
4. Directory traversal

Correct Answer: 2

Explanation

SQL injection occurs when an attacker manipulates application input so that malicious SQL statements are incorporated into database queries. Successful exploitation can allow unauthorized access to information, modification or deletion of records, authentication bypass, or other harmful actions depending on the application’s privileges and database configuration. Parameterized queries or prepared statements are among the primary defenses against SQL injection. Input validation, least privilege for database accounts, secure coding practices, and security testing provide additional protection. Applications should never construct database queries by blindly concatenating untrusted input.

Question 216

A web application displays attacker-supplied script code in another user’s browser. Which vulnerability does this describe?

1. SQL injection
2. Cross-site scripting
3. Command injection
4. Race condition

Correct Answer: 2

Explanation

Cross-site scripting, or XSS, occurs when an application allows attacker-controlled content to execute as script in another user’s browser. Depending on the type and context, XSS can enable session theft, malicious page modification, credential harvesting, or unauthorized actions performed through the victim’s browser. Common defenses include context-appropriate output encoding, input validation, secure content security policies, and careful handling of untrusted content. Developers should understand the difference between reflected, stored, and DOM-based XSS because the attack mechanisms and appropriate defensive techniques can differ.

Question 217

Which vulnerability occurs when the outcome of a process depends on the timing or ordering of events that can be manipulated by an attacker?

1. Race condition
2. SQL injection
3. Phishing
4. Password spraying

Correct Answer: 1

Explanation

A race condition occurs when the security or correctness of a process depends on the timing or sequence of events. An attacker may attempt to manipulate the timing so that a system performs an action under one condition and then uses a changed condition during a later step. This can lead to authorization bypasses, inconsistent data, or other security problems. Developers can reduce race-condition risks through appropriate synchronization, atomic operations, locking mechanisms, secure transaction design, and careful validation of state changes. Security testing should consider concurrent operations where relevant.

Question 218

Which password-storage technique adds a unique random value to each password before hashing to make precomputed attacks more difficult?

1. Encryption
2. Salting
3. Tokenization
4. Encoding

Correct Answer: 2

Explanation

Salting adds a unique random value to each password before the password is processed by a password-hashing function. A unique salt prevents identical passwords from producing identical stored hash values and makes precomputed rainbow-table attacks substantially less useful. Passwords should be processed using password-specific hashing algorithms designed to be computationally expensive, rather than relying on fast general-purpose hashes alone. Salts do not need to remain secret, but they should be stored with the corresponding password hash. Strong password storage also requires appropriate access controls and secure credential management.

Question 219

Which device or service is designed to prevent unauthorized devices from connecting to an organization’s internal network based on defined access policies?

1. Network access control
2. Load balancer
3. DNS resolver
4. Proxy cache

Correct Answer: 1

Explanation

Network access control, or NAC, enforces policies governing which devices may connect to a network. NAC solutions can evaluate characteristics such as device identity, authentication status, security posture, operating system, or compliance state before granting access. Noncompliant devices may be denied access or placed into restricted remediation networks. NAC can help reduce the risk associated with unmanaged or compromised endpoints. Effective NAC deployments should be integrated with identity services, endpoint security, network infrastructure, and monitoring while ensuring that emergency and operational requirements are properly addressed.

Question 220

Which cryptographic device is specifically designed to securely generate, store, and use cryptographic keys while protecting them from unauthorized extraction?

1. Proxy server
2. Hardware security module
3. Network switch
4. Load balancer

Correct Answer: 2

Explanation

A hardware security module, or HSM, is a specialized device designed to protect cryptographic keys and perform sensitive cryptographic operations in a controlled hardware environment. HSMs can support key generation, storage, signing, encryption, decryption, and other operations while providing mechanisms intended to prevent unauthorized key extraction. They are commonly used in payment systems, certificate authorities, enterprise key management, and other environments requiring strong protection of cryptographic material. Proper physical security, access control, key lifecycle management, backup procedures, and operational governance remain important even when HSMs are deployed.