View Full ISC CISSP Exam Dumps and Practice Test Dumps.

 

Question 301

Which security mechanism is primarily responsible for verifying that a user’s claimed identity is genuine?

1. Authorization
2. Authentication
3. Accounting
4. Auditing

Correct Answer: 2

Explanation

Authentication is the process of verifying the identity claimed by a subject, such as a user, device, or service. It may use passwords, hardware tokens, biometrics, certificates, or combinations of multiple authentication factors. Authentication occurs before authorization decisions can normally be made because the system needs to establish who or what is requesting access. Strong authentication reduces the likelihood of unauthorized account use, although it should be combined with appropriate authorization, monitoring, and lifecycle management controls for comprehensive identity security.

Question 302

Which process determines what actions an authenticated user is permitted to perform on a specific resource?

1. Authorization
2. Identification
3. Authentication
4. Registration

Correct Answer: 1

Explanation

Authorization determines what an authenticated subject is allowed to access or perform. Once a system establishes the identity of a user or service, authorization policies determine whether that subject can read, modify, delete, execute, or otherwise interact with a resource. Authorization decisions can be based on roles, attributes, security labels, ownership, or other policies. Strong authorization should follow least privilege and need-to-know principles. Organizations should regularly review permissions because excessive or outdated privileges can increase the potential impact of compromised accounts.

Question 303

Which security principle requires actions performed by users or systems to be traceable to the entity responsible for them?

1. Availability
2. Accountability
3. Confidentiality
4. Redundancy

Correct Answer: 2

Explanation

Accountability ensures that actions can be associated with the individuals, systems, or processes responsible for performing them. It commonly depends on unique identities, authentication, logging, monitoring, and properly protected audit records. Accountability supports investigations, compliance, incident response, and deterrence because users understand that activities can be traced. Shared accounts can weaken accountability because multiple individuals may appear as the same identity in logs. Organizations should therefore use individual accounts where practical and protect audit records from unauthorized alteration or deletion.

Question 304

Which security objective ensures that authorized users can access systems and information when needed?

1. Integrity
2. Confidentiality
3. Availability
4. Nonrepudiation

Correct Answer: 3

Explanation

Availability ensures that authorized users can access systems, services, and information when required. Availability can be affected by hardware failures, software defects, network outages, denial-of-service attacks, natural disasters, power interruptions, or operational mistakes. Organizations can improve availability through redundancy, resilient architectures, backups, capacity planning, disaster recovery, monitoring, and appropriate maintenance. Availability requirements should be established according to business needs because not every system requires the same level of uptime. Business impact analysis can help determine appropriate recovery priorities and objectives.

Question 305

Which security objective prevents unauthorized parties from obtaining or viewing protected information?

1. Confidentiality
2. Availability
3. Integrity
4. Accountability

Correct Answer: 1

Explanation

Confidentiality protects information from unauthorized disclosure or access. Controls supporting confidentiality include access control, encryption, data classification, authentication, network segmentation, and secure handling procedures. Confidentiality requirements vary according to the sensitivity and business value of information. A compromise may occur through technical attacks, excessive permissions, social engineering, accidental disclosure, or poor data handling practices. Organizations should identify sensitive information, determine who legitimately needs access, and implement controls that prevent unauthorized disclosure while still supporting authorized business operations.

Question 306

Which security objective ensures that information remains accurate, complete, and protected from unauthorized modification?

1. Availability
2. Integrity
3. Confidentiality
4. Privacy

Correct Answer: 2

Explanation

Integrity ensures that information remains accurate, complete, and protected against unauthorized or inappropriate modification. Integrity controls can include cryptographic hashes, digital signatures, access restrictions, transaction controls, file integrity monitoring, and change management. Integrity is important because unauthorized modification can cause operational, financial, legal, or safety consequences. Organizations should protect both stored and transmitted information and maintain appropriate mechanisms for detecting unauthorized changes. When integrity is critical, independent verification and protected audit records can provide additional assurance.

Question 307

Which mechanism provides evidence that a specific message was approved or signed by the holder of a private cryptographic key?

1. Digital signature
2. Password hash
3. Security token
4. Network address translation

Correct Answer: 1

Explanation

A digital signature is created using a private cryptographic key and can provide assurance regarding message authenticity and integrity. The corresponding public key can be used to verify the signature. Digital signatures can also support nonrepudiation when implemented within an appropriate legal, technical, and operational framework. They help recipients determine whether signed data has been altered after signing and whether the signature corresponds to the expected key. Private keys must be carefully protected because compromise of the signing key can undermine the trust associated with signatures.

Question 308

Which cryptographic approach uses the same secret key for both encryption and decryption?

1. Asymmetric cryptography
2. Hashing
3. Symmetric cryptography
4. Digital signing

Correct Answer: 3

Explanation

Symmetric cryptography uses the same secret key, or a related shared secret, for encryption and decryption. It is generally efficient and suitable for protecting large amounts of data. The primary challenge is securely distributing and managing the shared keys between communicating parties. Examples of symmetric algorithms include AES and other approved cryptographic algorithms. In many secure communication protocols, asymmetric cryptography is used to establish or protect keys, while symmetric cryptography handles the bulk data encryption because of its performance advantages.

Question 309

Which cryptographic approach uses mathematically related public and private keys?

1. Symmetric encryption
2. Asymmetric cryptography
3. Hashing
4. Data masking

Correct Answer: 2

Explanation

Asymmetric cryptography uses a pair of mathematically related keys: a public key and a private key. The public key can be distributed more broadly, while the private key must remain protected by its owner. Asymmetric cryptography supports functions such as digital signatures, key establishment, and encryption in appropriate protocols. It generally requires more computational resources than symmetric encryption, so secure systems often combine both approaches. Proper private-key protection is essential because compromise can affect the security services provided by the associated key pair.

Question 310

Which cryptographic function is designed to produce a fixed-length value from input data and is commonly used to verify data integrity?

1. Hash function
2. Symmetric cipher
3. Digital certificate
4. Encryption key exchange

Correct Answer: 1

Explanation

A cryptographic hash function processes input data and produces a fixed-length output commonly called a digest or hash. A secure cryptographic hash is designed so that finding collisions or reconstructing the original input from the digest is computationally difficult under appropriate conditions. Hashes can help detect unauthorized changes because modifying the input normally changes the resulting digest. Hashing is not encryption because it is not intended to provide reversible confidentiality. Organizations should select modern, approved hash algorithms appropriate to the security requirement and avoid obsolete algorithms.

Question 311

Which security protocol protects web traffic by providing encryption and authentication between clients and servers?

1. TLS
2. DNS
3. DHCP
4. ICMP

Correct Answer: 1

Explanation

Transport Layer Security, or TLS, protects communications by providing encryption, integrity protection, and authentication mechanisms for network connections. It is commonly used to secure web traffic through HTTPS and can also protect other application protocols. TLS relies on certificates and cryptographic mechanisms to establish trust and secure session keys. Organizations should use current secure protocol versions and properly configured cryptographic algorithms while disabling obsolete protocols and weak cipher suites. Certificate management is also important because expired, invalid, or improperly issued certificates can disrupt secure communications or weaken trust.

Question 312

Which technology creates an encrypted connection over an untrusted network to securely connect a remote user or network to protected resources?

1. VPN
2. VLAN
3. NAT
4. Proxy ARP

Correct Answer: 1

Explanation

A virtual private network, or VPN, establishes a protected communication channel across an untrusted network such as the public internet. VPN technologies can provide confidentiality and integrity for traffic and may authenticate users, devices, or both. Remote-access VPNs commonly connect individual users to organizational resources, while site-to-site VPNs can connect separate networks. Secure configuration, strong authentication, current cryptographic protocols, and appropriate access restrictions are important. A VPN protects the communication channel but does not automatically make the endpoint or the accessed application secure.

Question 313

Which technology translates private IP addresses into public addresses when systems communicate with external networks?

1. NAT
2. DNSSEC
3. LDAP
4. RADIUS

Correct Answer: 1

Explanation

Network Address Translation, or NAT, modifies network address information so that private internal addresses can communicate through networks using public addresses. NAT is commonly used to conserve public IPv4 address space and can provide a degree of address hiding. However, NAT should not be considered a replacement for a firewall or other security controls because it does not inherently provide comprehensive access control or threat detection. Organizations should combine NAT with appropriate firewall rules, network segmentation, monitoring, and secure system configurations.

Question 314

Which protocol securely synchronizes system clocks and protects time information against certain manipulation attempts?

1. Secure NTP
2. FTP
3. Telnet
4. POP3

Correct Answer: 1

Explanation

Secure time synchronization helps systems maintain accurate and trustworthy clocks, which are important for authentication, certificates, logging, auditing, and incident investigation. Standard Network Time Protocol, or NTP, provides time synchronization, while secure implementations can use authentication mechanisms to provide stronger assurance that systems are receiving time information from trusted sources. Accurate time across systems is especially important when correlating events from multiple logs. Organizations should configure trusted time sources, protect synchronization traffic where required, and monitor significant clock deviations that could affect security operations.

Question 315

Which security technology collects and correlates security events from multiple systems to help identify suspicious activity?

1. SIEM
2. RAID
3. DHCP
4. NAT

Correct Answer: 1

Explanation

A security information and event management system, or SIEM, collects security-relevant logs and events from multiple sources and can correlate them to identify suspicious patterns. Sources may include servers, firewalls, authentication systems, applications, endpoints, and network devices. SIEM capabilities can support monitoring, alerting, investigation, compliance reporting, and incident response. Effective SIEM deployment requires appropriate log sources, time synchronization, useful correlation rules, secure log handling, and trained personnel. Excessive or poorly configured data can create noise, so organizations should prioritize meaningful security events.

Question 316

Which security control helps prevent sensitive information from leaving an organization through unauthorized channels?

1. Data loss prevention
2. Load balancing
3. Network address translation
4. File compression

Correct Answer: 1

Explanation

Data loss prevention, or DLP, uses policies and technical mechanisms to identify and control sensitive information as it is stored, used, or transmitted. DLP solutions can monitor endpoints, email, cloud services, network traffic, and other data channels depending on the implementation. They may detect sensitive information using patterns, classifications, labels, or other indicators and can alert, block, or quarantine activity according to policy. Effective DLP requires accurate data classification and carefully designed policies because overly broad rules can disrupt legitimate business activities and generate excessive alerts.

Question 317

Which security mechanism checks files or system components for unauthorized changes by comparing their current state with a trusted reference?

1. File integrity monitoring
2. Load balancing
3. Packet forwarding
4. Data aggregation

Correct Answer: 1

Explanation

File integrity monitoring, or FIM, detects changes to files and other monitored system components by comparing their current state against an established trusted baseline. It can identify unauthorized modifications to configuration files, system binaries, application components, or other important resources. Alerts can help security teams investigate malware, unauthorized administrative activity, or accidental changes. FIM is most effective when baselines are protected from unauthorized modification and legitimate changes are properly documented. Organizations should tune monitored resources and establish procedures for reviewing and responding to integrity alerts.

Question 318

Which security control restricts network access by evaluating a device’s security posture before allowing it to connect?

1. Network access control
2. Data masking
3. Tokenization
4. Password hashing

Correct Answer: 1

Explanation

Network access control, or NAC, can evaluate devices before or during network access and enforce policies based on factors such as identity, device type, security configuration, or compliance status. An organization may require current security software, approved configurations, or other conditions before granting access. Noncompliant devices can be denied, restricted, or placed into a remediation network. NAC can reduce the risk posed by unmanaged or compromised endpoints, but it should operate alongside endpoint security, authentication, segmentation, monitoring, and vulnerability management.

Question 319

Which hardware security component is designed to generate, store, and protect cryptographic keys within a dedicated secure environment?

1. HSM
2. Proxy server
3. Load balancer
4. Network tap

Correct Answer: 1

Explanation

A hardware security module, or HSM, is a specialized device designed to protect cryptographic keys and perform cryptographic operations within a controlled hardware environment. HSMs can help protect highly sensitive keys used for encryption, digital signatures, certificate services, payment systems, and other critical applications. They can provide strong access controls and tamper-related protections depending on their design and certification. Organizations should establish appropriate key-management procedures around HSM deployment, including backup, recovery, authorization, auditing, and lifecycle management.

Question 320

Which security technology is designed to actively detect and block malicious network traffic before it reaches a protected system?

1. IDS
2. IPS
3. SIEM
4. Network monitor

Correct Answer: 2

Explanation

An intrusion prevention system, or IPS, monitors network traffic for malicious or unauthorized activity and can take automated action to block or disrupt detected threats. This distinguishes an IPS from a traditional intrusion detection system, which primarily identifies and alerts on suspicious activity without directly preventing it. IPS solutions can use signatures, behavioral analysis, protocol inspection, or other detection methods. Proper tuning is important because overly aggressive prevention rules can block legitimate traffic. Organizations should regularly update detection mechanisms and review alerts and blocked activity.