View Full ISC CISSP Exam Dumps and Practice Test Dumps.

 

Question 1

Which security principle ensures that users receive only the permissions necessary to perform their assigned responsibilities?

1. Separation of duties
2. Least privilege
3. Mandatory access control
4. Need to know

Correct Answer: 2

Explanation

The principle of least privilege requires users, applications, and systems to receive only the permissions necessary to perform their authorized tasks. This reduces the potential damage caused by compromised accounts, malicious insiders, or accidental actions. For example, a database administrator may need permission to modify database structures but does not necessarily require access to financial application data. Least privilege should be reviewed periodically because job responsibilities and system requirements can change over time. Applying this principle is a fundamental approach to reducing unnecessary access throughout an organization’s environment.

Question 2

A company wants to ensure that no single employee can initiate, approve, and complete a sensitive financial transaction. Which security concept should be implemented?

1. Separation of duties
2. Least privilege
3. Job rotation
4. Mandatory access control

Correct Answer: 1

Explanation

Separation of duties divides critical responsibilities among multiple individuals so that one person cannot complete an entire sensitive process independently. This reduces the opportunity for fraud, abuse, and unauthorized activity. For example, one employee might create a purchase request, another might approve it, and a third might process the payment. Even if one employee’s account is compromised, the attacker cannot easily complete the entire transaction. Separation of duties is particularly important for financial processes, privileged administration, security operations, and other activities where unchecked authority could create significant risk.

Question 3

Which type of risk response involves implementing controls to reduce either the likelihood or impact of a threat?

1. Risk avoidance
2. Risk acceptance
3. Risk mitigation
4. Risk transference

Correct Answer: 3

Explanation

Risk mitigation involves implementing safeguards that reduce the likelihood of a threat occurring, decrease its potential impact, or accomplish both. Examples include deploying firewalls, encryption, multifactor authentication, security monitoring, and backup systems. Mitigation does not necessarily eliminate the underlying risk; instead, it reduces the organization’s exposure to an acceptable level. Risk avoidance removes the activity creating the risk, while risk transference shifts some financial consequences to another party, such as an insurer. Risk acceptance means the organization knowingly retains the identified risk without implementing additional controls.

Question 4

An organization requires employees to use two independent authentication factors before accessing sensitive systems. Which security objective is primarily strengthened by this control?

1. Availability
2. Confidentiality
3. Integrity
4. Authentication

Correct Answer: 4

Explanation

Authentication is the process of verifying the identity of an individual, system, or entity requesting access. Multifactor authentication strengthens authentication by requiring evidence from two or more different factor categories, such as something the user knows, something the user has, or something the user is. A password combined with a hardware security token is a common example. Although multifactor authentication can indirectly support confidentiality and integrity by reducing unauthorized access, its primary purpose is to establish that the entity requesting access is genuinely who it claims to be.

Question 5

Which security model is primarily concerned with preventing unauthorized disclosure of information by enforcing confidentiality rules?

1. Bell-LaPadula
2. Biba
3. Clark-Wilson
4. Brewer-Nash

Correct Answer: 1

Explanation

The Bell-LaPadula model focuses primarily on confidentiality. Its classic rules include the Simple Security Property, commonly described as “no read up,” and the *-Property, commonly described as “no write down.” These restrictions help prevent subjects at lower classification levels from accessing higher-classified information and prevent information from being written to lower classification levels in ways that could cause unauthorized disclosure. Bell-LaPadula is therefore associated mainly with protecting sensitive information from unauthorized disclosure rather than maintaining data integrity or preventing conflicts of interest.

Question 6

A security architect wants to ensure that data cannot be modified by unauthorized individuals without detection. Which security objective is most directly addressed?

1. Availability
2. Integrity
3. Confidentiality
4. Privacy

Correct Answer: 2

Explanation

Integrity ensures that information remains accurate, complete, and protected against unauthorized or improper modification. Controls supporting integrity can include cryptographic hashes, digital signatures, access controls, checksums, version control, and audit logging. For example, a digital signature can help recipients determine whether a document was altered after it was signed. Confidentiality protects information from unauthorized disclosure, while availability ensures authorized users can access resources when needed. Privacy focuses on the appropriate collection, processing, use, retention, and disclosure of personal information.

Question 7

Which type of security control is a security guard who physically prevents unauthorized individuals from entering a restricted facility?

1. Detective
2. Corrective
3. Preventive
4. Compensating

Correct Answer: 3

Explanation

A security guard performing access control duties is generally considered a preventive control because the guard attempts to stop unauthorized physical access before it occurs. Preventive controls are designed to prevent undesirable events or reduce their probability. Other examples include access badges, security gates, locks, and properly configured access control systems. Detective controls identify events after or while they occur, such as cameras or intrusion detection systems. Corrective controls help restore conditions after an incident, while compensating controls provide an alternative safeguard when the preferred control cannot be implemented.

Question 8

During a risk assessment, an organization identifies a threat but determines that implementing additional controls would cost more than the expected loss. Management decides to retain the risk. What risk treatment has been selected?

1. Avoidance
2. Mitigation
3. Transference
4. Acceptance

Correct Answer: 4

Explanation

Risk acceptance occurs when management knowingly decides to retain an identified risk after considering its potential consequences, likelihood, and treatment costs. This decision should normally be documented and made by an appropriate level of management with sufficient authority. Acceptance does not mean that the organization is unaware of the risk. Instead, it means management has determined that additional controls may not provide enough benefit compared with their cost or operational impact. Risk acceptance should also be periodically reviewed because threat conditions, business requirements, and risk levels can change.

Question 9

Which protocol is commonly used to provide secure remote command-line administration by encrypting the communication between a client and server?

1. Telnet
2. FTP
3. SSH
4. HTTP

Correct Answer: 3

Explanation

Secure Shell, or SSH, provides encrypted communications for remote administration and other secure network services. It can protect credentials, commands, and data exchanged between an SSH client and server from interception over an untrusted network. Telnet does not provide comparable built-in confidentiality and transmits information in plaintext. FTP is primarily designed for file transfers and is also insecure when used without additional protection. HTTP is an application-layer protocol for web communications and does not itself provide encryption. SSH is therefore commonly preferred for securely administering Unix, Linux, network, and other compatible systems.

Question 10

Which document formally defines the rules and responsibilities governing acceptable use of an organization’s information systems?

1. Business continuity plan
2. Acceptable use policy
3. Disaster recovery plan
4. Incident response plan

Correct Answer: 2

Explanation

An Acceptable Use Policy defines how employees, contractors, and other authorized users may use organizational information systems and resources. It can address requirements involving passwords, internet usage, email, mobile devices, software installation, data handling, and prohibited activities. The policy establishes behavioral expectations and helps management communicate security responsibilities to users. A business continuity plan focuses on maintaining essential business functions, while a disaster recovery plan addresses restoration of technology and services. An incident response plan defines procedures for identifying, containing, investigating, and recovering from security incidents.

Question 11

Which access control model allows the owner of a resource to determine who can access that resource?

1. Mandatory access control
2. Role-based access control
3. Discretionary access control
4. Rule-based access control

Correct Answer: 3

Explanation

Discretionary Access Control, or DAC, allows the owner or controller of a resource to determine which subjects can access it. Access decisions may commonly be implemented through access control lists associated with files, directories, or other objects. DAC provides flexibility because resource owners can grant or revoke permissions according to organizational requirements. Mandatory Access Control is controlled by centrally defined security classifications and labels. Role-Based Access Control assigns permissions according to organizational roles, while rule-based models use predefined rules to make access decisions based on specified conditions.

Question 12

An organization classifies information as Public, Internal, Confidential, and Restricted. What is the primary purpose of this classification scheme?

1. To determine appropriate protection requirements
2. To calculate employee salaries
3. To eliminate all security risks
4. To identify network performance problems

Correct Answer: 1

Explanation

Information classification helps an organization determine how information should be handled and protected according to its sensitivity, value, and potential impact if compromised. Different classifications can require different controls for access, storage, transmission, retention, and destruction. For example, Restricted information may require stronger encryption and tighter access restrictions than Public information. Classification also helps organizations allocate security resources appropriately. It does not eliminate risk, determine employee compensation, or directly measure network performance. Effective classification should be supported by clear policies and handling procedures.

Question 13

Which cryptographic property ensures that a message has not been altered since it was created?

1. Confidentiality
2. Integrity
3. Availability
4. Obfuscation

Correct Answer: 2

Explanation

Integrity ensures that data has not been improperly altered, corrupted, or manipulated. Cryptographic hash functions can help detect changes by producing a fixed-length value based on the original data. If the data changes, the resulting hash will normally change as well. Digital signatures can provide integrity protection while also supporting authentication and nonrepudiation when implemented appropriately. Confidentiality protects information from unauthorized disclosure, while availability concerns timely access to resources. Obfuscation makes information harder to understand but is not a substitute for cryptographic integrity mechanisms.

Question 14

Which type of attack attempts to make a service unavailable by overwhelming it with traffic or requests from many compromised systems?

1. Phishing
2. Privilege escalation
3. Distributed denial-of-service
4. Credential stuffing

Correct Answer: 3

Explanation

A Distributed Denial-of-Service, or DDoS, attack attempts to disrupt the availability of a service by generating large volumes of malicious traffic or requests from multiple systems. Attackers commonly use compromised devices organized into botnets to distribute the attack across numerous sources. The distributed nature can make blocking the attack more difficult than blocking traffic from a single system. Security measures such as traffic filtering, rate limiting, content delivery networks, specialized DDoS protection services, and scalable architectures can help organizations maintain availability during these attacks.

Question 15

Which principle requires security controls to remain effective even when some individual components or mechanisms fail?

1. Defense in depth
2. Open design
3. Least privilege
4. Economy of mechanism

Correct Answer: 1

Explanation

Defense in depth uses multiple layers of security controls so that the failure or bypass of one control does not automatically expose the protected asset. For example, an organization might combine network segmentation, endpoint protection, multifactor authentication, encryption, monitoring, and access controls. Each layer provides an additional opportunity to prevent, detect, or contain an attack. This approach recognizes that no individual security mechanism is perfect. Defense in depth therefore reduces reliance on a single control and can limit the consequences when one protection mechanism is compromised.

Question 16

A company wants to ensure that a former employee’s access is removed immediately after termination. Which process is most important for achieving this objective?

1. Data classification
2. Account deprovisioning
3. Security awareness training
4. Vulnerability scanning

Correct Answer: 2

Explanation

Account deprovisioning is the process of removing or disabling a user’s access when the individual no longer requires it. It is especially important when employees leave an organization because unused accounts can provide attackers or former users with unauthorized access. Effective offboarding should address accounts, privileged permissions, remote access, tokens, credentials, physical badges, and other access mechanisms. Ideally, termination information should flow quickly from human resources or management to the appropriate identity and access management processes. Timely deprovisioning helps reduce the organization’s exposure to unauthorized access.

Question 17

Which security assessment activity involves attempting to exploit identified vulnerabilities in an authorized manner?

1. Vulnerability scanning
2. Security audit
3. Penetration testing
4. Risk analysis

Correct Answer: 3

Explanation

Penetration testing is an authorized security assessment in which testers attempt to exploit vulnerabilities to determine whether weaknesses can actually be used to compromise systems, applications, networks, or information. It can provide evidence about the practical impact of vulnerabilities and the effectiveness of existing security controls. Vulnerability scanning generally focuses on identifying and reporting potential weaknesses without necessarily exploiting them. A security audit evaluates compliance with defined requirements, while risk analysis examines threats, vulnerabilities, likelihood, and potential impact to support risk decisions.

Question 18

Which security control provides evidence about who performed a specific action on a system?

1. Audit logging
2. Data encryption
3. Network segmentation
4. Backup

Correct Answer: 1

Explanation

Audit logging records information about system and user activities, such as authentication attempts, administrative actions, configuration changes, and access to sensitive resources. Properly designed logs can help establish who performed an action, what occurred, when it occurred, and sometimes where or from which system it originated. Logs support security monitoring, incident investigation, compliance, and accountability. Encryption protects confidentiality, network segmentation limits communication paths, and backups support recovery. Audit logs should themselves be protected against unauthorized modification or deletion to preserve their evidentiary value.

Question 19

An organization wants to ensure that sensitive information remains protected if a laptop is lost or stolen. Which control provides the most direct protection for the stored data?

1. Network intrusion detection
2. Full-disk encryption
3. Security awareness training
4. Network segmentation

Correct Answer: 2

Explanation

Full-disk encryption protects data stored on a device by encrypting the contents of the storage medium. If a properly protected laptop is lost or stolen, an unauthorized person who removes the drive or attempts to access its contents may be unable to read the encrypted information without the required cryptographic keys or authentication. Network intrusion detection primarily monitors network activity, while segmentation controls communication between network zones. Security awareness training can reduce risky behavior but does not directly protect data stored on a physically lost device.

Question 20

Which principle states that security mechanisms should be simple enough to be analyzed, tested, and maintained effectively?

1. Fail securely
2. Complete mediation
3. Psychological acceptability
4. Economy of mechanism

Correct Answer: 4

Explanation

The economy of mechanism principle recommends keeping security mechanisms as simple and straightforward as practical. Complex security mechanisms are generally more difficult to analyze, test, maintain, and verify, increasing the possibility of configuration errors or hidden weaknesses. Simplicity does not mean eliminating necessary security capabilities; rather, it emphasizes avoiding unnecessary complexity. Other secure design principles address different concerns. Fail securely focuses on maintaining protection when failures occur, complete mediation requires access checks to be consistently enforced, and psychological acceptability emphasizes making security mechanisms usable.