View Full ISC CISSP Exam Dumps and Practice Test Dumps.

 

Question 41

Which security domain focuses primarily on establishing and maintaining secure organizational policies, standards, guidelines, and risk management practices?

1. Asset Security
2. Security and Risk Management
3. Security Architecture and Engineering
4. Communication and Network Security

Correct Answer: 2

Explanation

Security and Risk Management focuses on the governance and management foundations of an organization’s security program. It includes topics such as security governance, risk management, compliance, legal and regulatory requirements, policies, business continuity, and professional ethics. This domain helps organizations align security activities with business objectives and acceptable risk levels. Rather than concentrating only on technical controls, it establishes the processes and principles that guide security decisions across the organization. Effective governance ensures that security responsibilities, requirements, and accountability are clearly defined and consistently maintained.

Question 42

A security professional is responsible for determining how sensitive information should be stored, handled, retained, and destroyed throughout its lifecycle. Which CISSP domain is most directly involved?

1. Asset Security
2. Identity and Access Management
3. Security Assessment and Testing
4. Software Development Security

Correct Answer: 1

Explanation

Asset Security focuses on identifying, classifying, owning, handling, retaining, and protecting information and related assets throughout their lifecycle. Security professionals must understand the sensitivity and value of information so appropriate controls can be selected. This includes considerations for storage, processing, transmission, retention, and secure disposal. Asset owners are typically responsible for determining classification and protection requirements, while custodians may implement the required safeguards. Effective asset security reduces the risk of unauthorized disclosure, improper modification, loss, and inappropriate retention of organizational information.

Question 43

Which CISSP domain addresses authentication mechanisms, account management, authorization, and access provisioning?

1. Security Operations
2. Communication and Network Security
3. Identity and Access Management
4. Security Architecture and Engineering

Correct Answer: 3

Explanation

Identity and Access Management, or IAM, focuses on controlling who or what can access organizational resources and what actions they are authorized to perform. The domain includes identification, authentication, authorization, provisioning, account management, and access review processes. Strong IAM helps enforce least privilege and reduces unauthorized access. Examples include multifactor authentication, role-based access control, identity governance, privileged access management, and centralized authentication services. Effective IAM should also address the complete identity lifecycle, including account creation, modification, suspension, and removal when access is no longer required.

Question 44

An organization wants to verify whether its security controls are operating as intended and whether employees are complying with established requirements. Which activity is most appropriate?

1. Data classification
2. Security assessment
3. Disaster recovery
4. Threat modeling

Correct Answer: 2

Explanation

Security assessment involves evaluating security controls, processes, systems, or procedures to determine whether they are properly implemented and functioning as intended. Assessments can include interviews, documentation reviews, technical testing, observations, vulnerability assessments, and control validation. The objective is to identify weaknesses, gaps, or areas requiring improvement. Security assessments may also support compliance requirements and risk management decisions. Threat modeling is more focused on identifying and analyzing potential threats during design, while disaster recovery concentrates on restoring operations after disruptive events.

Question 45

Which type of control is specifically designed to restore a system or process to its previous secure state after an unwanted event?

1. Detective
2. Preventive
3. Corrective
4. Deterrent

Correct Answer: 3

Explanation

Corrective controls are designed to restore systems, processes, or security conditions after an incident or unwanted event. Examples include restoring files from backups, reinstalling compromised systems, removing malware, resetting compromised credentials, and correcting unauthorized configuration changes. Corrective controls are often used after detective mechanisms identify a problem. Preventive controls attempt to stop incidents before they occur, while detective controls identify events and deterrent controls discourage undesirable behavior. Organizations generally use multiple control types together because prevention alone cannot guarantee that every security incident will be avoided.

Question 46

Which risk analysis method uses monetary values to quantify the potential impact of a risk?

1. Quantitative risk analysis
2. Qualitative risk analysis
3. Vulnerability assessment
4. Threat modeling

Correct Answer: 1

Explanation

Quantitative risk analysis assigns numerical or monetary values to risk factors so that potential losses can be expressed in measurable terms. It may use asset values, exposure factors, annualized rates of occurrence, and expected financial losses to support management decisions. Quantitative analysis can help compare the expected cost of a risk with the cost of implementing a security control. Qualitative analysis instead commonly uses descriptive categories such as low, medium, and high. Both approaches can be useful, depending on the availability and reliability of organizational data.

Question 47

Which concept describes the process of determining whether a person has the authority to perform a requested action after the person’s identity has been verified?

1. Identification
2. Authentication
3. Authorization
4. Accounting

Correct Answer: 3

Explanation

Authorization determines what an authenticated subject is permitted to do. The process normally occurs after identification and authentication. For example, a user may successfully authenticate with a username, password, and security token, but authorization determines whether that user can view a payroll database or modify its records. Identification claims an identity, authentication verifies that identity, and accounting or auditing records activity. Authorization can be implemented using access control lists, roles, attributes, policies, or other mechanisms. Proper authorization is essential for enforcing least privilege and preventing unauthorized actions.

Question 48

Which security architecture approach places security controls at multiple independent layers so that compromising one layer does not automatically compromise the entire environment?

1. Defense in depth
2. Security through obscurity
3. Single sign-on
4. Data minimization

Correct Answer: 1

Explanation

Defense in depth uses multiple layers of complementary security controls to reduce dependence on any single protection mechanism. For example, an organization may combine physical security, network segmentation, endpoint protection, identity controls, encryption, application security, monitoring, and incident response. If an attacker bypasses one layer, additional controls can still prevent, detect, or limit the attack. Defense in depth is valuable because security mechanisms can fail, be misconfigured, or be bypassed. A layered approach therefore increases resilience and helps contain security incidents when individual controls are unsuccessful.

Question 49

A company uses a centralized system that collects authentication, firewall, endpoint, and application logs and correlates events to identify suspicious activity. Which technology is being used?

1. DLP
2. SIEM
3. NAC
4. HSM

Correct Answer: 2

Explanation

A Security Information and Event Management, or SIEM, platform collects and analyzes security-related events from multiple sources. It can aggregate logs from firewalls, operating systems, applications, identity systems, endpoints, and other infrastructure. Correlation capabilities allow the SIEM to identify relationships between events that may indicate suspicious activity or an attack. SIEM systems can support centralized monitoring, alerting, investigation, compliance reporting, and incident response. DLP focuses on preventing unauthorized data disclosure, NAC controls network access, and an HSM provides specialized protection for cryptographic keys.

Question 50

Which security control is most directly designed to prevent sensitive information from leaving an organization through unauthorized channels?

1. DLP
2. SIEM
3. IDS
4. Vulnerability scanner

Correct Answer: 1

Explanation

Data Loss Prevention, or DLP, technologies are designed to identify, monitor, and potentially prevent unauthorized transmission or exposure of sensitive information. DLP solutions can inspect data at rest, in use, and in motion, depending on their architecture. Policies may identify sensitive information such as financial records, personally identifiable information, or intellectual property and then block, quarantine, alert on, or log unauthorized activity. SIEM platforms focus on security event analysis, IDS technologies detect suspicious network activity, and vulnerability scanners identify weaknesses rather than directly preventing data exfiltration.

Question 51

Which cryptographic technique uses the same secret key for both encryption and decryption?

1. Asymmetric cryptography
2. Symmetric cryptography
3. Hashing
4. Digital signing

Correct Answer: 2

Explanation

Symmetric cryptography uses the same secret key, or a mathematically related shared secret, for encryption and decryption. Because symmetric algorithms are generally efficient, they are widely used for protecting large amounts of data. The primary challenge is securely distributing and managing the shared keys between communicating parties. Asymmetric cryptography uses separate public and private keys and is commonly used for key exchange, digital signatures, and other functions. Hashing is a one-way transformation rather than encryption. Digital signatures generally rely on asymmetric cryptographic mechanisms.

Question 52

An organization needs to exchange encrypted information with a business partner but does not want to establish a pre-shared secret key in advance. Which cryptographic approach can support this requirement?

1. Symmetric encryption only
2. Asymmetric cryptography
3. Hashing
4. Steganography

Correct Answer: 2

Explanation

Asymmetric cryptography uses a mathematically related public key and private key, allowing parties to communicate securely without initially sharing a secret key through a separate secure channel. A sender can use a recipient’s public key for certain cryptographic operations, while the recipient uses the corresponding private key. Asymmetric cryptography is also widely used for digital signatures and establishing secure session keys. Symmetric encryption is typically more efficient for bulk data protection but requires secure key distribution. Hashing and steganography do not provide the same key-based encryption capability.

Question 53

Which type of attack attempts to discover a password by systematically trying every possible combination of characters?

1. Dictionary attack
2. Password spraying
3. Brute-force attack
4. Credential stuffing

Correct Answer: 3

Explanation

A brute-force attack attempts to discover a password by systematically testing possible character combinations until the correct credential is found. The time required depends on factors such as password length, character complexity, hashing strength, and available computing resources. A dictionary attack instead uses lists of likely words and phrases. Password spraying attempts a small number of common passwords against many accounts, while credential stuffing uses previously compromised username and password combinations. Strong passwords, multifactor authentication, rate limiting, account lockout controls, and monitoring can reduce password attack risks.

Question 54

Which protocol is commonly used to securely transfer files over an SSH connection?

1. SCP
2. SNMP
3. LDAP
4. NTP

Correct Answer: 1

Explanation

Secure Copy Protocol, or SCP, provides file transfer capabilities using SSH for secure communication. Because SSH encrypts the communication channel, credentials and transferred data are protected from straightforward interception on the network. SCP has traditionally been used for securely copying files between systems that support SSH. SNMP is used for network management and monitoring, LDAP supports directory services, and NTP synchronizes system clocks. Other secure file-transfer technologies, such as SFTP, also use SSH-based secure communication and may provide additional file-management capabilities.

Question 55

Which network security architecture separates systems into security zones based on trust levels and access requirements?

1. Network segmentation
2. Data deduplication
3. Tokenization
4. Load balancing

Correct Answer: 1

Explanation

Network segmentation divides a network into separate zones or segments to control communication between systems with different security requirements or trust levels. For example, an organization may separate public-facing servers, user workstations, databases, and administrative systems into different network segments. Security devices and access rules can then restrict traffic between those zones. Segmentation limits lateral movement if an attacker compromises one system and can reduce the scope of security incidents. It also supports regulatory and architectural requirements by separating sensitive workloads from less trusted environments.

Question 56

A security team wants to identify malicious software behavior on endpoints and automatically respond to suspicious activity. Which solution is most appropriate?

1. EDR
2. DNS server
3. Load balancer
4. Proxy cache

Correct Answer: 1

Explanation

Endpoint Detection and Response, or EDR, solutions continuously monitor endpoint activity to identify suspicious behavior and potential threats. EDR platforms can collect telemetry such as process execution, network connections, file activity, and system changes. Security teams can use this information for investigation and may initiate response actions such as isolating a compromised endpoint or terminating a malicious process. Traditional antivirus focuses heavily on identifying known malicious files, while EDR provides broader behavioral visibility and response capabilities. EDR is therefore valuable for detecting and investigating modern endpoint threats.

Question 57

Which type of malware can independently replicate itself across networks without requiring a user to execute an infected file?

1. Trojan horse
2. Worm
3. Rootkit
4. Logic bomb

Correct Answer: 2

Explanation

A worm is malware capable of self-replication and propagation, often by exploiting vulnerabilities or weaknesses in networked systems. Unlike a traditional virus, a worm does not necessarily require a host file or direct user action to spread. Worms can consume network bandwidth, compromise large numbers of systems, and rapidly distribute malicious payloads. A Trojan horse disguises malicious functionality as legitimate software, while a rootkit focuses on maintaining stealth and privileged access. A logic bomb executes when a predefined condition or trigger occurs rather than continuously self-propagating.

Question 58

Which security technology is primarily designed to detect and block malicious network traffic based on predefined rules or signatures?

1. IDS
2. IPS
3. SIEM
4. DLP

Correct Answer: 2

Explanation

An Intrusion Prevention System, or IPS, monitors network traffic and can actively block or prevent traffic identified as malicious according to signatures, rules, behavioral analysis, or other detection methods. This differentiates an IPS from an Intrusion Detection System, or IDS, which primarily detects suspicious activity and generates alerts without necessarily blocking it inline. SIEM platforms aggregate and correlate security events from multiple sources, while DLP focuses on preventing unauthorized disclosure of sensitive information. IPS technology can therefore provide an active network defense layer.

Question 59

Which type of vulnerability occurs when an application processes user-controlled input as part of an operating system command?

1. Command injection
2. Cross-site request forgery
3. Session fixation
4. Clickjacking

Correct Answer: 1

Explanation

Command injection occurs when an application incorporates untrusted user input into an operating system command without adequately validating or safely handling that input. An attacker may manipulate the input to execute unauthorized commands with the privileges of the vulnerable application or process. Strong input validation, safe APIs, parameterized interfaces, least privilege, and avoiding unnecessary shell invocation can reduce this risk. Cross-site request forgery targets unauthorized actions through a victim’s authenticated session, while session fixation and clickjacking involve different application security weaknesses.

Question 60

Which software development practice integrates security activities throughout the development lifecycle rather than treating security as a final testing phase?

1. Secure SDLC
2. Change management
3. Configuration management
4. Capacity planning

Correct Answer: 1

Explanation

A Secure Software Development Life Cycle, or Secure SDLC, integrates security considerations throughout software development rather than postponing them until deployment. Security activities can include requirements analysis, threat modeling, secure architecture, code review, dependency analysis, security testing, vulnerability remediation, and secure deployment practices. Addressing security earlier can reduce the cost and impact of correcting vulnerabilities later. Change management controls modifications to systems, configuration management maintains desired system states, and capacity planning addresses resource requirements. Secure SDLC therefore embeds security into the development process from beginning to end.