View Full ISC CISSP Exam Dumps and Practice Test Dumps.

 

Question 81

Which security principle ensures that an organization can demonstrate that a person cannot credibly deny performing a specific digitally signed action?

1. Availability
2. Nonrepudiation
3. Confidentiality
4. Separation of duties

Correct Answer: 2

Explanation

Nonrepudiation provides evidence that can help establish the origin or involvement of a party in a digital transaction, making it difficult for that party to credibly deny the action later. Digital signatures are commonly associated with nonrepudiation because they can link signed data to a private key under appropriate conditions. Legal and organizational requirements also influence whether evidence provides nonrepudiation. Authentication confirms identity, while integrity helps demonstrate that information was not altered. Nonrepudiation therefore focuses on accountability for actions and transactions.

Question 82

A security team needs to identify weaknesses in thousands of network devices without actively exploiting those weaknesses. Which assessment technique is most appropriate?

1. Penetration testing
2. Vulnerability scanning
3. Red team exercise
4. Social engineering

Correct Answer: 2

Explanation

Vulnerability scanning uses automated tools to identify known weaknesses, missing patches, insecure configurations, exposed services, and other potential security issues across many systems. It is particularly useful when an organization needs broad coverage across large environments. Unlike penetration testing, vulnerability scanning generally does not attempt to exploit identified weaknesses to demonstrate their practical impact. Red team exercises simulate adversarial activity more comprehensively, while social engineering tests human behavior. Vulnerability scanning should be followed by validation, prioritization, remediation, and periodic rescanning to verify improvements.

Question 83

Which type of penetration test provides the security team with detailed knowledge of the target’s architecture, source code, and internal documentation?

1. Black-box
2. Gray-box
3. White-box
4. Blind-box

Correct Answer: 3

Explanation

White-box penetration testing provides testers with extensive information about the target environment, potentially including source code, architecture diagrams, credentials, configuration information, and internal documentation. This knowledge allows testers to examine the system deeply and identify weaknesses that may not be discoverable from an external perspective. Black-box testing provides little or no internal information, while gray-box testing provides partial knowledge. White-box testing can therefore be valuable when an organization wants comprehensive technical analysis and wants testers to evaluate internal security controls and application logic.

Question 84

Which activity is primarily concerned with identifying potential threats and vulnerabilities during the design of a new application?

1. Threat modeling
2. Data destruction
3. Log retention
4. Capacity planning

Correct Answer: 1

Explanation

Threat modeling is a structured process used to identify potential threats, attack paths, trust boundaries, vulnerabilities, and security requirements during system or application design. Performing threat modeling early allows developers and architects to address security weaknesses before implementation becomes expensive to change. Common approaches examine assets, entry points, trust boundaries, attacker capabilities, and potential attack scenarios. Threat modeling does not replace penetration testing or vulnerability scanning, but it helps guide secure architecture and development decisions by identifying security concerns before systems are deployed.

Question 85

Which software vulnerability occurs when an application improperly handles data sent by a user and executes it as part of a database query?

1. Buffer overflow
2. SQL injection
3. Race condition
4. Cross-site request forgery

Correct Answer: 2

Explanation

SQL injection occurs when untrusted input is incorporated into database queries in an unsafe manner, allowing an attacker to alter the intended query logic. Depending on the application’s privileges and database configuration, successful SQL injection can expose, modify, or delete data and potentially enable additional attacks. Parameterized queries or prepared statements are among the primary defenses. Input validation, least privilege, secure error handling, and monitoring also reduce risk. Buffer overflows involve memory handling, while cross-site request forgery abuses authenticated sessions to induce unwanted actions.

Question 86

Which application security weakness occurs when malicious script content is inserted into a web page and executed in another user’s browser?

1. Cross-site scripting
2. SQL injection
3. Command injection
4. Directory traversal

Correct Answer: 1

Explanation

Cross-site scripting, or XSS, occurs when an application allows attacker-controlled script content to be included in web pages viewed by other users. Depending on the type of XSS and application context, malicious scripts may access browser data, manipulate page content, perform actions using the victim’s session, or redirect users to malicious resources. Common defenses include context-aware output encoding, appropriate input handling, content security policies, and secure application design. SQL injection targets database queries, while command injection targets operating system commands.

Question 87

Which vulnerability occurs when two processes access shared resources concurrently and the outcome depends on the timing of their operations?

1. Race condition
2. Integer overflow
3. Session hijacking
4. Privilege creep

Correct Answer: 1

Explanation

A race condition occurs when the security or correctness of a system depends on the timing or order of concurrent operations. An attacker may attempt to exploit a small window between checking a condition and using a resource, commonly known as a time-of-check-to-time-of-use issue. Secure programming practices should use appropriate synchronization, atomic operations, locking mechanisms, and careful state management. Race conditions can be difficult to reproduce because timing affects the outcome. They can create serious security consequences when shared resources or authorization decisions are involved.

Question 88

A developer stores passwords using a secure one-way cryptographic function with unique random values added before hashing. What is the primary purpose of the random values?

1. To increase network bandwidth
2. To prevent identical passwords from producing identical stored hashes
3. To enable password recovery
4. To replace multifactor authentication

Correct Answer: 2

Explanation

A unique random salt is added to each password before applying a password hashing function. Salting ensures that identical passwords do not produce identical stored hash values, making precomputed attacks such as rainbow tables less effective. The salt does not need to remain secret and is generally stored with the password hash. Passwords should be protected using dedicated password hashing algorithms designed to resist brute-force attacks, rather than general-purpose fast hashes alone. Salting complements strong password hashing but does not provide password recovery or replace multifactor authentication.

Question 89

Which security control helps prevent unauthorized execution of applications by allowing only approved software to run on managed endpoints?

1. Application allowlisting
2. Network address translation
3. Data classification
4. Full-disk encryption

Correct Answer: 1

Explanation

Application allowlisting restricts execution to software that has been explicitly approved by organizational policy. This can reduce the risk of unauthorized applications, malware, and potentially unwanted software executing on managed endpoints. Depending on the implementation, allowlisting may use file hashes, digital signatures, publisher information, paths, or application identities. It is particularly useful for systems requiring tightly controlled software environments. Full-disk encryption protects stored data, NAT translates network addresses, and data classification determines information sensitivity. Allowlisting should be carefully maintained so legitimate software remains available.

Question 90

Which endpoint security technology is designed to prevent unauthorized devices from connecting to an organization’s network based on security compliance requirements?

1. NAC
2. SIEM
3. DLP
4. HSM

Correct Answer: 1

Explanation

Network Access Control, or NAC, controls whether devices are permitted to connect to a network based on defined security requirements. A NAC solution may evaluate factors such as device identity, authentication status, operating system version, security software, patch status, and compliance posture. Noncompliant devices can be denied access, placed into a restricted network, or directed toward remediation resources. SIEM platforms analyze security events, DLP protects sensitive information from unauthorized disclosure, and HSMs protect cryptographic keys. NAC therefore provides an important control at the point of network access.

Question 91

Which security mechanism is designed to securely store and perform cryptographic operations involving highly sensitive keys?

1. HSM
2. Proxy server
3. SIEM
4. IDS

Correct Answer: 1

Explanation

A Hardware Security Module, or HSM, is a specialized device designed to protect cryptographic keys and perform sensitive cryptographic operations within a controlled hardware environment. HSMs can provide strong key protection and may support functions such as encryption, decryption, signing, verification, and key generation. They are commonly used by organizations with high-value cryptographic requirements, including payment systems, certificate authorities, and secure transaction platforms. SIEM systems analyze security events, IDS solutions detect suspicious activity, and proxies mediate communications. HSMs specifically address cryptographic key security.

Question 92

Which encryption mode is generally designed to provide confidentiality while also supporting authentication of encrypted data when used appropriately?

1. ECB
2. CBC
3. GCM
4. CFB

Correct Answer: 3

Explanation

Galois/Counter Mode, or GCM, is an authenticated encryption mode that can provide both confidentiality and integrity protection for data. It produces authenticated ciphertext and can also protect associated data that does not itself need encryption. Proper nonce management is essential because reusing a nonce with the same key can seriously compromise security. ECB has significant pattern-leakage weaknesses for many data types, while CBC and CFB primarily provide confidentiality and require additional mechanisms for authentication. GCM is widely used in modern secure communications and applications.

Question 93

Which cryptographic algorithm is commonly used as a modern symmetric encryption standard for protecting sensitive data?

1. RSA
2. AES
3. SHA-256
4. Diffie-Hellman

Correct Answer: 2

Explanation

Advanced Encryption Standard, or AES, is a widely used symmetric encryption algorithm for protecting sensitive information. AES supports key sizes of 128, 192, and 256 bits and is commonly implemented through secure modes such as GCM or appropriately configured counter-based modes. RSA is an asymmetric cryptographic algorithm, SHA-256 is a cryptographic hash function, and Diffie-Hellman is primarily used to establish shared secrets. AES is efficient for encrypting substantial quantities of data and is therefore commonly used in storage, network, and application security.

Question 94

Which cryptographic process is specifically designed to produce a fixed-length representation of input data that changes significantly when the input changes?

1. Encryption
2. Hashing
3. Key exchange
4. Digital certificate issuance

Correct Answer: 2

Explanation

Cryptographic hashing transforms input data into a fixed-length digest. A secure cryptographic hash function is designed so that even a small change to the input produces a substantially different output, commonly referred to as the avalanche effect. Hashes can support integrity verification, password storage when used with appropriate password-hashing schemes, digital signatures, and other security functions. Hashing is not encryption because it is designed as a one-way transformation rather than a reversible process using a decryption key. SHA-256 is an example of a widely used cryptographic hash function.

Question 95

Which security technology can inspect encrypted network traffic by decrypting it at a controlled inspection point before forwarding it to its destination?

1. TLS inspection proxy
2. Network hub
3. DNS resolver
4. DHCP server

Correct Answer: 1

Explanation

A TLS inspection proxy can terminate or inspect encrypted sessions at a controlled security point, allowing security technologies to examine traffic that would otherwise remain encrypted. Depending on the architecture, the proxy establishes separate encrypted connections with the client and destination while inspecting the traffic between them. This can improve visibility for malware detection, data loss prevention, and policy enforcement. However, TLS inspection introduces privacy, performance, certificate-management, and application-compatibility considerations. Organizations should carefully define which traffic can be inspected and ensure appropriate authorization and policy controls.

Question 96

Which authentication protocol is widely used to obtain tickets for accessing network resources in a centralized authentication environment?

1. Kerberos
2. FTP
3. ICMP
4. ARP

Correct Answer: 1

Explanation

Kerberos is a network authentication protocol that uses tickets and a trusted third party to authenticate users and services. It is widely associated with enterprise directory environments and supports mutual authentication and single sign-on capabilities. Instead of repeatedly transmitting passwords to individual services, clients obtain tickets that can be presented to authorized services. Kerberos relies on cryptographic mechanisms and synchronized system clocks for proper operation. FTP transfers files, ICMP supports network diagnostics and control messaging, and ARP maps network-layer addresses to link-layer addresses.

Question 97

Which attack attempts to deceive an employee into revealing credentials by pretending to be a trustworthy person or organization?

1. Phishing
2. Port scanning
3. ARP poisoning
4. Buffer overflow

Correct Answer: 1

Explanation

Phishing is a social engineering attack that attempts to deceive individuals into revealing sensitive information, executing malicious actions, or visiting harmful resources. Attackers may impersonate trusted organizations, colleagues, service providers, or executives through email, messaging platforms, websites, or other communication channels. Effective defenses include security awareness training, phishing-resistant authentication, email security controls, URL filtering, reporting mechanisms, and careful verification of unusual requests. Technical controls are important, but human awareness remains an important layer because phishing specifically targets user decision-making and trust.

Question 98

Which social engineering attack involves an attacker following an authorized person through a secured physical entrance without using their own credentials?

1. Shoulder surfing
2. Tailgating
3. Pretexting
4. Baiting

Correct Answer: 2

Explanation

Tailgating occurs when an unauthorized individual follows an authorized person into a restricted area without independently authenticating. Attackers may exploit social courtesy by carrying objects, appearing familiar with employees, or claiming to have forgotten an access badge. Physical security controls such as mantraps, security guards, badge readers, visitor management, and security awareness training can reduce this risk. Shoulder surfing involves observing sensitive information, pretexting uses a fabricated scenario to obtain information or access, and baiting uses an enticing object or offer to encourage a target to take an unsafe action.

Question 99

Which physical security control uses two interlocking doors to prevent an individual from entering a secure area while another person is exiting?

1. Bollard
2. Mantrap
3. Turnstile
4. Fence

Correct Answer: 2

Explanation

A mantrap is a physical access control mechanism consisting of two interlocking doors designed to prevent simultaneous entry and exit. Typically, one door must close before the second door can open. Mantraps can be combined with badge readers, biometric authentication, security personnel, and monitoring systems to provide stronger access control for highly restricted areas. Bollards protect against vehicle intrusion, turnstiles regulate pedestrian movement, and fences establish physical boundaries. Mantraps are particularly useful where controlling individual physical entry is important, such as data centers and secure facilities.

Question 100

Which physical security control is primarily designed to prevent vehicles from intentionally or accidentally entering a protected area?

1. Bollard
2. Motion detector
3. Mantrap
4. Visitor badge

Correct Answer: 1

Explanation

Bollards are physical barriers designed to prevent or limit vehicle access to protected areas. They can be fixed, removable, or retractable depending on the security and operational requirements. Bollards are commonly placed around building entrances, pedestrian areas, government facilities, and other locations where vehicle intrusion presents a risk. A mantrap controls pedestrian access, a motion detector identifies movement, and a visitor badge provides identification for people. Physical security controls should be selected based on the threats, facility layout, operational requirements, and consequences of unauthorized access.