Free CISSP Practice Test 2026: Full 150-Question Mock Exams

Question 1Security & Risk Management

A security architect at a medical device maker finds a flaw in shipped insulin pump firmware that could harm patients. Her manager tells her to stay quiet until the next scheduled release in six months. Based on the order of the ISC2 Code of Ethics canons, what should guide her decision?

Correct answer: C. Protect society and the common good, which ranks above her employer
The first canon, protecting society, the common good and public trust, ranks above the duty to principals. Patient safety outweighs the manager's request to stay silent. Following the manager matches the third canon, which is lower in the order.

Question 2Security Architecture & Engineering

A defense agency's system enforces mandatory access control based on Bell-LaPadula. An analyst cleared for Secret tries to save a summary of a Secret report to an Unclassified file share. Which rule should block this action?

Correct answer: B. The star property, which prevents writing down
The star (*) property stops a subject from writing to an object at a lower classification, which keeps Secret data out of Unclassified storage. The simple security property controls reading up, not writing down, so it does not apply to this save action.

Question 3Identity & Access Management

A security manager at a research firm is comparing four fingerprint readers for a laboratory door. The vendors list a crossover error rate (CER) for each device. Which reader should be considered the MOST accurate overall?

Correct answer: D. The reader with a CER of 1.5 percent
The CER is the point where the false rejection and false acceptance rates meet, and a lower value means fewer errors overall. The 6.0 percent reader is not stricter; it simply makes more mistakes of both kinds.

Question 4Communication & Network Security

During a penetration test at Northwind Logistics, a tester sends frames carrying two 802.1Q tags so that traffic from the native VLAN lands in a restricted VLAN. At which OSI layer does this attack operate, and what is the BEST mitigation?

Correct answer: A. Layer 2; change the native VLAN to an unused ID on all trunks
Double tagging abuses how a switch strips the outer 802.1Q tag on the native VLAN, which is Layer 2 behavior. Moving the native VLAN to an unused ID (or tagging it) removes the path. Router ACLs work at Layer 3 and never see the frame, because the switch delivers it straight into the target VLAN.

Question 5Security Operations

During an investigation of suspected insider fraud, an analyst finds the suspect's workstation still powered on and logged in. Which evidence source should be collected FIRST?

Correct answer: B. The contents of the system's RAM
RAM is the most volatile source listed and is lost when the system powers down, so it is captured first according to the order of volatility. The hard drive image matters too, but disk data survives a shutdown and can be collected after memory.

Question 6Security Assessment & Testing

Northwind Health is choosing a cloud document storage vendor and needs evidence that the vendor's security controls actually operated effectively throughout the past year, not just that they were designed properly. Which report should Northwind request?

Correct answer: A. A SOC 2 Type II report covering a review period of several months
A SOC 2 Type II report tests whether security controls operated effectively over a period of time, usually 6 to 12 months. A Type I report only describes control design at a single point in time, so it cannot show that the controls worked throughout the year.

Question 7Asset Security

A retail company is launching a new loyalty database containing customer purchase histories and contact details. Several teams disagree about what classification level it should receive. Who should make the final classification decision?

Correct answer: D. The marketing director accountable for the loyalty program
The data owner, usually a senior business manager accountable for the data, decides its classification. The CISO defines the classification scheme and advises, but does not own the business data or decide its level.

Question 8Software Development Security

A company is starting a new payroll application using a waterfall approach. The project sponsor asks when security should first be addressed to keep remediation costs lowest. What is the BEST answer?

Correct answer: A. During requirements gathering, with the functional requirements
Security requirements defined at the start cost far less to meet than flaws found later in the lifecycle. Secure coding standards help, but if no security requirements exist, developers have nothing to build against and later fixes cost more.

Question 9Security & Risk Management

Before acquiring a smaller software firm, Northwind Corp's security team reviews the target's audit reports, breach history and open vulnerabilities. Which concept does this activity BEST represent?

Correct answer: C. Due diligence
Due diligence is the research and investigation done to understand risk before committing to a decision. Due care is the ongoing reasonable action a prudent organization takes, such as implementing and maintaining controls. Reviewing the target before signing is investigation, so it is due diligence.

Question 10Identity & Access Management

A government contractor is tuning a biometric system that protects a vault holding classified material. Which type of error should the security manager be MOST concerned about minimizing?

Correct answer: A. Type II errors, because they admit unauthorized people
A Type II error (false acceptance) lets an impostor in, which is the worst outcome for a high-security vault. Type I errors (false rejections) annoy legitimate users, but they do not expose the protected asset.

Question 11Security Architecture & Engineering

A manufacturer is designing a control system in which readings from untrusted field sensors must never be able to corrupt the high-integrity production database. Which security model BEST fits this requirement?

Correct answer: D. Biba, because it stops low integrity data flowing upward
Biba is an integrity model whose no-write-up and no-read-down rules stop low-integrity sources from contaminating high-integrity data. Bell-LaPadula is tempting because it is also a lattice model, but it protects confidentiality and does not address data corruption.

Question 12Communication & Network Security

Contoso Manufacturing is linking two plants over the internet with gateway-to-gateway IPsec. Security requires that the internal source and destination addresses of each packet be hidden from anyone watching the internet link. Which configuration BEST meets this requirement?

Correct answer: B. ESP in tunnel mode between the two gateways
Tunnel mode wraps the whole original packet, including its internal IP header, inside a new packet, and ESP encrypts it. AH in tunnel mode also wraps the packet but only authenticates it, so the inner addresses stay readable. Transport mode leaves the original header exposed.

Question 13Security Operations

A seized laptop is handed from the first responder to a forensic examiner at the company's lab. Which action is MOST important to keep the evidence admissible?

Correct answer: C. Record the transfer on the chain of custody form
A chain of custody record shows who held the evidence, when, and why at every step, which is what courts look for before accepting it. Booting the laptop may seem useful, but it changes data on the drive and can damage the evidence.

Question 14Security Assessment & Testing

Contoso Bank's external financial auditors need assurance about controls at a third-party payroll processor, because payroll data feeds directly into Contoso's financial statements. Which report is MOST appropriate?

Correct answer: B. SOC 1 report covering controls relevant to financial reporting
SOC 1 reports address controls at a service organization that affect the user entity's internal control over financial reporting, which is exactly what financial auditors rely on. A SOC 2 report focuses on security, availability and similar trust criteria, so it does not directly address financial statement assertions.

Question 15Asset Security

A company adopts a NIST control baseline for a new branch office. The office has no wireless networks, so the team removes all wireless-related controls from the baseline. Which term MOST specifically describes this activity?

Correct answer: D. Scoping
Scoping means selecting only the baseline controls that apply to the system, such as dropping controls for technology that is not present. Tailoring is the broader process of adjusting controls to fit the organization's mission, so scoping is the more specific term here.

Question 16Software Development Security

An online retailer has adopted DevOps and now deploys code to production several times a day. The security team's manual review before each release has become a bottleneck. What is the BEST way to keep security in step with delivery?

Correct answer: B. Build automated security tests into the pipeline and share ownership
DevSecOps builds automated security checks into the pipeline so every change is tested without slowing delivery, and makes security a shared duty. A weekly release window keeps the manual gate but defeats the business reason for adopting DevOps.

Question 17Security & Risk Management

A supplier and a manufacturer exchange electronic purchase orders. The manufacturer wants proof that the supplier cannot later deny sending a specific order. Which control BEST meets this requirement?

Correct answer: C. A digital signature made with the supplier's private key
Only the supplier holds its private key, so a valid signature ties the order to the supplier and supports non-repudiation. An HMAC uses a shared key, so either company could have produced it and the supplier can still deny it.

Question 18Identity & Access Management

A bank's online portal asks users for a password and then for the answer to a personal security question. An auditor reviews this design. What is the BEST assessment?

Correct answer: A. It is single-factor authentication because both are something you know
Multifactor authentication requires factors of different types, such as something you know plus something you have. A password and a security answer are both knowledge factors, so two secrets of the same type still count as a single factor.

Question 19Security Architecture & Engineering

A bank wants tellers to change account balances only through certified application programs that log every change, never by editing database tables directly. Which security model does this design reflect?

Correct answer: D. Clark-Wilson, using well-formed transactions and access triples
Clark-Wilson enforces integrity by binding users to specific certified programs that are the only way to change constrained data items, known as the subject-program-object access triple. Biba also protects integrity, but it relies on integrity levels and does not require changes to go through certified transactions.

Question 20Communication & Network Security

The network team at Fabrikam still polls routers with SNMPv2c community strings. An audit finds the strings can be sniffed on the management VLAN. Which change BEST resolves the finding while keeping device monitoring in place?

Correct answer: A. Migrate to SNMPv3 using the authPriv security level on all devices
SNMPv3 with authPriv adds user-based authentication and encrypts the SNMP payload, so credentials and data are no longer readable on the wire. ACLs limit who can query devices, but the community string still crosses the network in cleartext. Longer strings are also sent unencrypted, so sniffing still works.

Question 21Security Operations

After creating a forensic image of a suspect's hard drive using a write blocker, how can the examiner BEST prove the image is an exact copy of the original?

Correct answer: C. Compare cryptographic hashes of the drive and image
Matching cryptographic hash values, such as SHA-256, show that every bit of the image matches the original. Equal used space or file counts can match even when the content differs, so they do not prove integrity.

Question 22Security Assessment & Testing

A security manager at Fabrikam has hired an outside firm to perform a penetration test of the company's internet-facing systems. What should be completed FIRST, before any testing begins?

Correct answer: D. Obtain written authorization and an agreed scope from management
Signed authorization from management that defines scope and rules of engagement is the first requirement, because testing without it can be illegal and may go beyond what the business accepts. Backups and notifications are sensible preparation steps, but they come after permission and scope are formally agreed.

Question 23Security & Risk Management

After a major data breach at Contoso Retail, regulators ask who is ultimately accountable for the protection of customer data. Who holds this accountability?

Correct answer: D. Senior management and the board of directors
Senior management holds ultimate accountability for protecting the organization's assets, even when tasks are delegated. The CISO runs the security program and advises leadership but does not carry final accountability. Responsibility can be delegated, accountability cannot.

Question 24Asset Security

A company is ending its contract with a public IaaS provider. Its virtual disks were encrypted with keys held in the company's own key management service, and the provider will not allow physical destruction of shared drives. What is the BEST way to sanitize the company's data?

Correct answer: B. Destroy all copies of the encryption keys once data is migrated
Crypto-shredding destroys the keys, so any ciphertext left on the provider's media becomes unreadable, which suits cloud storage you cannot physically control. Overwriting a virtual disk does not guarantee that the underlying physical blocks, snapshots or replicas are overwritten.

Question 25Software Development Security

A software company wants an open framework to assess and improve its software security practices. It should be organized around business functions such as governance, design, implementation, verification and operations. Which model BEST fits?

Correct answer: C. OWASP Software Assurance Maturity Model (SAMM)
OWASP SAMM is an open maturity model built for software security and is structured around those five business functions. CMMI measures general process maturity, but it is not focused on software security practices.

Question 26Identity & Access Management

A healthcare company is creating accounts for remote contractors who will access patient records. Before any credentials are issued, what should be done FIRST?

Correct answer: D. Verify each contractor's claimed identity against trusted evidence
Identity proofing confirms that the person really is who they claim to be, and every later step depends on it. Issuing MFA tokens to an unverified person only gives an impostor a stronger credential.

Question 27Security Architecture & Engineering

A consulting firm advises two competing airlines. After a consultant opens files for the first airline, the system must automatically deny that consultant access to the competitor's files. Which model provides this behavior?

Correct answer: C. Brewer-Nash, because access depends on earlier access
Brewer-Nash, also called the Chinese Wall model, changes a user's permissions dynamically based on what they have already accessed, which prevents conflicts of interest. Bell-LaPadula uses static clearances and labels, so it cannot react to the consultant's earlier choices.

Question 28Communication & Network Security

The CIO of Adatum Corp wants to deploy DNSSEC so that outside parties can no longer see which domains employees are looking up. As the security advisor, what is the BEST response?

Correct answer: B. Explain that DNSSEC signs records for integrity but does not encrypt queries
DNSSEC uses digital signatures to prove that answers are authentic and unaltered, which stops cache poisoning, but queries and responses stay readable. Hiding lookups needs an encrypted transport such as DNS over TLS or DNS over HTTPS. Turning DNSSEC on everywhere still adds no confidentiality.

Question 29Security Operations

A SOC manager wants the SIEM to automatically receive indicators of compromise from an industry sharing group in a standardized, machine-readable format. Which combination BEST supports this goal?

Correct answer: C. STIX for describing the threat data and TAXII for exchanging it
STIX is a structured language for describing cyber threat information, and TAXII is the protocol used to share it between organizations and tools. Syslog moves log messages, but it is not a standard for expressing threat intelligence such as indicators and threat actor details.

Question 30Security & Risk Management

A new HR database will store employee salary and medical leave records. Who should decide the classification level of this data?

Correct answer: A. The data owner, typically the HR business leader
The data owner is the business manager responsible for the data and decides its classification and who may access it. The custodian carries out the owner's decisions, such as backups and access settings, but does not set the classification.

Question 31Security Assessment & Testing

An online retailer wants to detect slow checkout performance and outages even during overnight hours, when very few real customers are using the site. Which monitoring approach BEST meets this need?

Correct answer: B. Synthetic transactions that run scripted checkout steps on a regular schedule
Synthetic transactions run scripted user activity on a schedule, so they detect problems even when no real customers are active. Real user monitoring is passive and depends on actual traffic, which is low overnight, so issues could go unnoticed until customers arrive.

Question 32Identity & Access Management

Employees of a manufacturing firm log in to a partner's procurement portal with their own corporate credentials through SAML. Which party authenticates the employee and issues the assertion?

Correct answer: A. The identity provider operated by the manufacturing firm
In SAML, the identity provider authenticates the user and issues a signed assertion that the service provider trusts. The service provider, or relying party, only consumes the assertion and never checks the employee's corporate password.

Question 33Security Architecture & Engineering

A company wants each laptop to confirm that its boot components have not been altered and to release the disk encryption key only to that specific, unmodified device. Which component should the design rely on?

Correct answer: C. A Trusted Platform Module on the laptop motherboard
A TPM records boot measurements in its platform configuration registers and can seal a key so it is released only when those measurements match. An HSM protects keys well, but it sits on the network and cannot measure each laptop's boot process.

Question 34Security & Risk Management

Fabrikam's security team issues a document requiring that all company laptops use full disk encryption with AES-256. Which type of document is this?

Correct answer: D. Standard
A standard is a mandatory rule that names specific technologies or settings, such as a required encryption algorithm. A policy is a high-level statement of management intent and would not name a specific algorithm. Guidelines are recommendations, not requirements.

Question 35Asset Security

A hospital is retiring laptops that use solid-state drives holding patient records. A technician proposes using the degausser the hospital already uses for old backup tapes. What should the security manager advise?

Correct answer: D. Reject it, because degaussing has no effect on flash-based storage
SSDs store data in flash memory cells, not magnetic domains, so a degausser does not erase them. The drives need a purge method such as the vendor's sanitize or cryptographic erase command, or physical destruction such as shredding.

Question 36Software Development Security

During a major outage, an engineer applies a fix directly to production under the organization's emergency change procedure. Service is restored. What should happen NEXT?

Correct answer: A. Document the change and submit it for retroactive CAB review
Emergency procedures let a fix go in first, but the change must then be documented, reviewed and formally approved so the baseline stays accurate. Rolling back would bring back the outage for a change that followed an approved process.

Question 37Communication & Network Security

A utility runs DNP3 encapsulated over TCP/IP between its control center and its substations. From a security architecture view, what is the MOST significant implication of this multilayer design?

Correct answer: B. Hidden content can pass filters that inspect only the outer IP/TCP headers
Multilayer protocols wrap one protocol inside another, so a firewall that checks only IP and TCP headers can pass malicious commands or covert channels inside the payload. Inspection that understands DNP3 is needed. Encapsulation adds no encryption, and TCP sequence numbers only support ordering and reliability.

Question 38Security Operations

While investigating a breach, analysts cannot reliably rebuild the attack timeline because events from firewalls, servers, and the SIEM show conflicting timestamps. What should the security manager implement to prevent this in the future?

Correct answer: D. Synchronize all devices to a common NTP time source
Correlating events across sources depends on every device using the same accurate clock, which NTP provides. Longer retention keeps more logs but does nothing to fix timestamps that disagree.

Question 39Security Assessment & Testing

During requirements testing for a new funds-transfer feature, the team documents scenarios such as an attacker changing the destination account in a request after it has been approved. What type of testing is this?

Correct answer: C. Misuse case testing
Misuse case testing models how a malicious user could abuse a feature, such as tampering with a transfer request, and checks that the system resists it. Use case testing only confirms that intended functions work for legitimate users, so it would not reveal this kind of abuse.

Question 40Security & Risk Management

A warehouse system valued at $200,000 faces a flood threat. A flood would destroy 25% of its value, and a flood is expected once every two years. What is the annualized loss expectancy (ALE)?

Correct answer: B. $25,000
SLE equals asset value times exposure factor: $200,000 x 0.25 = $50,000. ALE equals SLE times ARO: $50,000 x 0.5 = $25,000. The $50,000 option is the SLE, not the yearly figure.

Question 41Identity & Access Management

A scheduling startup wants its app to read users' calendar entries stored with a large online provider. The provider does not want users to share their passwords with the startup. Which technology BEST fits this need?

Correct answer: C. OAuth 2.0, which grants the app a scoped access token
OAuth 2.0 is designed for delegated authorization: the user consents and the app receives a limited access token instead of the password. LDAP binding would require handing the user's password to the startup, which is exactly what the provider wants to avoid.

Question 42Security Architecture & Engineering

A payment company runs an issuing certificate authority that signs thousands of certificates per hour. Auditors require the CA private key to be generated and used only inside tamper-resistant, validated hardware. What is the BEST solution?

Correct answer: A. Use a FIPS 140 validated hardware security module
An HSM generates and uses keys inside tamper-resistant hardware and is built for high-volume signing, so the private key never leaves the device. A TPM also protects keys in hardware, but it is tied to a single endpoint and is not designed to serve a production CA.

Question 43Communication & Network Security

Woodgrove Bank is moving database storage to iSCSI over its existing Ethernet network. Which approach BEST protects the storage traffic?

Correct answer: B. Put iSCSI on an isolated storage network and require CHAP authentication
iSCSI carries block storage commands over standard IP, so it inherits IP network threats. A dedicated storage VLAN or network plus CHAP (and IPsec where confidentiality is needed) limits who can reach and mount targets. TCP checksums catch accidental errors, not deliberate tampering.

Question 44Security Operations

A finance employee who normally works 9-to-5 suddenly logs in at 3 AM and downloads thousands of files from a share they rarely use. Which tool is BEST suited to flag this activity automatically?

Correct answer: A. User and entity behavior analytics (UEBA)
UEBA builds a baseline of normal behavior for each user and alerts on major deviations such as unusual hours and data volumes. A signature-based IDS looks for known attack patterns and would not recognize valid credentials being used in an abnormal way.

Question 45Asset Security

A financial services firm has purchased a data loss prevention (DLP) suite and wants to start blocking leaks within a month. What should the security team do FIRST?

Correct answer: C. Identify and classify the sensitive data the DLP rules must protect
DLP rules can only protect data the organization has located and classified, so discovery and classification come first. Turning on blocking without that groundwork causes missed leaks and a flood of false positives that disrupt the business.

Question 46Software Development Security

A security analyst must assess a purchased web application that runs in a staging environment. The vendor will not provide source code. Which testing approach is MOST appropriate?

Correct answer: B. Dynamic application security testing (DAST)
DAST tests a running application from the outside by sending requests and studying the responses, so it needs no source code. SAST and peer review both depend on access to the code, which the analyst does not have.

Question 47Security Assessment & Testing

A software vendor wants to find crashes and memory errors in a file-parsing component by automatically feeding it large numbers of malformed and unexpected inputs. Which technique BEST fits this goal?

Correct answer: D. Fuzz testing
Fuzz testing sends malformed, random or semi-random input to a program to trigger crashes, hangs and memory errors in input handling. Static code analysis reviews code without running it, so it can miss failures that only appear when unusual data is actually processed.

Question 48Security & Risk Management

Tailspin Travel's analysis shows that an online currency exchange feature carries fraud risk far above its risk appetite, and no affordable controls reduce it enough. Management decides to drop the feature. Which risk response is this?

Correct answer: A. Risk avoidance
Avoidance removes the risk by stopping the activity that creates it. Mitigation would add controls to lower the risk, but the scenario says no affordable controls work, so ending the feature is avoidance.

Question 49Identity & Access Management

A developer already uses OAuth 2.0 for API access and now needs a standard way for the app to learn who the user is after login. What should the security architect recommend?

Correct answer: B. Add OpenID Connect, which returns an ID token about the user
OpenID Connect adds an authentication layer on top of OAuth 2.0 and issues an ID token, a signed JWT with claims about the user. An OAuth access token is meant for the resource server and is not a reliable statement of who logged in.

Question 50Security Architecture & Engineering

A company is choosing fire suppression for a staffed data center full of energized equipment. Management wants fast suppression, no residue and minimal risk to people who may be in the room. Which option BEST meets these goals?

Correct answer: D. A clean agent system such as FM-200
Clean agents such as FM-200 suppress fire quickly, do not conduct electricity, leave no residue and are designed for occupied spaces at normal design concentrations. Carbon dioxide also leaves no residue, but at extinguishing concentrations it can suffocate people, so it suits unoccupied areas.

Question 51Communication & Network Security

An architect at Litware proposes extending FCoE between two data centers that are connected only by a routed IP WAN. What is the PRIMARY technical problem with this design?

Correct answer: D. FCoE frames ride directly on Ethernet and cannot be routed over IP
FCoE places Fibre Channel frames directly inside Ethernet frames with no IP header, so it stays inside a Layer 2 domain and needs lossless Ethernet. Crossing a routed WAN calls for an IP-based option such as FCIP or iSCSI. FCoE does not use UDP or IPsec at all.

Question 52Security Operations

A company is concerned about zero-day attacks for which no signatures yet exist. Which type of intrusion detection is MOST likely to detect such attacks?

Correct answer: A. Anomaly-based detection comparing traffic to a baseline
Anomaly-based (behavior-based) detection flags activity that departs from a normal baseline, so it can catch attacks never seen before. Signature-based detection, even with daily updates, can only match attacks that already have a known signature.

Question 53Security & Risk Management

A BIA sets the maximum tolerable downtime (MTD) for an order processing system at 8 hours. The proposed recovery plan has a recovery time objective (RTO) of 12 hours. What should the BCP team conclude?

Correct answer: C. The plan must change because the RTO must not exceed the MTD
The RTO is the target time to restore the system and must be equal to or less than the MTD, or the business suffers unacceptable harm. Raising the MTD to fit the plan ignores the business impact the BIA identified.

Question 54Security Assessment & Testing

After a test cycle, a development manager wants to know how much of the application's code, including each decision branch, was actually executed by the test suite. Which activity provides this information?

Correct answer: A. Code coverage analysis
Code coverage analysis measures how much of the code, such as statements, branches or conditions, was exercised by tests. Regression testing reruns tests after changes to catch new defects, but it does not by itself report which code paths were never tested.

Question 55Asset Security

A security review finds employees uploading work files to dozens of unapproved cloud storage and file-sharing apps. Management wants visibility into this usage and the ability to enforce policy on approved SaaS apps. Which solution BEST meets this need?

Correct answer: B. A cloud access security broker (CASB)
A CASB sits between users and cloud services to discover shadow IT and enforce policies such as blocking uploads or requiring encryption. DRM protects individual documents after they are shared, but it does not show which cloud apps employees are using.

Question 56Software Development Security

A developer accidentally commits a cloud API key to a public code repository and removes it in the next commit an hour later. What should the security team do FIRST?

Correct answer: B. Revoke the exposed key and issue a replacement credential
The key remained in the commit history and may already have been collected by automated scanners, so it must be treated as compromised and revoked. Purging history is good cleanup, but it does nothing about copies an attacker may already hold.

Question 57Identity & Access Management

After a virtualization upgrade, users in one branch office suddenly cannot obtain Kerberos tickets, while other offices work normally. Which issue should the administrator check FIRST?

Correct answer: C. Clock drift between branch systems and the KDC
Kerberos uses timestamps to stop replay attacks, so clocks that drift beyond the allowed skew (often five minutes) make ticket requests fail. TLS certificates are not part of the basic Kerberos ticket exchange, so they are a less likely cause.

Question 58Security Architecture & Engineering

A data center must keep a water-based sprinkler system to satisfy the local fire code, but managers worry that a damaged pipe or sprinkler head could flood the server racks. Which sprinkler type BEST addresses this concern?

Correct answer: B. Pre-action, which fills pipes only after a detector alarms
A pre-action system keeps its pipes dry until a separate detection system triggers, and a head must still open from heat before water flows, so one broken pipe or head does not cause discharge. A dry pipe system also starts empty, but water rushes in as soon as a head breaks, so accidental damage can still flood equipment.

Question 59Communication & Network Security

A law firm uses SIP-based VoIP and worries that attackers on the LAN could record attorney phone calls. Which control MOST directly protects the content of the calls?

Correct answer: D. SRTP to encrypt the media streams carrying the voice packets
Call audio travels in RTP streams, and SRTP encrypts and authenticates that media, so captured packets cannot be turned back into speech. A voice VLAN separates traffic, but anyone who reaches that VLAN can still capture plain RTP. SIP authentication protects registration, not the conversation.

Question 60Security Operations

The security team wants malicious network traffic to be blocked in real time, not just reported. How should the intrusion system be deployed?

Correct answer: A. As an IPS placed inline in the traffic path
An IPS must sit inline so traffic passes through it, which lets it drop malicious packets before they reach the target. An IDS on a SPAN port only sees a copy of the traffic, so it can alert but cannot stop the attack itself.

Question 61Security & Risk Management

A trading firm can lose no more than 15 minutes of transaction data after an outage, but its backups run only once a night. Which metric does the 15-minute limit define, and what does it MOST directly drive?

Correct answer: C. RPO, which drives how often data is backed up or replicated
The recovery point objective is the maximum acceptable data loss measured in time, so it sets backup or replication frequency. Nightly backups could lose up to 24 hours of data. RTO is about restoration speed, not how much data is lost.

Question 62Security Assessment & Testing

Woodgrove Insurance is connecting its claims system to a partner's pricing service through a REST API. Which testing type should focus on verifying that data exchanged between the two systems is handled correctly, including error conditions?

Correct answer: A. Interface testing
Interface testing checks how separate systems or components exchange data, including APIs, and verifies correct handling of both valid messages and error conditions. Unit testing examines individual components in isolation, so it would not confirm that the two systems work together correctly.

Question 63Identity & Access Management

A network team wants to control which commands each administrator can run on routers and switches, and to log every command entered. Which protocol BEST supports this requirement?

Correct answer: D. TACACS+, because it separates authorization and supports per-command control
TACACS+ handles authentication, authorization and accounting separately, which allows command-level authorization and detailed command logging on network devices. RADIUS combines authentication and authorization, so it fits network access better than fine-grained device administration.

Question 64Security Architecture & Engineering

Technicians in a server room report frequent static shocks when they touch equipment racks during the winter months. Which environmental condition is the MOST likely cause?

Correct answer: A. Relative humidity in the room is too low
Dry air allows static charge to build up, so low humidity leads to electrostatic discharge that can damage components. High humidity causes the opposite problem, condensation and corrosion, rather than static shocks.

Question 65Asset Security

A company plans to run analytics on sensitive customer data in a public cloud. The data is already encrypted at rest and in transit, but the board worries that the cloud operator could read it while it is being processed. Which control BEST addresses this concern?

Correct answer: C. Run the workloads in hardware-based secure enclaves
Data in use sits decrypted in memory, and hardware enclaves (trusted execution environments) keep it protected even from the host operator during processing. Full-disk encryption only protects data at rest and does nothing once the data is loaded into memory.

Question 66Software Development Security

A critical vulnerability is announced in a widely used open-source logging library. The CISO wants to know within hours which of the company's applications include it. Which artifact would help MOST?

Correct answer: D. A software bill of materials for each application
An SBOM lists the components and versions inside each application, including transitive dependencies, so affected products can be found quickly. Penetration test reports describe findings at a point in time and do not list every component in use.

Question 67Security & Risk Management

A systems administrator with broad privileged access is being terminated for cause. When should the administrator's access be disabled?

Correct answer: D. At the same time as, or just before, the termination meeting
Access for a terminated privileged user should be removed at or just before notification so the person cannot cause damage in anger. Waiting until the end of the day or after the exit interview leaves a window for sabotage or data theft.

Question 68Communication & Network Security

A trading firm is selecting data center switches. Engineers want the lowest possible forwarding latency, and the security team wants the tradeoff understood. Which statement BEST describes the risk of cut-through switching?

Correct answer: B. Frames are forwarded before the FCS is checked, so corrupt frames can spread
Cut-through switches start forwarding as soon as they read the destination address, before the frame check sequence arrives, so damaged frames can pass through. Buffering and verifying the whole frame first describes store-and-forward, not cut-through. Cut-through still learns MAC addresses and keeps VLAN tags.

Question 69Security Operations

An audit finds that many production servers no longer match the approved hardened build because administrators made undocumented local changes. What is the BEST long-term solution?

Correct answer: C. Use automated configuration management to enforce the baseline
Automated configuration management keeps comparing systems to the approved baseline and can report or reverse unauthorized changes. Reimaging fixes today's drift, but the same problem returns without ongoing enforcement.

Question 70Security Assessment & Testing

A CISO wants continuous, automated validation that controls such as EDR, email filtering and data loss prevention detect and block current attacker techniques, without waiting for the annual penetration test. Which solution BEST meets this goal?

Correct answer: B. A breach and attack simulation platform
Breach and attack simulation tools run safe, automated attack scenarios mapped to known techniques on a continuous basis and show which controls detect or block them. A vulnerability scan finds missing patches and misconfigurations, but it does not test whether defensive controls actually stop attack behavior.

Question 71Identity & Access Management

A retail chain with high staff turnover finds that granting permissions to each new cashier one by one leads to errors. Which access control model would BEST reduce this administrative burden?

Correct answer: C. Role-based access control, with permissions tied to job functions
RBAC assigns permissions to roles, so a new cashier simply receives the cashier role and inherits the right access. Mandatory access control adds strict labeling that is costly to run and does not address the turnover problem.

Question 72Security Architecture & Engineering

A facility's power monitoring system records that utility voltage stayed noticeably below normal for several hours during peak demand, without a complete outage. What is this condition called?

Correct answer: B. A brownout
A brownout is a prolonged period of low voltage, while a sag is only a momentary drop. A blackout is a prolonged complete loss of power, which did not happen here.

Question 73Security & Risk Management

An accounts payable clerk has processed vendor payments alone for nine years and has never taken more than one day off. An auditor is concerned about undetected fraud. Which control would BEST help uncover it?

Correct answer: C. Mandatory vacation with a coworker doing the clerk's tasks
Mandatory vacation forces someone else to perform the duties, which often exposes ongoing fraud that depends on the original person being present. Separation of duties is a strong preventive control, but on its own it does not reveal fraud that already happened.

Question 74Asset Security

A newly hired CISO at a manufacturing company finds no reliable record of what servers, applications and data stores exist. She wants to build a risk-based protection program. What should she do FIRST?

Correct answer: A. Create an inventory of information assets and assign owners
Assets must be identified and owned before they can be valued, classified and protected in proportion to risk. Encryption or new tools deployed without an inventory leave unknown systems unprotected and may spend money on low-value assets.

Question 75Communication & Network Security

Routers at Tailspin Airlines show high CPU from a flood of packets addressed to the routers themselves, and routing adjacencies keep dropping. Which control MOST directly protects the affected plane?

Correct answer: D. Control plane policing to rate-limit traffic destined to the router CPU
Routing adjacencies live in the control plane, and control plane policing limits how much traffic reaches the route processor so routing stays stable. Out-of-band management helps administrators reach devices but does nothing to stop the flood. Transit ACLs act on the data plane, not on traffic aimed at the router itself.

Question 76Security Operations

A small company lets one accounts payable clerk create new vendors in the system and also approve payments to them. Which principle does this violate, creating the GREATEST fraud risk?

Correct answer: A. Separation of duties
Separation of duties splits a sensitive task so that no single person can complete it alone, such as creating a vendor and then paying it. Least privilege limits access to what a job needs, but here the job itself has been designed to include both conflicting tasks.

Question 77Software Development Security

A company moves its customer relationship management system to a SaaS provider. Which security responsibility remains with the company?

Correct answer: C. Managing user accounts, access rights and its own data
In SaaS the provider runs the application and the infrastructure beneath it, but the customer still owns its data and decides who can access it. Patching the application belongs to the provider, because the customer has no control over the code.

Question 78Security & Risk Management

An EU-based retailer wants to send customer personal data to a service provider in a country that has no EU adequacy decision. Which mechanism allows this transfer under GDPR?

Correct answer: D. Standard contractual clauses approved by the European Commission
Standard contractual clauses are an approved transfer safeguard when the destination country lacks an adequacy decision. An NDA protects confidentiality but does not provide the legal basis or data subject rights GDPR requires for the transfer.

Question 79Identity & Access Management

In a defense agency, a project lead owns a file labeled Secret and tries to grant read access to a contractor who holds only a Confidential clearance. The system denies the change even though the lead owns the file. Which access control model is in use?

Correct answer: D. Mandatory access control
Under mandatory access control, the system compares security labels with clearances, and owners cannot override those decisions. In discretionary access control the owner could grant the access, which is exactly what the system refused here.

Question 80Security Architecture & Engineering

A research team of 50 people wants every pair of members to share a unique symmetric key so that any two of them can communicate privately. How many keys are required?

Correct answer: B. 1,225
The number of symmetric keys grows as n(n-1)/2, so 50 x 49 / 2 gives 1,225 keys. The figure 2,450 is tempting, but it skips dividing by two and counts each pair twice.

Question 81Security Assessment & Testing

A security steering committee asks for a metric that gives early warning that the organization's risk exposure is increasing. Which of the following is the BEST example of a key risk indicator (KRI)?

Correct answer: B. Number of critical vulnerabilities open longer than the patching SLA
A KRI signals rising exposure to risk, and a growing count of critical vulnerabilities past their deadline directly shows that the chance of compromise is increasing. Training completion is a performance measure of program activity, so it shows effort rather than a change in risk level.

Question 82Communication & Network Security

After a breach at Proseware, investigators find the attacker moved between virtual machines in the same data center for weeks. The perimeter firewall logged nothing unusual. Which control would have BEST limited this activity?

Correct answer: D. Distributed firewalls enforcing policy on east-west traffic between workloads
Movement between servers inside the data center is east-west traffic, which never crosses the perimeter. Distributed firewalls apply policy at each workload, so lateral movement is blocked or logged. Stronger north-south inspection still sees only traffic entering or leaving the site.

Question 83Security Operations

A bank wants to uncover fraud schemes that depend on an employee's daily presence to keep them hidden. Which control is MOST effective for this purpose?

Correct answer: C. Mandatory vacations with duties covered by another employee
When an employee must take time off and someone else performs their duties, schemes that need constant hands-on concealment tend to surface. Background checks screen people before hiring but cannot detect fraud that a current employee is actively hiding.

Question 84Security & Risk Management

A company subject to GDPR confirms a personal data breach that is likely to put individuals' rights at risk. What is the deadline for notifying the supervisory authority?

Correct answer: B. Within 72 hours of becoming aware of the breach, where feasible
GDPR requires notice to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. The clock starts at awareness, not when the investigation ends, so waiting 30 days would break the rule.

Question 85Asset Security

An HR team holds a list of employee names and a separate list of internal project codes, each classified as Internal. A new report joins the two and reveals which staff work on an unannounced acquisition. How should the joined report be classified?

Correct answer: C. At a level that reflects the sensitivity of the combined result
Aggregation can create information more sensitive than any single source, so the combined report must be classified for what it reveals. Inheriting the Internal label from the sources ignores the new sensitivity of the acquisition details.

Question 86Software Development Security

A code review finds that a login page builds its SQL statement by joining the username and password typed by the user directly into the query string. What is the BEST remediation?

Correct answer: A. Use parameterized queries so input is never treated as code
Parameterized queries send the SQL structure and the user data separately, so input cannot change the meaning of the statement. A WAF can block some attacks, but it can be bypassed and leaves the flawed code in place.

Question 87Identity & Access Management

A design firm lets employees set permissions on the files they create and share them as they see fit. Which risk is MOST closely associated with this access control model?

Correct answer: B. Access spreads beyond intent because owners grant rights freely
Discretionary access control lets owners pass access to others, so permissions can spread widely and malware running as the user inherits that power. Central labeling belongs to mandatory access control, the opposite of the owner-driven model described.

Question 88Security Architecture & Engineering

A manager wants recipients to be able to prove that a purchase approval email truly came from her and that she cannot later deny sending it. What should her email client do?

Correct answer: A. Sign a hash of the message with her own private key
A digital signature is created by encrypting a hash of the message with the sender's private key, which only she holds, so it provides authenticity, integrity and non-repudiation. Encrypting with the recipient's public key protects confidentiality but proves nothing about who sent the message.

Question 89Security Assessment & Testing

Backup software at Tailspin Toys reports that every nightly backup job has completed successfully for the past six months. What is the BEST way for the security manager to verify that the backups can actually support recovery?

Correct answer: C. Perform periodic test restores of data and validate the results
Only a real restore proves that backup data is complete, readable and usable for recovery. Job logs can report success even when data is corrupted or key files were excluded, so they are weaker evidence.

Question 90Communication & Network Security

During a recent outage at Coho Winery, administrators could not reach the core switches because the production network itself was down. Which design change BEST addresses this?

Correct answer: D. Out-of-band management over a separate physical network or console
Out-of-band management uses a path independent of production, such as a separate management network or console servers, so devices stay reachable when production fails. A management VLAN is still in-band and shares the same links and switches. Redundancy lowers outage risk but does not provide an independent path.

Question 91Security & Risk Management

A logistics company has a route optimization algorithm that gives it a major edge. It wants protection that can last indefinitely and does not require publicly disclosing how the algorithm works. Which form of protection fits BEST?

Correct answer: D. Trade secret
A trade secret stays protected as long as the company keeps it confidential, with no fixed expiry and no public filing. A patent requires public disclosure of the invention and expires after a set term, usually 20 years.

Question 92Security Operations

System administrators currently use a single domain admin account for both email and server maintenance. What is the BEST way to reduce the risk this creates?

Correct answer: A. Give administrators separate standard and privileged accounts
Separate accounts mean that email and web browsing happen with a low-privilege account, while the privileged account is used only for admin tasks. Logging admin activity helps detect misuse after the fact but does not reduce exposure of the powerful account.

Question 93Identity & Access Management

A hospital wants doctors to view patient records only while on shift, on the hospital network, and assigned to the patient's ward. Which access control approach BEST meets this requirement?

Correct answer: B. Attribute-based access control using user, resource, and context
ABAC makes decisions using several attributes at once, such as shift, network location and ward assignment, which suits this fine-grained policy. A single doctor role would give every physician the same access regardless of time, network or assignment.

Question 94Security Architecture & Engineering

A web team wants browsers to confirm that the site's certificate has not been revoked, without each browser downloading large lists or contacting the CA directly on every visit. Which approach is BEST?

Correct answer: D. Enable OCSP stapling on the web server
With OCSP stapling, the server obtains a signed, time-stamped status response from the CA and delivers it during the TLS handshake, so the browser does not need to query the CA. Publishing CRLs more often still forces clients to download and process large lists, which is what the team wants to avoid.

Question 95Asset Security

An automated job will purge email archives older than five years next week, as the retention policy requires. Today the legal department reports that a lawsuit involving a former sales manager is reasonably expected. What should the security manager do FIRST?

Correct answer: C. Suspend deletion of the relevant records under a legal hold
Once litigation is reasonably anticipated, relevant records must be preserved, and this overrides the normal retention schedule. Running the purge, even under policy, could be treated as destruction of evidence.

Question 96Software Development Security

A tester notices that a web application assigns a session ID when a visitor first arrives and keeps the same ID after the user logs in. Which change BEST addresses this weakness?

Correct answer: A. Issue a new session ID immediately after login
Keeping the pre-login ID allows session fixation, where an attacker plants a known ID and waits for the victim to log in with it. A longer ID resists guessing, but it does not help when the attacker already knows the ID.

Question 97Security Assessment & Testing

An auditor is testing whether Litware's account management process removes access promptly when employees leave the company. Which approach provides the MOST reliable evidence?

Correct answer: C. Compare a sample of HR termination records with system account status
Comparing HR termination records with actual account status tests whether the process works in practice and gives objective, verifiable evidence. Interviews and policy reviews only show what should happen, not whether accounts were really disabled on time.

Question 98Security & Risk Management

A US security vendor plans to sell its encryption software in several countries. Which multilateral arrangement shapes the export controls many countries apply to dual-use goods such as cryptography?

Correct answer: A. The Wassenaar Arrangement
The Wassenaar Arrangement is a multilateral export control regime for conventional arms and dual-use goods, including cryptography. The Patent Cooperation Treaty and the Berne Convention deal with intellectual property, not technology exports.

Question 99Communication & Network Security

A water treatment plant keeps its control network air-gapped from all other networks. Which threat vector should the security manager treat as the MOST significant remaining risk?

Correct answer: B. Malware introduced on removable media and contractor maintenance laptops
An air gap removes network paths, so data and software must be carried in on USB drives or laptops, which is how threats such as Stuxnet crossed the gap. Strict media control and scanning matter most. Internet-based attacks need a network path, which a true air gap does not have.

Question 100Security Operations

A company plans to sell retired laptops with solid-state drives that held confidential data. Which sanitization approach is MOST appropriate before resale?

Correct answer: A. Run the drive's built-in cryptographic or secure erase
Cryptographic or secure erase purges data on solid-state drives, including areas hidden by wear leveling, so the drives can be resold safely. Degaussing works on magnetic media but has no effect on flash memory, so the data would remain.

Question 101Identity & Access Management

In a zero trust design, an API gateway intercepts every request and asks a central policy engine whether to allow it. The engine evaluates the rules and returns a decision. What role does the API gateway play?

Correct answer: C. Policy enforcement point
The policy enforcement point sits in the request path and applies the allow or deny decision. The central engine that evaluates the rules is the policy decision point, so the gateway is the enforcer, not the decider.

Question 102Security Architecture & Engineering

After a breach, investigators find that attackers cracked most user passwords quickly using precomputed rainbow tables against unsalted SHA-256 hashes. Which change BEST prevents this in the new design?

Correct answer: B. Use per-user salts with a slow function such as bcrypt
A unique salt makes precomputed tables useless, and a deliberately slow function such as bcrypt or Argon2 makes every guess expensive. Moving to SHA-512 still leaves fast, unsalted hashes that rainbow tables and GPUs can attack.

Question 103Security & Risk Management

Litware Inc. sues a former partner for breach of a data sharing contract. What standard of proof will the court MOST likely apply?

Correct answer: D. Preponderance of the evidence
Civil cases are usually decided on the preponderance of the evidence, meaning one side's claim is more likely true than not. Beyond a reasonable doubt is the much higher standard used in criminal cases.

Question 104Security Assessment & Testing

A penetration test finds a critical flaw in a legacy manufacturing system that cannot be patched until the vendor releases a new version next year. What is the BEST way to handle this finding?

Correct answer: A. Record an owner-approved exception with compensating controls
A formal exception approved by the system owner, with compensating controls and a review date, keeps the risk visible and managed. Shutting the system down could stop critical business operations, which is usually an unacceptable reaction when other controls can reduce the risk.

Question 105Asset Security

An online retailer stores and processes payment card data. Leadership wants to adopt the NIST Cybersecurity Framework as its only security framework. What should the security advisor point out?

Correct answer: B. PCI DSS still applies because the card brands require it by contract
PCI DSS is imposed through contracts with the card brands and acquiring banks, so any company handling card data must meet it whatever other framework it uses. NIST CSF is voluntary and open to any organization, but it does not replace PCI DSS obligations.

Question 106Software Development Security

Testers of a mobile banking API find that changing the account number in a request returns another customer's statement. What is the BEST fix?

Correct answer: A. Check on the server that the caller owns each requested record
This is broken object-level authorization, so the server must verify on every request that the authenticated user may access that specific record. Random identifiers only make guessing harder, and any leaked identifier would still work.

Question 107Communication & Network Security

A managed service provider hosts several customers on shared edge routers. Two customers use the same 10.10.0.0/16 address range and must remain fully isolated. Which technology BEST meets this need?

Correct answer: D. Virtual routing and forwarding instances for each customer
VRF gives each customer its own routing table on the same router, so overlapping address ranges can coexist without leaking routes. Private VLANs isolate ports at Layer 2 but do not separate routing tables. Policy-based routing on source address fails when both customers use the same addresses.

Question 108Security Operations

An analyst confirms that ransomware is actively encrypting file shares and spreading to other hosts on the same network segment. What should the incident response team do NEXT?

Correct answer: A. Isolate the affected systems to stop the spread
Once an incident is confirmed and still spreading, containment comes next to limit the damage. Restoring from backup is part of recovery, and doing it before containment risks the restored data being encrypted again.

Question 109Identity & Access Management

An internal audit finds that several long-serving employees still hold access from three previous jobs within the company. Which control would BEST detect and correct this problem going forward?

Correct answer: C. Periodic access reviews where managers recertify each user's rights
Access left over from old roles is privilege creep, and regular access reviews with manager recertification find and remove it. Mandatory vacations help uncover fraud, but they do not systematically clean up excess rights.

Question 110Security Architecture & Engineering

An analyst studying a proprietary cipher notices that every encrypted message from a device begins with the same standard header, so she holds several matching pairs of plaintext and ciphertext. Which type of cryptanalytic attack does this enable?

Correct answer: A. Known-plaintext attack
In a known-plaintext attack the analyst has samples of both plaintext and the matching ciphertext, which she did not choose, and uses them to learn about the key. A chosen-ciphertext attack requires the ability to submit ciphertexts for decryption, which the analyst does not have here.

Question 111Security & Risk Management

During threat modeling of a payment app, the team notes that users could claim they never approved a transfer because the app keeps no signed audit trail. Which STRIDE category does this threat fall under?

Correct answer: D. Repudiation
Repudiation is the threat that a user can deny performing an action because there is no reliable proof. Spoofing is pretending to be someone else, which is a different problem from denying one's own actions.

Question 112Security Assessment & Testing

An independent security researcher discovers a serious vulnerability in a widely used commercial software product. Following ethical disclosure practices, what should the researcher do FIRST?

Correct answer: B. Report it privately to the vendor through its disclosure process
Coordinated disclosure means reporting the flaw privately to the vendor first so a fix can be developed before details become public. Publishing right away exposes every user to attack before any patch exists, which causes more harm than it prevents.

Question 113Communication & Network Security

Margie's Travel is adopting zero trust. A manager asks which principle should guide access decisions for users who are already connected to the internal network. What is the BEST answer?

Correct answer: C. Each request is verified using identity, device and context, not location
Zero trust removes implicit trust based on network location and evaluates every access request using identity, device health and context. Subnet-based trust zones repeat the old perimeter model on a smaller scale. Being on the internal network or VPN grants nothing by itself.

Question 114Security Operations

A data breach has been contained, systems are restored, and normal operations have resumed. What is the PRIMARY purpose of the meeting the incident manager now schedules?

Correct answer: B. Identify improvements to controls and the response process
The lessons learned review looks at what happened and what did or did not work, so the organization can improve its controls and response plan. Turning the meeting into a search for someone to blame discourages honest input and defeats its purpose.

Question 115Asset Security

A European company outsources payroll to a cloud provider that processes employee data only on the company's documented instructions. Under GDPR, what role does the cloud provider hold?

Correct answer: D. Data processor
A processor handles personal data on behalf of, and under the instructions of, the controller, which here is the European company that decides why and how the data is processed. Custodian is an operational role for maintaining data, not the GDPR term for an outside service provider.

Question 116Software Development Security

During a funds transfer, the database debits Account A, but the server crashes before Account B is credited. After restart, the debit is reversed automatically. Which ACID property does this demonstrate?

Correct answer: B. Atomicity
Atomicity means a transaction completes fully or not at all, so a partial transfer is rolled back. Consistency keeps the database in a valid state under its rules, but the all-or-nothing behavior described here is atomicity.

Question 117Security & Risk Management

A security team wants a threat modeling method that follows seven stages, starts with business objectives and ends with risk and impact analysis based on simulated attacks. Which method fits?

Correct answer: C. PASTA
PASTA, the Process for Attack Simulation and Threat Analysis, is a seven-stage, risk-centric method that ties threats to business objectives. STRIDE is a set of categories for classifying threats and does not define a staged, business-driven process.

Question 118Identity & Access Management

A system administrator is about to be dismissed for misconduct. HR will inform him at a meeting at 2:00 p.m. When should his access be disabled?

Correct answer: A. At the same time he is informed of the dismissal
For an involuntary termination, especially of a privileged user, access should be removed as the person is notified so there is no window for revenge or data theft. Waiting until the end of the day leaves hours in which an angry administrator could cause serious damage.

Question 119Security Architecture & Engineering

A tester recovers the secret key from a payment smart card by measuring tiny variations in its power consumption while it performs encryption. Which attack category does this represent?

Correct answer: D. A side-channel attack
Power analysis is a side-channel attack because it extracts secrets from physical leakage of the implementation rather than from a weakness in the algorithm. A chosen-plaintext attack studies how the algorithm transforms selected inputs and does not depend on measuring power.

Question 120Security Assessment & Testing

Investigators at Adventure Works are concerned that an attacker with administrator rights on a server could delete local logs to hide activity. Which control BEST protects the value of these logs for later review?

Correct answer: A. Forward logs in real time to a central server with restricted access
Sending logs immediately to a separate, tightly controlled log server means a local administrator cannot erase the copies after compromising the server. Larger local log files help retention, but they remain under the attacker's control and can still be deleted.

Question 121Security & Risk Management

Before signing with a cloud file storage provider, Proseware wants independent assurance that the provider's security controls operated effectively over a period of time. Which report should it request?

Correct answer: C. SOC 2 Type II report
A SOC 2 Type II report covers security-related controls and tests whether they operated effectively over a period, often 6 to 12 months. A Type I report only describes control design at a single point in time.

Question 122Communication & Network Security

Relecloud deploys a VXLAN overlay across its data center. IDS sensors attached to the underlay suddenly stop producing useful alerts for tenant traffic. What is the MOST likely cause?

Correct answer: D. The sensors see outer UDP headers and are not decoding the inner frames
VXLAN wraps tenant Ethernet frames in outer UDP/IP headers, so a sensor that does not decode the encapsulation sees only tunnel traffic between endpoints. VXLAN itself adds no encryption, so the payload is readable once decoded. Its 24-bit identifier supports about 16 million segments, not 4,094.

Question 123Security Operations

The email gateway receives an attachment from an unknown sender that does not match any known malware signature. Which control would BEST determine whether the file is malicious before it reaches users?

Correct answer: D. Detonate it in an isolated sandbox and watch its behavior
A sandbox runs the file in a contained environment and watches what it does, which can reveal new malware that signatures miss. Adding a warning banner still delivers a possibly harmful file and relies on users to make the right decision.

Question 124Identity & Access Management

A company finds that dozens of applications use the same service account, whose password has not changed in five years and is stored in configuration files. What is the BEST corrective action?

Correct answer: B. Give each application its own service account and keep its secret in a vault with rotation
Unique service accounts limit the damage if one is compromised and make activity traceable, while a vault with automatic rotation removes stale, hard-coded passwords. A one-time password change still leaves a shared, overused account with its secret spread by email.

Question 125Security Architecture & Engineering

Attackers captured the NTLM hash of a local administrator account on one workstation and used it to log on to dozens of other workstations without ever cracking it. Which control would MOST limit this lateral movement?

Correct answer: C. Use a unique, rotated local admin password per host
Pass-the-hash reuses the hash itself, so the attack spreads only where the same credential is valid, and unique per-host passwords stop one hash from opening other machines. Longer passwords make cracking harder, but the attacker is not cracking anything, so complexity alone does not help.

Question 126Asset Security

An e-commerce company wants to reduce how many of its systems fall within PCI DSS scope. Order systems need a stored value they can reference for refunds, but they do not need the real card number. Which method BEST meets this goal?

Correct answer: D. Tokenization, replacing card numbers with tokens held in a vault
Tokens have no mathematical link to the card number, so systems that store only tokens can drop out of much of PCI DSS scope while the vault holds the real data. Encrypted card numbers are still cardholder data, so every system holding them and the shared key stays in scope.

Question 127Software Development Security

An analyst with access only to unclassified shipping schedules and fuel orders correctly works out the destination of a classified military deployment. Which database security problem does this illustrate?

Correct answer: C. Inference
Inference occurs when a user deduces sensitive information from data they are allowed to see. Aggregation is related, but it describes a collection of items becoming more sensitive than its parts, while here the key act is reasoning out a hidden fact.

Question 128Security & Risk Management

A company rolled out phishing awareness training six months ago. Leadership asks how to measure whether it is changing behavior. Which metric is BEST?

Correct answer: B. Trend in click and report rates in phishing simulations
Click and report rates in phishing simulations show how people actually behave when they face a realistic lure. Completion rates only prove that people took the course, not that their behavior changed.

Question 129Security Assessment & Testing

A development team wants to find security flaws such as SQL injection patterns early in development, before the application can be deployed to a test environment. Which testing method is MOST suitable?

Correct answer: C. Static application security testing
Static testing examines source code or binaries without running them, so it can be used before the application is deployable. Dynamic testing requires a running application, so it cannot start until a working build is available in a test environment.

Question 130Communication & Network Security

A small accounting firm uses a shared Wi-Fi passphrase. The owner worries that an attacker could capture the handshake and crack the passphrase offline. Which option BEST addresses this concern?

Correct answer: A. WPA3-Personal using Simultaneous Authentication of Equals (SAE)
SAE uses a password-authenticated key exchange, so captured handshakes cannot be used for offline dictionary attacks. A longer WPA2 passphrase only slows cracking, and hidden SSIDs are easy to discover. MAC filtering is bypassed by simple spoofing.

Question 131Security Operations

Legal counsel is reviewing a planned honeynet. Which practice would MOST likely be viewed as entrapment rather than enticement?

Correct answer: B. Publicly urging people to break into it for a reward
Entrapment means inducing someone to commit a crime they had no prior intent to commit, such as openly urging people to break in. Leaving vulnerable services or attractive fake files is enticement, which only gives an existing attacker an opportunity.

Question 132Identity & Access Management

A cloud team wants to remove standing administrator rights while still letting engineers fix production issues when needed. Which approach BEST achieves this?

Correct answer: A. Just-in-time access that grants elevated rights for a limited, approved period
Just-in-time access grants privileges only when an approved need exists and removes them automatically afterward, so no one holds standing admin rights. Quarterly reviews help, but engineers would still keep permanent elevated access between reviews.

Question 133Security Architecture & Engineering

Incident responders confirm that attackers obtained the password hash of the KRBTGT account in an Active Directory domain and are forging Kerberos ticket-granting tickets. Which action is required to invalidate these forged tickets?

Correct answer: C. Reset the KRBTGT account password twice
Golden tickets are signed with the KRBTGT key, and the domain accepts both the current and previous key, so the password must be reset twice, with time for replication in between. Resetting user passwords does not help, because forged tickets do not depend on any user's password.

Question 134Security & Risk Management

A legacy plant control server cannot support multifactor authentication. The security team places it on an isolated network segment reachable only through a monitored jump host that requires MFA. What type of control is this?

Correct answer: D. Compensating
A compensating control is an alternative safeguard used when the preferred control cannot be put in place, here MFA on the server itself. A corrective control acts after an incident to fix its effects, which is not what segmentation and a jump host do.

Question 135Asset Security

A law firm finds a box of old archive DVD-R discs containing confidential client files. The discs will never be reused. What is the MOST appropriate sanitization method?

Correct answer: D. Shred or incinerate the discs with an approved device
Optical discs store data as physical marks, not magnetic patterns, so destruction such as shredding or incineration is the reliable method. Degaussing has no effect on optical media, and write-once DVD-R discs cannot be overwritten.

Question 136Software Development Security

Operations wants assurance that the package deployed to production is exactly the one the build pipeline produced and was not altered in the artifact repository. Which control BEST provides this?

Correct answer: A. Sign packages in the pipeline and verify signatures at deploy
A digital signature created by the pipeline and checked at deployment proves both origin and integrity. A hash stored beside the package can be replaced by anyone able to change the package, and MD5 is no longer collision resistant.

Question 137Security Assessment & Testing

After a developer applies a fix for an authentication flaw, the QA lead wants to confirm that the change did not break features that were previously working. Which testing should be performed?

Correct answer: B. Regression testing
Regression testing reruns existing tests after a change to make sure working functionality still behaves correctly. Penetration testing could confirm the flaw is fixed, but it is not designed to check that unrelated features still work.

Question 138Communication & Network Security

Employees at Fourth Coffee report that contacts and calendar data were copied from their phones at a trade show without any pairing prompt. Which attack is MOST likely, and what is the BEST preventive step?

Correct answer: D. Bluesnarfing; keep Bluetooth non-discoverable and patch device firmware
Bluesnarfing is unauthorized theft of data such as contacts and calendars over Bluetooth, usually from vulnerable or discoverable devices. Turning off discoverability and applying firmware patches reduce exposure. Bluejacking only sends unsolicited messages and does not copy data.

Question 139Security Operations

A retailer's self-service kiosks run a single fixed application, yet attackers keep installing unauthorized programs on them. Which control would MOST effectively stop this?

Correct answer: C. Application allow listing that permits only approved programs
Allow listing blocks everything not explicitly approved, which suits fixed-function systems where the list of needed programs is short and stable. Anti-malware only stops software it recognizes, so new or renamed programs can still run.

Question 140Identity & Access Management

Customers of an online banking site often leave sessions open on shared computers. Which control BEST reduces the risk of another person using an abandoned session?

Correct answer: B. An idle timeout that ends the session after a short period of inactivity
An idle session timeout invalidates the session token after inactivity, so a walk-up attacker cannot reuse it. Stronger passwords protect the login step, but they do nothing once a valid session is already open.

Question 141Security Architecture & Engineering

A vendor tells a bank that its new encryption product is secure because the algorithm design is kept secret and never published. Which principle does this approach contradict?

Correct answer: C. Kerckhoffs's principle
Kerckhoffs's principle says a cryptosystem should stay secure even if everything about it except the key is public. Relying on a secret algorithm is security through obscurity, which fails once the design leaks or is reverse-engineered.

Question 142Security & Risk Management

Investigators in several countries are pursuing a group that breached systems across Europe and North America. Which international treaty was created to harmonize cybercrime laws and speed up cross-border cooperation?

Correct answer: A. The Budapest Convention on Cybercrime
The Council of Europe's Budapest Convention is the main international treaty on cybercrime, aligning national laws and providing for mutual legal assistance. The NIS Directive sets security duties for operators in the EU but is not a treaty for cross-border investigations.

Question 143Asset Security

A user prints a Confidential pricing report, but the printed pages carry no classification marking. A copy is later left in a shared meeting room and treated as ordinary paper. Which control gap does this MOST directly show?

Correct answer: B. Labels do not follow the data into printed and other forms
Marking must follow data into every form, including printouts, so anyone handling it knows which handling rules apply. The classification itself was correct; the failure was that nothing told the finder the paper was Confidential.

Question 144Software Development Security

A penetration test finds a high-risk flaw in a legacy customer portal. The vendor fix will not be available for three months, and the portal supports key revenue. What is the BEST course of action?

Correct answer: A. Add compensating controls and document owner-accepted risk
Compensating controls such as a WAF rule or tighter access reduce the risk while the business keeps running, and the owner formally accepts what remains. Shutting the portal removes the risk but causes business harm that is out of proportion when mitigation is possible.

Question 145Security Assessment & Testing

Senior management at Proseware wants to know whether weaknesses in its network could actually be exploited by an attacker to reach customer data. Which assessment BEST answers this question?

Correct answer: C. A penetration test with controlled exploitation
A penetration test goes beyond finding weaknesses and attempts to exploit them in a controlled way, showing whether an attacker could actually reach sensitive data. A vulnerability scan identifies potential weaknesses, but it does not prove they can be used in a real attack path.

Question 146Communication & Network Security

A facilities team installs Zigbee sensors for building automation. A review finds the devices join the network using the widely published default trust center link key. What is the PRIMARY risk, and the BEST fix?

Correct answer: B. Sniffed joins can expose the network key; use unique install codes instead
When devices join with the well-known default link key, anyone who captures the join can recover the network key and read or inject traffic. Install codes give each device a unique link key for joining. Zigbee does use AES-128 encryption, so the weakness is key distribution, not missing encryption.

Question 147Security Operations

During a weekend outage, an engineer applied an urgent firewall rule change to restore a critical service without prior change board approval. What should happen next?

Correct answer: D. Document the change and submit it for retroactive review
Emergency change procedures allow urgent fixes, but the change must still be documented and reviewed by the change board afterward. Removing a working fix would bring the critical outage back without any security benefit.

Question 148Identity & Access Management

A company is rolling out single sign-on to more than 200 internal and cloud applications. What is the MOST important control to pair with this rollout?

Correct answer: A. Requiring multifactor authentication at the SSO identity provider
With SSO, one stolen credential can unlock every connected application, so MFA at the identity provider protects the single point of entry. Keeping separate local passwords defeats the purpose of SSO and brings back password sprawl.

Question 149Security Architecture & Engineering

A company is replacing its flat corporate network and VPN with a zero trust architecture. Which principle should guide every access decision in the new design?

Correct answer: B. Each request is verified using identity and device state
Zero trust removes implicit trust based on network location and evaluates each request using identity, device posture and context, as described in NIST SP 800-207. Trusting a device after one VPN login is the old perimeter model, which lets an attacker move freely after a single compromise.

Question 150Security & Risk Management

A global manufacturer wants an internationally recognized information security management system that external auditors can certify. Which standard should it adopt?

Correct answer: D. ISO/IEC 27001
ISO/IEC 27001 defines the requirements for an ISMS, and organizations can be formally certified against it. ISO/IEC 27002 gives control guidance but is not a certifiable standard on its own.