CISSP · 2024 exam outline · Updated 2026
Free CISSP Practice Exam (2026)
Full-length mock exams that match the maximum length and time of the real CISSP exam. Tough, think-like-a-manager questions across all 8 domains, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
150 questions · 3 hours · same as the real exam
You have an unfinished attempt on this set.
Your score by topic
Questions 1–10Page 1 of 15
🏆
Question 1Security & Risk Management
A fellow ISC2 member at another company asks a security consultant to share a confidential penetration test report the consultant wrote for a client, saying it would help the profession learn. What should the consultant do?
Correct answer: A. Decline, because duty to the client ranks above helping the profession
The canon to serve principals diligently and competently ranks above the canon to advance and protect the profession, and the report belongs to the client. Removing names does not make sharing acceptable without the client's permission, since the findings are still confidential.
The canon to serve principals diligently and competently ranks above the canon to advance and protect the profession, and the report belongs to the client. Removing names does not make sharing acceptable without the client's permission, since the findings are still confidential.
Question 2Security Architecture & Engineering
During a building power failure, the electronic locks on the doors of a secured operations center must behave correctly. Which design BEST balances security with the top priority of protecting people?
Correct answer: C. Doors allow free exit from inside while entry stays locked
Human safety always comes first, so occupants must be able to leave, while keeping entry locked still protects the room from intruders. Unlocking in both directions also protects people, but it needlessly opens the room to anyone outside during the outage.
Human safety always comes first, so occupants must be able to leave, while keeping entry locked still protects the room from intruders. Unlocking in both directions also protects people, but it needlessly opens the room to anyone outside during the outage.
Question 3Identity & Access Management
After a break-in attempt, a data center raises the matching threshold on its hand geometry readers to make them stricter. What effect should the security manager expect?
Correct answer: D. The false rejection rate will increase for authorized staff
Making a biometric system stricter lowers false acceptances but raises false rejections (Type I errors), so more legitimate staff will be turned away. The CER describes where the two error curves cross and never reaches zero in practice.
Making a biometric system stricter lowers false acceptances but raises false rejections (Type I errors), so more legitimate staff will be turned away. The CER describes where the two error curves cross and never reaches zero in practice.
Question 4Communication & Network Security
A mining company connects a remote site through a geostationary satellite link supplied by a provider. Which security consideration should the security manager prioritize?
Correct answer: D. Encrypt traffic end to end because the signal covers a very wide area
Satellite downlinks cover a large footprint, and researchers have shown that unencrypted satellite traffic can be captured with inexpensive equipment. End-to-end encryption such as IPsec or TLS protects data regardless of provider settings. Relying only on provider link encryption depends on controls the company cannot verify.
Satellite downlinks cover a large footprint, and researchers have shown that unencrypted satellite traffic can be captured with inexpensive equipment. End-to-end encryption such as IPsec or TLS protects data regardless of provider settings. Relying only on provider link encryption depends on controls the company cannot verify.
Question 5Security Operations
A vendor releases a critical security patch for the database platform that supports the company's order system. What should the security manager ensure happens FIRST?
Correct answer: B. Test the patch in a non-production environment
Testing in a non-production environment checks that the patch does not break the order system before it is rolled out under change control. Deploying straight to production is faster but risks an outage caused by the patch itself.
Testing in a non-production environment checks that the patch does not break the order system before it is rolled out under change control. Deploying straight to production is faster but risks an outage caused by the patch itself.
Question 6Security Assessment & Testing
Fabrikam has only five days of tester time to assess a critical internal application and wants the MOST thorough coverage possible in that window. Which testing approach should be chosen?
Correct answer: B. White-box testing with full system knowledge
White-box testers receive full information such as source code, diagrams and credentials, so they spend no time on discovery and can cover more of the application in limited time. Black-box testing better simulates an outside attacker, but much of the time goes to reconnaissance, which reduces coverage.
White-box testers receive full information such as source code, diagrams and credentials, so they spend no time on discovery and can cover more of the application in limited time. Black-box testing better simulates an outside attacker, but much of the time goes to reconnaissance, which reduces coverage.
Question 7Asset Security
At a logistics company, the IT operations team runs nightly backups, maintains the database servers and applies the access rules set by the finance director for general ledger data. What role does the IT operations team fill for this data?
Correct answer: D. Data custodian
Custodians carry out day-to-day protection tasks such as backups and enforcing access rules as directed by the owner. Processor is a privacy-law term for an outside party handling personal data for a controller, not an internal IT team.
Custodians carry out day-to-day protection tasks such as backups and enforcing access rules as directed by the owner. Processor is a privacy-law term for an outside party handling personal data for a controller, not an internal IT team.
Question 8Software Development Security
After several years of improvement, a development organization uses a documented, standard software process across all projects, tailored as needed. It does not yet control its processes with quantitative metrics. Which CMM level has it reached?
Correct answer: C. Defined
At the Defined level, processes are documented and standardized across the organization. The Managed level adds quantitative measurement and control of those processes, which this organization has not yet achieved.
At the Defined level, processes are documented and standardized across the organization. The Managed level adds quantitative measurement and control of those processes, which this organization has not yet achieved.
Question 9Security & Risk Management
Before installing a firmware update on core routers, an engineer verifies the vendor's code-signing signature. Which security properties does a valid signature MAINLY confirm?
Correct answer: B. Authenticity of the source and integrity of the code
A valid code-signing signature proves the update came from the holder of the vendor's private key and was not altered after signing. Any non-repudiation it offers applies to the vendor as signer, not to the engineer who installs it.
A valid code-signing signature proves the update came from the holder of the vendor's private key and was not altered after signing. Any non-repudiation it offers applies to the vendor as signer, not to the engineer who installs it.
Question 10Identity & Access Management
A company issues hardware tokens that display a new six-digit code every 30 seconds without the user entering anything. How is this token BEST described?
Correct answer: C. A synchronous token based on a shared secret and time
A synchronous token generates codes from a shared secret combined with time (or a counter), so it stays in step with the server. An asynchronous token needs the user to enter a challenge from the server, which this device does not require.
A synchronous token generates codes from a shared secret combined with time (or a counter), so it stays in step with the server. An asynchronous token needs the user to enter a challenge from the server, which this device does not require.
Question 11Security Architecture & Engineering
A product team is building a fitness app that can collect precise location data from users. Which approach BEST reflects privacy by design?
Correct answer: A. Collect location only when a feature needs it, off by default
Privacy by design builds privacy in from the start, which includes minimizing collection and making the privacy-friendly option the default. A clear privacy policy supports transparency, but it does not reduce how much personal data the app gathers.
Privacy by design builds privacy in from the start, which includes minimizing collection and making the privacy-friendly option the default. A clear privacy policy supports transparency, but it does not reduce how much personal data the app gathers.
Question 12Communication & Network Security
A government contractor is concerned that IMSI catchers near its facility could identify and track employee phones. Which 5G standalone feature MOST directly addresses this concern?
Correct answer: B. Concealment of the permanent subscriber identifier using SUCI
In 5G standalone networks the phone encrypts its permanent identifier (SUPI) with the home network's public key and sends only the concealed SUCI, so a fake base station cannot simply read it. Network slicing isolates traffic types but does not hide subscriber identity. Shorter mmWave range does not stop a nearby IMSI catcher.
In 5G standalone networks the phone encrypts its permanent identifier (SUPI) with the home network's public key and sends only the concealed SUCI, so a fake base station cannot simply read it. Network slicing isolates traffic types but does not hide subscriber identity. Shorter mmWave range does not stop a nearby IMSI catcher.
Question 13Security Operations
Monthly vulnerability scans of internal servers report very few findings, yet administrators know many systems are missing patches. What change would MOST improve scan accuracy?
Correct answer: A. Run authenticated scans using a dedicated service account
Authenticated (credentialed) scans log in to each host and can see installed software and patch levels, which gives far more accurate results. Scanning more often without credentials would just repeat the same incomplete findings.
Authenticated (credentialed) scans log in to each host and can see installed software and patch levels, which gives far more accurate results. Scanning more often without credentials would just repeat the same incomplete findings.
Question 14Security Assessment & Testing
A company wants to simulate a malicious insider by giving testers a normal employee account and a basic network diagram, but no source code or administrator access. What type of test is this?
Correct answer: C. Gray-box test
Gray-box testing gives testers partial knowledge, such as a standard account and limited documentation, which matches the view of a typical insider. White-box testing would provide full details like source code and admin access, which goes beyond this scenario.
Gray-box testing gives testers partial knowledge, such as a standard account and limited documentation, which matches the view of a typical insider. White-box testing would provide full details like source code and admin access, which goes beyond this scenario.
Question 15Asset Security
A defense contractor adopts a control baseline that requires sessions to lock after 15 minutes of inactivity. Because its labs handle highly sensitive designs, it changes the setting to 5 minutes for lab workstations. What is this activity called?
Correct answer: D. Tailoring
Tailoring modifies baseline controls, such as adjusting parameter values, so they fit the organization's mission and risk. Scoping removes controls that do not apply, and here no control was removed, only adjusted.
Tailoring modifies baseline controls, such as adjusting parameter values, so they fit the organization's mission and risk. Scoping removes controls that do not apply, and here no control was removed, only adjusted.
Question 16Software Development Security
A large enterprise uses a scaled agile framework with twelve teams contributing to one release train. Security architects want cross-cutting security requirements applied consistently. Where are these BEST managed?
Correct answer: D. As shared nonfunctional requirements at the train level
In scaled agile, cross-cutting concerns such as security are defined as nonfunctional requirements at the program or train level, so every team's backlog is bound by them. Letting each product owner write them separately leads to gaps and uneven controls across teams.
In scaled agile, cross-cutting concerns such as security are defined as nonfunctional requirements at the program or train level, so every team's backlog is bound by them. Letting each product owner write them separately leads to gaps and uneven controls across teams.
Question 17Security & Risk Management
A newly hired CISO at a regional bank is asked to build a security program. What should she do FIRST?
Correct answer: A. Understand the bank's business objectives and risk appetite
A security program must align with business strategy, so the CISO first needs to understand objectives, priorities and risk appetite. A penetration test is useful, but without business context she cannot judge which findings matter most.
A security program must align with business strategy, so the CISO first needs to understand objectives, priorities and risk appetite. A penetration test is useful, but without business context she cannot judge which findings matter most.
Question 18Identity & Access Management
An employee normally logs in from the head office during business hours. One night, a login with the correct password comes from an unfamiliar country. What should a risk-based access control system do?
Correct answer: B. Require step-up authentication before granting access
Risk-based access control weighs context such as location, time and device, and responds to higher risk with stronger checks like an MFA challenge. Allowing access just because the password is right ignores the risk signals the system is built to catch.
Risk-based access control weighs context such as location, time and device, and responds to higher risk with stronger checks like an MFA challenge. Allowing access just because the password is right ignores the risk signals the system is built to catch.
Question 19Security Architecture & Engineering
A security architect reviews a new network appliance. Out of the box it has every service enabled, remote management open to any address and a well-known default admin password. Which secure design principle is MOST clearly missing?
Correct answer: D. Secure defaults
Secure defaults means a product should ship in its most secure state, with unneeded services off and no default credentials. Zero trust is about verifying every access request, not about a device's initial configuration.
Secure defaults means a product should ship in its most secure state, with unneeded services off and no default credentials. Zero trust is about verifying every access request, not about a device's initial configuration.
Question 20Communication & Network Security
Bellows College put its website behind a CDN for DDoS protection. Attackers then flooded the web server directly using its original IP address. What is the BEST corrective action?
Correct answer: C. Allow inbound traffic at the origin only from the CDN's address ranges
A CDN only protects traffic that passes through it, so the origin must refuse connections that do not come from the CDN, ideally on a new unpublished IP address. Longer caching reduces normal load but does nothing about attackers who bypass the CDN. A larger server only raises the cost of the attack.
A CDN only protects traffic that passes through it, so the origin must refuse connections that do not come from the CDN, ideally on a new unpublished IP address. Longer caching reduces normal load but does nothing about attackers who bypass the CDN. A larger server only raises the cost of the attack.
Question 21Security Operations
A company takes a full backup every Sunday night and a differential backup every other night. A server fails on Thursday afternoon. Which backups are needed to restore the most recent data?
Correct answer: A. Sunday's full backup and Wednesday's differential
A differential backup holds all changes since the last full backup, so only the full backup and the latest differential are needed. Restoring every differential in sequence is how incremental backups work and only adds time here.
A differential backup holds all changes since the last full backup, so only the full backup and the latest differential are needed. Restoring every differential in sequence is how incremental backups work and only adds time here.
Question 22Security Assessment & Testing
A QA team has confirmed that a web form accepts valid ZIP codes. The security lead now wants testers to submit letters, very long strings and special characters to confirm the form rejects them safely. What type of testing is this?
Correct answer: C. Negative testing
Negative testing checks that a system handles invalid or unexpected input correctly, for example by rejecting it and failing safely. Positive testing only confirms expected behavior with valid input, which the team has already done.
Negative testing checks that a system handles invalid or unexpected input correctly, for example by rejecting it and failing safely. Positive testing only confirms expected behavior with valid input, which the team has already done.
Question 23Security & Risk Management
Developers at a software company build a commercial product that it sells and ships to customers, and they include a library released under a strong copyleft license such as the GPL. Legal is reviewing the release. What is the MAIN licensing risk?
Correct answer: A. The company may have to release its own product source code under the same license
Strong copyleft licenses require that distributed works built on the code be released under the same terms, which can force disclosure of proprietary source. Copyleft licenses do not charge royalties, so the payment option is a distractor.
Strong copyleft licenses require that distributed works built on the code be released under the same terms, which can force disclosure of proprietary source. Copyleft licenses do not charge royalties, so the payment option is a distractor.
Question 24Asset Security
A school district wants to donate old desktop computers with magnetic hard drives to a charity. The drives held student records and must remain usable by the charity. Which approach BEST meets both goals?
Correct answer: B. Purge each drive with a verified secure erase or overwrite tool
A verified secure erase or overwrite protects against lab-level recovery while leaving the drive usable. Degaussing also removes the data, but it typically destroys the servo tracks of modern hard drives and leaves them unusable.
A verified secure erase or overwrite protects against lab-level recovery while leaving the drive usable. Degaussing also removes the data, but it typically destroys the servo tracks of modern hard drives and leaves them unusable.
Question 25Software Development Security
A government agency forms an integrated product team for a new case management system. What is the MAIN security benefit of this approach?
Correct answer: A. Security staff work with developers and users from the start
An integrated product team brings people from all relevant disciplines, including security, together for the whole life of the product, so security needs shape decisions early. It does not remove the need for formal authorization before the system goes live.
An integrated product team brings people from all relevant disciplines, including security, together for the whole life of the product, so security needs shape decisions early. It does not remove the need for formal authorization before the system goes live.
Question 26Identity & Access Management
A firewall blocks all inbound remote desktop traffic from the internet, no matter which user is trying to connect. Which access control model does this BEST illustrate?
Correct answer: C. Rule-based access control
Rule-based access control applies global rules set by an administrator to all subjects, regardless of who they are. Role-based access control would decide based on the user's job role, which plays no part in this firewall rule.
Rule-based access control applies global rules set by an administrator to all subjects, regardless of who they are. Role-based access control would decide based on the user's job role, which plays no part in this firewall rule.
Question 27Security Architecture & Engineering
A power plant must send sensor readings from its control network to the corporate network for reporting, but nothing from the corporate side must ever be able to reach the control network. Which control BEST enforces this?
Correct answer: B. A unidirectional gateway (data diode)
A data diode physically allows traffic in one direction only, so the control network can send data out but cannot receive anything. A firewall enforces direction with rules that can be misconfigured or bypassed, while a diode enforces it in hardware.
A data diode physically allows traffic in one direction only, so the control network can send data out but cannot receive anything. A firewall enforces direction with rules that can be misconfigured or bypassed, while a diode enforces it in hardware.
Question 28Communication & Network Security
Lucerne Publishing is migrating to a software-defined network with a central controller. Which risk should receive the MOST attention in the security design?
Correct answer: D. Compromise of the controller, which could reprogram the entire network
SDN moves control into a central controller that programs every switch, so a compromised controller or its APIs could redirect or drop traffic everywhere. Hardening, redundancy and authenticated southbound channels come first. Controllers usually install flow rules rather than inspect each packet, so per-packet latency is not the main concern.
SDN moves control into a central controller that programs every switch, so a compromised controller or its APIs could redirect or drop traffic everywhere. Hardening, redundancy and authenticated southbound channels come first. Controllers usually install flow rules rather than inspect each packet, so per-packet latency is not the main concern.
Question 29Security Operations
An online retailer wants transaction log entries from its order database sent to an offsite facility as they occur, so that very little data is lost if the primary site fails. Which technique BEST meets this need?
Correct answer: A. Remote journaling
Remote journaling sends transaction log entries to an offsite location in real time or near real time, which keeps data loss very small. Electronic vaulting transfers backup data in bulk batches, so more recent transactions could be lost.
Remote journaling sends transaction log entries to an offsite location in real time or near real time, which keeps data loss very small. Electronic vaulting transfers backup data in bulk batches, so more recent transactions could be lost.
Question 30Security & Risk Management
A web application has an ALE of $80,000 from attacks. A proposed web application firewall would reduce the ALE to $20,000 and costs $45,000 per year to run. What is the annual value of this safeguard to the company?
Correct answer: B. $15,000
Safeguard value equals ALE before minus ALE after minus the annual cost of the safeguard: $80,000 - $20,000 - $45,000 = $15,000. The $60,000 option is only the drop in ALE and ignores what the firewall costs to run.
Safeguard value equals ALE before minus ALE after minus the annual cost of the safeguard: $80,000 - $20,000 - $45,000 = $15,000. The $60,000 option is only the drop in ALE and ignores what the firewall costs to run.
Question 31Security Assessment & Testing
A SOC reviewing authentication logs is flooded with alerts for every single failed login. The team decides to alert only when one account has more than five failures within ten minutes. What is this threshold called?
Correct answer: A. Clipping level
A clipping level sets a threshold of normal errors, so only activity above it is flagged for review. The crossover error rate is a biometric accuracy measure, not a log review threshold.
A clipping level sets a threshold of normal errors, so only activity above it is flagged for review. The crossover error rate is a biometric accuracy measure, not a log review threshold.
Question 32Identity & Access Management
In a Kerberos realm, a user who already holds a valid TGT wants to open a share on a file server. What happens NEXT?
Correct answer: D. The client presents the TGT to the ticket-granting service to obtain a service ticket
With a valid TGT, the client asks the ticket-granting service for a service ticket and then presents that ticket to the file server. Kerberos is designed so the password never travels to the file server, so sending it there is wrong.
With a valid TGT, the client asks the ticket-granting service for a service ticket and then presents that ticket to the file server. Kerberos is designed so the password never travels to the file server, so sending it there is wrong.
Question 33Security Architecture & Engineering
A security architect needs a model that represents subjects and objects as nodes in a directed graph and shows how access rights can be passed from one subject to another. Which model fits this description?
Correct answer: A. Take-Grant model
The Take-Grant model uses a directed graph with take, grant, create and remove rules to analyze how rights can spread between subjects. Graham-Denning also defines rules for managing rights, but it uses a set of eight protection rules rather than a graph.
The Take-Grant model uses a directed graph with take, grant, create and remove rules to analyze how rights can spread between subjects. Graham-Denning also defines rules for managing rights, but it uses a set of eight protection rules rather than a graph.
Question 34Security & Risk Management
A risk team wants several senior managers to rate the likelihood of insider threats without anyone being swayed by more senior or vocal colleagues. Which technique BEST supports this?
Correct answer: C. Delphi technique
The Delphi technique gathers anonymous opinions over several rounds to reach consensus without social pressure or groupthink. A brainstorming workshop is open discussion, so senior or loud voices can sway the result.
The Delphi technique gathers anonymous opinions over several rounds to reach consensus without social pressure or groupthink. A brainstorming workshop is open discussion, so senior or loud voices can sway the result.
Question 35Asset Security
An administrator plans to sanitize solid-state drives for reuse outside the company by overwriting each one once with zeros using a standard disk utility. Why is this approach a concern?
Correct answer: A. Wear leveling can leave data in blocks the utility cannot reach
SSD controllers remap writes through wear leveling and keep spare over-provisioned blocks, so a standard overwrite may miss old data. NIST SP 800-88 points to the drive's built-in sanitize or cryptographic erase commands, or destruction, rather than more overwrite passes.
SSD controllers remap writes through wear leveling and keep spare over-provisioned blocks, so a standard overwrite may miss old data. NIST SP 800-88 points to the drive's built-in sanitize or cryptographic erase commands, or destruction, rather than more overwrite passes.
Question 36Software Development Security
A system received formal authorization two years ago. Since then, the team has added a payment module and connected it to a new external partner. What should the security manager do?
Correct answer: D. Reassess the system's risk and seek a new authorization
A significant change to a system's functions or connections alters its risk profile, so it should be reassessed and reauthorized. A written statement from the partner covers only the partner's side and does not evaluate the new module or interface.
A significant change to a system's functions or connections alters its risk profile, so it should be reassessed and reauthorized. A written statement from the partner covers only the partner's side and does not evaluate the new module or interface.
Question 37Communication & Network Security
A team is building an application in a cloud VPC. The database tier must never be reachable from the internet but still needs to download vendor patches. Which design BEST meets both requirements?
Correct answer: B. Place the database in a private subnet with outbound access via a NAT gateway
A private subnet has no route from the internet, and a NAT gateway lets instances start outbound connections without accepting inbound ones. A public subnet with a restrictive security group depends on a single rule that could be changed by mistake. Public IPs and vendor peering both widen exposure for no benefit.
A private subnet has no route from the internet, and a NAT gateway lets instances start outbound connections without accepting inbound ones. A public subnet with a restrictive security group depends on a single rule that could be changed by mistake. Public IPs and vendor peering both widen exposure for no benefit.
Question 38Security Operations
A payment processor's business impact analysis sets a recovery time objective of two hours for its core processing system. Which recovery site strategy is MOST appropriate?
Correct answer: C. A hot site with current systems and data ready to run
A hot site is fully equipped and kept close to current, so operations can resume within hours. A warm site costs less but needs time to load data and configure systems, which would likely exceed a two-hour target.
A hot site is fully equipped and kept close to current, so operations can resume within hours. A warm site costs less but needs time to load data and configure systems, which would likely exceed a two-hour target.
Question 39Security Assessment & Testing
During an authorized penetration test, a tester finds evidence that a real attacker already has a backdoor on one of the client's servers. What should the tester do FIRST?
Correct answer: B. Stop and notify the client's designated contact right away
Evidence of an actual compromise falls outside the test's purpose and needs immediate attention, so the tester should stop and inform the agreed contact as the rules of engagement describe. Removing the backdoor could destroy evidence and goes beyond the authorized scope.
Evidence of an actual compromise falls outside the test's purpose and needs immediate attention, so the tester should stop and inform the agreed contact as the rules of engagement describe. Removing the backdoor could destroy evidence and goes beyond the authorized scope.
Question 40Security & Risk Management
A vulnerability assessment finds a residual risk on a customer portal that the business wants to accept rather than fix. Who should formally accept this risk?
Correct answer: D. The business owner with authority over the portal
Risk acceptance should be a documented decision by a business owner or manager with the authority and budget to own the consequences. The security team identifies and explains risk, but it should not accept risk on behalf of the business.
Risk acceptance should be a documented decision by a business owner or manager with the authority and budget to own the consequences. The security team identifies and explains risk, but it should not accept risk on behalf of the business.
Question 41Identity & Access Management
A security architect is reviewing a Kerberos deployment for an enterprise. Which weakness should be treated as the MOST significant risk?
Correct answer: B. The KDC holds every principal's secret key and is a single point of failure
The KDC stores the long-term keys of every user and service, so its compromise or outage affects the whole realm and it needs strong protection and redundancy. Kerberos does not send passwords in clear text; it uses keys derived from them.
The KDC stores the long-term keys of every user and service, so its compromise or outage affects the whole realm and it needs strong protection and redundancy. Kerberos does not send passwords in clear text; it uses keys derived from them.
Question 42Security Architecture & Engineering
A malicious process on a multilevel server signals data to a lower-level process by varying how heavily it uses the CPU, while the other process measures its own response times. What type of threat is this?
Correct answer: C. A covert timing channel
A covert timing channel conveys information by changing the timing or use of a shared resource, which the receiver observes through performance changes. A covert storage channel instead writes data into a shared location, such as a file attribute, that the other process can read.
A covert timing channel conveys information by changing the timing or use of a shared resource, which the receiver observes through performance changes. A covert storage channel instead writes data into a shared location, such as a file attribute, that the other process can read.
Question 43Communication & Network Security
Alpine Ski House wants to spot unusual data transfers between internal hosts without the storage cost of full packet capture. Which monitoring approach BEST fits this goal?
Correct answer: A. Collect NetFlow or IPFIX records summarizing conversations and volumes
Flow records capture metadata such as source, destination, ports, timing and byte counts, which is enough to spot unusual transfers at a fraction of the storage. Mirroring everything to a capture appliance gives more detail but brings exactly the storage cost the company wants to avoid. Switch syslog does not describe host-to-host conversations.
Flow records capture metadata such as source, destination, ports, timing and byte counts, which is enough to spot unusual transfers at a fraction of the storage. Mirroring everything to a capture appliance gives more detail but brings exactly the storage cost the company wants to avoid. Switch syslog does not describe host-to-host conversations.
Question 44Security Operations
A storage administrator needs a disk array that keeps working even if any two drives fail at the same time. Which RAID level meets this requirement?
Correct answer: D. RAID 6 (dual distributed parity)
RAID 6 stores two independent sets of parity, so the array survives the loss of any two drives. RAID 5 is the closest option, but its single parity set protects against only one failed drive.
RAID 6 stores two independent sets of parity, so the array survives the loss of any two drives. RAID 5 is the closest option, but its single parity set protects against only one failed drive.
Question 45Asset Security
A company's network DLP appliance catches sensitive files sent by plain email but misses uploads to HTTPS file-sharing sites. Management does not want to decrypt all employee web traffic at the proxy. What is the BEST way to close this gap?
Correct answer: A. Deploy endpoint DLP that inspects files before they are encrypted
Endpoint DLP sees file content on the device before the browser encrypts it, so it can block HTTPS uploads without breaking TLS at the proxy. Adding more network appliances does not help, because they still cannot read the encrypted traffic.
Endpoint DLP sees file content on the device before the browser encrypts it, so it can block HTTPS uploads without breaking TLS at the proxy. Adding more network appliances does not help, because they still cannot read the encrypted traffic.
Question 46Software Development Security
A team is choosing a language for a new network-facing service and wants to eliminate buffer overflows as a class of flaw rather than just reduce them. What is the BEST choice?
Correct answer: C. Use a memory-safe language with automatic bounds checking
Memory-safe languages check bounds and manage memory automatically, which keeps most buffer overflows from being written at all. Stack canaries and DEP make exploitation harder, but the underlying overflow can still exist.
Memory-safe languages check bounds and manage memory automatically, which keeps most buffer overflows from being written at all. Stack canaries and DEP make exploitation harder, but the underlying overflow can still exist.
Question 47Security Assessment & Testing
At Northwind Traders, the internal audit team that reviews IT security controls reports directly to the CIO, who owns the systems being audited. What is the BEST way to improve this arrangement?
Correct answer: D. Have internal audit report to the board's audit committee
Reporting to the audit committee gives internal audit independence from the management it reviews, so findings are not filtered or suppressed. Having the CIO approve findings makes the conflict of interest worse, because the system owner could weaken or block negative results.
Reporting to the audit committee gives internal audit independence from the management it reviews, so findings are not filtered or suppressed. Having the CIO approve findings makes the conflict of interest worse, because the system owner could weaken or block negative results.
Question 48Security & Risk Management
Executives want early warning when the organization's exposure to a key risk starts rising, rather than finding out after an incident. Which tool BEST supports this?
Correct answer: D. Key risk indicators with defined thresholds
Key risk indicators are metrics tracked over time with thresholds that trigger action when exposure rises. An annual assessment gives only a yearly snapshot, so it would miss changes between reviews.
Key risk indicators are metrics tracked over time with thresholds that trigger action when exposure rises. An annual assessment gives only a yearly snapshot, so it would miss changes between reviews.
Question 49Identity & Access Management
A law firm is adopting several SaaS applications and wants staff to use their corporate credentials without each vendor storing those passwords. What is the BEST approach?
Correct answer: B. Federate the SaaS apps with the firm's identity provider using SAML or OIDC
Federation lets the firm's identity provider authenticate users and send signed assertions or tokens, so vendors never receive or store the passwords. Copying password hashes to every vendor widens the attack surface and defeats the goal.
Federation lets the firm's identity provider authenticate users and send signed assertions or tokens, so vendors never receive or store the passwords. Copying password hashes to every vendor widens the attack surface and defeats the goal.
Question 50Security Architecture & Engineering
Attackers keep exploiting a buffer overflow by placing shellcode on the stack and redirecting execution to it. Which memory protection control specifically stops code from running in memory regions marked as data?
Correct answer: C. Data execution prevention
Data execution prevention marks stack and heap pages as non-executable, so injected shellcode in those regions cannot run. ASLR makes it harder to predict where code and data sit in memory, but it does not mark memory as non-executable.
Data execution prevention marks stack and heap pages as non-executable, so injected shellcode in those regions cannot run. ASLR makes it harder to predict where code and data sit in memory, but it does not mark memory as non-executable.
Question 51Communication & Network Security
A retailer is deploying edge computing nodes in hundreds of stores to process video analytics locally. Which security concern is MOST specific to this architecture?
Correct answer: D. Nodes sit in locations with weak physical security and limited oversight
Edge computing pushes processing out to many distributed sites, often without guards, locked rooms or on-site IT staff, so tampering and theft become real risks. Secure boot, disk encryption and remote attestation help. A single central data center describes the opposite model.
Edge computing pushes processing out to many distributed sites, often without guards, locked rooms or on-site IT staff, so tampering and theft become real risks. Secure boot, disk encryption and remote attestation help. A single central data center describes the opposite model.
Question 52Security Operations
Employees complain that VoIP calls become choppy whenever large file transfers run across the company's WAN link. What is the MOST cost-effective solution?
Correct answer: C. Configure QoS to give voice traffic higher priority
Quality of service lets the network give delay-sensitive voice traffic priority over bulk transfers on the existing link. Doubling the bandwidth may help, but it costs far more and does not guarantee voice traffic is handled first.
Quality of service lets the network give delay-sensitive voice traffic priority over bulk transfers on the existing link. Doubling the bandwidth may help, but it costs far more and does not guarantee voice traffic is handled first.
Question 53Security & Risk Management
Under the NIST Risk Management Framework (SP 800-37), a system's controls have been implemented and assessed. A senior official now reviews the results and decides whether the remaining risk is acceptable to operate the system. Which step is this?
Correct answer: B. Authorize
In the Authorize step, a senior official, the authorizing official, accepts the residual risk and grants authorization to operate. Monitor comes after authorization and covers ongoing assessment of controls and changes.
In the Authorize step, a senior official, the authorizing official, accepts the residual risk and grants authorization to operate. Monitor comes after authorization and covers ongoing assessment of controls and changes.
Question 54Security Assessment & Testing
Woodgrove Bank plans to run a penetration test against applications it hosts on a public IaaS cloud platform. What should the security team review FIRST?
Correct answer: C. The cloud provider's penetration testing policy
Cloud providers set rules on what customers may test, and some activities need notice or are forbidden, so the provider's testing policy must be checked before anything starts. A SOC 2 report gives assurance about the provider's controls, but it does not authorize the bank to test on shared infrastructure.
Cloud providers set rules on what customers may test, and some activities need notice or are forbidden, so the provider's testing policy must be checked before anything starts. A SOC 2 report gives assurance about the provider's controls, but it does not authorize the bank to test on shared infrastructure.
Question 55Asset Security
An engineering firm must send design drawings to an outside manufacturer. It wants to prevent printing and forwarding, and to revoke access when the contract ends, even after the files leave its network. Which control BEST meets these requirements?
Correct answer: A. Digital rights management applied to the drawing files
DRM keeps persistent controls attached to the files, enforcing rules such as no printing and allowing access to be revoked after sharing. DLP can stop files from leaving, but it has no control over what the recipient does once they have them.
DRM keeps persistent controls attached to the files, enforcing rules such as no printing and allowing access to be revoked after sharing. DLP can stop files from leaving, but it has no control over what the recipient does once they have them.
Question 56Software Development Security
A security team receives hundreds of alerts daily from its application security tools. It wants alerts enriched automatically, tickets opened and containment steps triggered by predefined playbooks. Which technology BEST fits?
Correct answer: B. Security orchestration, automation and response (SOAR)
SOAR platforms run playbooks that enrich alerts, create tickets and trigger response actions across tools. A SIEM collects and correlates events, but automated, playbook-driven response is the defining job of SOAR.
SOAR platforms run playbooks that enrich alerts, create tickets and trigger response actions across tools. A SIEM collects and correlates events, but automated, playbook-driven response is the defining job of SOAR.
Question 57Identity & Access Management
Two companies plan to federate identities so each company's staff can reach the other's project portal. Before any technical integration, what should be done FIRST?
Correct answer: A. Agree on a trust framework covering identity proofing, attributes, and liability
Federation depends on trust, so the parties must first agree on how identities are vetted, which attributes are shared and who is liable when something goes wrong. Exchanging certificates is a later technical step that should follow the business and legal agreement.
Federation depends on trust, so the parties must first agree on how identities are vetted, which attributes are shared and who is liable when something goes wrong. Exchanging certificates is a later technical step that should follow the business and legal agreement.
Question 58Security Architecture & Engineering
A team designing a security kernel insists that its code base be kept as small as possible. Which reference monitor requirement does this MOST directly support?
Correct answer: C. It must be verifiable through analysis
A reference monitor must be tamperproof, always invoked and verifiable, and keeping the kernel small is what makes thorough analysis and testing possible. Complete mediation is also required, but code size mainly affects whether the mechanism can be verified.
A reference monitor must be tamperproof, always invoked and verifiable, and keeping the kernel small is what makes thorough analysis and testing possible. Complete mediation is also required, but code size mainly affects whether the mechanism can be verified.
Question 59Communication & Network Security
Staff at Datum Hospital complain that VoIP calls sound choppy. Monitoring shows average latency within target and no packet loss, but packet arrival times vary widely. Which metric explains the problem?
Correct answer: D. Jitter, the variation in delay between consecutive packet arrivals
Jitter measures how much packet delay varies, and voice suffers from it because packets must be played out at a steady rate. QoS prioritization and jitter buffers address it. Average latency is already within target, so it does not explain the uneven audio.
Jitter measures how much packet delay varies, and voice suffers from it because packets must be played out at a steady rate. QoS prioritization and jitter buffers address it. Average latency is already within target, so it does not explain the uneven audio.
Question 60Security Operations
A company has just finished writing its first disaster recovery plan. Management wants an initial exercise that checks the plan with key team members at minimal cost and with no risk to operations. Which test is BEST?
Correct answer: D. A tabletop exercise walking through a scenario
A tabletop exercise has team members talk through a scenario to find gaps in the plan without touching any systems. A parallel test gives deeper assurance, but it needs the alternate site and much more cost and effort, which suits a later stage.
A tabletop exercise has team members talk through a scenario to find gaps in the plan without touching any systems. A parallel test gives deeper assurance, but it needs the alternate site and much more cost and effort, which suits a later stage.
Question 61Security & Risk Management
Wingtip Toys is starting its first business continuity planning effort. What should happen FIRST?
Correct answer: A. Get senior management support and define the scope
BCP begins with project initiation: senior management support, a sponsor and a clear scope. The BIA is a key early step, but it needs that mandate and scope to know which areas to cover.
BCP begins with project initiation: senior management support, a sponsor and a clear scope. The BIA is a key early step, but it needs that mandate and scope to know which areas to cover.
Question 62Security Assessment & Testing
Litware must show auditors that its 3,000 servers comply with an approved hardening baseline. Which approach is the MOST efficient and repeatable?
Correct answer: B. Automated compliance scans using SCAP content
SCAP-based tools compare system settings automatically against a standard baseline, so every server can be checked quickly and the same way each time. Manual sampling is slower and only covers part of the environment, so noncompliant servers may be missed.
SCAP-based tools compare system settings automatically against a standard baseline, so every server can be checked quickly and the same way each time. Manual sampling is slower and only covers part of the environment, so noncompliant servers may be missed.
Question 63Identity & Access Management
IT administrators at a logistics company keep privileged passwords in personal spreadsheets. Which solution would BEST improve control over these credentials?
Correct answer: D. A credential management system that vaults, rotates, and logs privileged secrets
A credential management system stores secrets in an encrypted vault, rotates them and records who checked out each credential, which provides control and accountability. Password-protecting personal spreadsheets still leaves secrets scattered and unaudited.
A credential management system stores secrets in an encrypted vault, rotates them and records who checked out each credential, which provides control and accountability. Password-protecting personal spreadsheets still leaves secrets scattered and unaudited.
Question 64Security Architecture & Engineering
A company is moving workloads from virtual machines to containers running on shared hosts. Compared with virtual machines, what is the MOST significant architectural security concern?
Correct answer: C. Containers share the host operating system kernel
Containers isolate processes but share one host kernel, so a kernel flaw or container escape can affect every container on that host. Virtual machines each run their own kernel on a hypervisor, which gives stronger isolation, and container images can be scanned, so that option is false.
Containers isolate processes but share one host kernel, so a kernel flaw or container escape can affect every container on that host. Virtual machines each run their own kernel on a hypervisor, which gives stronger isolation, and container images can be scanned, so that option is false.
Question 65Asset Security
A marketing team's newsletter sign-up form asks for name, email address, date of birth, home address and national ID number. What is the BEST recommendation from a data security perspective?
Correct answer: B. Limit collection to what the newsletter needs, such as email
Data minimization means collecting only what the stated purpose needs, which removes risk instead of managing it. Encrypting unneeded fields still leaves the company holding sensitive data it never had a reason to collect.
Data minimization means collecting only what the stated purpose needs, which removes risk instead of managing it. Encrypting unneeded fields still leaves the company holding sensitive data it never had a reason to collect.
Question 66Software Development Security
An auditor asks the organization to prove which exact version of source code produced the binary now running in production. Which process MOST directly supports this?
Correct answer: C. Software configuration management with versioned baselines
Software configuration management identifies and tracks configuration items, versions and baselines, so a build can be traced back to its exact source. Release notes describe what changed, but they are not a controlled record linking a binary to specific code.
Software configuration management identifies and tracks configuration items, versions and baselines, so a build can be traced back to its exact source. Release notes describe what changed, but they are not a controlled record linking a binary to specific code.
Question 67Security & Risk Management
A BIA at a hospital produces these maximum tolerable downtimes: patient records system 2 hours, billing 3 days, staff scheduling 1 day, intranet 7 days. Which function should be recovered FIRST?
Correct answer: A. Patient records, because it has the shortest MTD
Recovery priority follows the MTD, so the function that can tolerate the least downtime is restored first, and patient records also bear on patient safety. Billing has financial impact, but it can tolerate three days.
Recovery priority follows the MTD, so the function that can tolerate the least downtime is restored first, and patient records also bear on patient safety. Billing has financial impact, but it can tolerate three days.
Question 68Communication & Network Security
Trey Research needs a link between two buildings along a path next to high-voltage equipment. Leadership also wants the medium that is hardest to tap without detection. Which medium BEST fits?
Correct answer: B. Fiber optic cable, which carries light and emits no EM signal
Fiber carries light, so it is immune to electromagnetic interference and does not radiate signals that can be picked up. Tapping it usually causes measurable signal loss. Shielded copper reduces interference but still emits and is easier to tap.
Fiber carries light, so it is immune to electromagnetic interference and does not radiate signals that can be picked up. Tapping it usually causes measurable signal loss. Shielded copper reduces interference but still emits and is easier to tap.
Question 69Security Operations
Management wants to confirm that the alternate site can process real business transactions, but it will not accept any disruption to the primary site. Which DR test meets these conditions?
Correct answer: A. Parallel test
A parallel test brings up systems at the alternate site and processes real data while the primary site keeps running normally. A full interruption test also proves the alternate site works, but it shuts down the primary site and causes exactly the disruption management wants to avoid.
A parallel test brings up systems at the alternate site and processes real data while the primary site keeps running normally. A full interruption test also proves the alternate site works, but it shuts down the primary site and causes exactly the disruption management wants to avoid.
Question 70Security Assessment & Testing
Quarterly assessment reports at Tailspin Toys show the same high-risk findings repeated for over a year with no remediation. What is the BEST next step for the security manager?
Correct answer: C. Escalate the findings to senior management for review and decision
Management review and approval exists so leaders can assign resources, set priorities and hold owners accountable, or formally accept the risk. Testing more often only produces more reports about the same problem without fixing the lack of action.
Management review and approval exists so leaders can assign resources, set priorities and hold owners accountable, or formally accept the risk. Testing more often only produces more reports about the same problem without fixing the lack of action.
Question 71Identity & Access Management
An attacker who compromised a help desk account added that account to the domain administrators group. Which control would MOST likely detect this activity quickly?
Correct answer: B. Real-time alerts on changes to privileged group membership
Alerting on changes to privileged groups catches vertical privilege escalation as it happens. An annual recertification would eventually find the change, but the attacker could keep admin rights for months before then.
Alerting on changes to privileged groups catches vertical privilege escalation as it happens. An annual recertification would eventually find the change, but the attacker could keep admin rights for months before then.
Question 72Security Architecture & Engineering
A water utility runs legacy PLCs that the vendor no longer patches and that cannot be replaced for several years. Which action BEST reduces the risk to these controllers?
Correct answer: D. Isolate them in segmented zones with tightly limited conduits
When controllers cannot be patched, network segmentation with tightly controlled conduits, as described in ISA/IEC 62443, limits who and what can reach them. Antivirus usually cannot run on PLCs and could disrupt real-time operations, so it is not a practical control here.
When controllers cannot be patched, network segmentation with tightly controlled conduits, as described in ISA/IEC 62443, limits who and what can reach them. Antivirus usually cannot run on PLCs and could disrupt real-time operations, so it is not a practical control here.
Question 73Security & Risk Management
An employee moves from the finance department to the marketing team. Six months later, a review shows she can still approve payments. What process failure does this indicate?
Correct answer: A. The transfer did not trigger an access review, causing privilege creep
When a person changes roles, access should be reviewed and anything not needed for the new role removed. Without this, privileges pile up over time, which is called privilege creep and breaks least privilege.
When a person changes roles, access should be reviewed and anything not needed for the new role removed. Without this, privileges pile up over time, which is called privilege creep and breaks least privilege.
Question 74Asset Security
A company wants to move its European customer database to the cheapest cloud region, which is located on another continent. What should the security manager evaluate FIRST?
Correct answer: B. Legal restrictions on cross-border transfer of the data
Data location decides which laws apply, and rules such as GDPR restrict transfers of personal data outside the EU without approved safeguards. Encryption and performance matter, but a move that breaks transfer rules exposes the company to fines whatever the technical controls.
Data location decides which laws apply, and rules such as GDPR restrict transfers of personal data outside the EU without approved safeguards. Encryption and performance matter, but a move that breaks transfer rules exposes the company to fines whatever the technical controls.
Question 75Communication & Network Security
A branch office connects every workstation and server to a single central switch in a star topology. From an availability standpoint, what is the MOST important weakness to address?
Correct answer: D. The central switch is a single point of failure for the whole branch
In a star, every device depends on the central switch, so its failure takes down the whole branch. Redundant switches or dual-homed links address this. A single cable break in a star affects only the attached device, unlike a bus.
In a star, every device depends on the central switch, so its failure takes down the whole branch. Redundant switches or dual-homed links address this. A single cable break in a star affects only the attached device, unlike a bus.
Question 76Security Operations
A fire alarm sounds in the main data center while administrators are midway through a critical database migration. What should the administrators do FIRST?
Correct answer: D. Evacuate the building following the emergency plan
Human safety always comes first, so staff should evacuate according to the emergency plan. Saving data or equipment is never worth the risk to people, and systems can be recovered later using backups and the DR plan.
Human safety always comes first, so staff should evacuate according to the emergency plan. Saving data or equipment is never worth the risk to people, and systems can be recovered later using backups and the DR plan.
Question 77Software Development Security
A company wants a testing tool that runs as an agent inside the application while QA performs functional tests. It should report the vulnerable line of code with few false positives. Which approach is this?
Correct answer: A. Interactive application security testing (IAST)
IAST instruments the running application, so it sees both the incoming request and the code path it triggers, which pinpoints the vulnerable line. DAST also tests a running application, but from the outside, so it cannot see the code and gives less precise results.
IAST instruments the running application, so it sees both the incoming request and the code path it triggers, which pinpoints the vulnerable line. DAST also tests a running application, but from the outside, so it cannot see the code and gives less precise results.
Question 78Security & Risk Management
Two partner companies will connect their networks through a dedicated site-to-site VPN. Which document BEST specifies the technical and security requirements for this connection?
Correct answer: C. Interconnection security agreement (ISA)
An interconnection security agreement documents the technical and security requirements for connecting two organizations' systems. An MOU or MOA usually covers the business relationship and responsibilities, not the detailed security settings of the link.
An interconnection security agreement documents the technical and security requirements for connecting two organizations' systems. An MOU or MOA usually covers the business relationship and responsibilities, not the detailed security settings of the link.
Question 79Identity & Access Management
An accountant is moving to the marketing department. What is the BEST way to handle her access during this transition?
Correct answer: A. Grant marketing access and remove accounting access as part of the transfer
A transfer should add access for the new role and remove access for the old one, which prevents privilege creep and preserves least privilege. Waiting for the annual audit leaves months of unneeded financial access in place.
A transfer should add access for the new role and remove access for the old one, which prevents privilege creep and preserves least privilege. Waiting for the annual audit leaves months of unneeded financial access in place.
Question 80Security Architecture & Engineering
A city plans to deploy thousands of IoT traffic sensors that are expected to stay in service for ten years. Which procurement requirement BEST addresses vulnerabilities discovered after deployment?
Correct answer: B. Sensors must support signed firmware updates from the vendor
Long-lived devices will face new vulnerabilities, so an authenticated update path is the only way to fix them in the field without replacing hardware. Tamper-evident enclosures help detect physical interference, but they do nothing about software flaws found later.
Long-lived devices will face new vulnerabilities, so an authenticated update path is the only way to fix them in the field without replacing hardware. Tamper-evident enclosures help detect physical interference, but they do nothing about software flaws found later.
Question 81Security Assessment & Testing
A security awareness manager must show the executive team whether the training program is actually changing employee behavior. Which metric is the MOST meaningful?
Correct answer: B. Trend in phishing simulation click and report rates over time
Phishing simulation results show how employees actually behave when faced with a realistic attack, so a falling click rate and a rising report rate show real change. Completion rates only show that people attended training, not that they act differently afterward.
Phishing simulation results show how employees actually behave when faced with a realistic attack, so a falling click rate and a rising report rate show real change. Completion rates only show that people attended training, not that they act differently afterward.
Question 82Communication & Network Security
Contractors at Wingtip Toys plug personal laptops into open wired ports, and several lacked current patches and antivirus. Which control BEST keeps these devices away from production systems?
Correct answer: C. NAC with 802.1X and posture checks that quarantine non-compliant devices
NAC authenticates the device and checks its health before granting access, sending non-compliant laptops to a remediation VLAN. Port security limits MAC addresses but cannot tell whether a laptop is patched, and MACs can be spoofed. A signed policy does not technically stop a connection.
NAC authenticates the device and checks its health before granting access, sending non-compliant laptops to a remediation VLAN. Port security limits MAC addresses but cannot tell whether a laptop is patched, and MACs can be spoofed. A signed policy does not technically stop a connection.
Question 83Security Operations
During a major outage, a reporter calls a network technician directly and asks what caused the problem. How should the technician respond?
Correct answer: B. Refer the reporter to the company's designated spokesperson
Disaster communication plans name trained spokespeople so the public receives accurate, consistent, and approved information. Explaining the cause directly may seem helpful, but it could release unverified or sensitive details that conflict with official statements.
Disaster communication plans name trained spokespeople so the public receives accurate, consistent, and approved information. Explaining the cause directly may seem helpful, but it could release unverified or sensitive details that conflict with official statements.
Question 84Security & Risk Management
HR reports that an employee has been streaming videos on a company laptop all day, against the acceptable use policy. No law appears to be broken. Which type of investigation is this?
Correct answer: D. Administrative
An administrative investigation looks into violations of internal policy and is handled by the organization itself. A criminal investigation needs a suspected crime and law enforcement involvement, which does not apply here.
An administrative investigation looks into violations of internal policy and is handled by the organization itself. A criminal investigation needs a suspected crime and law enforcement involvement, which does not apply here.
Question 85Asset Security
A product roadmap was classified Confidential before launch. The product has now been publicly announced with full details on the company website. What is the MOST appropriate action?
Correct answer: A. Have the data owner review it and lower its classification
Classification should reflect current value and sensitivity, so the owner should downgrade data once it becomes public. Keeping it Confidential wastes protection effort, and deletion is a retention decision the custodian cannot make alone.
Classification should reflect current value and sensitivity, so the owner should downgrade data once it becomes public. Keeping it Confidential wastes protection effort, and deletion is a retention decision the custodian cannot make alone.
Question 86Software Development Security
Developers pull dozens of open-source packages into each build. Legal is worried about license obligations, and security is worried about known vulnerabilities in those packages. Which tool BEST addresses both concerns?
Correct answer: C. Software composition analysis in the build
Software composition analysis inventories third-party components and checks them against vulnerability and license data. Static analysis looks for flaws in the team's own code and does not track component licenses.
Software composition analysis inventories third-party components and checks them against vulnerability and license data. Static analysis looks for flaws in the team's own code and does not track component licenses.
Question 87Identity & Access Management
A company using RBAC now has more roles than employees because a new role was created for every small exception. What should the IAM team do FIRST?
Correct answer: A. Perform role mining to consolidate roles based on actual shared access
Role explosion is fixed by analyzing real access patterns (role mining) and merging them into a manageable set of job-based roles. Assigning permissions directly to users abandons RBAC and makes access reviews even harder.
Role explosion is fixed by analyzing real access patterns (role mining) and merging them into a manageable set of job-based roles. Assigning permissions directly to users abandons RBAC and makes access reviews even harder.
Question 88Security Architecture & Engineering
A database lets analysts query individual unclassified records about shipping schedules. Security staff realize that combining many of these records reveals the classified movements of naval vessels. Which database issue does this describe?
Correct answer: D. Aggregation
Aggregation occurs when combining many items of lower sensitivity produces information more sensitive than any single item. Polyinstantiation is a countermeasure that stores different versions of a record for different clearance levels, not the problem described here.
Aggregation occurs when combining many items of lower sensitivity produces information more sensitive than any single item. Polyinstantiation is a countermeasure that stores different versions of a record for different clearance levels, not the problem described here.
Question 89Security Assessment & Testing
An auditor is evaluating whether Adventure Works can meet the four-hour recovery time objective (RTO) for its order system. Which evidence is the MOST convincing?
Correct answer: A. Recorded recovery times from the most recent failover test
Measured recovery times from an actual failover test show directly whether the system can be restored within four hours. An approved plan describes the intended process, but it does not prove the steps work in the required time.
Measured recovery times from an actual failover test show directly whether the system can be restored within four hours. An approved plan describes the intended process, but it does not prove the steps work in the required time.
Question 90Communication & Network Security
An administrator connecting over SSH to a core router gets a warning that the remote host key has changed. No maintenance was scheduled. What should the administrator do FIRST?
Correct answer: C. Stop and verify the key fingerprint through a trusted out-of-band channel
An unexpected host key change can signal a man-in-the-middle attack, so the administrator should stop and confirm the fingerprint through the console or device owner before sending credentials. Accepting the key could hand credentials to an attacker. Telnet sends everything in cleartext and makes the risk worse.
An unexpected host key change can signal a man-in-the-middle attack, so the administrator should stop and confirm the fingerprint through the console or device owner before sending credentials. Accepting the key could hand credentials to an attacker. Telnet sends everything in cleartext and makes the risk worse.
Question 91Security & Risk Management
Developers at a software company added a library licensed under the GNU GPL to a commercial product that is sold and distributed to customers. What is the MAIN licensing risk?
Correct answer: D. The product's source code may have to be released under the GPL
The GPL is a copyleft license, so distributing a derivative work can require releasing its source code under the same license. The GPL does not charge royalties, so that is the wrong concern.
The GPL is a copyleft license, so distributing a derivative work can require releasing its source code under the same license. The GPL does not charge royalties, so that is the wrong concern.
Question 92Security Operations
An earthquake damages the company's headquarters overnight, and all staff are confirmed safe. Before deciding whether to activate the alternate processing site, what should the disaster recovery team do FIRST?
Correct answer: D. Assess the damage and estimate how long the outage will last
A damage assessment shows how severe the damage is and how long the outage is likely to last, which drives the decision to declare a disaster. Moving to the alternate site right away may be unnecessary and costly if the primary site can be restored within the maximum tolerable downtime.
A damage assessment shows how severe the damage is and how long the outage is likely to last, which drives the decision to declare a disaster. Moving to the alternate site right away may be unnecessary and costly if the primary site can be restored within the maximum tolerable downtime.
Question 93Identity & Access Management
A finance system allows the same user to both create vendors and approve vendor payments. Where is the BEST place to prevent such conflicting access from being granted?
Correct answer: B. Separation of duties rules enforced during provisioning
Checking separation of duties rules when access is requested stops toxic combinations before they exist, which is a preventive control. Reviewing payment reports is detective and only finds fraud after it may already have happened.
Checking separation of duties rules when access is requested stops toxic combinations before they exist, which is a preventive control. Reviewing payment reports is detective and only finds fraud after it may already have happened.
Question 94Security Architecture & Engineering
A medical device maker needs strong public key cryptography on battery-powered implants with very limited processing power and memory. Which approach is BEST?
Correct answer: C. Elliptic curve cryptography with shorter keys
Elliptic curve cryptography gives security comparable to much larger RSA keys, for example 256-bit ECC versus 3072-bit RSA, which saves processing, memory and power. AES-256 is efficient, but it is symmetric and cannot provide the public key functions the design requires.
Elliptic curve cryptography gives security comparable to much larger RSA keys, for example 256-bit ECC versus 3072-bit RSA, which saves processing, memory and power. AES-256 is efficient, but it is symmetric and cannot provide the public key functions the design requires.
Question 95Asset Security
Legal counsel has set a seven-year retention period for customer transaction records. The IT team keeps all records indefinitely in case they are ever needed. What is the BEST advice to management?
Correct answer: B. Securely destroy records after seven years unless under legal hold
Holding data past its required period raises breach impact, storage cost and e-discovery exposure with no business benefit. Moving records to tape does not reduce that risk, because archived data is still retained and still discoverable.
Holding data past its required period raises breach impact, storage cost and e-discovery exposure with no business benefit. Moving records to tape does not reduce that risk, because archived data is still retained and still discoverable.
Question 96Software Development Security
During an audit of the change process, the auditor finds that developers have administrator rights on the server that stores the code repository's audit logs. What is the PRIMARY concern?
Correct answer: C. Developers could alter or delete records of their own changes
Audit logs support accountability only if the people being logged cannot change them, so log storage should be kept out of their control. Time synchronization matters for correlating events, but tampering by privileged users destroys the evidence itself.
Audit logs support accountability only if the people being logged cannot change them, so log storage should be kept out of their control. Time synchronization matters for correlating events, but tampering by privileged users destroys the evidence itself.
Question 97Security Assessment & Testing
A penetration testing firm is preparing its final report, and the board of directors will read the results. What should the section written for the board focus on?
Correct answer: B. Business impact of the findings and key recommendations
Executives need a summary that explains business risk, likely impact and recommended actions in plain language. Detailed exploit steps and tool output belong in the technical sections for the teams who must fix the issues.
Executives need a summary that explains business risk, likely impact and recommended actions in plain language. Detailed exploit steps and tool output belong in the technical sections for the teams who must fix the issues.
Question 98Security & Risk Management
A company subject to GDPR loses a backup tape of customer data. The data was strongly encrypted, and the keys were stored separately and not compromised. What is generally TRUE about notifying the affected customers?
Correct answer: C. Customers need not be told because the data is unintelligible
GDPR does not require telling data subjects when the data was rendered unintelligible, for example by strong encryption with uncompromised keys. The 72-hour deadline applies to notifying the supervisory authority, not individuals, and only when the breach poses a risk.
GDPR does not require telling data subjects when the data was rendered unintelligible, for example by strong encryption with uncompromised keys. The 72-hour deadline applies to notifying the supervisory authority, not individuals, and only when the breach poses a risk.
Question 99Communication & Network Security
To reduce load on the VPN concentrator, a manager proposes enabling split tunneling for remote staff. What is the PRIMARY security risk of this change?
Correct answer: A. A compromised laptop can bridge the internet to the corporate network
With split tunneling the laptop reaches the internet directly while connected to the corporate network, so malware or an attacker on it gains a path inward, and internet traffic skips corporate inspection. Corporate traffic inside the tunnel stays encrypted, so encryption is not the issue.
With split tunneling the laptop reaches the internet directly while connected to the corporate network, so malware or an attacker on it gains a path inward, and internet traffic skips corporate inspection. Corporate traffic inside the tunnel stays encrypted, so encryption is not the issue.
Question 100Security Operations
The primary data center has been repaired after a flood, and operations have been running at the alternate site for three weeks. Which business functions should be moved back to the primary site FIRST?
Correct answer: D. The least critical functions
Moving the least critical functions first tests whether the restored site is stable without putting key operations at risk. If the most critical functions moved first and the site failed again, the organization would suffer the worst possible impact.
Moving the least critical functions first tests whether the restored site is stable without putting key operations at risk. If the most critical functions moved first and the site failed again, the organization would suffer the worst possible impact.
Question 101Identity & Access Management
Staff at a data center often hold the door open for people behind them after badging in. Which physical control BEST prevents this tailgating?
Correct answer: A. An access control vestibule that admits one person at a time
An access control vestibule (mantrap) physically allows only one authenticated person through at a time, which directly stops tailgating. CCTV records the event for later review but does not prevent it.
An access control vestibule (mantrap) physically allows only one authenticated person through at a time, which directly stops tailgating. CCTV records the event for later review but does not prevent it.
Question 102Security Architecture & Engineering
An organization is reviewing how large-scale quantum computers could affect its stored data encrypted with AES-128. Considering Grover's algorithm, what is the BEST recommendation?
Correct answer: C. Move from AES-128 to AES-256 for long-lived data
Grover's algorithm roughly halves the effective strength of a symmetric key, so AES-256 keeps about 128 bits of security while AES-128 falls to about 64. Switching to RSA goes the wrong way, because Shor's algorithm breaks RSA outright on a large quantum computer.
Grover's algorithm roughly halves the effective strength of a symmetric key, so AES-256 keeps about 128 bits of security while AES-128 falls to about 64. Switching to RSA goes the wrong way, because Shor's algorithm breaks RSA outright on a large quantum computer.
Question 103Security & Risk Management
An online store collected customer addresses only to ship orders. The marketing team now wants to use those addresses to build detailed lifestyle profiles for ad targeting. Which privacy principle does this MOST directly conflict with?
Correct answer: D. Purpose limitation
Purpose limitation means personal data collected for one stated purpose should not be reused for an incompatible purpose without a valid legal basis. Storage limitation is about how long data is kept, not what it is used for.
Purpose limitation means personal data collected for one stated purpose should not be reused for an incompatible purpose without a valid legal basis. Storage limitation is about how long data is kept, not what it is used for.
Question 104Security Assessment & Testing
A vulnerability assessment at Proseware produced 600 findings, and the IT team can only fix a small number each week. How should remediation be prioritized?
Correct answer: D. By risk, combining severity, exploitability and asset value
Risk-based prioritization considers how severe a flaw is, how likely it is to be exploited and how important the affected asset is. CVSS base score alone ignores business context, so a high-scoring flaw on a test server could be fixed before a lower-scoring one on a critical payment system.
Risk-based prioritization considers how severe a flaw is, how likely it is to be exploited and how important the affected asset is. CVSS base score alone ignores business context, so a high-scoring flaw on a test server could be fixed before a lower-scoring one on a critical payment system.
Question 105Asset Security
An analytics team replaces customer names with random codes and keeps the code-to-name mapping table on a separate restricted server. The team says the dataset is now outside the scope of GDPR. How should the privacy officer respond?
Correct answer: B. Disagree, because pseudonymized data can still be re-identified
Pseudonymized data remains personal data under GDPR because the mapping table allows re-identification. Only truly anonymized data, with no reasonable way to link it back, falls outside the regulation, and encrypting the mapping table does not change that.
Pseudonymized data remains personal data under GDPR because the mapping table allows re-identification. Only truly anonymized data, with no reasonable way to link it back, falls outside the regulation, and encrypting the mapping table does not change that.
Question 106Software Development Security
A company plans to buy a commercial off-the-shelf HR system. The vendor will not share source code. What is the BEST way to evaluate the product's security before purchase?
Correct answer: B. Review independent test results and the vendor's SDLC practices
Without source code, the buyer should rely on independent evidence such as certifications and third-party test reports, plus a review of how the vendor builds software. Testing after deployment finds problems only once the company is committed and exposed.
Without source code, the buyer should rely on independent evidence such as certifications and third-party test reports, plus a review of how the vendor builds software. Testing after deployment finds problems only once the company is committed and exposed.
Question 107Communication & Network Security
Northwind Traders plans a permanent network connection to a logistics partner for order processing. What should the security manager ensure is completed FIRST?
Correct answer: D. An interconnection agreement defining each party's security duties
An interconnection security agreement sets requirements, responsibilities, data handling and incident notification before any technical link is built. Building the VPN first puts technology ahead of governance. Scanning a partner's systems without permission could itself be unauthorized.
An interconnection security agreement sets requirements, responsibilities, data handling and incident notification before any technical link is built. Building the VPN first puts technology ahead of governance. Scanning a partner's systems without permission could itself be unauthorized.
Question 108Security Operations
Security cameras show that unauthorized people often follow employees through the badge-controlled main entrance. Which control would BEST prevent this?
Correct answer: C. An access control vestibule (mantrap) at the entrance
An access control vestibule (mantrap) lets only one person through, and the inner door opens only after the outer door closes, which physically prevents tailgating. More cameras would record tailgating but would not stop it from happening.
An access control vestibule (mantrap) lets only one person through, and the inner door opens only after the outer door closes, which physically prevents tailgating. More cameras would record tailgating but would not stop it from happening.
Question 109Identity & Access Management
A research lab uses proximity badges alone to open secure doors. After a badge is cloned, management wants a quick improvement. What is the BEST option?
Correct answer: B. Require a PIN at the reader in addition to the badge
Adding a PIN creates two-factor authentication (something you have plus something you know), so a cloned badge alone no longer opens the door. Photos on badges help guards, but an electronic reader cannot check a photo.
Adding a PIN creates two-factor authentication (something you have plus something you know), so a cloned badge alone no longer opens the door. Photos on badges help guards, but an electronic reader cannot check a photo.
Question 110Security Architecture & Engineering
A company wants to protect the master key of its key management system so that no single administrator can ever reconstruct or use it alone. Which practice BEST meets this goal?
Correct answer: C. Split knowledge using an M-of-N key share scheme
Split knowledge with M-of-N control divides the key into shares so that a minimum number of custodians must cooperate to rebuild it, and no one person can act alone. Key escrow keeps a copy for recovery, but whoever holds the escrowed copy could still use it alone.
Split knowledge with M-of-N control divides the key into shares so that a minimum number of custodians must cooperate to rebuild it, and no one person can act alone. Key escrow keeps a copy for recovery, but whoever holds the escrowed copy could still use it alone.
Question 111Security & Risk Management
A tester finds that changing a hidden form field from role=user to role=admin gives full administrative rights in a web application. Which STRIDE category BEST describes this threat?
Correct answer: A. Elevation of privilege
Gaining capabilities beyond what the user was granted is elevation of privilege. The attacker does tamper with a parameter, but the threat's impact is the jump to admin rights, which STRIDE classifies as elevation of privilege.
Gaining capabilities beyond what the user was granted is elevation of privilege. The attacker does tamper with a parameter, but the threat's impact is the jump to admin rights, which STRIDE classifies as elevation of privilege.
Question 112Security Assessment & Testing
A SaaS provider wants to display assurance about its security controls on its public website for prospective customers, without sharing detailed control descriptions and test results. Which report fits this purpose?
Correct answer: B. SOC 3 report
A SOC 3 report is a general-use summary based on the trust services criteria, so it can be shared publicly without exposing detailed controls and test procedures. A SOC 2 report contains those details and is meant for restricted distribution to customers and their auditors.
A SOC 3 report is a general-use summary based on the trust services criteria, so it can be shared publicly without exposing detailed controls and test procedures. A SOC 2 report contains those details and is meant for restricted distribution to customers and their auditors.
Question 113Communication & Network Security
The board of Contoso Pharmaceuticals meets on a cloud video conferencing service. Directors are concerned that the provider itself could access meeting content. Which control BEST addresses this concern?
Correct answer: A. End-to-end encryption with keys held only on participant endpoints
With end-to-end encryption, media is encrypted on participant devices and the provider never holds the keys, so it cannot view the content. TLS protects traffic only between each client and the provider, which then decrypts it. Passcodes and MFA control who joins, not what the provider can see.
With end-to-end encryption, media is encrypted on participant devices and the provider never holds the keys, so it cannot view the content. TLS protects traffic only between each client and the provider, which then decrypts it. Passcodes and MFA control who joins, not what the provider can see.
Question 114Security Operations
A facility manager is choosing how electronically locked doors on emergency exit routes should behave during a power failure. Which setting is MOST appropriate?
Correct answer: C. Fail-safe, so the doors unlock and people can exit
Fail-safe locks release when power is lost so people can escape during an emergency, because life safety takes priority over asset protection. Fail-secure suits doors such as server room entries that are not exit routes, but on exit paths it could trap people.
Fail-safe locks release when power is lost so people can escape during an emergency, because life safety takes priority over asset protection. Fail-secure suits doors such as server room entries that are not exit routes, but on exit paths it could trap people.
Question 115Asset Security
A vendor announces end-of-life for a firewall model the company uses. It will no longer be sold, but security patches will continue for three more years until end-of-support. What is the BEST response?
Correct answer: D. Keep patching and plan to replace the units before end-of-support
End-of-life here means the product is no longer sold, while end-of-support is when patches stop, so the units remain acceptable while patched. Planning and budgeting replacement now avoids running unsupported devices later, while immediate replacement spends money before it is needed.
End-of-life here means the product is no longer sold, while end-of-support is when patches stop, so the units remain acceptable while patched. Planning and budgeting replacement now avoids running unsupported devices later, while immediate replacement spends money before it is needed.
Question 116Software Development Security
A web application blocks file paths containing dot-dot-slash sequences to prevent directory traversal. An attacker bypasses the filter by submitting the same sequence in URL-encoded form. What is the BEST fix?
Correct answer: D. Canonicalize input first, then validate it with an allowlist
Input should be decoded to its standard form before it is checked, and allowlists are stronger than blocklists. Adding encoded variants to a blocklist is a losing race, because attackers can try many alternative encodings.
Input should be decoded to its standard form before it is checked, and allowlists are stronger than blocklists. Adding encoded variants to a blocklist is a losing race, because attackers can try many alternative encodings.
Question 117Security & Risk Management
During threat modeling, a team starts with the goal "steal customer payment data" as the root and then branches out into every path an attacker could use to reach it. Which technique is the team using?
Correct answer: A. Attack tree analysis
An attack tree puts the attacker's goal at the root and breaks it into the possible ways to achieve it, which helps rank and cover attack paths. A business impact analysis looks at the effect of disruption, not at attack paths.
An attack tree puts the attacker's goal at the root and breaks it into the possible ways to achieve it, which helps rank and cover attack paths. A business impact analysis looks at the effect of disruption, not at attack paths.
Question 118Identity & Access Management
A company uses RADIUS between its VPN concentrators and an authentication server across an untrusted network segment. Which RADIUS limitation is MOST relevant to this design?
Correct answer: B. It encrypts only the password, leaving other attributes exposed
Classic RADIUS hides only the user password and sends the rest of the packet in clear text, so traffic over an untrusted segment should be protected, for example with IPsec or RADIUS over TLS. RADIUS runs over UDP, not TCP, so the delay option is incorrect.
Classic RADIUS hides only the user password and sends the rest of the packet in clear text, so traffic over an untrusted segment should be protected, for example with IPsec or RADIUS over TLS. RADIUS runs over UDP, not TCP, so the delay option is incorrect.
Question 119Security Architecture & Engineering
A security architect is choosing a hash function for digital signatures and explains that a longer output is needed to resist collisions. Which attack is she MOST concerned about?
Correct answer: D. Birthday attack
A birthday attack finds two inputs with the same hash in roughly 2 to the power of n/2 attempts, so a 128-bit hash offers only about 64 bits of collision resistance. Rainbow tables target password hashes by looking up likely inputs, which is a different problem from finding collisions to forge signatures.
A birthday attack finds two inputs with the same hash in roughly 2 to the power of n/2 attempts, so a 128-bit hash offers only about 64 bits of collision resistance. Rainbow tables target password hashes by looking up likely inputs, which is a different problem from finding collisions to forge signatures.
Question 120Security Assessment & Testing
A European service organization's customers ask for an internationally recognized assurance report on controls relevant to their financial reporting, similar to a US SOC 1 report. Which standard should the service auditor use?
Correct answer: C. ISAE 3402
ISAE 3402 is the international standard for assurance reports on service organization controls relevant to user entities' financial reporting, and it is the counterpart of SSAE 18 used for SOC 1 in the US. ISO 27001 certifies an information security management system, not financial reporting controls.
ISAE 3402 is the international standard for assurance reports on service organization controls relevant to user entities' financial reporting, and it is the counterpart of SSAE 18 used for SOC 1 in the US. ISO 27001 certifies an information security management system, not financial reporting controls.
Question 121Security & Risk Management
A procurement officer finds network switches at 60% below list price from an unauthorized online reseller. What is the BEST security advice?
Correct answer: A. Buy only from the manufacturer or its authorized distributors
Gray market hardware may be counterfeit, tampered with or lack valid support, so buying through authorized channels is the strongest supply chain safeguard. A firmware update cannot remove malicious hardware implants or fix counterfeit parts.
Gray market hardware may be counterfeit, tampered with or lack valid support, so buying through authorized channels is the strongest supply chain safeguard. A firmware update cannot remove malicious hardware implants or fix counterfeit parts.
Question 122Communication & Network Security
Graphic Design Institute needs centralized authentication for network device administrators, with per-command authorization and encryption of the full packet body. Which protocol BEST fits?
Correct answer: C. TACACS+, which uses TCP and separates authentication from authorization
TACACS+ encrypts the entire payload and separates authentication, authorization and accounting, which allows per-command authorization for device administration. RADIUS encrypts only the password field and bundles authentication with authorization. LDAP and Kerberos do not provide command-level authorization on routers and switches.
TACACS+ encrypts the entire payload and separates authentication, authorization and accounting, which allows per-command authorization for device administration. RADIUS encrypts only the password field and bundles authentication with authorization. LDAP and Kerberos do not provide command-level authorization on routers and switches.
Question 123Security Operations
An executive is traveling to a country known for state-sponsored industrial espionage. Which measure BEST protects company data?
Correct answer: A. Issue a loaner laptop with minimal data and reimage it on return
A clean loaner device with only the data needed for the trip limits what can be stolen, and reimaging it on return removes any implanted malware. Encryption protects data at rest, but travelers can be forced to unlock devices at border crossings, exposing everything on them.
A clean loaner device with only the data needed for the trip limits what can be stolen, and reimaging it on return removes any implanted malware. Encryption protects data at rest, but travelers can be forced to unlock devices at border crossings, exposing everything on them.
Question 124Identity & Access Management
A mobile banking app uses the OAuth 2.0 authorization code flow. Because the app cannot keep a client secret safe, what should the developers add to protect the authorization code?
Correct answer: B. Proof Key for Code Exchange (PKCE)
PKCE binds the authorization request to a one-time secret created by the app, so an attacker who intercepts the code cannot exchange it for tokens. The implicit grant is now discouraged because it exposes tokens in the browser redirect.
PKCE binds the authorization request to a one-time secret created by the app, so an attacker who intercepts the code cannot exchange it for tokens. The implicit grant is now discouraged because it exposes tokens in the browser redirect.
Question 125Security Architecture & Engineering
A company is building a room to hold seized laptops and drives for internal investigations that may end up in court. Which design feature is MOST important?
Correct answer: A. Controlled access with logging of every entry and item transfer
Evidence is only useful in court if the chain of custody can be shown, so access to the room and every transfer of an item must be controlled and recorded. Fire suppression protects the items, but it does not prove that no one tampered with them.
Evidence is only useful in court if the chain of custody can be shown, so access to the room and every transfer of an item must be controlled and recorded. Fire suppression protects the items, but it does not prove that no one tampered with them.
Question 126Asset Security
A storage array being retired held mostly Public marketing files, plus one volume of Confidential HR records. How should the array be handled for sanitization and disposal?
Correct answer: C. As Confidential, matching the most sensitive data it held
Media and systems are handled at the level of the most sensitive data they have stored. Deleting the HR volume does not remove remnant data, so treating the array as Public risks exposing HR records.
Media and systems are handled at the level of the most sensitive data they have stored. Deleting the HR volume does not remove remnant data, so treating the array as Public risks exposing HR records.
Question 127Software Development Security
When a database query fails, a web application shows users a full stack trace that includes table names and server paths. What is the BEST remediation?
Correct answer: B. Show users a generic message and log the details server-side
Users should see a generic error, while full details go to protected server logs for troubleshooting. Limiting traces to internal users still exposes system details to insiders and to anyone who gains internal access.
Users should see a generic error, while full details go to protected server logs for troubleshooting. Limiting traces to internal users still exposes system details to insiders and to anyone who gains internal access.
Question 128Security & Risk Management
A new CISO at a manufacturing company currently reports to the CIO, who also runs IT operations and sets its budget. The board wants security risks to be reported without that conflict of interest. Where should the CISO role report?
Correct answer: D. To the CEO or a board committee, independent of IT operations
Security governance works best when the security function can report risks without being overruled by the team it oversees. Reporting to the CIO creates a conflict between operational goals and risk disclosure.
Security governance works best when the security function can report risks without being overruled by the team it oversees. Reporting to the CIO creates a conflict between operational goals and risk disclosure.
Question 129Security Assessment & Testing
An automated scanner found no serious issues in an e-commerce application, but the security manager worries that users could change item prices or apply discounts multiple times during checkout. Which testing approach BEST addresses this concern?
Correct answer: A. Manual testing focused on the application's business logic
Business logic flaws, such as price tampering or reused discounts, depend on understanding how the application should work, which automated tools usually cannot judge. Rescanning with new rules still relies on known patterns and is unlikely to catch abuse of legitimate functions.
Business logic flaws, such as price tampering or reused discounts, depend on understanding how the application should work, which automated tools usually cannot judge. Rescanning with new rules still relies on known patterns and is unlikely to catch abuse of legitimate functions.
Question 130Communication & Network Security
On a dual-stack office LAN, hosts suddenly start sending traffic through an unknown device that announced itself as an IPv6 default gateway. Which control would BEST have prevented this?
Correct answer: B. RA Guard on access switch ports to block rogue router advertisements
IPv6 hosts learn default gateways from router advertisements, and any device can send them unless switches filter them. RA Guard permits advertisements only from authorized router ports. DHCP snooping protects IPv4 address assignment and does not inspect IPv6 router advertisements.
IPv6 hosts learn default gateways from router advertisements, and any device can send them unless switches filter them. RA Guard permits advertisements only from authorized router ports. DHCP snooping protects IPv4 address assignment and does not inspect IPv6 router advertisements.
Question 131Security Operations
A bank teller is forced by an armed robber to disable the vault alarm. The bank wants a way for the teller to call for help without alerting the robber. Which control BEST meets this need?
Correct answer: A. A duress code that looks normal but sends a silent alarm
A duress code appears to work normally to the attacker while silently notifying security, which helps keep the teller safe. A loud panic button could provoke the robber and put the teller and customers in greater danger.
A duress code appears to work normally to the attacker while silently notifying security, which helps keep the teller safe. A loud panic button could provoke the robber and put the teller and customers in greater danger.
Question 132Identity & Access Management
Operators in a control room share one login on the plant monitoring console. After an unauthorized setting change, investigators cannot tell who made it. Which principle has been undermined MOST directly?
Correct answer: D. Accountability
Accountability depends on unique identification, so actions can be traced to one person through logs. Least privilege limits what users can do, but even with minimal rights a shared login still hides who acted.
Accountability depends on unique identification, so actions can be traced to one person through logs. Least privilege limits what users can do, but even with minimal rights a shared login still hides who acted.
Question 133Security Architecture & Engineering
A hospital is retiring a patient records system as part of the information system lifecycle. Which activity is MOST important in this disposal phase?
Correct answer: A. Sanitizing media to match data sensitivity and recording it
Disposal must ensure that sensitive data cannot be recovered from retired media, using methods matched to the data's sensitivity, with records to prove it was done. A final vulnerability scan adds little value for a system that is being shut down.
Disposal must ensure that sensitive data cannot be recovered from retired media, using methods matched to the data's sensitivity, with records to prove it was done. A final vulnerability scan adds little value for a system that is being shut down.
Question 134Security & Risk Management
All developers at a fintech company completed general security awareness training, yet code reviews keep finding SQL injection flaws. What should the security manager recommend?
Correct answer: C. Provide role-based secure coding training for developers
Awareness training builds general recognition of threats, but developers need targeted, role-based training to build secure coding skills. Repeating the same general course will not teach input validation or parameterized queries.
Awareness training builds general recognition of threats, but developers need targeted, role-based training to build secure coding skills. Repeating the same general course will not teach input validation or parameterized queries.
Question 135Asset Security
A company sends weekly backup tapes containing customer data to an offsite vault by courier. What is the MOST effective control to protect the data if a tape is lost or stolen on the way?
Correct answer: A. Encrypt the backup data before it is written to the tapes
Encryption protects the data even when a tape ends up in the wrong hands, which physical controls cannot guarantee. A bonded courier and custody records lower the chance of loss and support accountability, but they do not protect data on a missing tape.
Encryption protects the data even when a tape ends up in the wrong hands, which physical controls cannot guarantee. A bonded courier and custody records lower the chance of loss and support accountability, but they do not protect data on a missing tape.
Question 136Software Development Security
A company runs hundreds of short-lived containers that start and stop automatically. It wants security policies to follow each workload wherever it runs. Which approach BEST fits?
Correct answer: D. Software-defined security with policies enforced through code
Software-defined security expresses controls as code and applies them automatically through APIs, so policy is attached to each workload as it is created. Manually updated hardware firewall rules cannot keep pace with workloads that change by the minute.
Software-defined security expresses controls as code and applies them automatically through APIs, so policy is attached to each workload as it is created. Manually updated hardware firewall rules cannot keep pace with workloads that change by the minute.
Question 137Security Assessment & Testing
A vulnerability scan reports a critical Apache web server flaw on a host that the asset inventory lists as running Microsoft IIS. What should the analyst do FIRST?
Correct answer: B. Validate the finding to confirm whether it is real
The mismatch between the reported software and the inventory suggests a possible false positive, so the finding should be verified before any action is taken. Applying an Apache patch to an IIS server wastes effort and could cause problems without reducing any real risk.
The mismatch between the reported software and the inventory suggests a possible false positive, so the finding should be verified before any action is taken. Applying an Apache patch to an IIS server wastes effort and could cause problems without reducing any real risk.
Question 138Communication & Network Security
A security architect at Humongous Insurance is asked why TLS 1.3 should replace TLS 1.2 setups that still allow static RSA key exchange. Which benefit is MOST significant?
Correct answer: C. TLS 1.3 drops static RSA in favor of ephemeral Diffie-Hellman exchange
TLS 1.3 removed static RSA key exchange and uses ephemeral Diffie-Hellman for certificate-based handshakes, so later theft of the server's private key cannot decrypt recorded sessions. Server certificates are still required. TLS 1.3 also removed compression because it enabled attacks such as CRIME.
TLS 1.3 removed static RSA key exchange and uses ephemeral Diffie-Hellman for certificate-based handshakes, so later theft of the server's private key cannot decrypt recorded sessions. Server certificates are still required. TLS 1.3 also removed compression because it enabled attacks such as CRIME.
Question 139Security Operations
A company wants to detect and stop employees from sending files containing customer credit card numbers to personal email accounts. Which control BEST meets this goal?
Correct answer: B. Data loss prevention monitoring outbound traffic
Network DLP inspects outbound content for sensitive patterns such as card numbers and can block or alert on the transfer. Full-disk encryption protects data on a lost device but does nothing to stop an authorized user from sending data out.
Network DLP inspects outbound content for sensitive patterns such as card numbers and can block or alert on the transfer. Full-disk encryption protects data on a lost device but does nothing to stop an authorized user from sending data out.
Question 140Identity & Access Management
A company is replacing passwords with facial recognition for workstation login. Which concern is MOST unique to biometric credentials compared with passwords?
Correct answer: D. A compromised biometric trait cannot easily be changed or reissued
A leaked password can be reset, but a person cannot get a new face or fingerprint, so biometric templates need strong protection. Users cannot forget a biometric trait, which is actually one of its advantages over passwords.
A leaked password can be reset, but a person cannot get a new face or fingerprint, so biometric templates need strong protection. Users cannot forget a biometric trait, which is actually one of its advantages over passwords.
Question 141Security Architecture & Engineering
A company with many branch offices and remote staff wants to combine wide area networking with cloud-delivered security services such as a secure web gateway, CASB and zero trust network access. Which architecture does this describe?
Correct answer: B. Secure access service edge (SASE)
SASE converges SD-WAN networking with cloud-delivered security functions such as SWG, CASB, firewall as a service and ZTNA, applied close to users wherever they are. A software-defined perimeter provides zero trust access to applications, but it does not include the WAN and web security services described.
SASE converges SD-WAN networking with cloud-delivered security functions such as SWG, CASB, firewall as a service and ZTNA, applied close to users wherever they are. A software-defined perimeter provides zero trust access to applications, but it does not include the WAN and web security services described.
Question 142Security & Risk Management
Legal counsel recommends adding a warning banner to all system logins stating that use is monitored and unauthorized access is prohibited. What is the MAIN benefit?
Correct answer: C. It removes users' expectation of privacy and supports legal action
A banner deters misuse and gives legal notice, so users cannot claim they expected privacy or did not know access was restricted. It does not technically block anyone, so it is not a preventive control.
A banner deters misuse and gives legal notice, so users cannot claim they expected privacy or did not know access was restricted. It does not technically block anyone, so it is not a preventive control.
Question 143Asset Security
Developers at a software company launch cloud virtual machines from various public marketplace images, and many end up untracked and misconfigured. Which approach BEST provisions these resources securely?
Correct answer: A. Require approved hardened images that are tagged and inventoried
Secure provisioning starts from approved, hardened baseline images and records each new asset in inventory when it is created, which prevents drift and orphaned systems. Quarterly scanning only finds problems after insecure systems are already running.
Secure provisioning starts from approved, hardened baseline images and records each new asset in inventory when it is created, which prevents drift and orphaned systems. Quarterly scanning only finds problems after insecure systems are already running.
Question 144Software Development Security
In a multilevel secure database, a low-cleared user tries to insert a record whose key matches an existing secret record. To avoid revealing that the secret record exists, the database stores a separate record at the lower level. What is this technique called?
Correct answer: D. Polyinstantiation
Polyinstantiation keeps multiple versions of the same record at different classification levels, so a low-level user cannot infer that a higher-level record exists. Content-dependent access control limits what a user can view, but a rejected insert would still reveal the hidden record.
Polyinstantiation keeps multiple versions of the same record at different classification levels, so a low-level user cannot infer that a higher-level record exists. Content-dependent access control limits what a user can view, but a rejected insert would still reveal the hidden record.
Question 145Security Assessment & Testing
A software team wants the MOST formal code review process, with defined roles, entry and exit criteria, and stages for planning, preparation, an inspection meeting, rework and follow-up. Which method fits this description?
Correct answer: A. Fagan inspection
Fagan inspection is a highly structured review method with defined roles and formal stages from planning through follow-up. Tool-assisted peer review is useful and efficient, but it is less formal and does not require the full set of stages and criteria.
Fagan inspection is a highly structured review method with defined roles and formal stages from planning through follow-up. Tool-assisted peer review is useful and efficient, but it is less formal and does not require the full set of stages and criteria.
Question 146Communication & Network Security
A university shares an InfiniBand HPC fabric among several research groups whose data must stay isolated from one another. Which mechanism BEST provides this isolation within the fabric?
Correct answer: C. Partition keys assigned by the subnet manager to each group's nodes
InfiniBand isolates traffic with partitions, enforced through partition keys (P_Keys) that the subnet manager assigns, so nodes talk only to members of their partition. InfiniBand does not use Ethernet 802.1Q tags or MAC addresses. Native RDMA bypasses the host IP stack, so IPsec does not apply to it.
InfiniBand isolates traffic with partitions, enforced through partition keys (P_Keys) that the subnet manager assigns, so nodes talk only to members of their partition. InfiniBand does not use Ethernet 802.1Q tags or MAC addresses. Native RDMA bypasses the host IP stack, so IPsec does not apply to it.
Question 147Security Operations
A company is outsourcing 24/7 security monitoring to a managed security service provider. What should the contract include to ensure suspected incidents are escalated quickly?
Correct answer: D. An SLA defining notification times by alert severity
A service level agreement sets measurable duties, such as notifying the company within a set time for each severity level, so performance can be tracked. Accountability for protecting data stays with the company, so trying to shift all liability does not solve the escalation problem.
A service level agreement sets measurable duties, such as notifying the company within a set time for each severity level, so performance can be tracked. Accountability for protecting data stays with the company, so trying to shift all liability does not solve the escalation problem.
Question 148Identity & Access Management
An analyst requests access to a customer database, and the request reaches the IAM team. Who should normally approve the access before it is provisioned?
Correct answer: D. The data owner responsible for the customer database
The data owner is accountable for the data and decides who may access it, while IT staff carry out the approved request. The database administrator is a custodian who implements controls but does not make business access decisions.
The data owner is accountable for the data and decides who may access it, while IT staff carry out the approved request. The database administrator is a custodian who implements controls but does not make business access decisions.
Question 149Security Architecture & Engineering
A company is redesigning its backup architecture after a competitor lost months of data to ransomware that also encrypted its online backups. Which design BEST ensures recovery?
Correct answer: B. Keep immutable, offline backup copies and test restores
Immutable or offline copies cannot be altered by ransomware that gains network or admin access, and regular restore tests confirm they actually work. Real-time replication to another online site is tempting, but it can copy encrypted or deleted data just as quickly.
Immutable or offline copies cannot be altered by ransomware that gains network or admin access, and regular restore tests confirm they actually work. Real-time replication to another online site is tempting, but it can copy encrypted or deleted data just as quickly.
Question 150Security & Risk Management
A mid-size firm is beginning its first formal risk assessment. Which activity should come FIRST?
Correct answer: C. Identifying and valuing the organization's assets
Risk assessment starts by identifying assets and their value, because threats and impacts only make sense in relation to what is being protected. ALE cannot be calculated until asset value is known.
Risk assessment starts by identifying assets and their value, because threats and impacts only make sense in relation to what is being protected. ALE cannot be calculated until asset value is known.
The real CISSP exam at a glance
150questions
3htime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free Cyber Security practice tests
CEH v13 Practice Test125 questions · 312-50CompTIA Security+ Practice Test90 questions · SY0-701 & SY0-801CompTIA CySA+ Practice Test85 questions · CS0-004CompTIA SecurityX Practice Test90 questions · CAS-005CHFI v11 Practice Test150 questions · 312-49CCISO Practice Test150 questions · Blueprint v3
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the CISSP exam. They are not real exam questions. CISSP and ISC2 are trademarks of their owners. Real exam format: adaptive (CAT) exam with 100 to 150 questions · 3 hours · passing score 700 out of 1000.