You will have 90 minutes to complete this exam, which consists of 60 questions. The actual CISSP exam requires a minimum passing score of 700 out of 1,000. Ensure that you read each question, looking for details that would rule out any of the possible answers. Many times there will be two or more correct answers; however, there is only one best answer, and that is the one you should select. In the real world, a security professional often has several options to secure a network, but one option is better than the others. This is the case, for example, when choosing the best encryption to secure data or wireless networks.
Remember that the CISSP exam asks many conceptual questions for which there may not be perfect answers. If you encounter such a question, choose the best answer. Leaving a question blank will count against you, so you are always better off taking a guess than leaving a question blank. The exam may present you with drag-and-drop questions or scenarios, and it may offer figures or diagrams. Examine each question carefully, and if you are taking the adaptive exam, keep in mind that once you pass a question, you cannot go back to it.
1. What fence height is required to prevent a determined intruder?
A. 4 feet
B. 6 feet
C. 8 feet
D. None of these answers is correct.
2. A fire caused by combustible metals would be considered which class of fire?
A. A
B. B
C. C
D. D
3. Controls should be implemented using a layered approach. Review the following diagram. Which order does the diagram most closely represent?
A. (1) Physical/preventive, (2) administrative/preventive, (3) technical/deterrent control layered approach
B. (1) Physical/preventive/deterrent, (2) technical/preventive/detective/, (3) administrative/preventive layered approach
C. (1) Deterrent/preventive, (2) administrative/detective, (3) preventive training
D. (1) Physical/preventive/deterrent, (2) hardware/software preventive, (3) administrative/preventive layered approach
4. Which of the following types of card keys contains rows of copper strips?
A. Magnetic strip
B. Electronic circuit
C. Magnetic stripe
D. Active electronic
5. Tony’s company manufactures proprietary tractor-trailer tracking devices. Now that employees will be issued laptops, Tony is concerned about the loss of confidential information if an employee’s laptop is stolen. Which of the following would be the best defensive method?
A. Use integrity programs such as MD5 and SHA to verify the validity of installed programs.
B. Place labels on the laptops offering a reward for stolen or missing units.
C. Issue laptop users locking cables to secure the units and prevent their theft.
D. Encrypt the hard drives.
6. Under what conditions can halon be expected to degrade into toxic compounds?
A. At temperatures greater than 500°F
B. At temperatures greater than 900°F and concentrations greater than 10%
C. At temperatures greater than 900°F
D. At temperatures greater than 500°F and concentrations greater than 7%
7. According to NIST perimeter lighting standards, critical areas should be illuminated to what measurement?
A. 10 feet in height, with 2 foot-candles of illuminance
B. 12 feet in height, with 4 foot-candles of illuminance
C. 8 feet in height, with 2 foot-candles of illuminance
D. 8 feet in height, with 4 foot-candles of illuminance
8. What type of biometric error signifies that an authorized user has been denied legitimate access?
A. Type I
B. Type II
C. Type III
D. Type IV
9. In biometrics, the point at which the FAR equals the FRR is known as which of the following?
A. Crossover error rate
B. Error acceptance rate
C. Crossover acceptance rate
D. Failure acceptance rate
10. RSA’s SecurID is an example of which of the following?
A. SSO system
B. Synchronous authentication
C. Token authentication
D. Asynchronous authentication
11. Which of the following is a weak implementation of EAP?
A. EAP-FAST
B. LEAP
C. PEAP
D. EAP-TLS
12. When discussing the security of SSO systems, which of the following is considered a disadvantage?
A. Single sign-on involves a lot of maintenance and overhead because all systems are tied together.
B. The biggest disadvantage of single sign-on is that system time on all systems must be held to very tight standards; deviations from these standards can lead to serious access problems.
C. There are no real disadvantages to single sign-on.
D. Breaching single sign-on allows an intruder access to all systems tied to the SSO implementation.
13. Snort started as what type of system?
A. Behavior-based IPS
B. Signature-based IDS
C. Behavior-based IDS
D. Signature-based IPS
14. What type of attack is also known as a race condition?
A. Synchronous attack
B. Buffer overflow
C. Asynchronous attack
D. Scanlog attack
15. I/O drivers and utilities are typically found at what protected ring layer?
A. Layer 1
B. Layer 2
C. Layer 3
D. Layer 0
16. What type of CPU can interleave two or more programs for execution at any one time?
A. Multiprogramming
B. Multitasking
C. Multiapp
D. Multiprocessor
17. What portion of the CPU performs arithmetic and logical operations on binary data?
A. I/O buffer
B. Registers
C. Control circuit
D. ALU
18. You are a security consultant for a contracting agency. The agency chief wants to prevent subjects from writing information to a higher level than the subject’s security clearance. He also wants to ensure that subjects from a higher clearance level cannot read information at a lower level. The agency requires some type of access control model for its information systems to protect the integrity of its data. What is your best recommendation for the model to use in this case?
A. Bell-LaPadula
B. Biba
C. State machine
D. Clark-Wilson
19. How many stages are involved in the Lockheed Martin Cyber Kill Chain framework?
A. 5
B. 7
C. 4
D. 6
20. Which of the following has become a major trend in software development as an alternative or companion to virtualization?
A. Microservices
B. Serverless
C. Containerization
D. Embedded systems
21. Which of the following is considered the totality of protection mechanisms within a computer system and is responsible for enforcing security?
A. Rings of protection
B. The security kernel
C. TCB
D. Resource isolation
22. Johnny is worried that someone might be able to intercept and decrypt his VoIP phone calls. Which of the following protocols is most closely associated with VoIP?
A. SKYP
B. SLIP
C. S/MIME
D. SIP
23. Which of the following wireless standards uses direct-sequence spread spectrum (DSSS) by default?
A. Bluetooth
B. 802.11a
C. 802.11b
D. 802.11ac
24. What is a rogue AP?
A. An individual connected to an unauthorized modem
B. An unauthorized AP attached to a corporate network
C. An unauthorized modem attached to a network
D. An individual intercepting wireless traffic from inside or outside an organization
25. Which of the following is typically used with software to search for defects during various phases of the software development process to prevent issues and outages before the software is placed in production?
A. Fuzzing
B. Synthetic transactions
C. Fagen inspection
D. RASP
26. Which of the following does a T1 line use to multiplex DS0s into a composite T1?
A. Channel division
B. Frequency-hopping spread spectrum
C. Frequency division
D. Time division
27. Which of the following focuses on how to repair and restore a data center and the information at an original or new primary site?
A. BCP
B. BCM
C. DRP
D. BIA
28. What type of service is used to provide protection for source code in the event that the manufacturer declares bankruptcy or goes broke?
A. Government access to keys
B. MAD
C. Electronic vaulting
D. Software escrow
29. Which of the following describes the cooperative effort between the United States and Europe to exchange information about European citizens between European firms and North American parent corporations?
A. SB 168
B. Demar Act
C. Safe Harbor Act
D. Safety Shield Act
30. Which of the following best describes an approved type of forensic duplication?
A. Logical copy
B. Bit copy
C. Microsoft Backup
D. Xcopy
31. Which of the following best describes the SET protocol?
A. Originated by Victor Miller and Neal Koblitz for use as a digital signature cryptosystem. It is useful in applications for which memory, bandwidth, or computational power is limited.
B. Originated by MasterCard and Visa to be used on the Internet for credit card transactions. It uses digital signatures.
C. Originated by Victor Miller and Neal Koblitz for use as a key exchange cryptosystem. It is useful in applications for which memory, bandwidth, or computational power is limited.
D. Originated by MasterCard and Visa to be used on the Internet for credit card transactions. It uses the SSL protocol.
32. Which of the following information-management systems uses artificial intelligence?
A. Polyinstantiation
B. Known signature scanning
C. Application programming interface
D. Knowledge discovery in databases
33. DNS lookups that are less than 512 bytes are typically performed on which of the following protocols and ports?
A. UDP port 53
B. UDP port 69
C. TCP port 53
D. UDP port 161
34. Bob is worried that a program someone gave him at DEF CON has been altered from the original. Which of the following is a valid technique that Bob can use to verify the program’s authenticity?
A. Run AES against the program.
B. Compare the size and date with those of the version found on the developer’s website.
C. Run md5sum and check against the md5sum from developer sites.
D. Calculate a digital signature.
35. Which of the following is not an email encryption security standard?
A. IMAP
B. MOSS
C. PGP
D. PEM
36. Which of the following best describes link encryption?
A. Data is encrypted at the point of origin and is decrypted at the destination.
B. The message is decrypted and re-encrypted as it passes through each successive node, using a key common to the two nodes.
C. The KDC shares a user-unique key with each user.
D. It requires a session key that the KDC shares between the originator and the final destination.
37. Diameter uses which of the following as a base?
A. TACACS
B. TACACS+
C. RADIUS
D. Kerberos
38. The ACID test is used to describe what?
A. Behavior-based intrusion detection systems
B. Database transactions
C. Signature-based intrusion detection systems
D. The strength of a cryptographic function
39. Which fault-tolerant system can back up media in much the same way as disk striping?
A. RAID
B. RAIT
C. JBOD
D. SOAR
40. Which of the following is a stream cipher?
A. DES
B. Camellia
C. RC4
D. Twofish
41. Which of the following is considered the weakest mode of DES?
A. Electronic Code Book
B. Cipher Block Chaining
C. Cipher Feedback
D. Output Feedback
42. Which ethical standard states that “access and use of the Internet is a privilege and should be treated as such by all users”?
A. RFC 1087
B. (ISC)2 Code of Ethics
C. The Ten Commandments of Computer Ethics
D. RFC 1109
43. Which of the following would be considered the oldest and most well-known software development method?
A. Spiral
B. Clean room
C. Waterfall
D. V-shaped waterfall
44. Which of the following techniques would not be considered one of the techniques used by fileless malware?
A. RAM
B. Multipartite
C. Memory code injection
D. Windows register manipulation
45. HTTPS uses TCP and which of the following ports?
A. 80
B. 110
C. 111
D. 443
46. Which of the following is considered the oldest type of database system?
A. Hierarchical
B. Network
C. Relational
D. Object oriented
47. The IEEE separates the OSI data link layer into two sublayers. What are they?
A. Media MAC Control and Media Access Control
B. Logical Link Control and Media Access Control
C. High-Level Data Link Control and Media MAC Control
D. Data Link Control and Media MAC Control
Questions 48 and 49 refer to the following table.
User and Object List
Dwayne |
Object 1 |
Object 2 |
Object 3 |
---|---|---|---|
Mike |
Write |
Read |
Read/write |
Christine |
No access |
Read |
Read |
Betsy |
Read/write |
Read |
Read |
48. What does the model shown in the table represent?
A. MAC
B. RBAC
C. LBAC
D. Access control matrix
49. Using the model shown in the table, Mike, Christine, Dwayne, and Betsy are _________, and Object 1, Object 2, and Object 3 are _____.
A. Objects; subjects
B. Subject; objects
C. Names of users; resources the users access
D. Names of the users; objects the users access
50. 802.11 networks are identified by which of the following?
A. Security identifier (SID)
B. Broadcast name
C. Kismet
D. Service set identifier (SSID)
51. Which of the following refers to a dynamic, adaptive technology that leverages large-scale threat history data to proactively block and remediate future malicious attacks on a network?
A. Threat intelligence
B. Intrusion detection and prevention (IDP)
C. Security information and event management (SIEM)
D. User and entity behavior analytics (UEBA)
52. The Common Criteria rating “functionality tested” means the design meets what level of verification?
A. EAL 1
B. EAL 2
C. EAL 4
D. EAL 5
53. Which of the following is not addressed by the Clark-Wilson security model?
A. Blocking unauthorized individuals from making changes to data
B. Maintaining internal and external consistency
C. Protecting the confidentiality of information
D. Blocking authorized individuals from making unauthorized changes to data
54. Which of the following individuals would be responsible for maintaining and protecting the company’s assets and data?
A. User
B. Data owner
C. Data custodian
D. Security auditor
55. Which of the following is the proper formula for calculating ALE?
A. Single loss expectancy (SLE) × Annualized rate of occurrence (ARO)
B. Asset value × Annualized rate of occurrence (ARO)
C. Single loss expectancy (SLE) × Annualized rate of occurrence (ARO)
D. Asset value / Annualized rate of occurrence (ARO)
56. Which of the following best describes a qualitative assessment?
A. A qualitative assessment deals with real numbers and seeks to place dollar values on losses. These dollar amounts are then used to determine where to apply risk controls.
B. A qualitative assessment assigns a rating to each risk.
C. A qualitative assessment is performed by experts or external consultants who seek to place dollar values on losses.
D. A qualitative assessment is performed by experts or external consultants, is based on risk scenarios, and assigns non-dollar values to risks.
57. Facilitated Risk Analysis Process (FRAP) is an example of what?
A. A BCP analysis technique
B. A quantitative assessment technique
C. A DRP analysis technique
D. A qualitative assessment technique
58. Classification levels like confidential and secret are tied to which data classification scheme?
A. ISO 17799
B. U.S. Department of Defense (DoD)
C. RFC 2196 Site Security Guidelines
D. Commercial Data Classification Standard (CDCS)
59. Which of the following methods of dealing with risk is considered the least prudent course of action?
A. Risk reduction
B. Risk rejection
C. Risk transference
D. Risk acceptance
60. Your employer is pleased that you have become CISSP certified and would now like you to evaluate your company’s security policy. Your boss believes that encryption should be used for all network traffic and that a $50,000 encrypted database should replace the current customer database. Based on what you know about risk management, on what should you base your decision to use encryption and purchase the new database? Choose the most correct answer.
A. If an analysis shows that there is potential risk, the cost of protecting the network and database should be weighed against the cost of the deterrent.
B. If an analysis shows that the company’s network is truly vulnerable, systems should be implemented to protect the network data and the customer database.
C. If the network is vulnerable, systems should be implemented to protect the network and the database, regardless of the price.
D. Because it is only a customer database and the company is not well known, the probability of attack is not great; therefore, the risk should be accepted or transferred through the use of insurance.
3.91.106.157