Sample ISC2 CISSP CISSP Practice Questions
Q: Which of the following is the PRIMARY purpose of a security policy?
A: B. To communicate management's expectations for security across the organization — A security policy communicates management's expectations and direction for how the organization will protect its assets. Technical configurations are found in standards and baselines, vulnerability lists come from assessments, and step-by-step instructions are procedures.
Q: Which data classification level in a government/military system is used for information that could cause 'serious damage' to national security if disclosed?
A: B. Secret — In government classification, Secret information could cause serious damage to national security if disclosed. Confidential could cause damage, Top Secret could cause exceptionally grave damage, and Unclassified information has no classification.
Q: The Bell-LaPadula model enforces which security property?
A: C. Confidentiality — The Bell-LaPadula model is a formal security model that enforces confidentiality. Its two key rules are 'no read up' (Simple Security Property) and 'no write down' (Star Property), preventing information from flowing to lower classification levels.
Q: At which layer of the OSI model does a traditional firewall that filters based on IP addresses and port numbers operate?
A: B. Layer 3 - Network and Layer 4 - Transport — A traditional packet-filtering firewall operates at Layer 3 (Network) for IP address filtering and Layer 4 (Transport) for port number filtering. Layer 7 firewalls (WAFs) inspect application-layer content, and Layer 2 operates at the data link level.
Q: Which authentication protocol is commonly used in Active Directory environments and uses tickets for authentication?
A: C. Kerberos — Kerberos is the default authentication protocol in Active Directory environments. It uses a Key Distribution Center (KDC) that issues Ticket-Granting Tickets (TGTs) and service tickets to authenticate users without transmitting passwords across the network.
Q: What is the PRIMARY purpose of a vulnerability assessment?
A: B. To identify, classify, and prioritize security vulnerabilities in systems and applications — A vulnerability assessment systematically identifies, classifies, and prioritizes security vulnerabilities in systems, applications, and network devices. Unlike penetration testing, it typically does not exploit the vulnerabilities found. Tools like Nessus, Qualys, and OpenVAS are commonly used.
Q: What is the FIRST step in the incident response process according to NIST SP 800-61?
A: C. Preparation — According to NIST SP 800-61, the incident response lifecycle begins with Preparation, followed by Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Preparation involves establishing the incident response team, plans, tools, and training.
Q: Which phase of the Software Development Life Cycle (SDLC) should security requirements be defined?
A: C. Requirements gathering — Security requirements should be defined during the requirements gathering phase of the SDLC. Integrating security from the beginning (shift-left) is more cost-effective than adding it later. Security requirements include authentication, authorization, data protection, input validation, and compliance needs.
Q: An organization calculates the Single Loss Expectancy (SLE) of a server at $50,000 and the Annualized Rate of Occurrence (ARO) at 0.2. What is the Annualized Loss Expectancy (ALE)?
A: B. $10,000 — ALE = SLE x ARO. $50,000 x 0.2 = $10,000. The ALE represents the expected annual monetary loss from a specific threat to a specific asset.
Q: Which risk response strategy involves shifting the financial burden of a risk to a third party?
A: C. Risk transference — Risk transference shifts the financial impact of a risk to a third party, commonly through insurance or contractual agreements. Risk avoidance eliminates the activity, mitigation reduces likelihood or impact, and acceptance acknowledges the risk without action.