Navigate the complexities of CISSP certification preparation with this series of practice tests covering a wide range of information security domains. From risk management practices to security governance frameworks, each article offers a comprehensive set of questions to test your understanding and readiness for the exam.
1. What is the main advantage of using a Federated Identity Management (FIM) system?
A. It increases the number of passwords a user has to remember.
B. It allows users to use the same credentials to access services across multiple organizations.
C. It reduces the need for encryption.
D. It increases the need for firewalls.
Correct Answer: B
2. What is the purpose of the “least privilege” principle in access control?
A. To ensure that users have access to all the information they might need
B. To ensure that users only have the minimum levels of access necessary to perform their job functions
C. To prevent any single individual from being able to complete a significant process or transaction on their own
D. To ensure that users know the consequences of misusing their access rights
Correct Answer: B
3. What does the term “identification” refer to in the context of Access Control Services?
A. The process of a user claiming or professing an identity
B. The process of granting access to systems and data to a new employee
C. The process of allowing different organizations to share and manage identity information
D. The process of terminating access when an employee leaves the organization
Correct Answer: A
4. What does the term “Identity as a Service (IDaaS)” refer to?
A. The process of confirming or establishing that somebody is who they claim to be
B. The process of granting access to systems and data to a new employee
C. The process of allowing different organizations to share and manage identity information
D. A cloud-based service that provides Identity and Access Management functions to an organization’s systems that reside on-premises and/or in the cloud
Correct Answer: D
5. What is the primary purpose of the Kerberos protocol in the context of authentication systems?
A. To provide a secure communication channel
B. To provide encryption for data in transit
C. To allow third-party services to access user data without needing to know the user’s credentials
D. To provide a secure method for transmitting information and authenticating both the user and the server
Correct Answer: D
6. What is the main disadvantage of using a Federated Identity Management (FIM) system?
A. It increases the number of passwords a user has to remember.
B. If the FIM system is compromised, all services that use it are potentially at risk.
C. It reduces the need for encryption.
D. It increases the need for firewalls.
Correct Answer: B
7. What is the purpose of the “accountability” principle in access control?
A. To ensure that users have access to all the information they might need
B. To ensure that users only have the minimum levels of access necessary to perform their job functions
C. To prevent any single individual from being able to complete a significant process or transaction on their own
D. To ensure that actions can be traced back to the individual who performed them
Correct Answer: D
8. What does the term “biometrics” refer to in the context of authentication systems?
A. The process of a user claiming or professing an identity
B. The use of physical or behavioral characteristics to verify a user’s Identity
C. The process of allowing different organizations to share and manage identity information
D. The process of terminating access when an employee leaves the organization
Correct Answer: B
9. What does the term “identity proofing” refer to in the context of Identity and Access Management (IAM)?
A. The process of confirming or establishing that somebody is who they claim to be
B. The process of granting access to systems and data to a new employee
C. The process of verifying a user’s claimed Identity by comparing it against one or more reliable sources
D. The process of terminating access when an employee leaves the organization
Correct Answer: C
10. What does the term “Identity Federation” refer to in the context of Identity and Access Management (IAM)?
A. The process of confirming or establishing that somebody is who they claim to be
B. The process of granting access to systems and data to a new employee
C. The process of allowing different organizations to share and manage identity information
D. The process of terminating access when an employee leaves the organization
Correct Answer: C
11. What is the primary purpose of the RADIUS protocol in the context of authentication systems?
A. To provide a secure communication channel
B. To provide a networking protocol that offers centralized authentication, authorization, and accounting (AAA) management for users who connect and use a network service
C. To allow third-party services to access user data without needing to know the user’s credentials
D. To provide encryption for data in transit
Correct Answer: B
12. What is the main disadvantage of using biometric authentication systems?
A. It increases the number of passwords a user has to remember.
B. If the biometric data is compromised, it cannot be changed like a password.
C. It reduces the need for encryption.
D. It increases the need for firewalls.
Correct Answer: B
13. What is the purpose of the “non-repudiation” principle in access control?
A. To ensure that users have access to all the information they might need
B. To ensure that users only have the minimum levels of access necessary to perform their job functions
C. To prevent any single individual from being able to complete a significant process or transaction on their own
D. To ensure that actions can be definitively traced back to the individual who performed them, and they cannot deny performing them
Correct Answer: D
14. What does the term “multifactor authentication (MFA)” refer to in the context of authentication systems?
A. The process of a user claiming or professing an identity
B. The use of two or more independent credentials for verifying a user’s Identity
C. The process of allowing different organizations to share and manage identity information
D. The process of terminating access when an employee leaves the organization
Correct Answer: B
15. What does the term “identity life cycle” refer to in the context of Identity and Access Management (IAM)?
A. The process of confirming or establishing that somebody is who they claim to be
B. The stages a digital identity goes through from creation to deletion
C. The process of allowing different organizations to share and manage identity information
D. The process of terminating access when an employee leaves the organization
Correct Answer: B
16. What is the primary purpose of the TACACS+ protocol in the context of authentication systems?
A. To provide a secure communication channel
B. To provide a networking protocol that offers centralized authentication, authorization, and accounting (AAA) management for users who connect and use a network service
C. To allow third-party services to access user data without needing to know the user’s credentials
D. To provide encryption for data in transit
Correct Answer: B
17. What is the main disadvantage of using password-based authentication systems?
A. It increases the number of passwords a user has to remember.
B. Passwords can be easily forgotten, shared, or stolen.
C. It reduces the need for encryption.
D. It increases the need for firewalls.
Correct Answer: B
18. What is the purpose of the “principle of least privilege” in access control?
A. To ensure that users have access to all the information they might need
B. To ensure that users only have the minimum levels of access necessary to perform their job functions
C. To prevent any single individual from being able to complete a significant process or transaction on their own
D. To ensure that actions can be definitively traced back to the individual who performed them, and they cannot deny performing them
Correct Answer: B
19. What does the term “Single Sign-On (SSO)” refer to in the context of authentication systems?
A. The process of a user claiming or professing an identity
B. The use of a single set of credentials to access multiple applications or services
C. The process of allowing different organizations to share and manage identity information
D. The process of terminating access when an employee leaves the organization
Correct Answer: B
20. What does the term “provisioning” refer to in the context of Identity and Access Management (IAM)?
A. The process of confirming or establishing that somebody is who they claim to be
B. The process of setting up a new user account with appropriate access rights
C. The process of allowing different organizations to share and manage identity information
D. The process of terminating access when an employee leaves the organization
Correct Answer: B
21. What is the primary purpose of the SAML protocol in the context of authentication systems?
A. To provide a secure communication channel
B. To provide a standard for exchanging authentication and authorization data between parties
C. To allow third-party services to access user data without needing to know the user’s credentials
D. To provide encryption for data in transit
Correct Answer: B
22. What is the main disadvantage of using role-based access control systems?
A. It increases the number of passwords a user has to remember.
B. It can be difficult to manage if roles are not clearly defined or if users have multiple roles.
C. It reduces the need for encryption.
D. It increases the need for firewalls.
Correct Answer: B
23. What is the purpose of the “mandatory access control” in access control?
A. To ensure that users have access to all the information they might need
B. To enforce access control policies based on the classification of information and the security clearance of users
C. To prevent any single individual from being able to complete a significant process or transaction on their own
D. To ensure that actions can be definitively traced back to the individual who performed them, and they cannot deny performing them
Correct Answer: B
24. What does the term “attribute-based access control (ABAC)” refer to in the context of access control systems?
A. The process of a user claiming or professing an identity
B. A flexible access control method where access rights are granted to users through the use of policies which combine attributes together
C. The process of allowing different organizations to share and manage identity information
D. The process of terminating access when an employee leaves the organization
Correct Answer: B
25. What does the term “deprovisioning” refer to in the context of Identity and Access Management (IAM)?
A. The process of confirming or establishing that somebody is who they claim to be
B. The process of removing an existing user account and its associated access rights
C. The process of allowing different organizations to share and manage identity information
D. The process of setting up a new user account with appropriate access rights
Correct Answer: B
26. What is the primary purpose of the OAuth protocol in the context of authentication systems?
A. To provide a secure communication channel
B. To provide a standard for authorizing third-party applications to access user data without sharing passwords
C. To allow third-party services to access user data without needing to know the user’s credentials
D. To provide encryption for data in transit
Correct Answer: B
27. What is the main disadvantage of using discretionary access control systems?
A. It increases the number of passwords a user has to remember.
B. It can lead to “privilege creep” if access rights are not regularly reviewed and updated.
C. It reduces the need for encryption.
D. It increases the need for firewalls.
Correct Answer: B
28. What is the purpose of “discretionary access control” in access control?
A. To ensure that users have access to all the information they might need
B. To allow the owners of information to control who can access their information
C. To prevent any single individual from being able to complete a significant process or transaction on their own
D. To ensure that actions can be definitively traced back to the individual who performed them, and they cannot deny performing them
Correct Answer: B
29. What does the term “privilege escalation” refer to in the context of access control systems?
A. The process of a user claiming or professing an identity
B. The act of exploiting a bug, design flaw, or configuration oversight in an operating system or software application to gain elevated access to resources
C. The process of allowing different organizations to share and manage identity information
D. The process of terminating access when an employee leaves the organization
Correct Answer: B
30. What is the primary function of the SESAME protocol in the context of Single Sign-On authentication?
A. To provide a secure communication channel
B. To provide accounting, authentication, and auditing services
C. To allow third-party services to access user data without needing to know the user’s credentials
D. To support both symmetric and asymmetric cryptography
Correct Answer: D
31. What is the primary purpose of the Authenticator Assurance Levels (AAL)?
A. To provide a secure communication channel
B. To rank the strength of authentication processes and systems
C. To allow third-party services to access user data without needing to know the user’s credentials
D. To provide encryption for data in transit
Correct Answer: B
32. What is the primary difference between discretionary access control (DAC) and mandatory access control (MAC)?
A. DAC is determined by the owner of the asset, while MAC is determined by the system based on labels.
B. DAC is determined by the system based on labels, while MAC is determined by the owner of the asset.
C. DAC is a protocol for enabling Single Sign-On, while MAC is an improved version of DAC.
D. DAC is an improved version of MAC, while MAC is a protocol for enabling Single Sign-On.
Correct Answer: A
33. What does the term “Identity as a Service (IDaaS)” refer to?
A. The process of confirming or establishing that somebody is who they claim to be
B. The implementation or integration of identity services in a cloud-based environment
C. The process of allowing different organizations to share and manage identity information
D. The process of terminating access when an employee leaves the organization
Correct Answer: B
34. What does the term “Just-in-Time Access” refer to in the context of access control?
A. The process of confirming or establishing that somebody is who they claim to be
B. The process of elevating user privileges for a short period to complete necessary but infrequent tasks
C. The process of allowing different organizations to share and manage identity information
D. The process of terminating access when an employee leaves the organization
Correct Answer: B
35. Which of the following is the primary purpose of a vulnerability assessment?
A. To exploit vulnerabilities in a system
B. To determine the effectiveness of security controls
C. To identify weaknesses in a system without exploiting them
D. To test the organization’s incident response capability
Correct Answer: C
36. What is the primary difference between a white box and a black box test?
A. The tools used for testing
B. Knowledge of the system’s architecture and design
C. The time taken to complete the test
D. The outcome of the test
Correct Answer: B
37. Which phase of the penetration testing process involves gathering as much information as possible about the target system before launching an attack?
A. Exploitation
B. Post-exploitation
C. Reconnaissance
D. Scanning
Correct Answer: C
38. During a security assessment, a tester identifies a vulnerability but does not have a tool or an exploit to take advantage of it. What should the tester do next?
A. Ignore the vulnerability.
B. Manually attempt to exploit the vulnerability.
C. Report the vulnerability to the organization.
D. Wait for a tool to become available.
Correct Answer: C
39. Which of the following best describes a false positive in the context of security testing?
A. A vulnerability that is correctly identified but cannot be exploited
B. A vulnerability that is misclassified by the testing tool
C. An identified vulnerability that does not actually exist
D. A vulnerability that is missed by the testing tool
Correct Answer: C
40. For which attack type is IP spoofing most frequently utilized?
A. Salami
B. Keystroke logging
C. Denial of service (DoS)
D. Data diddling
Correct Answer: C
41. Which statement accurately characterizes session hijacking?
A. Session hijacking initially undermines the DNS process, allowing an attacker to exploit an existing TCP connection.
B. Session hijacking manipulates the UDP protocol, enabling an attacker to leverage an ongoing connection.
C. Session hijacking focuses on the TCP connection between the client and the server. If an attacker discerns the initial sequence, they can potentially take over the connection.
D. Session hijacking begins by compromising the DNS process, subsequently allowing an attacker to exploit an established UDP connection.
Correct Answer: C
42. Following a series of email scams targeting your company’s employees, which solution would most effectively address these attacks?
A. Enforce a stringent password policy mandating complex passwords.
B. Initiate an employee training and awareness campaign.
C. Enhance the company’s email filtering capabilities.
D. Implement a policy limiting email to strictly official purposes.
Correct Answer: B
43. Which statement is part of the ISC2 Code of Ethics?
A. One must not use a computer to harm others.
B. Violating user privacy is deemed unethical.
C. All information should be universally accessible.
D. Conduct oneself with honor, honesty, justice, responsibility, and within the bounds of the law.
Correct Answer: D
44. Which group poses the most significant threat to your organization?
A. Internal employees
B. Corporate espionage agents
C. State-sponsored agents
D. Novice hackers
Correct Answer: A
45. What does Locard’s exchange principle assert?
A. The continuity of evidence must remain unbroken.
B. Trace evidence always exists.
C. A crime necessitates means, motive, and opportunity.
D. Authenticating evidence requires checksums.
Correct Answer: B
46. Which global entity was founded to standardize the treatment of forensic evidence?
A. The Global Forensic Analysis Organization
B. The European Union’s Criminal Evidence Policy Council
C. The United Nations Computer Evidence Committee
D. The International Organization on Computer Evidence
Correct Answer: D
47. For evidence to be admissible in court, it must not be?
A. Pertinent
B. Preserved correctly
C. Recognizable
D. Justified
Correct Answer: D
48. How is hearsay evidence best defined?
A. Admissible in civil proceedings
B. Inadmissible in court
C. Regarded as third-tier information
D. Used to corroborate evidence presented as the best evidence
Correct Answer: B
49. In what fundamental way do ethical hackers differ from malicious hackers?
A. They are authorized to dismantle networks.
B. Their primary objective is to avoid causing harm.
C. They are immune to legal repercussions for damages.
D. They are exempt from legal prosecution.
Correct Answer: B
50. In the realm of computer forensics, which component should be prioritized for examination?
A. Hard disk drives
B. DVD media
C. Random Access Memory (RAM) content
D. Printed outputs from the computer
Correct Answer: C
51. How is the tool SATAN best characterized?
A. A utility for password decryption
B. A tool for analyzing audit logs
C. A software for system exploitation
D. A scanner for system vulnerabilities
Correct Answer: D
52. What should an investigator ensure during the duplication in computer forensics?
A. Create an exact duplicate.
B. Generate a bit-by-bit copy.
C. Produce a logical copy.
D. Format the destination drive to erase any existing data before duplication.
Correct Answer: B
53. Which type of penetration testing evaluates the access capabilities of internal users?
A. White box testing
B. Gray box testing
C. Black box testing
D. Blue box testing
Correct Answer: A
You may also like:- Top 30 Linux Questions (MCQs) with Answers and Explanations
- 75 Important Cybersecurity Questions (MCQs with Answers)
- 260 One-Liner Information Security Questions and Answers for Fast Learning
- Top 20 HTML5 Interview Questions with Answers
- 80 Most Important Network Fundamentals Questions With Answers
- 100 Most Important SOC Analyst Interview Questions
- Top 40 Cyber Security Questions and Answers
- Top 10 React JS Interview Theory Questions and Answers
- CISSP – Practice Test Questions – 2024 – Set 20 (53 Questions)
- Part 2: Exploring Deeper into CCNA – Wireless (145 Practice Test Questions)
