CISSP – Practice Test Questions – 2024 – Set 18 (53 Questions)

CISSP Part 18

Prepare to excel in the CISSP exam with this series of practice tests designed to test your knowledge and skills across all domains of information security. Explore topics such as security governance, enterprise security architecture, and security program management as you strive for certification success.

1. A security analyst is reviewing the organization’s continuity plan and notices that there is no mention of the time it would take to recover from a disaster and resume operations. Which of the following should the analyst recommend adding to the plan?

A. Recovery point objective (RPO)
B. Recovery time objective (RTO)
C. Business impact analysis (BIA)
D. Incident response plan (IRP)

Correct Answer: B

2. Which of the following best describes the principle of “least privilege” in an information security context?

A. Users should be given only the minimum levels of access necessary to perform their job functions.
B. Users should be given full access to all systems and data, but their activities should be logged and audited.
C. Users should be given access based on their seniority within the organization.
D. Users should be given access to systems and data based on their job title.

Correct Answer: A

3. Which of the following is a primary purpose of using a demilitarized zone (DMZ) in network security?

A. To provide a secure area for sensitive data storage
B. To provide an area isolated from the network for incident response
C. To provide an area where public-facing servers can be placed
D. To provide an area for the internal network infrastructure

Correct Answer: C

4. A security analyst at a large corporation is reviewing the company’s current security posture. The analyst discovers that the company has a robust security infrastructure with firewalls, intrusion detection systems (IDS), and regular patch management. However, there is no formal process for managing and responding to identified security incidents. Which of the following should be the analyst’s NEXT step?

A. Implement a security information and event management (SIEM) system
B. Develop an incident response (IR) plan
C. Conduct a penetration testing exercise
D. Implement an intrusion prevention system (IPS)

Correct Answer: B

5. An organization is planning to migrate its on-premises email server to a cloud-based email service. The Chief Information Security Officer (CISO) is concerned about the potential loss of control over the organization’s data and the inability to conduct forensic investigations in case of a security incident. Which of the following should be the CISO’s PRIMARY consideration to mitigate these concerns?

A. Implementing a Cloud Access Security Broker (CASB)
B. Ensuring the cloud provider offers strong Service-Level Agreements (SLAs)
C. Conducting regular security audits of the cloud provider
D. Implementing end-to-end encryption for emails

Correct Answer: A

6. A company is planning to implement a new software system that will handle sensitive customer data. The Chief Information Security Officer (CISO) is concerned about potential security vulnerabilities in the software. Which of the following should be the CISO’s PRIMARY consideration to mitigate these concerns?

A. Implementing a robust intrusion detection system (IDS)
B. Conducting a thorough software security assessment before deployment
C. Ensuring the software vendor provides regular security updates
D. Encrypting all customer data stored by the software

Correct Answer: B

7. An organization has recently suffered a data breach due to an insider threat. The organization wants to implement measures to detect and prevent such threats in the future. Which of the following should be the organization’s PRIMARY focus?

A. Implementing a robust firewall and intrusion prevention system (IPS)
B. Conducting regular security awareness training for employees
C. Implementing a User and Entity Behavior Analytics (UEBA) solution
D. Regularly updating and patching all systems

Correct Answer: C

8. A company is implementing a Bring Your Own Device (BYOD) policy. The Chief Information Security Officer (CISO) is concerned about the potential security risks associated with this policy. Which of the following should be the CISO’s PRIMARY consideration to mitigate these risks?

A. Implementing a Mobile Device Management (MDM) solution
B. Conducting regular security audits of employee devices
C. Implementing a strong password policy for all devices
D. Ensuring all data transmitted to and from the devices is encrypted

Correct Answer: A

9. A company is planning to implement a new cloud-based Customer Relationship Management (CRM) system. The Chief Information Security Officer (CISO) is concerned about the potential privacy risks associated with storing customer data in the cloud. Which of the following should be the CISO’s PRIMARY consideration to mitigate these concerns?

A. Ensuring the cloud provider complies with relevant data protection regulations
B. Implementing a robust intrusion detection system (IDS) for the cloud environment
C. Conducting regular security audits of the cloud provider
D. Encrypting all customer data stored in the cloud

Correct Answer: A

10. An organization has implemented a new security policy that requires multifactor authentication (MFA) for all users. However, the IT department is receiving numerous complaints from users about the inconvenience of MFA. Which of the following should be the organization’s PRIMARY response to these complaints?

A. Disable MFA for users who find it inconvenient
B. Provide training to users on the importance of MFA
C. Implement a Single Sign-On (SSO) solution
D. Review and update the security policy

Correct Answer: B

11. A company has recently suffered a data breach due to a zero-day exploit. The company wants to improve its ability to respond to such threats in the future. Which of the following should be the company’s PRIMARY focus?

A. Implementing a robust patch management process
B. Conducting regular penetration testing
C. Implementing an intrusion prevention system (IPS)
D. Subscribing to a threat intelligence service

Correct Answer: D

12. A company is planning to implement a new Internet of Things (IoT) solution. The Chief Information Security Officer (CISO) is concerned about the potential security risks associated with IoT devices. Which of the following should be the CISO’s PRIMARY consideration to mitigate these concerns?

A. Ensuring the IoT devices support the latest encryption standards
B. Implementing a robust intrusion detection system (IDS) for the IoT network
C. Conducting a thorough security assessment of the IoT devices before deployment
D. Ensuring the IoT devices are included in the company’s regular patch management process

Correct Answer: C

13. An organization is implementing a new web application firewall (WAF) to protect its web applications from attacks. The security team is debating whether to place the WAF in blocking mode or monitoring mode. Which of the following should be the organization’s PRIMARY consideration in making this decision?

A. The potential impact on application performance
B. The ability of the WAF to accurately differentiate between legitimate traffic and attacks
C. The cost of the WAF solution
D. The ease of managing and maintaining the WAF

Correct Answer: B

14. A company is implementing a new policy that requires all employees to use a Virtual Private Network (VPN) when accessing the company network from a remote location. Some employees have complained that the VPN is difficult to use. Which of the following should be the company’s PRIMARY response to these complaints?

A. Provide training to employees on how to use the VPN
B. Implement a simpler security solution that does not require a VPN
C. Allow employees to opt out of using the VPN if they find it too difficult
D. Implement a two-factor authentication (2FA) solution in addition to the VPN

Correct Answer: A

15. A company is planning to implement a new policy that requires all employees to use multifactor authentication (MFA) when accessing company resources. The Chief Information Security Officer (CISO) is concerned about potential resistance from employees due to the perceived inconvenience of MFA. Which of the following should be the CISO’s PRIMARY strategy to ensure the successful implementation of this policy?

A. Implementing a Single Sign-On (SSO) solution in addition to MFA
B. Providing training and awareness sessions to employees about the importance of MFA
C. Allowing employees to opt out of MFA if they find it too inconvenient
D. Implementing a biometric authentication method as one of the factors in MFA

Correct Answer: B

16. An organization is implementing a new web application. The security team is concerned about potential SQL injection attacks. Which of the following should be the organization’s PRIMARY focus to mitigate this risk?

A. Implementing a web application firewall (WAF)
B. Conducting regular security audits of the web application
C. Implementing input validation for all user inputs in the web application
D. Encrypting all data stored by the web application

Correct Answer: C

17. A company is implementing a new policy that requires all employees to encrypt their email communications. Some employees have complained that the encryption process is too complicated. Which of the following should be the company’s PRIMARY response to these complaints?

A. Provide training to employees on how to encrypt their emails
B. Implement an email client that automatically encrypts emails
C. Allow employees to opt out of email encryption if they find it too complicated
D. Implement a two-factor authentication (2FA) solution for email access

Correct Answer: B

18. A financial organization is considering the adoption of a public cloud solution for its data storage needs. The Chief Information Security Officer (CISO) is concerned about the potential risks associated with data residency and sovereignty. Which of the following should be the CISO’s PRIMARY consideration to address these concerns?

A. Ensuring the cloud provider offers data encryption at rest and in transit
B. Verifying that the cloud provider has data centers in the same jurisdiction as the organization
C. Implementing a robust data backup and recovery solution
D. Conducting regular vulnerability assessments of the cloud environment

Correct Answer: B

19. An organization is implementing a new system that will process and store Personally Identifiable Information (PII). The security team wants to ensure that unauthorized access to this data is prevented. Which of the following should be the organization’s PRIMARY focus to achieve this goal?

A. Implementing a strong password policy for system access
B. Ensuring that data is encrypted both at rest and in transit
C. Conducting regular security awareness training for employees
D. Implementing a role-based access control (RBAC) system

Correct Answer: D

20. A company is concerned about the increasing number of phishing attacks targeting its employees. The Chief Information Security Officer (CISO) wants to implement a solution to reduce the risk of employees falling victim to these attacks. Which of the following should be the company’s PRIMARY strategy?

A. Implementing an email filtering solution to block phishing emails
B. Providing regular training and simulated phishing exercises for employees
C. Implementing two-factor authentication (2FA) for all company systems
D. Regularly updating and patching email servers.

Correct Answer: B

21. A healthcare organization is planning to digitize its patient records. The Chief Information Security Officer (CISO) is concerned about the potential risks associated with the confidentiality and integrity of electronic health records (EHR). Which of the following should be the CISO’s PRIMARY consideration to mitigate these concerns?

A. Implementing a robust backup solution for the EHR system
B. Ensuring that the EHR system is compliant with relevant healthcare regulations
C. Implementing a strong password policy for EHR system access
D. Regularly conducting vulnerability assessments of the EHR system

Correct Answer: B

22. An organization is considering the use of a public Wi-Fi network for its remote employees to access company resources. The security team is concerned about the potential risks associated with public Wi-Fi. Which of the following should be the organization’s PRIMARY focus to mitigate this risk?

A. Implementing a Virtual Private Network (VPN) for remote access
B. Providing training to employees on the risks of public Wi-Fi
C. Implementing MAC address filtering on company devices
D. Ensuring all company devices have updated antivirus software

Correct Answer: A

23. A company is deploying a new web portal for its customers. The portal will store sensitive financial data, and the company wants to ensure the highest level of security. Which of the following should be the company’s PRIMARY strategy to protect the data?

A. Implementing a Content Delivery Network (CDN) to improve portal performance
B. Conducting regular penetration testing on the web portal
C. Implementing data encryption both at rest and in transit
D. Implementing a CAPTCHA system to prevent automated attacks

Correct Answer: C

24. A multinational corporation is expanding its operations to a country with strict data localization laws. The Chief Information Security Officer (CISO) is concerned about complying with these regulations while maintaining data accessibility for global operations. Which of the following should be the CISO’s PRIMARY strategy to address this challenge?

A. Implementing a hybrid cloud solution with data centers located in the new country
B. Encrypting all data transmitted between the company’s global offices
C. Conducting a comprehensive risk assessment of the new country’s IT infrastructure
D. Implementing a strong access control policy for data originating from the new country

Correct Answer: A

25. A company is transitioning its legacy applications to a microservices architecture. The security team wants to ensure that inter-service communications are secure. Which of the following should be the company’s PRIMARY strategy to achieve this?

A. Implementing an API gateway to manage inter-service communications
B. Encrypting all data stored by the microservices
C. Conducting regular vulnerability assessments of the microservices
D. Implementing mutual TLS (mTLS) for inter-service communications

Correct Answer: D

26. A financial institution is considering the adoption of a multi-cloud strategy to enhance resilience and avoid vendor lock-in. The Chief Information Security Officer (CISO) is concerned about the increased complexity and potential security risks. Which of the following should be the CISO’s PRIMARY consideration to address these concerns?

A. Implementing a centralized identity and access management (IAM) solution across all cloud providers
B. Ensuring all cloud providers are compliant with industry-specific regulations
C. Conducting regular backups of data across all cloud environments
D. Implementing a uniform encryption standard across all cloud providers

Correct Answer: A

27. An organization is deploying an Internet of Things (IoT) solution for its manufacturing plants. The security team is concerned about potential unauthorized access to these IoT devices. Which of the following should be the organization’s PRIMARY focus to mitigate this risk?

A. Implementing network segmentation to isolate IoT devices
B. Regularly updating the firmware of the IoT devices
C. Implementing strong authentication mechanisms for IoT device access
D. Conducting regular security awareness training focused on IoT threats

Correct Answer: C

28. A company is developing a new web application that will handle sensitive customer data. The development team wants to ensure that the application is resilient against cross-site scripting (XSS) attacks. Which of the following should be the company’s PRIMARY strategy to achieve this?

A. Implementing input validation for all user inputs in the application
B. Conducting regular penetration testing focused on XSS vulnerabilities
C. Implementing a web application firewall (WAF) with XSS filtering capabilities
D. Providing training to the development team on secure coding practices

Correct Answer: A

29. A retail organization is planning to deploy a new Point of Sale (POS) system across all its stores. The Chief Information Security Officer (CISO) is concerned about potential risks associated with credit card data theft. Which of the following should be the CISO’s PRIMARY consideration to address these concerns?

A. Ensuring the POS system is compliant with the Payment Card Industry Data Security Standard (PCI DSS)
B. Implementing a strong password policy for all POS system users
C. Regularly updating the firmware and software of the POS devices
D. Implementing network segmentation to isolate the POS system from other networks

Correct Answer: A

30. An organization is considering the use of containerization for its application deployment. The security team is concerned about potential risks associated with container escape vulnerabilities. Which of the following should be the organization’s PRIMARY focus to mitigate this risk?

A. Implementing a container orchestration platform with strong security features
B. Regularly scanning container images for known vulnerabilities
C. Implementing network segmentation between containers
D. Providing training to the development team on secure container practices

Correct Answer: B

31. A company is deploying a new cloud-based Customer Relationship Management (CRM) system. The security team wants to ensure that unauthorized access to customer data is prevented. Which of the following should be the company’s PRIMARY strategy to achieve this?

A. Implementing multifactor authentication (MFA) for CRM system access
B. Regularly backing up customer data to a secure location
C. Conducting regular vulnerability assessments of the CRM system
D. Encrypting all customer data stored in the CRM system

Correct Answer: A

32. A global organization is implementing a new video conferencing solution for its remote workforce. The Chief Information Security Officer (CISO) is concerned about potential eavesdropping and data interception during video calls. Which of the following should be the CISO’s PRIMARY consideration to address these concerns?

A. Ensuring the video conferencing solution supports end-to-end encryption
B. Implementing a strong password policy for video conferencing rooms
C. Regularly updating the video conferencing software to the latest version
D. Implementing network segmentation for devices using the video conferencing solution

Correct Answer: A

33. An organization is deploying an intrusion detection system (IDS) to monitor network traffic for malicious activities. The security team is concerned about potential false positives that might disrupt legitimate business operations. Which of the following should be the organization’s PRIMARY focus to mitigate this risk?

A. Regularly updating the IDS signature database
B. Implementing a robust incident response plan
C. Conducting regular security awareness training for employees
D. Fine-tuning the IDS configuration based on the organization’s network traffic patterns

Correct Answer: D

34. A company is considering the adoption of a Software as a Service (SaaS) solution for its human resources (HR) department. The security team is concerned about potential data breaches and unauthorized access to employee data. Which of the following should be the company’s PRIMARY strategy to address this concern?

A. Implementing multifactor authentication (MFA) for the SaaS solution
B. Regularly auditing the SaaS provider’s security practices and compliance certifications
C. Encrypting all data before uploading it to the SaaS platform
D. Implementing strict access controls based on job roles within the HR department

Correct Answer: B

35. A pharmaceutical company is developing a new cloud-based platform to store and analyze clinical trial data. The Chief Information Security Officer (CISO) is concerned about the potential risks associated with data integrity and unauthorized data manipulation. Which of the following should be the CISO’s PRIMARY consideration to address these concerns?

A. Implementing a digital signature mechanism for all data entries
B. Conducting regular backups of the clinical trial data
C. Implementing a strong password policy for all platform users
D. Regularly updating the cloud platform’s software components

Correct Answer: A

36. An organization is planning to deploy a new ecommerce platform. The security team is concerned about potential distributed denial-of-service (DDoS) attacks that might disrupt the platform’s availability. Which of the following should be the organization’s PRIMARY focus to mitigate this risk?

A. Implementing a Content Delivery Network (CDN) with DDoS protection capabilities
B. Regularly scanning the ecommerce platform for vulnerabilities
C. Implementing strict access controls for the platform’s administrative interfaces
D. Conducting regular security awareness training focused on DDoS threats

Correct Answer: A

37. A company is transitioning its data analytics operations to a Big Data platform. The security team wants to ensure that sensitive data, such as Personally Identifiable Information (PII), is protected. Which of the following should be the company’s PRIMARY strategy to achieve this?

A. Implementing data masking techniques for sensitive data fields
B. Regularly auditing user access logs for the Big Data platform
C. Implementing a robust backup solution for the Big Data platform
D. Conducting regular vulnerability assessments of the Big Data platform

Correct Answer: A

38. A financial institution is implementing a new online banking platform. The Chief Information Security Officer (CISO) is concerned about potential risks associated with phishing attacks targeting their customers. Which of the following should be the CISO’s PRIMARY consideration to address these concerns?

A. Implementing a Secure Socket Layer (SSL) certificate for the online banking website
B. Conducting regular phishing simulation exercises for customers
C. Implementing multifactor authentication (MFA) for customer logins
D. Regularly updating the online banking platform’s software components

Correct Answer: C

39. An organization is deploying a new enterprise resource planning (ERP) system. The security team is concerned about potential risks associated with insider threats. Which of the following should be the organization’s PRIMARY focus to mitigate this risk?

A. Implementing strict access controls based on the principle of least privilege
B. Regularly scanning the ERP system for vulnerabilities
C. Implementing a robust backup solution for the ERP system
D. Conducting regular security awareness training focused on insider threats

Correct Answer: A

40. A company is considering the adoption of a hybrid cloud infrastructure to support its growing IT needs. The security team wants to ensure that data movement between the on-premises environment and the cloud is secure. Which of the following should be the company’s PRIMARY strategy to achieve this?

A. Implementing a Virtual Private Network (VPN) between the on-premises environment and the cloud
B. Regularly auditing the cloud provider’s security practices and compliance certifications
C. Encrypting all data at rest in the cloud environment
D. Implementing strict access controls for data stored in the cloud

Correct Answer: A

41. A healthcare institution is implementing a new electronic health record (EHR) system. The Chief Information Security Officer (CISO) is concerned about potential risks associated with unauthorized access to patient records. Which of the following should be the CISO’s PRIMARY consideration to address these concerns?

A. Implementing a robust audit logging mechanism for all access to the EHR system
B. Regularly updating the EHR system to the latest version
C. Implementing multifactor authentication (MFA) for EHR system access
D. Conducting regular security awareness training focused on the importance of patient data privacy

Correct Answer: C

42. An organization is planning to deploy an Internet-facing web application. The security team is concerned about potential risks associated with web application attacks, such as SQL injection and cross-site scripting (XSS). Which of the following should be the organization’s PRIMARY focus to mitigate this risk?

A. Implementing a web application firewall (WAF) with specific rules to detect and block such attacks
B. Regularly backing up the web application data
C. Implementing strict access controls for the web application’s administrative interfaces
D. Conducting regular code reviews to identify and fix vulnerabilities in the application code

Correct Answer: D

43. A company is considering the use of a public cloud platform for its data storage needs. The security team wants to ensure that data confidentiality is maintained even if the cloud provider is compromised. Which of the following should be the company’s PRIMARY strategy to achieve this?

A. Implementing encryption for all data before uploading it to the cloud platform
B. Regularly auditing the cloud provider’s security practices and compliance certifications
C. Implementing a Virtual Private Network (VPN) between the company’s network and the cloud platform
D. Implementing strict access controls for data stored in the cloud based on job roles

Correct Answer: A

44. A manufacturing company is deploying an industrial control system (ICS) to manage its production line. The Chief Information Security Officer (CISO) is concerned about potential risks associated with cyber-physical attacks that could disrupt production. Which of the following should be the CISO’s PRIMARY consideration to address these concerns?

A. Implementing a dedicated network for the ICS, isolated from the corporate network
B. Regularly updating the ICS software to the latest version
C. Implementing multifactor authentication (MFA) for ICS system access
D. Conducting regular security awareness training focused on the importance of ICS security

Correct Answer: A

45. An organization is planning to deploy a Bring Your Own Device (BYOD) policy to allow employees to use their personal devices for work purposes. The security team is concerned about potential risks associated with data leakage. Which of the following should be the organization’s PRIMARY focus to mitigate this risk?

A. Implementing a Mobile Device Management (MDM) solution to control and monitor devices accessing corporate data
B. Regularly backing up all data stored on employee devices
C. Implementing a strong password policy for all devices accessing corporate data
D. Conducting regular security awareness training focused on the risks of using personal devices for work

Correct Answer: A

46. A company is considering migrating its customer database to a cloud-based solution. The security team wants to ensure that the company retains control over the encryption keys used to protect the data. Which of the following should be the company’s PRIMARY strategy to achieve this?

A. Implementing a hybrid cloud solution to keep sensitive data on-premises
B. Regularly rotating the encryption keys used for data protection
C. Using a Bring Your Own Key (BYOK) approach for data encryption in the cloud
D. Implementing strict access controls for data stored in the cloud based on job roles

Correct Answer: C

47. A retail company is deploying a new Point of Sale (POS) system across its stores. The Chief Information Security Officer (CISO) is concerned about potential risks associated with credit card skimming attacks. Which of the following should be the CISO’s PRIMARY consideration to address these concerns?

A. Implementing end-to-end encryption for all credit card transactions
B. Regularly updating the POS system software to the latest version
C. Implementing multifactor authentication (MFA) for POS system access
D. Conducting regular security awareness training focused on recognizing skimming devices

Correct Answer: A

48. An organization is planning to integrate artificial intelligence (AI) into its cybersecurity operations. The security team is concerned about potential risks associated with adversarial attacks on the AI models. Which of the following should be the organization’s PRIMARY focus to mitigate this risk?

A. Implementing a robust backup solution for the AI system data
B. Regularly retraining the AI models with updated and diverse datasets
C. Implementing strict access controls for the AI system’s administrative interfaces
D. Conducting regular security awareness training focused on the risks of AI in cybersecurity

Correct Answer: B

49. A company is considering the use of containerization for its software development and deployment. The security team wants to ensure that container images are free from vulnerabilities. Which of the following should be the company’s PRIMARY strategy to achieve this?

A. Implementing a strict access control policy for the container registry
B. Regularly scanning container images for vulnerabilities using specialized tools
C. Implementing a robust backup solution for the container data
D. Conducting regular security awareness training focused on container security best practices

Correct Answer: B

50. A multinational corporation is expanding its operations to a country with strict data residency laws. The Chief Information Security Officer (CISO) is concerned about potential risks associated with data sovereignty. Which of the following should be the CISO’s PRIMARY consideration to address these concerns?

A. Implementing data encryption for all data transmitted outside the country
B. Storing and processing data locally within the country’s borders
C. Implementing multifactor authentication (MFA) for accessing data
D. Conducting regular security awareness training focused on data residency regulations

Correct Answer: B

51. An organization is planning to adopt a Zero Trust security model. The security team is concerned about potential risks associated with lateral movement attacks within the network. Which of the following should be the organization’s PRIMARY focus to mitigate this risk?

A. Implementing network segmentation based on roles and responsibilities
B. Regularly updating all network devices to the latest firmware version
C. Implementing a strong password policy for all network devices
D. Conducting regular security awareness training focused on the principles of Zero Trust

Correct Answer: A

52. A company is deploying a new IoT-based solution for its smart building infrastructure. The security team wants to ensure that the IoT devices cannot be easily compromised. Which of the following should be the company’s PRIMARY strategy to achieve this?

A. Implementing a dedicated network for IoT devices, isolated from the main corporate network
B. Regularly rotating the passwords used by IoT devices
C. Implementing a robust backup solution for the IoT system data
D. Conducting regular security awareness training focused on IoT security best practices

Correct Answer: A

53. A financial institution is deploying a new mobile banking application. The Chief Information Security Officer (CISO) is concerned about potential risks associated with man-in-the-middle (MITM) attacks during transactions. Which of the following should be the CISO’s PRIMARY consideration to address these concerns?

A. Implementing SSL pinning for the mobile application
B. Regularly updating the mobile application to the latest version
C. Implementing multifactor authentication (MFA) for user logins
D. Conducting regular security awareness training focused on recognizing phishing attempts

Correct Answer: A

You may also like:

Related Posts

Leave a Reply