CISSP Practice Questions (1–20)

Answer: D

Rationale: Defining an ISCM strategy based on risk tolerance is the foundational step because it sets direction, objectives, and boundaries. Without this, subsequent design and implementation lack focus. CISSP emphasizes starting with strategy before architecture or metrics. The other options (A–C) are tactical steps that follow once the strategy is defined.

Answer: D

Rationale: Security involvement must begin at requirements definition — when the need and purpose are documented — to ensure security is built in rather than bolted on later. This aligns with CISSP SDLC principles emphasizing early engagement in the concept/requirements phase.

Answer: D

Rationale: While physical safety of personnel is first, the next priority is resources and reputation — representing business continuity and stakeholder trust. CISSP exam perspective: protecting assets and maintaining operations preserves organizational viability beyond tangible items like hardware.

Answer: A

Rationale: Deduplication removes redundant data by storing only unique instances, making it more efficient than compression for redundant data elimination.

Answer: C

Rationale: Logging and auditing are essential for detecting misuse and ensuring accountability in remote access systems. While a DMZ separation (A) improves network security, CISSP prioritizes visibility and traceability for remote sessions — hence C is best.

Answer: C

Rationale: A Protection Profile (PP) defines generic, implementation-independent security requirements and objectives — it’s not tied to a specific system. The Security Target (ST) applies those requirements to an actual implementation. CISSP exams often test this distinction.

Answer: D

Rationale: WPA2-Enterprise uses 802.1X with EAP for authentication; SSH, IPsec, and SSL/TLS aren’t how Wi-Fi clients authenticate onto the WLAN.

Answer: B

Rationale: Network Access Control (NAC) verifies device compliance (patch level, AV, configuration) before granting network access — exactly what the Question #describes. GPO and MDM apply policies but do not verify compliance pre-connection.

Answer: A

Rationale: Traffic filtering using virtual firewalls or vSwitch ACLs prevents unauthorized VM-to-VM communication and limits lateral movement. This is the most effective protection method for virtualized environments.

Answer: D

Rationale: 192.168.1.2/30 is in 192.168.1.0/30 and 192.168.1.6/30 is in 192.168.1.4/30—different L3 networks—so inter-subnet traffic must go through a router.

Answer: B

Rationale: For cloud enablement, the foundational SDN property is the separation/integration of control and data planes with centralized programmability (option B). Policy-shaping (D) is a result of SDN, but CISSP reasoning favors the core architectural capability that enables cloud agility and automation.

Answer: C

Rationale: To ensure components gracefully handle invalid input, the explicit CISSP-preferred method is negative testing (a.k.a. error/abuse testing). Integration tests verify interactions, but negative testing directly validates robust handling of bad input.

Answer: C

Rationale: Security must be built into requirements and objectives at the start — “security by design.” Audits and reviews come later, but CISSP prioritizes embedding objectives early to ensure secure SDLC.

Answer: A

Rationale: Federated identity enables cross-organization authentication while maintaining control over user management. SAML supports it technically, but federation is the broader architectural model — best CISSP answer.

Answer: A

Rationale: Excessive lockouts reduce availability — legitimate users can’t access systems. Strong authentication policies must balance security and usability, a common CISSP concept.

Answer: B

Rationale: DNS design inherently lacks authentication, allowing cache poisoning and spoofing; DNSSEC addresses this flaw.

Answer: D

Rationale: Quantum Key Distribution (QKD) offers provable security through quantum mechanics, unlike PKI which depends on computational assumptions.

Answer: B

Rationale: 802.1X offers port-based authentication before network access, verifying credentials and device compliance — the most secure NAC method. MAC filtering is easily spoofed, and NAT is unrelated to NAC.

Answer: A

Rationale: Before selecting a PP, the technical design must be verified to ensure chosen controls match system architecture. CISSP exam expects alignment between PP and technical requirements.

Answer: C

Rationale: Recognizing and reporting suspicious activity indicates security awareness training success. Awareness enables employees to identify social engineering attempts — key CISSP domain 7 concept.