CISSP Practice Questions (401–420)

Answer: B

Rationale: In federated IAM, the Identity Provider (IdP) authenticates users and issues tokens to Service Providers (SPs). Here, the retailer (IdP) validates user identity and grants access to partners (SPs).

Answer: D

Rationale: Least privilege in a cloud environment ensures that systems or segments have only the minimum access necessary. Keeping non-internet resources private minimizes exposure.

Answer: D

Rationale: redundant data usually points directly to deduplication, which removes duplicate files or blocks of data to reclaim storage.

Answer: B

Rationale: MPLS pre-determines the path of packets using labels, allowing routers along the route to forward traffic without making independent routing decisions. This improves speed and performance compared to hop-by-hop routing.

Answer: A

Rationale: A File Integrity Checker detects unauthorized modifications by comparing current file hashes with previously known-good hash values. It alerts when files have been changed without authorization.

Answer: D

Rationale: Business continuity testing is a key step in change management to ensure that any updates or modifications do not disrupt critical operations and that recovery processes remain intact.

Answer: C

Rationale: Multi-pass wipes securely overwrite storage sectors multiple times, erasing data beyond forensic recovery while keeping the drive functional for resale.

Answer: C

Rationale: SOC 2 Type 2 demonstrates that a vendor’s security, availability, processing integrity, confidentiality, and privacy controls were tested and operated effectively over time — the most comprehensive for data protection assurance.

Answer: B

Rationale: Peer-to-Peer (P2P) applications are high risk because they bypass security controls and enable direct file transfers, a common method for malware distribution.

Answer: A

Rationale: Tier 0 represents the physical asset layer — the base hardware level where devices like mobile assets are registered and tracked within asset management frameworks.

Answer: A

Rationale: Encrypting data in transit and at rest ensures confidentiality and integrity against unauthorized access — it’s the fundamental method for protecting information assets.

Answer: C

Rationale: Human Resources (HR) initiates user provisioning based on employment status changes — new hires, transfers, or terminations — which trigger IT account management actions.

Answer: C

Rationale: A mantrap is a physical security control designed to prevent tailgating or piggybacking by only allowing one person to pass through a secure area at a time.

Answer: C

Rationale: In the Do phase, organizations implement the policies and controls defined in the Plan phase. This ensures that BCM processes and procedures are executed as intended before review and improvement stages.

Answer: D

Rationale: SOC 2 Type 1 provides a point-in-time assessment of a vendor’s controls related to data security and operational integrity, serving as a recognized baseline for evaluating compliance readiness.

Answer: A

Rationale: Losing control of network devices is the most critical risk — it enables attackers to reconfigure, disable, or exfiltrate data across the environment, causing total compromise.

Answer: B

Rationale: SOC 1 reports focus on internal controls over financial reporting, ensuring that service providers protect the financial data integrity of client organizations.

Answer: C

Rationale: Automated code analysis tools identify security flaws such as injection or overflow vulnerabilities by testing against continuously updated vulnerability signatures.

Answer: B

Rationale: The (ISC)² Code of Ethics prioritizes:
1️⃣ Public safety first,
2️⃣ Duties to principals (employer/client),
3️⃣ Duties to the profession,
4️⃣ Duties to individuals.

Answer: D

Rationale: ITIL provides best practices for aligning IT services with business needs — improving efficiency, reducing risk, and enhancing service delivery.