CISSP Practice Questions (461–480)

Answer: B

Rationale: Data classification ensures that security controls match the sensitivity of data and the organization’s risk appetite, allowing proportional protection for each classification level (e.g., public, internal, confidential).

Answer: C

Rationale: Regular manual inspections ensure detection of tampering or breaches to buried data lines — providing an active, verifiable layer of defense that automated systems alone might miss.

Answer: B

Rationale: Baseline cybersecurity standards must be technically measurable and enforceable, ensuring suppliers meet defined configuration, encryption, and control criteria rather than vague or legal descriptions.

Answer: B

Rationale: ABAC grants or denies access based on attributes (e.g., role, device type, location, time, and environment) — offering dynamic and context-aware access decisions.

Answer: B

Rationale: SDN centralizes network control, which creates a single point of failure and increases the attack surface. Compromising the controller can compromise the entire network.

Answer: A

Rationale: Applying the principle of least privilege ensures users only have access necessary for their role, minimizing risk of unauthorized access or data exposure.

Answer: B

Rationale: Detailed and appropriate audit records allow auditors to generate corrective action reports, identifying the cause and recommending solutions without excessive or irrelevant data.

Answer: C

Rationale: Security architecture flows logically as:
Strategy → Program Management → Project Delivery → Governance → Operations, ensuring planning, implementation, oversight, and ongoing management occur in proper sequence.

Answer: B

Rationale: The IATF (Information Assurance Technical Framework) provides international guidance on securing systems, applications, and data — suitable for evaluating SaaS providers globally.

Answer: B

Rationale: Pass-the-ticket is a Kerberos-based attack that allows lateral movement using stolen tickets (authenticated credentials), often prompting organizations to adopt challenge-response mechanisms to stop reuse.

Answer: A

Rationale: GDPR Article 17(3) states that the “right to be forgotten” does not apply when processing is required for legal claims, ensuring data may be retained for legitimate defense.

Answer: D

Rationale: Dumpster diving is a reconnaissance (discovery) activity — it gathers preliminary data (like credentials or configurations) from discarded materials before active testing begins.

Answer: B

Rationale: The internal assessment evaluates real-world effectiveness — tracking phishing simulations or incident rates — rather than subjective employee feedback or quizzes.

Answer: D

Rationale: ITAM systems maintain an inventory linking each device to users, departments, and network locations — enabling fast identification and response to infected assets.

Answer: C

Rationale: Tracking vulnerabilities in open source components helps mitigate zero-day attacks, where unpatched or newly discovered flaws in reused code are exploited.

Answer: C

Rationale: The cloud provider establishes and enforces data security requirements — defining encryption, access, and storage controls — as part of its service responsibility model.

Answer: A

Rationale: NAC validates device posture (e.g., antivirus, patch level) before granting access, ensuring compliance and preventing noncompliant devices from connecting.

Answer: A

Rationale: Emergency vendor accounts represent high-risk external access. CISSP best practice is to disable them by default and only enable them when required, then disable again after use. RBAC limits permissions but does not eliminate the risk of standing vendor accounts.

Answer: B

Rationale: A catastrophe is defined in CISSP frameworks as an event that is deadly, destructive, and massively disruptive. Accidents are smaller-scale and unplanned; disasters require DR activation but are not always deadly.

Answer: C

Rationale: Software forensics analyzes code to identify authorship, origin, and behavior — commonly used in intellectual property or malware attribution investigations.