CISSP Practice Questions (481–500)

Answer: B

Rationale: Disabling unneeded services and tightening configurations addresses security misconfiguration, one of the OWASP Top 10 vulnerabilities that increases attack exposure.

Answer: A

Rationale: Threat modeling proactively evaluates how newly acquired software could be exploited within your environment, identifying attack vectors and security gaps before integration.

Answer: A

Rationale: A defined log retention policy ensures logs are archived, rotated, and preserved according to organizational requirements, preventing them from being overwritten. Increasing file size only delays overwriting but does not prevent it.

Answer: C

Rationale: GDPR mandates that data controllers notify the supervisory authority within 72 hours of becoming aware of a personal data breach, unless unlikely to result in risk.

Answer: D

Rationale: Code review is critical to identify vulnerabilities and logic flaws early in agile releases. It ensures the MVP meets secure coding practices before wider deployment.

Answer: D

Rationale: Negative testing checks how software behaves under invalid, unexpected, or malicious input, revealing weaknesses in input validation or error handling.

Answer: A

Rationale: Resilient network design—including redundancy, failover paths, adaptive routing, and reconfigurable infrastructure—prevents attackers from disabling the network. Access control does not stop attacks that target availability, such as DDoS or link disruption.

Answer: C

Rationale: Data classification identifies and categorizes sensitive data (e.g., confidential, internal, public), forming the foundation for implementing effective DLP policies and controls.

Answer: C

Rationale: The program sponsor provides organizational authority, strategic alignment, resources, and executive support. They are responsible for ensuring the success of major change initiatives across the entire organization.

Answer: C

Rationale: Federation authorities act as trusted intermediaries managing authentication between IdPs and RPs without revealing subscriber details — maintaining privacy across entities.

Answer: B

Rationale: The TPM securely stores root encryption keys within the device hardware, enabling strong endpoint encryption like BitLocker without exposing master keys to the OS.

Answer: B

Rationale: FIPS 140-2 specifies strong, validated algorithms such as AES (>128 bits), DH (≥2048 bits), and RSA (≥1024 bits) for secure key exchange and digital signatures.

Answer: A

Rationale: The goal of metrics is to measure behavior change and awareness improvements among employees — ensuring training effectiveness, not just participation tracking.

Answer: B

Rationale: DevOps relies on continuous integration and automated testing to ensure rapid, consistent validation of code quality. Manual approval processes such as CRBs slow down development and are not aligned with DevOps principles.

Answer: B

Rationale: A security assessment plan (SAP) defines objectives, scope, methodology, and criteria for conducting assessments — ensuring consistent and measurable evaluations.

Answer: D

Rationale: Physical loss control begins with creating an accurate inventory of assets. Valuation and control selection can only occur after all assets are identified.

Answer: A

Rationale: The Legal department ensures retention, discovery, and disclosure obligations for e-records are met under applicable laws and litigation requirements.

Answer: B

Rationale: Tiered log storage — online for recent activity and offline for archives — balances performance, retention, and cost efficiency while maintaining compliance.

Answer: D

Rationale: Federation refers to multiple domains establishing trust to share authentication and authorization data securely.

Answer: B

Rationale: Effective training increases user vigilance, resulting in more reporting of suspicious messages—not fewer.