CISSP Practice Questions (521–540)

Answer: B

Rationale: For VoIP, maintaining consistent Quality of Service (QoS) — minimizing latency and packet loss — is more critical than uptime metrics alone.

Answer: D

Rationale: Interface testing validates secure communication and data exchange between systems. Since unencrypted sensitive data was transmitted to the tax system, the issue occurred at the interface level, not within the application itself. The lack of interface testing led to undetected transmission vulnerabilities.

Answer: A

Rationale: Low fences (three to four feet high) are the most cost-effective means of deterring casual or accidental trespassers. CISSP physical security guidance states that such fences provide a psychological barrier and define the perimeter without the high cost associated with taller or more fortified fencing.

Answer: D

Rationale: Static or dynamic code analysis tools can automatically detect common coding flaws such as injection and buffer overflow errors.

Answer: C

Rationale: The Data Custodian manages data handling and transfer according to classification requirements and ensures compliance with security policies.

Answer: D

Rationale: The data plane (forwarding plane) handles actual traffic flow decisions based on control instructions and infrastructure status.

Answer: C

Rationale: Incident reporting ensures preservation of evidence for legal and forensic purposes, supporting prosecution or remediation actions.

Answer: C

Rationale: Memory segmentation isolates processes, preventing one from accessing another’s allocated space — a core protection mechanism in modern OSs.

Answer: B

Rationale: Threat modeling identifies potential attack vectors early in design, allowing proactive mitigation strategies before code implementation.

Answer: A

Rationale: Offline brute-force attacks are the most effective because they allow unlimited attempts without triggering account lockouts or alerts, testing password strength directly on hashed data.

Answer: B

Rationale: End users are directly affected by operational or procedural changes, as they interact with the system or service being modified.

Answer: B

Rationale: GDPR emphasizes protecting personal data through techniques such as masking and encryption to prevent unauthorized disclosure or access.

Answer: C

Rationale: To ensure private browsing, it’s best to avoid cloud storage of browsing data, keeping information local and under the user’s control.

Answer: B

Rationale: Code reviews occur during the development phase to identify and mitigate vulnerabilities before the testing stage.

Answer: B

Rationale: Access to application folders provides sufficient permissions to view logs without granting unnecessary elevated system privileges.

Answer: C

Rationale: Screening for client-side service vulnerabilities before implementation ensures potential exploits are mitigated prior to deployment.

Answer: A

Rationale: A proper RAR summarizes findings in an executive summary, includes detailed analysis in the body, and adds supporting data or evidence in appendices.

Answer: A

Rationale: ASLR randomizes memory address allocations, preventing malware from reliably exploiting fixed memory locations.

Answer: B

Rationale: A CMDB maintains detailed records of configuration items, making it ideal for tracking software and hardware asset data.

Answer: C

Rationale: Civil investigations address disputes or misconduct between entities such as organizations or individuals rather than criminal acts.