CISSP Practice Questions (541–560)

Answer: C

Rationale: Threat modeling evaluates architecture and design to identify and address potential security flaws before implementation.

Answer: A

Rationale: Using unsupported libraries introduces unpatched vulnerabilities that attackers can exploit, posing the highest risk in software supply chains.

Answer: D

Rationale: Notifying the Board of Directors ensures that leadership is informed and can authorize actions before recovery activities begin, maintaining control and accountability.

Answer: C

Rationale: TLS encrypts VoIP signaling and media streams, protecting against eavesdropping and unauthorized access.

Answer: D

Rationale: Encrypting the entire database ensures that sensitive data, including credentials, remain confidential even if unauthorized access occurs.

Answer: C

Rationale: CVSS defines and standardizes vulnerability severity scoring, forming the basis of metrics used by the NVD.

Answer: B

Rationale: Availability ensures systems remain operational and data remains accessible according to defined recovery objectives such as RPO and RTO.

Answer: A

Rationale: Information classification depends on ownership accountability, handling standards, and lifecycle management to ensure compliance and proper risk control.

Answer: B

Rationale: Defining the SOC’s scope and service catalog is the primary consideration for determining what functions it will perform, regardless of staffing or model.

Answer: D

Rationale: Federated access allows predefined access templates and project-specific privileges across systems without centralizing all credentials, maintaining flexibility.

Answer: C

Rationale: Fault tolerance ensures continued secure operation during component failure, a key principle of secure and resilient system design.

Answer: A

Rationale: SCAP standardizes vulnerability definitions and configuration benchmarks, allowing interoperability and consistency between security tools.

Answer: A

Rationale: The SDN northbound API abstracts low-level network details, providing developers with simplified network syntax, flow abstraction, and protocol independence.

Answer: A

Rationale: ABAC dynamically grants access based on attributes such as time, location, and role context, rather than static credentials.

Answer: D

Rationale: Using consistent configurations across virtual servers simplifies management and reduces misconfiguration risk while maintaining uniform security posture.

Answer: B

Rationale: Poor or missing change control introduces instability, unauthorized modifications, and increased risk of system outages or breaches.

Answer: C

Rationale: The CISO ensures that proper controls, compliance, and data protection mechanisms are in place during cloud migrations.

Answer: D

Rationale: Append-only permissions ensure that log entries can be added but never modified or deleted, preserving log integrity.

Answer: B

Rationale: Maintaining chain-of-custody ensures that collected evidence remains authentic and legally defensible throughout the investigation process.

Answer: C

Rationale: SDNs rely on virtualized infrastructure, with control and data planes often hosted on virtual machines to enable flexibility and scalability.