CISSP Practice Questions (41–60)

Answer: A

Rationale: Obfuscation conceals sensitive data elements, reducing what is exposed to attackers. While data-masking (D) hides values for specific views, obfuscation provides generalized protection against direct analysis — consistent with privacy-by-design principles tested in CISSP.

Answer: B

Rationale: Use of unsupported or unpatched libraries introduces persistent vulnerabilities without vendor fixes. CISSP supply-chain management stresses dependency security and component lifecycle awareness as highest risk compared with skills or evaluation complexity.

Answer: C

Rationale: CISSP incident-response lifecycle begins with detection → reporting → analysis. Immediate isolation or remediation before reporting can destroy evidence. Prioritizing and reporting align with structured IR processes (NIST 800-61).

Answer: D

Rationale: ISCM specifically means continuous security monitoring for situational awareness and risk decisions. ISMS governs the program, RMF manages risk lifecycle, and ISACs share threat intel. CISSP Domain 7 explicitly maps this term to NIST SP 800-137.

Answer: A

Rationale: Enumeration occurs when distinct error messages reveal valid usernames. Generic failure messages (“invalid username or password”) prevent this disclosure. Strong passwords and 2FA strengthen authentication but don’t stop enumeration.

Answer: A

Rationale: A security audit evaluates compliance, controls, and overall posture — the broadest assessment type. Pen tests and threat models are narrower. CISSP emphasizes due diligence via audits during mergers and acquisitions.

Answer: B

Rationale: Evaluation criteria are established during the planning and requirements phase before system acquisition or development.

Answer: D

Rationale: A site-to-site VPN encrypts data between entire networks over untrusted links, ideal for datacenter-to-datacenter communication. SSH is for single sessions; in-band adds risk by sharing production channels.

Answer: B

Rationale: For public-facing systems, SSL/TLS certificates must be trusted by browsers — meaning signed by a recognized CA. Internal signing would cause trust errors. Input validation is critical later but the key external-facing concern is certificate trust chain integrity.

Answer: A

Rationale: Directory services (e.g., Active Directory, LDAP) maintain authoritative identity sources that IDaaS consumes. MFA and SSO rely on directories but don’t store core identities themselves.

Answer: D

Rationale: You must classify data before applying DLP controls so sensitivity and handling requirements are known. Policy creation and IRM come later once categories are defined.

Answer: D

Rationale: A known-plaintext attack uses both plaintext and ciphertext pairs to deduce the key — exactly as described. Frequency analysis is statistical, and ciphertext-only lacks plaintext for comparison.

Answer: A

Rationale: EAP‑TLS provides mutual certificate-based authentication and native TLS encryption, avoiding passwords. It offers the strongest identity assurance versus tunneled password methods like PEAP or EAP‑TTLS.

Answer: B

Rationale: Change management ensures that changes are tested and approved before deployment; User Acceptance Testing is part of this preventive stage.

Answer: C

Rationale: Lack of change control is the most common cause of operational and security failures; it leads to unauthorized or poorly tested modifications.

Answer: D

Rationale: The four (ISC)² canons include: protect society, act honorably, provide diligent service to principals, and advance the profession. “Provide diligent and competent service” is one of the mandatory ethical canons.

Answer: B

Rationale: Annual Loss Expectancy (ALE) = (Single Loss Expectancy × Annualized Rate of Occurrence).
Three incidents in 15 years = 0.2 incidents/year.
70,000 × 0.05 = 3,500, matching option B. CISSP expects you to calculate ALE to determine expected annualized cost of risk.

Answer: D

Rationale: CISSP emphasizes maintaining complete and accurate asset inventories via automated configuration and management systems. Combining configuration, network, and license management ensures both visibility and compliance. Manual or isolated methods lack coverage and accuracy.

Answer: C

Rationale: A comprehensive wordlist or dictionary forms the core of effective brute-force or hybrid password strength testing. Offline attacks are faster but require password hashes, not always available. Online attacks trigger locks; social engineering is a different category entirely.

Answer: D

Rationale: Choosing a wireless spectrum depends on device compatibility, vendor support, and interference. CISSP’s communications domain prioritizes operational practicality — ensuring chosen spectrum works with existing equipment and minimal disruption.