CISSP Practice Questions (61–80)

Answer: C

Rationale: SOC 2 focuses on controls relevant to security, availability, processing integrity, confidentiality, and privacy — directly relevant to DR and BC policies. SOC 1 focuses on financial reporting only.

Answer: A

Rationale: The traffic (forwarding) plane handles how packets are directed based on network state. The control plane manages routing decisions, but actual flow direction (forwarding) occurs in the traffic plane per CISSP networking fundamentals.

Answer: A

Rationale: CISSP emphasizes supply-chain risk — open-source components often have publicly known CVEs that attackers exploit quickly. Developers must validate and patch dependencies; assuming safety (B–D) is incorrect.

Answer: D

Rationale: Information classification should be stakeholder-driven and formally approved by management to reflect organizational importance — aligning with governance standards. CISSP stresses top-level endorsement for consistent classification frameworks.

Answer: D

Rationale: Good security metrics must be repeatable, consistent, and measurable — quantitative metrics enable trend analysis. Visualization or conciseness (B–C) are presentation features, not defining characteristics.

Answer: C

Rationale: Strong access control enforcement prevents unauthorized access and limits exposure when external entities manage systems. Contracts (D) and logs (B) are supplementary safeguards but do not directly prevent compromise.

Answer: A

Rationale: CISSP explicitly defines Open Design as the principle that security should not depend on secrecy of design — countering “security by obscurity.” Robustness comes from tested and transparent mechanisms, not hidden details.

Answer: B

Rationale: KPIs for awareness programs track engagement and participation, such as attendance rates or completion metrics. The number of materials or controls does not measure effectiveness or reach.

Answer: B

Rationale: Fiber-optic systems risk light leakage at connectors, which can expose data through tapping. Shielded or properly terminated cables prevent leakage — a classic CISSP physical communications safeguard.

Answer: D

Rationale: CISSP’s business continuity planning requires MTD to be approved and declared by senior management. Internal audit references this to validate alignment between recovery objectives and business tolerance.

Answer: D

Rationale: A bastion host hardened in a DMZ and protected by MFA provides a secure access gateway. Static IPs and DDNS introduce risk, and screen-sharing tools bypass enterprise controls.

Answer: B

Rationale: A DHCP reservation binds a MAC address to a fixed IP, ensuring consistency. This is commonly used for servers, printers, and security devices.

Answer: B

Rationale: CISSP defines the distinction as scope of protection — network firewalls monitor transit traffic, while host firewalls protect inbound/outbound traffic of the local host itself.

Answer: A

Rationale: Cutover DR testing carries the highest operational risk because production is actually switched to the DR site; other methods (walkthrough, checklist, simulation) are lower risk.

Answer: D

Rationale: Confidential internal policies should only be released through approved channels and with appropriate authorization. The security professional must not unilaterally disclose or ignore the request, but instead route it through official processes so the proper authority (e.g., data owner, legal, or management) can decide whether the information can be shared.

Answer: A

Rationale: Hardening an internet-facing router focuses on network-layer protections such as disabling unnecessary services, enforcing anti-spoofing filters, and applying secure configurations. This directly mitigates IP spoofing attacks (including blind spoofing). MAC flooding is primarily a switch-layer issue, while SQL injection and ransomware are higher-layer application or endpoint concerns.

Answer: C

Rationale: Single Sign-On (SSO) allows a user to authenticate once and then access multiple related systems or applications without re-authenticating. Federated identity extends SSO across organizational boundaries, but the generic description of accessing multiple related servers and applications after one login is classic SSO.

Answer: B

Rationale: While many printers store temporary data, the embedded HDD retains entire image files and cached data, which could include PII. CISSP data sanitization guidance highlights removable or built-in storage as the highest disposal risk.

Answer: B

Rationale: Modularity divides systems into isolated, self‑contained components, aiding containment, fault isolation, and secure boundaries.

Answer: B

Rationale: Dumpster diving occurs during reconnaissance or discovery, where the tester gathers publicly accessible or discarded information before exploitation. It’s passive intelligence collection.