CISSP Practice Questions (81–100)

Answer: D

Rationale: ASLR randomizes memory address allocations, making it difficult for attackers to predict where code or libraries reside. This prevents buffer or heap overflow exploits from reliably executing injected shellcode.

Answer: C

Rationale: MTD = RTO + WRT.
RTO covers restoration of IT systems, and WRT accounts for business process catch-up. CISSP BCP metrics directly define this relationship.

Answer: C

Rationale: If there’s inadequate storage, logging fails silently, defeating the purpose of auditing. Ensuring capacity and retention are in place supports accountability — a CISSP monitoring and logging control.

Answer: A

Rationale: TLS encrypts VoIP signaling (e.g., SIP) and ensures confidentiality/authentication. 802.1x secures physical access but not end-to-end voice sessions; WAF applies to HTTP traffic only.

Answer: C

Rationale: Challenge-response authentication uses a dynamic token or algorithm-based code that changes each login, mitigating replay attacks — a key CISSP multifactor concept.

Answer: C

Rationale: Instant messaging applications often use dynamic or random ports, making it difficult for perimeter firewalls to identify, filter, and control the traffic. This significantly undermines perimeter security and is the most important challenge from a CISSP perspective.

Answer: C

Rationale: Accidental data leaks are typically due to user ignorance. Awareness and training ensure employees understand acceptable use and storage locations — foundational in CISSP security awareness programs.

Answer: C

Rationale: PCI-DSS mandates encryption of stored and transmitted cardholder data as a primary control. Retention or disposal are secondary operational concerns.

Answer: A

Rationale: Full-disk encryption immediately prevents disclosure of sensitive data even if physical theft occurs — CISSP’s primary control for mobile device data security.

Answer: D

Rationale: Baseline standards are technical benchmarks defining required configurations and controls (e.g., patch levels, encryption strength). CISSP differentiates these from policy (management intent) or legal terms.

Answer: A

Rationale: The CIA triad is a conceptual model or tool used to think about and classify security objectives for data and systems. It helps practitioners and management understand and balance confidentiality, integrity, and availability requirements; it is not itself an implementation or an assessment method.

Answer: C

Rationale: Channel bonding combines adjacent 20 MHz channels into wider 40 MHz ones to increase throughput without hardware upgrades — cost-effective for Wi-Fi 4 environments.

Answer: B

Rationale: A mobile device management (MDM) or enterprise mobility management (EMM) solution installed on devices provides event logging, tracking, and control — enabling continuous monitoring as required.

Answer: D

Rationale: Static analysis examines code without executing it — often disassembling binaries to inspect logic and detect vulnerabilities.

Answer: C

Rationale: COTS products are widely used, so vulnerabilities and exploits are more likely publicized, making them prime attack targets. CISSP notes this under software-acquisition risks.

Answer: B

Rationale: A missing or inactive log source indicates potential system compromise or failure, whereas 404 errors are expected behavior.

Answer: B

Rationale: Transposition ciphers rearrange characters within fixed-size blocks, not altering letter frequencies — making them recognizable through block-pattern analysis.

Answer: A

Rationale: Firewalls and IDS/IPS logs record anomalous or novel network traffic that may indicate zero-day exploitation attempts. Honeypots attract attacks but are secondary evidence sources.

Answer: C

Rationale: NAC enforces endpoint compliance by requiring multi-factor credentials or posture validation before granting access — enforcing policy at connection time.

Answer: D

Rationale: Without adequate log granularity, investigators cannot correlate events to specific users or systems. CISSP stresses detailed, timestamped, and correlated logs.