CISSP Practice Questions (1021–1040)

Answer: B

Rationale: The information owner is responsible for classifying information and defining who should have access to it, including specifying appropriate privileges and access rights based on business need and sensitivity.

Answer: A

Rationale: Reducing an application’s attack surface limits potential entry points for exploitation.

Answer: D

Rationale: RATs enable persistent unauthorized access and control over compromised systems.

Answer: A

Rationale: Fault tolerance ensures system availability by eliminating single points of failure through redundancy.

Answer: A

Rationale: Diffie-Hellman enables secure key exchange dynamically, removing the need to hard-code keys.

Answer: B

Rationale: 802.1x provides port-based access control, ensuring only authenticated devices connect to the network.

Answer: A

Rationale: Regular audits confirm that implemented controls remain effective and compliant with policies and regulations.

Answer: B

Rationale: AES is the industry standard for encrypting data at rest, providing strong confidentiality for stored information.

Answer: D

Rationale: Awareness is not the same as training. In CISSP, security awareness aims simply to focus attention on security and influence behavior, whereas training is used to build specific skills and procedural knowledge.

Answer: C

Rationale: Continuing education and professional development demonstrate commitment to advancing and protecting the cybersecurity profession.

Answer: C

Rationale: TLS authenticates peer identities using certificates, ensuring both ends of the connection are trusted.

Answer: B

Rationale: Integrating third-party identity services (federation, external IdPs) requires a scalable enterprise security architecture that can support cross-domain trust, federated authentication, and consistent policy enforcement across internal and external environments.

Answer: B

Rationale: Risk management involves identifying and linking assets, data, and processes to determine ownership, exposure, and accountability.

Answer: A

Rationale: Relevant security metrics provide quantitative justification for proposed updates to a security program.

Answer: D

Rationale: Strong access controls ensure that only authorized personnel from third parties can access sensitive data, mitigating external risk.

Answer: B

Rationale: The system owner is responsible for ensuring the system operates securely and that information is appropriately managed and protected.

Answer: B

Rationale: Integrating ICS with the office network increases exposure to threats from the enterprise network, reducing ICS isolation and security.

Answer: A

Rationale: TPMs contain a tamper-resistant storage area used for securely storing encryption keys and sensitive platform data.

Answer: D

Rationale: Data stewards are responsible for managing data quality and ensuring that data-related decisions, standards, and impacts are communicated and understood across the organization so that data is used consistently and correctly.

Answer: D

Rationale: A SYN flood attack sends a large number of SYN packets without completing the TCP handshake, filling or exceeding the server’s queue for new TCP connections and preventing legitimate clients from establishing connections.