CISSP Practice Questions (101–120)

Answer: A

Rationale: Proper forensic procedure begins with authorization, then planning, examination, and finally reporting — ensuring legal admissibility and chain of custody.

Answer: A

Rationale: Before assessing vendors or controls, CISSP’s secure design approach requires defining scope and assets for migration — knowing what and how much will move.

Answer: A

Rationale: Due diligence identifies and assesses potential security, legal, and financial risks before completing a merger — core CISSP governance practice.

Answer: A

Rationale: Role-Based Access Control ties permissions to group roles, not individuals — a fundamental CISSP concept.

Answer: C

Rationale: Vulnerability testing identifies configuration weaknesses, directly improving hardening and patching efforts

Answer: A

Rationale: A file integrity checker (like Tripwire) detects unauthorized changes to files by comparing cryptographic hashes over time. CISSP’s operations domain uses integrity monitoring as a control against tampering.

Answer: D

Rationale: Multi-factor authentication (MFA) and strong device encryption are the most effective controls for preventing data compromise if a device is seized or stolen during travel. CISSP emphasizes MFA as a safeguard against unauthorized access in hostile environments.

Answer: D

Rationale: Flash drives retain residual data even after overwriting. If released externally, data remanence risks exposure. CISSP guidance notes flash memory requires secure destruction (e.g., physical shredding).

Answer: D

Rationale: A complete Risk Assessment Report includes executive summary, detailed findings, and supporting appendices — consistent with NIST SP 800-30 guidance.

Answer: C

Rationale: UDP operates at the transport layer, where checksums validate integrity. Packets with incorrect checksums are dropped before reaching higher layers.

Answer: D

Rationale: SOC 2 Type 2 evaluates security, availability, confidentiality, and processing integrity controls over a period of time, meeting SaaS operational assurance requirements. Type 1 is only point-in-time.

Answer: B

Rationale: Detailed logs support root cause analysis and accountability. CISSP logging standards require sufficient granularity to investigate incidents effectively.

Answer: A

Rationale: The Mirai botnet exploited weakly secured IoT devices (like cameras and routers) to launch DDoS attacks — a key CISSP case study in insecure embedded systems.

Answer: B

Rationale: SOC 2 focuses on Trust Service Criteria (security, availability, confidentiality, privacy) — directly applicable to cloud and SaaS providers.

Answer: C

Rationale: Physical loss control begins with an inventory of assets — identifying what must be protected before applying controls. CISSP’s asset management process always starts with identification.

Answer: A

Rationale: Logical access controls primarily restrict access through identification, authentication, and authorization; physical access is a separate control family.

Answer: B

Rationale: SDN separates control and data planes. If an attacker sends malicious control messages, they can manipulate network flows — gaining full network control.

Answer: B

Rationale: SOC 2 Type 2 validates operational effectiveness across security, availability, confidentiality, privacy — the standard assurance report for third-party services.

Answer: C

Rationale: Application-level proxies operate at the application layer and can fully inspect HTTP/HTTPS requests, including URL paths, headers, and content. They can enforce content filtering policies, block malicious sites, and log detailed user browsing activity. Circuit-level proxies only verify session setup and cannot inspect URLs, making them insufficient for these requirements.

Answer: B

Rationale: A catastrophe implies massive destruction and prolonged disruption, exceeding normal disaster recovery thresholds — key in CISSP’s risk management terminology.