Question 1

Where can the OWASP list of associated vulnerabilities be found?
A. OWASP Top 10 Project
B. OWASP SAMM
C. OWASP Guide Project
D. OWASP Mobile Project

Accepted Answer

Correct answer: A. The OWASP Top 10 lists the most critical web application vulnerabilities — a global reference for application security programs.

Question 2

Which vulnerability assessment activity BEST exemplifies the 'Examine' method?
A. Review system logs
B. Perform port scans
C. Ask ISSO about patch process
D. Logging into a web server with default admin credentials

Accepted Answer

Correct answer: A. CISSP defines 'Examine' as reviewing documentation, configurations, records, or logs without executing code or directly manipulating systems. Reviewing system logs is a non-intrusive documentation-based activity and best represents the Examine method. Logging in with default credentials is considered Testing, not Examining.

Question 3

Within a large organization, which business unit is BEST positioned to handle provisioning and deprovisioning of user accounts?
A. Training
B. Internal Audit
C. Human Resources
D. IT

Accepted Answer

Correct answer: C. HR manages employment lifecycle — the authoritative source for onboarding/offboarding triggers for account management.

Question 4

After a ransomware attack, management wants improved availability and reduced RTO. Which solution should be implemented?
A. Virtualization
B. Antivirus
C. Process isolation
D. HIPS

Accepted Answer

Correct answer: A. Virtualization supports rapid restoration and replication of systems, reducing downtime — aligning with tighter RTO objectives.

Question 5

Which BEST describes the purpose of a reference monitor when defining access control?
A. Ensure quality by design
B. Validate organizational access policies
C. Cyber hygiene for system health
D. Keep staff safe

Accepted Answer

Correct answer: B. The Reference Monitor enforces access control policy decisions, mediating all access to objects based on system security model.

Question 6

What must be met during internal security audits to ensure objectivity and prevent retaliation?
A. Auditor must be independent and report directly to management
B. Auditor must use automated tools
C. Auditor must work closely with IT
D. Auditor must manually review processes

Accepted Answer

Correct answer: A. Independence ensures unbiased assessments and integrity of audit results — a fundamental CISSP audit principle.

Question 7

A company resells decommissioned drives to vendors. Which data sanitization method ensures security while retaining resale value?
A. Pinning
B. Clearing
C. Purging
D. Overwriting

Accepted Answer

Correct answer: D. Overwriting (logical clearing) securely removes data from storage while preserving the hardware for resale. Purging methods such as degaussing or physical destruction eliminate reuse value. Overwriting meets security needs while maintaining the resale value of the drives.

Question 8

Why is classifying data important during a risk assessment?
A. Framework for metrics
B. Justify security control cost
C. Classify control sensitivity
D. Determine appropriate control level

Accepted Answer

Correct answer: D. Classification helps define the level of protection and controls appropriate for each information type — foundational for CISSP asset management.

Question 9

OWASP SAMM allows organizations to assess impact based on which risk management aspect?
A. Risk tolerance
B. Risk exception
C. Risk treatment
D. Risk response

Accepted Answer

Correct answer: D. OWASP SAMM emphasizes risk response maturity — how effectively an organization reacts and mitigates software security risks.

Question 10

A fiber link between two campuses is broken. Which tool detects the exact break point?
A. OTDR
B. Tone generator
C. Fusion splicer
D. Cable tester

Accepted Answer

Correct answer: A. An Optical Time-Domain Reflectometer (OTDR) locates breaks and signal loss points in fiber optics — essential for telecom troubleshooting.

Question 11

A software architect building a global content platform should focus primarily on:
A. Service-oriented architecture
B. Media caching methodology
C. ISP relationships
D. WAN design

Accepted Answer

Correct answer: B. Content Delivery Networks (CDNs) rely on caching for latency reduction — ensuring global scalability and performance.

Question 12

Which datacenter architecture is most likely used in large SDN and extends beyond the datacenter?
A. iSCSI
B. FCoE
C. Three-tiered
D. Spine-and-leaf

Accepted Answer

Correct answer: B. Fibre Channel over Ethernet (FCoE) integrates storage and data traffic efficiently across SDN fabrics — scalable beyond single datacenters.

Question 13

What is the MOST common use of Online Certificate Status Protocol (OCSP)?
A. Get expiration date of a certificate
B. Get revocation status
C. Get author name
D. Verify certificate validity

Accepted Answer

Correct answer: D. OCSP validates the current revocation status of a digital certificate in real time — confirming it’s still trusted and not revoked.

Would you like me to continue formatting these into your two-column PDF layout (Question #+ Options vs Answer & Rationale side-by-side) like before?

Question 14

Which of the following is the PRIMARY type of cryptography required to support non-repudiation of a digitally signed document?
A. Message digest (MD)
B. Asymmetric
C. Symmetric
D. Hashing

Accepted Answer

Correct answer: B. Non-repudiation is achieved with asymmetric encryption (digital signatures) ensuring sender authenticity and integrity verification.

Question 15

Which of the following is the MOST important first step in preparing for a security audit?
A. Identify team members.
B. Define the scope.
C. Notify system administrators.
D. Collect evidence.

Accepted Answer

Correct answer: B. Defining the scope ensures that the audit boundaries, systems, and objectives are clear before any review begins. CISSP stresses scoping as the foundation of the audit lifecycle.

Question 16

Which of the following should be done at a disaster site before any item is removed, repaired, or replaced?
A. Take photos of the damage.
B. Notify all of the Board of Directors.
C. Communicate with the press.
D. Dispatch personnel to the disaster recovery site.

Accepted Answer

Correct answer: A. Documenting the disaster damage with photos and videos is a critical first step to preserve evidence for insurance and post-incident review. CISSP BCP/DRP best practices require evidence collection before remediation.

Question 17

Which of the following is the MOST common use of the Online Certificate Status Protocol (OCSP)?
A. To obtain the expiration date of an X.509 digital certificate
B. To obtain the revocation status of an X.509 digital certificate
C. To obtain the author name of an X.509 digital certificate
D. To verify the validity of an X.509 digital certificate

Accepted Answer

Correct answer: D. OCSP provides real-time validation of a certificate’s revocation status — confirming its validity without requiring a full Certificate Revocation List (CRL). It’s the modern, faster replacement for CRLs.

Question 18

An organization’s retail website provides its only source of revenue, so the disaster recovery plan must document estimated time for each recovery step. Which step would take the longest?
A. Update NAT table.
B. Update DNS with domain registrar.
C. Update BGP autonomous system number.
D. Update web server network configuration.

Accepted Answer

Correct answer: C. BGP autonomous system number updates require propagation across global routing infrastructure and often require coordination with ISPs, making them slower than DNS propagation or local configuration changes. Because BGP routing changes take longer to stabilize worldwide, this step has the longest recovery time.

Question 19

When resolving ethical conflicts, in what order should an information security professional prioritize responsibilities?
A. Public safety, duties to individuals, duties to the profession, duties to principals
B. Public safety, duties to principals, duties to individuals, duties to the profession
C. Public safety, duties to the profession, duties to principals, duties to individuals
D. Public safety, duties to individuals, duties to the profession, duties to principals

Accepted Answer

Correct answer: C. According to the (ISC)² Code of Ethics, professionals must first protect the public, then uphold the profession, then employers/principals, and finally individuals. This hierarchy preserves professional integrity and societal trust.

Question 20

What HTTP response header disables execution of inline JavaScript and eval()-type functions?
A. Strict-Transport-Security
B. X-XSS-Protection
C. X-Frame-Options
D. Content-Security-Policy

Accepted Answer

Correct answer: D. Content-Security-Policy (CSP) restricts allowed content sources, preventing inline script execution and mitigating XSS attacks — a key CISSP control in web application security.

CISSP Practice Questions (121–140)

Question 121

Question 122

Question 123

Question 124

Question 125

Question 126

Question 127

Question 128

Question 129

Question 130

Question 131

Question 132

Question 133

Question 134

Question 135

Question 136

Question 137

Question 138

Question 139

Question 140