CISSP Practice Questions (141–160)

Answer: B

Rationale: A MITM attack via Evil Twin AP captures traffic from unsuspecting users who connect to the attacker’s access point — a known wireless security threat in CISSP.

Answer: A

Rationale: A data steward manages data quality, business definitions, and usage — ensuring enterprise-wide consistency and meaning. Security is the responsibility of data custodians, not stewards.

Answer: B

Rationale: Protecting systems and data directly aligns with the second canon: “Protect society, the commonwealth, and the infrastructure.” CISSP ethics emphasize global good before personal or organizational interests.

Answer: D

Rationale: The Project Manager ensures coordination, communication, and successful delivery of change initiatives — integrating technical and business objectives under change management governance.

Answer: C

Rationale: A cold site provides infrastructure (space, power, network) but lacks preinstalled systems. It has the lowest cost and longest recovery time — critical in BCP classification.

Answer: A

Rationale: VLANs logically segment networks, limiting broadcast domains and isolating traffic, which enhances both performance and security — a common CISSP network control.

Answer: C

Rationale: Mandatory participation ensures consistency across the workforce. Awareness programs must be comprehensive and recurring to change behavior effectively.

Answer: D

Rationale: For magnetic HDDs with highly classified data, CISSP expects degaussing as the purge method per legacy NIST 800‑88/DoD logic. Note: real-world 800‑88r1 often prefers physical destruction; CISSP exam still selects degauss for magnetic HDDs.

Answer: C

Rationale: Address Space Layout Randomization (ASLR) randomizes memory address allocation, preventing predictable exploitation by malware — key in CISSP’s system hardening controls.

Answer: B

Rationale: The Operation stage in ISO 27001/27005 cycles involves executing corrective actions to address nonconformities found in audits.

Answer: A

Rationale: All controls fit into administrative (policy), technical (logical), and physical (environmental) domains per CISSP security management principles.

Answer: D

Rationale: To solve key distribution issues in symmetric encryption, asymmetric (RSA) keys are used to securely exchange symmetric session keys — ensuring confidentiality and scalability.

Answer: C

Rationale: Big data relies on distributed data collection and processing across multiple nodes (e.g., Hadoop, Spark). This decentralization improves scalability and availability.

Answer: D

Rationale: In CISSP context, “safe execution” refers to runtime type enforcement — dynamically typed languages can validate and enforce data types at execution, preventing type-related vulnerabilities.

Answer: B

Rationale: If an organization won’t accept residual risk, it can transfer it — typically by buying insurance or outsourcing, aligning with CISSP risk treatment strategies.

Answer: A

Rationale: The first step in defining a cybersecurity program is to perform a gap analysis by mapping current practices to recognized frameworks (like ISO 27001 or NIST). This identifies strengths, weaknesses, and compliance gaps before setting objectives or implementing controls.

Answer: D

Rationale: Active-active clustering ensures redundancy and fault tolerance. It compensates for lack of surge protection by ensuring continuous service availability even if equipment is damaged or fails.

Answer: D

Rationale: Attribute-Based Access Control (ABAC) uses policies evaluating user, resource, and environment attributes—not predefined roles like RBAC.

Answer: C

Rationale: The (ISC)² Code of Ethics requires professionals to perform only services for which they are fully competent and qualified. The correct approach is to inform the CISO and request assistance or training.

Answer: B

Rationale: “Pass-the-ticket” attacks exploit stolen Kerberos tickets to authenticate across systems without knowing user passwords—allowing lateral movement within a network.