CISSP Practice Questions (161–180)

Answer: C

Rationale: Biometric authentication (e.g., fingerprints or iris scans) uniquely ties the access event to a specific individual, ensuring non-repudiation—the person cannot deny their access.

Answer: A

Rationale: Bell-LaPadula enforces “no read-up, no write-down” to preserve confidentiality but makes segregation of duties and flexible access difficult, particularly in dynamic systems.

Answer: B

Rationale: BGP dynamically exchanges routing information between autonomous systems (AS) on the internet, determining the best paths for network traffic between large networks.

Answer: B

Rationale: netstat -a lists all active connections and listening ports, allowing administrators to verify that a service (like a database) is properly bound to a port.

Answer: D

Rationale: Dynamic registration allows temporary, privacy-preserving sharing of identity data—ideal when IdPs and RPs shouldn’t know each other’s full subscriber lists.

Answer: B

Rationale: Packet-filtering routers inspect packet headers and can block IP spoofing. They’re simple, quick to deploy, and efficient for low-risk environments where complex inspection is not needed.

Answer: B

Rationale: Disabling unnecessary services reduces the attack surface and prevents exposure of sensitive data through insecure services or default configurations.

Answer: B

Rationale: A stakeholder is anyone affected by a project or change — this includes employees, departments, customers, or partners who have a vested interest in its outcome.

Answer: A

Rationale: Since printers can’t perform 802.1x authentication, port security can restrict connections to trusted MAC addresses, maintaining a reasonable security control.

Answer: C

Rationale: Segmentation and DMZ-based VPN gateways isolate mobile device traffic from critical assets, reducing exposure and enhancing network security posture.

Answer: B

Rationale: GLBA governs how financial institutions protect consumers’ personal financial data, ensuring confidentiality and disclosure limits.

Answer: A

Rationale: GDPR applies to EU citizens’ personal data, regardless of where the processing occurs, ensuring their privacy is protected internationally.

Answer: C

Rationale: SOC 2 Type 1 reviews design effectiveness of controls at a specific point in time. Type 2 covers operating effectiveness over time, but since the requirement is for 12 months’ overview, Type 1 aligns better with periodic attestation.

Answer: D

Rationale: Federated identity management allows users to authenticate once and access external partner systems securely and seamlessly through trust relationships between organizations.

Answer: C

Rationale: The CISO is responsible for defining and overseeing security architecture, controls, and policies for protecting organizational data—including during cloud migration. While data owners determine classification and business sensitivity, the CISO is accountable for ensuring proper security controls are selected, implemented, and validated throughout the migration lifecycle.

Answer: C

Rationale: The security kernel enforces the rules of the reference monitor concept. It’s the core mechanism managing secure communication among system components.

Answer: B

Rationale: Threat analysis identifies events or conditions that could negatively impact strategic objectives. In strategic risk assessment, understanding threats—including external, internal, environmental, and geopolitical factors—is essential to determining what may affect organizational success. KRIs measure risk trends but do not identify the underlying threats themselves.

Answer: B

Rationale: Attackers frequently use brute-force password attacks on exposed RDP ports (e.g., TCP 3389) to gain unauthorized access.

Answer: C

Rationale: One of the four (ISC)² Code of Ethics canons is to 'Provide diligent and competent service to principals.' This emphasizes professional responsibility and quality of work. Option B is not an official canon, and Option A reflects values from other professions, not (ISC)².

Answer: A

Rationale: Auditing verifies that implemented security controls operate effectively, supporting the verify-and-improve phase of the continuous security review cycle.