ISC2 CISSP Practice Exam

• A. Refuse to downgrade the rating and escalate to executives in writing, citing patient safety Correct answer
• B. Report the flaw to the regulator and press first, bypassing internal escalation
• C. Commission an independent penetration test before deciding whether the severity should change
• D. Record the finding as low severity as instructed and schedule a fix after launch

Option A is correct because the ISC2 Code of Ethics puts protecting society and the common good first, and a flaw that lets anyone alter insulin dosage is a patient-safety risk that must not be downgraded for a launch date. Written escalation keeps the issue on record and uses the proper chain of authority. Option B bypasses internal escalation, Option C only delays a decision on an obvious safety flaw, and Option D falsifies the risk rating.

• A. Availability
• B. Accountability
• C. Integrity Correct answer
• D. Confidentiality

Option C is correct because integrity is the assurance that data is accurate and has not been altered without authorization, and an unnoticed change to an invoice amount violates that. Availability concerns access to the data, confidentiality concerns disclosure, and accountability concerns tracing actions to individuals, none of which is the core failure here.

• A. Hand the department shared generic accounts to use for the rest of the shift
• B. Switch to paper charting for emergency patients until the service is restored
• C. Invoke the break-glass procedure for named clinicians, with sessions logged for review Correct answer
• D. Suspend multifactor authentication for all clinical staff until the service returns

Option C is correct because a break-glass procedure gives named clinicians emergency access so care continues, while logging and after-the-fact review preserve accountability and protect patient records. Shared generic accounts (A) destroy accountability, and suspending MFA for everyone (D) removes a control for all staff. Paper charting (B) slows emergency care and does not restore access to the records the clinicians need.

• A. Information security officer
• B. Data processor
• C. Data owner Correct answer
• D. Data custodian

Option C is correct because the data owner is the accountable business role that decides classification and handling requirements for the data. The custodian applies the controls, the processor handles data on the owner's behalf, and the security officer advises on the policy but does not assign the business sensitivity level.

• A. Relabel the subsidiary's data under the parent's scheme before any files are exchanged
• B. Keep both schemes and have the security team review each exchanged file before release
• C. Apply the stricter scheme's handling rules to all exchanged files until the schemes are reconciled
• D. Have the data owners of both companies map the labels to equivalent handling rules Correct answer

Option D is correct because the data owners are accountable for sensitivity decisions, so mapping the two schemes to equivalent handling rules must start with them before anything is exchanged. Relabeling unilaterally or reviewing every file is slow and bypasses owner accountability, and applying the stricter scheme to everything is an interim measure that does not reconcile the schemes.

• A. Let the report author assign the label from their knowledge of the content and then send it
• B. Label the report Internal because most of its content comes from the Internal dashboard
• C. Hold the transfer until both owners have reviewed the combined content and agreed a label
• D. Label the report Confidential and send it under that level's controls, pending review Correct answer

Option D is correct because derived or aggregated data takes the classification of its most sensitive component (high-water mark), and the report still contains identifiable Confidential customer rows. With no owner reachable and policy silent, sending it under Confidential controls pending review protects the data while meeting the deadline. Labeling it Internal under-protects it, an author's judgment is not owner authority, and holding the transfer ignores the business need when a safe path exists.

• A. Economy of mechanism
• B. Fail-safe defaults
• C. Open design Correct answer
• D. Least common mechanism

Option C is correct because open design (Kerckhoffs's principle) says a mechanism's security should rest on the secrecy of keys or credentials, not on hiding how it works. Economy of mechanism favors simplicity, fail-safe defaults denies access unless explicitly granted, and least common mechanism limits shared components; none addresses design secrecy.

• A. Place the file servers behind a next-generation firewall that inspects all traffic entering the data center from user subnets
• B. Authorize each request using verified identity and device posture, wherever on the network it originates Correct answer
• C. Require all remote staff to connect through a VPN concentrator so they receive the same trust as staff in the office
• D. Group workstations into departmental VLANs and permit unrestricted traffic between systems that share a VLAN

Option B is correct because zero trust removes implicit trust based on network location and authorizes every request using verified identity and device posture. Options A, C and D still grant trust based on network position (perimeter, VPN or shared VLAN), which is exactly what allowed lateral movement in the breach.

• A. Transfer the exposure by buying a cyber insurance rider that covers card data breaches and treat the gap as addressed
• B. Reprioritize the capital plan to replace all terminals this quarter and defer other approved security projects
• C. Define compensating controls, such as isolation and access monitoring, that meet the requirement's intent, with the risk owner's approval Correct answer
• D. Tailor the baseline by scoping the encryption requirement out for these terminals and record the decision in the control catalog

Option C is correct because when a requirement cannot be met directly and the vendor will not fix it, compensating controls (isolation, access monitoring) that satisfy the requirement's intent, approved by the risk owner, are the proper response. Insurance transfers only financial impact and does not close the gap, replacing everything immediately is disproportionate, and scoping the requirement out simply removes the protection without mitigating the risk.

• A. Transport layer
• B. Session layer
• C. Network layer Correct answer
• D. Data link layer

Option C is correct because routers operate at the Network layer (Layer 3) and forward packets using logical addresses such as IP addresses. Transport deals with end-to-end segments and ports, Session manages dialogues, and Data link uses physical (MAC) addresses.

• A. Move both tiers into the screened subnet and rely on host-based authentication between the web and database servers
• B. Move the database into the screened subnet beside the web servers and enable transparent encryption of its data files
• C. Keep the web tier in the screened subnet and put the database on an internal segment open only to the web tier Correct answer
• D. Place the web tier on the internal network and publish it to the Internet through port forwarding on the perimeter firewall

Option C is correct because the web tier must be reachable from the Internet and so belongs in the screened subnet, while the database sits on an internal segment that only the web tier can reach. A compromised web server then cannot freely reach the data. Options A and B put the database in the exposed zone, and option D places the Internet-facing tier on the internal network.

• A. Internal IPv6 hosts sit behind address translation so that their addressing is hidden from the Internet
• B. Stateless address auto-configuration is switched on for every VLAN so hosts obtain addresses without manual setup
• C. Firewall rules and monitoring tools evaluate IPv6 traffic, including tunnelled traffic, with controls equal to IPv4 Correct answer
• D. Existing IPv4 access control lists are retained unchanged because they also filter IPv6 packets on the same interfaces

Option C is correct because enabling IPv6 creates a second protocol path that firewalls, IDS and monitoring must cover equally, including tunnelled IPv6 that can bypass IPv4-only controls. Option A is wrong since NAT is not a security control and IPv6 is not normally translated, option B concerns convenience rather than security, and option D is wrong because IPv4 ACLs do not filter IPv6 packets.

• A. Install optical turnstiles that release automatically on a fire alarm Correct answer
• B. Add entrance cameras and review footage after each reported incident
• C. Station a guard at the entrance during the busiest shift changes
• D. Run quarterly tailgating awareness campaigns with badge-challenge drills

Option A is correct because optical turnstiles physically prevent following through a door and fail open on a fire alarm, so life-safety egress is never delayed. Cameras (B) are detective only, guards (C) cover just part of the day, and awareness drills (D) don't physically stop tailgating.

• A. Discretionary access control
• B. Mandatory access control with sensitivity labels
• C. Role-based access control
• D. Attribute-based access control Correct answer

Option D is correct because attribute-based access control evaluates attributes of the subject, device and environment (patch status, location) at request time. DAC, MAC and RBAC rely on owner discretion, labels and roles and cannot make such contextual decisions.

• A. Reassess the cardholder-data environment after every major release and defer other systems to a multi-year cycle
• B. Run quarterly penetration tests on the data center network and leave the platform to developer testing
• C. Reassess every in-scope system annually at the same depth so results stay comparable year over year
• D. Set depth and frequency by each system's risk and rate of change, with continuous checks on the platform Correct answer

Option D is correct because assessment depth and frequency should follow each system's risk and rate of change, so the weekly-changing platform gets continuous checks while the stable network is assessed less often. Options A and B leave systems on a long cycle or on developer testing alone, which cannot give the board evidence that cardholder-data controls work. Option C applies the same depth everywhere, which wastes effort on stable systems and under-tests the fast-changing one.

• A. A reporting template approved by the audit committee that sets the format of the findings
• B. Written rules of engagement signed by the portal's owner that set scope, timing and permitted techniques Correct answer
• C. A remediation schedule agreed with the portal's hosting team for the vulnerabilities expected to be found
• D. A data-handling agreement that limits how long the firm may retain captured patient records

Option B is correct because signed rules of engagement from the system owner give legal authorization and define scope, timing and permitted techniques, and no testing should begin without them. The reporting template, the remediation schedule and the data-handling terms are all useful but can be settled alongside or after authorization, and none of them makes the test lawful or safe to start.

• A. Export and hash the proxy logs due to roll over, record custody, and report the preservation to counsel Correct answer
• B. Disable the contractor's accounts and recover the laptop so no further transfers can occur
• C. Image the contractor's laptop and have the forensic team review its contents for the customer records
• D. Obtain counsel's written approval of the scope, then collect the proxy logs and the laptop image

Option A is correct because the proxy logs are the one piece of evidence that will be lost within 24 hours, so they must be exported, hashed and covered by a custody record now, while counsel is told what was preserved and can still define the scope. Option B does nothing about the expiring logs and may alert the contractor. Option C is worthwhile but can wait until the logs are safe, and Option D lets the logs roll over while waiting for approval.

• A. Retain logs on each source system, with access limited to its system administrators
• B. Forward logs in real time to a write-once store that administrators cannot alter Correct answer
• C. Encrypt each host's logs nightly with a key held on the same host
• D. Extend local log retention on every server to twelve months

Option B is correct because logs sent in real time to a write-once store are out of reach of a compromised administrator account, so the record stays trustworthy as evidence. Option A leaves logs on the systems the administrators control and can alter. Option C encrypts the logs with a key kept on the same host, which an attacker with host access also obtains. Option D only keeps the logs longer and does nothing to protect their integrity.

• A. During requirements definition Correct answer
• B. During acceptance testing before release
• C. During unit testing of the first modules
• D. During the design review of the system architecture

Option A is correct because security requirements are derived from business needs, data classification and compliance obligations, which are captured during requirements definition; identifying them there lets design, coding and testing all trace back to them. Options B, C and D are later phases where missing requirements are far costlier to add and can only be verified, not originated.

• A. Penetration testing of an early build in the staging environment
• B. Fuzz testing of the planned service interfaces
• C. Threat modeling of data flows and trust boundaries Correct answer
• D. Static analysis of the prototype code and its libraries

Option C is correct because threat modeling works from architecture diagrams, data flows and trust boundaries, so it exposes design-level flaws before any code exists and at the lowest cost. Options A, B and D all require a running build, interfaces or code that do not yet exist, and they find implementation defects rather than design flaws.