Free CISSP sample questions

Correct answer: Backup tapes are generated unencrypted

This is the CORRECT answer. Backup tapes generated unencrypted represent the GREATEST risk to data confidentiality. If these tapes are lost, stolen, or improperly disposed of, all the sensitive data they contain becomes immediately accessible to unauthorized parties. Backup tapes often contain complete copies of critical databases and systems, making their compromise catastrophic for confidentiality. Other options may pose risks but none as severe and direct as unencrypted data at rest.

Correct answer: Conduct a gap analysis of a new facilities against existing security requirements

This is the CORRECT answer. From a data security perspective, conducting a gap analysis of the new facilities against existing security requirements is the most important consideration. This analysis will identify what security controls need to be implemented, upgraded, or modified in the new location to maintain the same level of data protection. It ensures that data classification requirements, access controls, physical security, and environmental protections are properly addressed in the new facility.

Correct answer: Application

This is the CORRECT answer. In a Tier 4 data center, application failures should be the primary concern for the IT manager during BCP planning. Tier 4 data centers provide fault-tolerant infrastructure with 99.995% uptime, redundant power, cooling, and network systems. Since the infrastructure is highly resilient, application-level failures become the most likely cause of service disruption that BCP must address.

Correct answer: Only when standards are defined

This is the CORRECT answer. According to ISO 27001 and 27002, management responsibilities can only be defined when standards are established. The standards provide the framework and requirements that determine what management responsibilities are needed for information security governance. Without standards defining the security requirements and controls, it is impossible to assign appropriate management responsibilities.

Correct answer: Hire a guard to protect the public area

This is the CORRECT answer. Hiring a guard to protect the public area is the most cost-effective reactive control for protecting personnel in public areas. A reactive control responds to incidents as they occur, and a security guard can immediately respond to threats, incidents, or emergencies involving personnel or visitors. This human control provides flexibility, judgment, and real-time response capabilities that automated systems cannot match. The other options are either preventive controls (mantraps, enclosures) or require more expensive infrastructure investments compared to hiring security personnel. Guards can also serve multiple functions including access control, emergency response, and incident reporting, making them highly cost-effective for public area protection.

Correct answer: People, technology, and operations

This is the CORRECT answer. Defense in depth requires a balanced focus on People, Technology, and Operations as the three PRIMARY elements. This concept, fundamental to CISSP Security Architecture domain, recognizes that effective security cannot be achieved through technology alone. People include security awareness, training, and proper procedures. Technology encompasses the security tools and controls. Operations involve the processes, procedures, and management practices that tie everything together. The other options represent phases or activities within security programs but are not the foundational elements of defense in depth strategy. Reference: https://www.giac.org/paper/gsec/3873/information-warfare-cyber-warfare-future-warfare/106165

Correct answer: Right of the owner to control delivery method

This is the CORRECT answer. Intellectual property rights are primarily concerned with the right of the owner to control the delivery method of their creation. This relates to the CISSP Legal and Compliance domain, covering how intellectual property can be distributed, accessed, and used. Control over delivery method encompasses licensing terms, distribution channels, access restrictions, and usage limitations. While financial gain and copyright maintenance are important considerations, the fundamental right is about controlling how the intellectual property reaches and is used by others. This control ensures the owner can enforce licensing agreements, prevent unauthorized distribution, and maintain the integrity of their intellectual creation.

Correct answer: 25%

This is the CORRECT answer. The residual risk is 25%. This question tests quantitative risk analysis from the CISSP Security Assessment domain. To calculate residual risk: First, the control stops 50% of attacks, so 50% still occur. Of those attacks that do occur (50%), the impact is reduced by 50%, meaning only 50% of the original impact remains. Therefore: 50% (attacks that occur) × 50% (remaining impact) = 25% residual risk. This calculation demonstrates how layered controls work together - prevention controls reduce likelihood while impact reduction controls minimize damage when prevention fails. Understanding residual risk calculations is essential for risk management and justifying security investments.

Correct answer: Physical Layer

This is the CORRECT answer. In the OSI model, the Physical Layer (Layer 1) is responsible for the transmission of binary data over a communications network. This relates to the CISSP Communication and Network Security domain. The Physical Layer handles the actual electrical, optical, or radio signals that represent binary 1s and 0s, including voltage levels, cable specifications, connector types, and transmission media characteristics. The Data-Link Layer (Layer 2) handles frame formatting and error detection, the Network Layer (Layer 3) manages routing and logical addressing, and the Application Layer (Layer 7) provides network services to applications. Understanding the OSI model layers is fundamental for network security architecture and troubleshooting communication security issues.

Correct answer: Spoofing

This is the CORRECT answer. Spoofing refers to the technique of authenticating one machine to another by forging packets from a trusted source. This falls under the CISSP Communication and Network Security domain. IP spoofing involves modifying packet headers to make them appear to originate from a trusted or legitimate source when they actually come from an attacker. This technique is used in various attacks including denial of service, session hijacking, and bypassing access controls. Smurfing is a specific type of DDoS attack, Man-in-the-Middle involves intercepting communications, and session redirect involves manipulating session tokens. Understanding spoofing techniques is essential for implementing proper network authentication and anti-spoofing controls.