ISC2 Certified Information Systems Security Professional (CISSP) - Blueprint Practice Exam 1

1. A company connects development and production networks through a firewall. What is most important for the initial rule set?
2. A contractor needs access to one internal application. Which design best limits network exposure?
3. A control costs $90,000 annually and reduces estimated annual loss from $160,000 to $120,000. What should inform the decision?
4. A control operates as designed but does not address the relevant threat. What distinction is important?
5. A critical application is vulnerable even though its network uses strong encryption. What does this demonstrate?
6. A critical dependency is replaced with a malicious package of a similar name. What defense best addresses this supply-chain risk?
7. A customer needs to verify a software package came from the publisher and was not altered. Which mechanism best fits?
8. A disaster-recovery exercise restores servers but excludes application transactions. What is the main assessment gap?
9. A file is encrypted using AES, and its key is stored beside it without access restrictions. What is the main deficiency?
10. A leased disk containing restricted data cannot be destroyed before return. What should determine the sanitization method?
11. A legal hold applies to records otherwise due for deletion. What is the best action?
12. A merger introduces incompatible access practices across two companies. What should guide the integration plan?
13. A network team proposes TLS inspection for all outbound connections. What should be assessed before deployment?
14. A new security leader inherits competing technical projects with no documented business priorities. What should they do first?
15. A patch is urgently required for an exploited vulnerability. How should change management respond?
16. A penetration tester identifies an attractive target outside the signed scope. What should happen before testing it?
17. A privileged account is needed briefly for emergency maintenance. Which design best supports control and accountability?
18. A responder finds active malware on a server containing volatile evidence. What should guide the next action?
19. A restore point meets the RPO but recovery takes longer than the approved RTO. What has failed?
20. A SaaS application trusts an external identity provider. What must the relying party validate in a signed assertion?
21. A security review finds direct concatenation of untrusted input into SQL. Which remediation is most appropriate?
22. A supplier has a valid certification but will process unusually sensitive data. What is the best next step?
23. A system administrator manages backups according to the owner's approved requirements. What role is illustrated?
24. A system owner wants to accept a high residual risk outside delegated tolerance. What should the security manager do?
25. A team wants to address abuse cases before implementation. Which activity best supports this?
26. A threat model identifies an untrusted parser handling privileged requests. What should be prioritized in the design?
27. A user has two memorized passwords from separate systems. Why is entering both not necessarily multifactor authentication?
28. A vulnerability dashboard reports total findings but not business exposure. What is the best improvement?
29. After a breach, management asks who can approve external notifications. What should define the answer?
30. An application handles highly sensitive secrets in memory shared with untrusted workloads. Which design principle is most relevant?
31. An application uses a service identity with database owner permissions for routine reads. What should be changed?
32. An authorization service becomes unavailable during a network partition. Which default best follows fail-secure design for restricted records?
33. An employee changes jobs internally and accumulates privileges from both roles. What best addresses the cause?
34. An executive asks why the organization needs security policy instead of only technical standards. Which response is best?
35. An offsite backup is accessible using the same compromised administrator identity as production. What weakness is present?
36. An organization wants resource permissions to depend on department, data classification and device compliance. Which model best fits?
37. Logs use inconsistent timestamps across systems. What is the most significant investigation concern?
38. Management wants independent assurance of a control assessment. Which arrangement best supports this?
39. Two sites need confidentiality and integrity for traffic crossing an untrusted carrier. Which approach is appropriate?
40. Who should make the accountable business decision about a dataset's classification?

Comments — 0