Free Practice CISSP Quiz

Explanation:

This question may be especially challenging since it contains distractors. The best approach with questions like this is to analyze each option carefully, rule out certain options based on key words, and give the available options a rating to see which one is CLOSEST to being the right answer.

Knowledge needed:

This question combines a few cross-domain concepts but ultimately tests your knowledge about the different control categories, such as technical, detective, and compensating. The audit logs themselves are not any type of control (more of an output), but the mechanism that creates them is a technical control. In this case it’s important to pay attention to wording, as “The mechanism that creates audit logs” would definitely be a system drive process, therefore a technical control. Notice how the various responses try to entice you with distractors.

Explanation:

This question may be challenging since it contains distractors in the available responses. The best approach with questions like this is to analyze each option carefully, rule out certain options based on key words, and give the available options a rating to see which one is CLOSEST to being the right answer.

Knowledge needed:

Masquerading is the correct answer, and while the audit logs may not seem useful, if the incident is detected and reported, they may still prove to be useful.
Spoofing without repudiation or recourse would not be the right choice because an authorized account was used. Repudiation and recourse are distractors.
Escalation of privilege with non-repudiation would not be the right choice because no escalation occurred (the account already had elevated privileges).
Tampering, one of the damaging steps within the STRIDE model would not be the right choice because the data was not tampered with; it was stolen/exfiltrated.

Explanation:

This question may be especially challenging since it asks the question in an overly complicated way. The best approach with questions like this when the question is overly large is to skip to the answer options and read through each one carefully (even ISC2 recommends reading the options before the question), and then re-read the question and try to understand what it’s asking. Once you’ve read everything a second or third time, rate each response in terms of what’s closest to being the right answer.

Knowledge needed:

If you got this question wrong, be sure to review the chapter on intellectual property. A digital rights management solution would suitable to protect intellectual property.

Explanation:

This question may be especially challenging since it asks the question in roundabout way. These questions are presented with statements like “which of the following is NOT”, which is misleading for those of us who are quick readers. The best approach with questions like this is to rephrase the question in your mind, and turn it into something like “all of these are good options EXCEPT” and then find the choice that doesn’t fit.

Knowledge needed:

An employee handbook that is not published is not current, and not in effect, thus it cannot be part of personnel security despite it potentially being published in the future (note: the question doesn’t indicate that it’ll be published ever). If you struggled with this question, be sure to study up on personnel security in Domain 1.

Explanation:

This question may be especially challenging since it has multiple correct answers. The best approach with questions like this is to rate each response according to which one would be better than the other. Whichever response has the better rating should be the answer you select.

Knowledge needed:

If you struggled with this question, be sure to review the chapter(s) on contingency planning, steps, and RTO in your book(s). Notice how two sites are mentioned specifically in the question, a primary site and mirror site. There is no mention of a hot site, warm site, or cold site, so we can’t assume that any of these are being used. The best choice in this scenario is to select the “higher level” option of “alternate” site, and we should be looking for recovery steps within the RTO. The terms recovery and reconstitution may be interchangeable in questions like this, but in this case the answer is made obvious due to its relationship to the RTO.

Explanation:

This question may be challenging since it contains irrelevant information. The best approach with questions like this is to take your time in reading the question and available responses a few times to identify the irrelevant information. This will help you to understand what the question is really asking.

Knowledge needed:

Domain 5 teaches about the various factors of authentication: something you know, something you have, and something you are. If you require one, it’s single-factor (such as a password). If you require two or more, it’s considered multifactor.

Knowledge needed:

Of these options, the best choice would be an updated version of LDAP to support TLS since (without knowing other factors) the other options are simply listing components of LDAP without applicability to security. TLS addresses security and would be the best choice in this scenario. If you have work-related experience in a certain area such as LDAP, try not to let it influence your answer selection. The Common Body of Knowledge talks about the better version of LDAP having support for TLS.

Explanation:

This question may be especially challenging since it does not have enough information to make a good choice with the available options (the question is vague or ambiguous). The best approach with questions like this is to either think through the process to what the eventual outcome or missing component might be, or to give the available options a rating to see which one is CLOSEST to being the right answer.

Knowledge needed:

One of the key words in this question is ‘process’. If it were asking about a ‘system’ the nature of the question would change entirely. This process describes a digital signature. The strength or weakness of the hashing function is irrelevant in this question. If you struggled with this question, be sure to study up on Digital Signatures in Domain 3.

This is straight from the Common Body of Knowledge. We include questions like this to prepare you for harder versions of the same question in later practice exams where the terminology may not align perfectly.

Explanation:

This question may be especially challenging since it asks the question in roundabout way. These questions are presented with statements like “which of the following is NOT”, which is misleading for those of us who are quick readers. The best approach with questions like this is to rephrase the question in your mind, and turn it into something like “all of these are good options EXCEPT” and then find the choice that doesn’t fit.

Knowledge needed:

Negative tests demonstrate application behavior when there is unexpected or invalid data. Information on this can be found in Domain 6.

This question tries to trick you by crossing concepts over domains. The question is really asking where is the baseline established? Most likely this is in the Secure phase.