CISSP+ CERTIFICATION EXAM STUDY GUIDE
2025 to 2026 COMPLETE REVIEW NOTES
PRACTICE QUESTIONS VERIFIED ANSWERS
and DETAILED EXPLANATIONS
What is the focus of the Information Flow security model? - CORRECT
ANSWER-The Information Flow security model concerns itself with how
information should or should not be passed from subject to subject within a
secure environment.
What is the focus of the Biba security model? - CORRECT ANSWER-
Integrity.
What is not directly provided by cryptography? - CORRECT
ANSWER-Availability is not directly provided by cryptography.
What should be used in a heating, ventilation and air conditioning (HVAC)
system? - CORRECT ANSWER-An HVAC system should employ
positive drain and positive pressure. Positive drain ensure that
condensation does not pool, and positive pressure prevents untreated air
from entering a building.
What TCP/IP layer do routers operate at? - CORRECT ANSWER-
Routers operate at the Internet layer of the TCP/IP model.
What are the three scores in CVSS? - CORRECT ANSWER-In order
they are:
1) Base;
,2) Temporal;
3) Environmental.
What port does S-HTTP operate on? - CORRECT ANSWER-TCP
Port 80, as it only encrypts the http data.
What should an HVAC system use? - CORRECT ANSWER-Positive
drain and positive pressure.
Why is Kerberos not susceptible to eavesdropping? - CORRECT
ANSWER-Kerberos credentials are encrypted by a secret key before
being sent over the network.
What type of cipher operates by rearranging groups of characters? -
CORRECT ANSWER-A block transposition cipher.
What is the difference between substitution and transposition ciphers? -
CORRECT ANSWER-Substitution replaces plaintext with different
characters; transposition just rearranges the existing characters.
What is the difference between stream and block ciphers? - CORRECT
ANSWER-Stream ciphers process one character at a time; block ciphers
process characters in groups.
,Which is more robust: stream or block ciphers? - CORRECT
ANSWER-Block ciphers are stronger, but they also require more
processing power than stream ciphers.
What are the phases of incident response? - CORRECT ANSWER-1)
Detection;
2) Containment;
3) Eradication;
4) Recovery;
5) Reporting.
How do stateful firewalls differ from other types? - CORRECT
ANSWER-They only allow traffic into the network if a corresponding
request was sent from inside the network. Essentially, the stateful firewall
actively invites traffic into the network (invitation only).
What is OAuth? - CORRECT ANSWER-An open http authentication
framework based on RFC 6749 which provides third-party applications
delegated access to resources without passing user credentials.
What is the "Ring Model"? - CORRECT ANSWER-A method of
hardware layering that uses system calls to communicate with the CPU via
the OS.
What is the focus of the Bell-LaPadula security model? - CORRECT
ANSWER-Data confidentiality
, What is the focus of the Biba security model? - CORRECT ANSWER-
Data integrity
What is the purpose of key distribution center? - CORRECT
ANSWER-To enable single-sign on services by functioning as a trusted
third-party authentication server.
What vulnerability does a covert storage channel present? - CORRECT
ANSWER-It can enable two processes with different security levels to
access the same information on a storage medium.
How do time domain reflectometry systems detect intrusion? -
CORRECT ANSWER-By receiving all or part of an RF signal when an
intruder tries to climb a fence. The RF signal is sent through cables running
parallel to a fence. When the cable is flexed the RF signal is reflected back
to its source. The TDR sensor measures the travel time of the returned RF
signal and so is able to calculate the location of the intruder.
What is a zero-day exploit? - CORRECT ANSWER-Malicious code
that takes advantage of a vulnerability that has no fix.
What is a zero-day vulnerability? - CORRECT ANSWER-A
vulnerability for which there is no currently existing fix.
What element of perimeter security is most likely to involve the use of
layered defenses? - CORRECT ANSWER-Delay.
2025 to 2026 COMPLETE REVIEW NOTES
PRACTICE QUESTIONS VERIFIED ANSWERS
and DETAILED EXPLANATIONS
What is the focus of the Information Flow security model? - CORRECT
ANSWER-The Information Flow security model concerns itself with how
information should or should not be passed from subject to subject within a
secure environment.
What is the focus of the Biba security model? - CORRECT ANSWER-
Integrity.
What is not directly provided by cryptography? - CORRECT
ANSWER-Availability is not directly provided by cryptography.
What should be used in a heating, ventilation and air conditioning (HVAC)
system? - CORRECT ANSWER-An HVAC system should employ
positive drain and positive pressure. Positive drain ensure that
condensation does not pool, and positive pressure prevents untreated air
from entering a building.
What TCP/IP layer do routers operate at? - CORRECT ANSWER-
Routers operate at the Internet layer of the TCP/IP model.
What are the three scores in CVSS? - CORRECT ANSWER-In order
they are:
1) Base;
,2) Temporal;
3) Environmental.
What port does S-HTTP operate on? - CORRECT ANSWER-TCP
Port 80, as it only encrypts the http data.
What should an HVAC system use? - CORRECT ANSWER-Positive
drain and positive pressure.
Why is Kerberos not susceptible to eavesdropping? - CORRECT
ANSWER-Kerberos credentials are encrypted by a secret key before
being sent over the network.
What type of cipher operates by rearranging groups of characters? -
CORRECT ANSWER-A block transposition cipher.
What is the difference between substitution and transposition ciphers? -
CORRECT ANSWER-Substitution replaces plaintext with different
characters; transposition just rearranges the existing characters.
What is the difference between stream and block ciphers? - CORRECT
ANSWER-Stream ciphers process one character at a time; block ciphers
process characters in groups.
,Which is more robust: stream or block ciphers? - CORRECT
ANSWER-Block ciphers are stronger, but they also require more
processing power than stream ciphers.
What are the phases of incident response? - CORRECT ANSWER-1)
Detection;
2) Containment;
3) Eradication;
4) Recovery;
5) Reporting.
How do stateful firewalls differ from other types? - CORRECT
ANSWER-They only allow traffic into the network if a corresponding
request was sent from inside the network. Essentially, the stateful firewall
actively invites traffic into the network (invitation only).
What is OAuth? - CORRECT ANSWER-An open http authentication
framework based on RFC 6749 which provides third-party applications
delegated access to resources without passing user credentials.
What is the "Ring Model"? - CORRECT ANSWER-A method of
hardware layering that uses system calls to communicate with the CPU via
the OS.
What is the focus of the Bell-LaPadula security model? - CORRECT
ANSWER-Data confidentiality
, What is the focus of the Biba security model? - CORRECT ANSWER-
Data integrity
What is the purpose of key distribution center? - CORRECT
ANSWER-To enable single-sign on services by functioning as a trusted
third-party authentication server.
What vulnerability does a covert storage channel present? - CORRECT
ANSWER-It can enable two processes with different security levels to
access the same information on a storage medium.
How do time domain reflectometry systems detect intrusion? -
CORRECT ANSWER-By receiving all or part of an RF signal when an
intruder tries to climb a fence. The RF signal is sent through cables running
parallel to a fence. When the cable is flexed the RF signal is reflected back
to its source. The TDR sensor measures the travel time of the returned RF
signal and so is able to calculate the location of the intruder.
What is a zero-day exploit? - CORRECT ANSWER-Malicious code
that takes advantage of a vulnerability that has no fix.
What is a zero-day vulnerability? - CORRECT ANSWER-A
vulnerability for which there is no currently existing fix.
What element of perimeter security is most likely to involve the use of
layered defenses? - CORRECT ANSWER-Delay.
