CISSP-CERTIFIED INFORMATION SYSTEMS SECURITY
PROFESSIONAL EXAM TESTBANK | ALL QUESTIONS AND
ANSWERS 2026/2027 | VERIFIED ANSWERS PLUS RATIONALES
GRADED Q&A COMPREHENSIVE STUDY GUIDE | VERIFIED
LATEST 2027
1. A security manager discovers that an administrator has been bypassing standard change
management controls to deploy emergency patches directly to production servers. Which of
the following is the primary risk introduced by this practice?
A. Increased network latency due to unoptimized patch sizes
B. Undocumented configuration drift and compromised system integrity
C. Immediate expiration of existing SSL/TLS certificates
D. Automatic revocation of the organization's ISO 27001 certification
Answer: B
Bypassing change management leads to undocumented configuration drift, making it difficult
to track system states, troubleshoot failures, or maintain audit compliance and security
baselines.
2. Which of the following access control models relies on security labels attached to objects
and clearance levels assigned to subjects to enforce mandatory policy compliance?
A. Discretionary Access Control (DAC)
B. Role-Based Access Control (RBAC)
C. Mandatory Access Control (MAC)
D. Attribute-Based Access Control (ABAC)
Answer: C
Mandatory Access Control (MAC) uses security labels and clearances, such as hierarchical
classification levels, managed exclusively by a central authority rather than the object owner.
3. An organization is evaluating cloud deployment models for a new application containing
highly sensitive financial records. The chief information security officer insists on exclusive
hardware tenancy and strict physical security oversight. Which cloud model best satisfies
these requirements?
A. Public cloud
B. Community cloud
C. Private cloud
D. Hybrid cloud
,Answer: C
A private cloud infrastructure is provisioned for exclusive use by a single organization,
providing maximum control over physical security, resource isolation, and data governance.
4. During an annual risk assessment, an organization identifies a critical database
vulnerability. The cost to remediate the vulnerability is estimated at fifty thousand dollars,
while the expected single loss expectancy resulting from a successful exploit is two hundred
thousand dollars with an annualized rate of occurrence of zero point five. What is the
annual loss expectancy (ALE)?
A. Twenty-five thousand dollars
B. One hundred thousand dollars
C. One hundred fifty thousand dollars
D. Two hundred thousand dollars
Answer: B
Annual Loss Expectancy is calculated by multiplying the Single Loss Expectancy by the
Annualized Rate of Occurrence ($200,000 \times 0.5 = $100,000).
5. Which cryptographic mode of operation converts a block cipher into a stream cipher,
enabling encryption with feedback mechanisms and error propagation characteristics
suitable for secure communication channels?
A. Electronic Codebook (ECB)
B. Cipher Block Chaining (CBC)
C. Output Feedback (OFB)
D. Galois/Counter Mode (GCM)
Answer: B
Cipher Block Chaining (CBC) uses an initialization vector and combines each plaintext block
with the previous ciphertext block, providing confidentiality while linking blocks together.
6. A security architect is designing a perimeter defense strategy for an enterprise network.
Which component should be placed in the demilitarized zone (DMZ) to handle external
web traffic while protecting internal backend resources?
A. Active directory domain controller
B. Reverse proxy server
C. Internal vulnerability scanner
D. Hardware security module (HSM)
Answer: B
,A reverse proxy server sits in the DMZ to intercept and inspect inbound external traffic,
shielding internal web servers from direct exposure to the public internet.
7. An employee receives an email appearing to come from the Chief Executive Officer
requesting an urgent wire transfer to a new vendor. The email creates a strong sense of
urgency and instructs the employee not to call to verify. This attack is best classified as:
A. Spear phishing / Business Email Compromise (BEC)
B. SQL injection
C. Cross-site scripting (XSS)
D. Session hijacking
Answer: A
Business Email Compromise and spear phishing target specific individuals with manipulated
sender addresses and social engineering tactics to induce unauthorized financial transactions.
8. Which phase of the Systems Development Life Cycle (SDLC) focuses on verifying that
the software meets functional requirements, security specifications, and design criteria
before operational deployment?
A. Initiation phase
B. Testing and verification phase
C. Conceptual design phase
D. Disposal phase
Answer: B
The testing phase validates system functionality, security controls, and design requirements
against specifications before releasing software into production environments.
9. According to the (ISC)² Code of Ethics, what is the primary duty of a certified
information systems security professional when faced with a conflict between
organizational directives and public safety?
A. Prioritize employer profitability above all external factors
B. Protect society, the commonwealth, and the infrastructure above corporate interests
C. Resign immediately without reporting the security violation
D. Follow executive management orders regardless of ethical implications
Answer: B
The first canon of the (ISC)² Code of Ethics requires professionals to protect society, the
common good, necessary public infrastructure, and the environment above corporate
demands.
, 10. Which physical security control is specifically designed to prevent piggybacking or
tailgating at secure building entrances?
A. Chain-link fence
B. Motion detector
C. Mantrap (airlock portal)
D. Bollard
Answer: C
A mantrap consists of two interlocking doors where the first door must close and verify
identity before the second door opens, preventing unauthorized tailgating.
11. A security analyst is investigating a suspected intrusion and needs to capture volatile
memory from a compromised Linux server. Which tool or practice is most appropriate for
preserving digital evidence integrity?
A. Restarting the server immediately to clear temporary caches
B. Utilizing specialized memory acquisition utilities like LiME (Linux Memory Extractor) while
maintaining a strict chain of custody
C. Deleting system logs to free up storage space for analysis
D. Modifying file timestamps directly to match investigation notes
Answer: B
Using specialized tools like LiME allows secure capture of volatile RAM while documenting the
chain of custody to maintain forensic integrity and admissibility.
12. Which asymmetric cryptographic algorithm relies on the mathematical difficulty of
factoring large composite numbers into their prime factors?
A. Advanced Encryption Standard (AES)
B. Rivest-Shamir-Adleman (RSA)
C. Elliptic Curve Cryptography (ECC)
D. Triple DES (3DES)
Answer: B
The RSA algorithm derives its security from the computational complexity of factoring the
product of two large prime numbers.
13. Which type of software testing involves examining the internal logical structure, code
paths, and execution branches of an application without necessarily executing the program
in a runtime environment?
A. Black-box testing
PROFESSIONAL EXAM TESTBANK | ALL QUESTIONS AND
ANSWERS 2026/2027 | VERIFIED ANSWERS PLUS RATIONALES
GRADED Q&A COMPREHENSIVE STUDY GUIDE | VERIFIED
LATEST 2027
1. A security manager discovers that an administrator has been bypassing standard change
management controls to deploy emergency patches directly to production servers. Which of
the following is the primary risk introduced by this practice?
A. Increased network latency due to unoptimized patch sizes
B. Undocumented configuration drift and compromised system integrity
C. Immediate expiration of existing SSL/TLS certificates
D. Automatic revocation of the organization's ISO 27001 certification
Answer: B
Bypassing change management leads to undocumented configuration drift, making it difficult
to track system states, troubleshoot failures, or maintain audit compliance and security
baselines.
2. Which of the following access control models relies on security labels attached to objects
and clearance levels assigned to subjects to enforce mandatory policy compliance?
A. Discretionary Access Control (DAC)
B. Role-Based Access Control (RBAC)
C. Mandatory Access Control (MAC)
D. Attribute-Based Access Control (ABAC)
Answer: C
Mandatory Access Control (MAC) uses security labels and clearances, such as hierarchical
classification levels, managed exclusively by a central authority rather than the object owner.
3. An organization is evaluating cloud deployment models for a new application containing
highly sensitive financial records. The chief information security officer insists on exclusive
hardware tenancy and strict physical security oversight. Which cloud model best satisfies
these requirements?
A. Public cloud
B. Community cloud
C. Private cloud
D. Hybrid cloud
,Answer: C
A private cloud infrastructure is provisioned for exclusive use by a single organization,
providing maximum control over physical security, resource isolation, and data governance.
4. During an annual risk assessment, an organization identifies a critical database
vulnerability. The cost to remediate the vulnerability is estimated at fifty thousand dollars,
while the expected single loss expectancy resulting from a successful exploit is two hundred
thousand dollars with an annualized rate of occurrence of zero point five. What is the
annual loss expectancy (ALE)?
A. Twenty-five thousand dollars
B. One hundred thousand dollars
C. One hundred fifty thousand dollars
D. Two hundred thousand dollars
Answer: B
Annual Loss Expectancy is calculated by multiplying the Single Loss Expectancy by the
Annualized Rate of Occurrence ($200,000 \times 0.5 = $100,000).
5. Which cryptographic mode of operation converts a block cipher into a stream cipher,
enabling encryption with feedback mechanisms and error propagation characteristics
suitable for secure communication channels?
A. Electronic Codebook (ECB)
B. Cipher Block Chaining (CBC)
C. Output Feedback (OFB)
D. Galois/Counter Mode (GCM)
Answer: B
Cipher Block Chaining (CBC) uses an initialization vector and combines each plaintext block
with the previous ciphertext block, providing confidentiality while linking blocks together.
6. A security architect is designing a perimeter defense strategy for an enterprise network.
Which component should be placed in the demilitarized zone (DMZ) to handle external
web traffic while protecting internal backend resources?
A. Active directory domain controller
B. Reverse proxy server
C. Internal vulnerability scanner
D. Hardware security module (HSM)
Answer: B
,A reverse proxy server sits in the DMZ to intercept and inspect inbound external traffic,
shielding internal web servers from direct exposure to the public internet.
7. An employee receives an email appearing to come from the Chief Executive Officer
requesting an urgent wire transfer to a new vendor. The email creates a strong sense of
urgency and instructs the employee not to call to verify. This attack is best classified as:
A. Spear phishing / Business Email Compromise (BEC)
B. SQL injection
C. Cross-site scripting (XSS)
D. Session hijacking
Answer: A
Business Email Compromise and spear phishing target specific individuals with manipulated
sender addresses and social engineering tactics to induce unauthorized financial transactions.
8. Which phase of the Systems Development Life Cycle (SDLC) focuses on verifying that
the software meets functional requirements, security specifications, and design criteria
before operational deployment?
A. Initiation phase
B. Testing and verification phase
C. Conceptual design phase
D. Disposal phase
Answer: B
The testing phase validates system functionality, security controls, and design requirements
against specifications before releasing software into production environments.
9. According to the (ISC)² Code of Ethics, what is the primary duty of a certified
information systems security professional when faced with a conflict between
organizational directives and public safety?
A. Prioritize employer profitability above all external factors
B. Protect society, the commonwealth, and the infrastructure above corporate interests
C. Resign immediately without reporting the security violation
D. Follow executive management orders regardless of ethical implications
Answer: B
The first canon of the (ISC)² Code of Ethics requires professionals to protect society, the
common good, necessary public infrastructure, and the environment above corporate
demands.
, 10. Which physical security control is specifically designed to prevent piggybacking or
tailgating at secure building entrances?
A. Chain-link fence
B. Motion detector
C. Mantrap (airlock portal)
D. Bollard
Answer: C
A mantrap consists of two interlocking doors where the first door must close and verify
identity before the second door opens, preventing unauthorized tailgating.
11. A security analyst is investigating a suspected intrusion and needs to capture volatile
memory from a compromised Linux server. Which tool or practice is most appropriate for
preserving digital evidence integrity?
A. Restarting the server immediately to clear temporary caches
B. Utilizing specialized memory acquisition utilities like LiME (Linux Memory Extractor) while
maintaining a strict chain of custody
C. Deleting system logs to free up storage space for analysis
D. Modifying file timestamps directly to match investigation notes
Answer: B
Using specialized tools like LiME allows secure capture of volatile RAM while documenting the
chain of custody to maintain forensic integrity and admissibility.
12. Which asymmetric cryptographic algorithm relies on the mathematical difficulty of
factoring large composite numbers into their prime factors?
A. Advanced Encryption Standard (AES)
B. Rivest-Shamir-Adleman (RSA)
C. Elliptic Curve Cryptography (ECC)
D. Triple DES (3DES)
Answer: B
The RSA algorithm derives its security from the computational complexity of factoring the
product of two large prime numbers.
13. Which type of software testing involves examining the internal logical structure, code
paths, and execution branches of an application without necessarily executing the program
in a runtime environment?
A. Black-box testing
