CISSP
Certified Information Systems Security Professional
Practice Exam
Cyber Interactive L.L.C.
,Contents
Section 1: Questions ..................................................................................................................................... 3
Security and Risk Management ................................................................................................................ 3
Asset Security ......................................................................................................................................... 54
Security Architecture and Engineering ................................................................................................... 59
Communication and Network Security ................................................................................................... 65
Identity and Access Management (IAM) ................................................................................................ 78
Security Assessment and Testing ............................................................................................................ 85
Security Operations................................................................................................................................. 91
Software Development Security ............................................................................................................. 98
Section 2: Answers and Explanations ....................................................................................................... 104
Security and Risk Management ............................................................................................................ 105
Asset Security ....................................................................................................................................... 124
Security Architecture and Engineering ................................................................................................. 126
Communication and Network Security ................................................................................................. 128
Identity and Access Management (IAM) .............................................................................................. 133
Security Assessment and Testing .......................................................................................................... 136
Security Operations............................................................................................................................... 138
Software Development Security ........................................................................................................... 141
2
,Section 1: Questions
Security and Risk Management
1. What is the primary goal of risk management?
A. Identify risks
B. Mitigate risks
C. Accept risks
D. Transfer risks
2. What is the purpose of a security policy?
A. Enforce specific technical controls
B. Document management procedures
C. Guide and support security objectives
D. Specify server configurations
3. What is the purpose of a security governance framework?
A. Set organizational security policies
B. Monitor network traffic
C. Develop encryption algorithms
D. Assess system vulnerabilities
4. What is the purpose of a business impact analysis (BIA) in the context of risk management?
A. Identify critical business functions and their dependencies
B. Test incident response procedures
C. Evaluate server performance
D. Assess network vulnerabilities
5. What is the primary purpose of a security policy framework?
A. Define technical controls
B. Set organizational security policies
3
, C. Monitor system performance
D. Develop encryption algorithms
6. What is the purpose of a risk assessment matrix?
A. Identify and prioritize risks
B. Develop encryption algorithms
C. Test incident response procedures
D. Assess network vulnerabilities
7. What is the primary purpose of a security risk assessment?
A. Assess the impact of security incidents
B. Identify vulnerabilities and assess risks
C. Test incident response procedures
D. Monitor system performance
8. What is the purpose of a privacy impact assessment (PIA) in the context of security and risk
management?
A. Assess the impact of security incidents on privacy
B. Identify vulnerabilities and assess risks
C. Test incident response procedures
D. Monitor system performance
9. What is the primary objective of a security awareness training program?
A. Enforce access control policies
B. Prevent security incidents
C. Monitor system performance
D. Test incident response procedures
10. What is the purpose of a risk treatment plan in the risk management process?
A. Identify and prioritize risks
4
Certified Information Systems Security Professional
Practice Exam
Cyber Interactive L.L.C.
,Contents
Section 1: Questions ..................................................................................................................................... 3
Security and Risk Management ................................................................................................................ 3
Asset Security ......................................................................................................................................... 54
Security Architecture and Engineering ................................................................................................... 59
Communication and Network Security ................................................................................................... 65
Identity and Access Management (IAM) ................................................................................................ 78
Security Assessment and Testing ............................................................................................................ 85
Security Operations................................................................................................................................. 91
Software Development Security ............................................................................................................. 98
Section 2: Answers and Explanations ....................................................................................................... 104
Security and Risk Management ............................................................................................................ 105
Asset Security ....................................................................................................................................... 124
Security Architecture and Engineering ................................................................................................. 126
Communication and Network Security ................................................................................................. 128
Identity and Access Management (IAM) .............................................................................................. 133
Security Assessment and Testing .......................................................................................................... 136
Security Operations............................................................................................................................... 138
Software Development Security ........................................................................................................... 141
2
,Section 1: Questions
Security and Risk Management
1. What is the primary goal of risk management?
A. Identify risks
B. Mitigate risks
C. Accept risks
D. Transfer risks
2. What is the purpose of a security policy?
A. Enforce specific technical controls
B. Document management procedures
C. Guide and support security objectives
D. Specify server configurations
3. What is the purpose of a security governance framework?
A. Set organizational security policies
B. Monitor network traffic
C. Develop encryption algorithms
D. Assess system vulnerabilities
4. What is the purpose of a business impact analysis (BIA) in the context of risk management?
A. Identify critical business functions and their dependencies
B. Test incident response procedures
C. Evaluate server performance
D. Assess network vulnerabilities
5. What is the primary purpose of a security policy framework?
A. Define technical controls
B. Set organizational security policies
3
, C. Monitor system performance
D. Develop encryption algorithms
6. What is the purpose of a risk assessment matrix?
A. Identify and prioritize risks
B. Develop encryption algorithms
C. Test incident response procedures
D. Assess network vulnerabilities
7. What is the primary purpose of a security risk assessment?
A. Assess the impact of security incidents
B. Identify vulnerabilities and assess risks
C. Test incident response procedures
D. Monitor system performance
8. What is the purpose of a privacy impact assessment (PIA) in the context of security and risk
management?
A. Assess the impact of security incidents on privacy
B. Identify vulnerabilities and assess risks
C. Test incident response procedures
D. Monitor system performance
9. What is the primary objective of a security awareness training program?
A. Enforce access control policies
B. Prevent security incidents
C. Monitor system performance
D. Test incident response procedures
10. What is the purpose of a risk treatment plan in the risk management process?
A. Identify and prioritize risks
4
