Hard CISSP Practice Questions - Domain Wise (400 Questions) (Udemy.com)

Domain-wise 400 original and unseen practice exam questions that will help you clear the CISSP exam in the first attempt.

• Designed by a team of CISSP certified PhDs and industry experts

• Detailed Explanations

• Distributed Domain Wise

• Questions very similar to the actual exam in difficulty

Please note that our exams are designed to be difficult to crack, but that is because we try to match the difficulty and complexity of the actual CISSP exam which has an incredibly low pass rate (and hence the stellar reputation). Please attempt these only if you are ready to attack the actual exam. If you have doubts about the validity/correctness of any of our questions, just ping us and we will provide several references to support the accuracy of our exams.

Please take this course if you understand/appreciate the following sample questions which are a noteworthy indication of the quality of the rest of the course:

Sample Questions (Solution Below):

1. In an organization, the primary purpose of a security procedure is to __________.

a) Guide in decision making with regards to security

b) Train employees and ensure consistency in security related business processes

c) Indicate expected user behaviour

d) Provide recommendations on implementing security processes

2. Which of the following is a possible oversight which can happen with job rotation?

a) Privilege creep

b) Lack of separation of duties

c) Collusion

d) All of the above

3. Which of the following BEST describes exposure?

a) A flaw or weakness of an asset or a safeguard

b) Damage, loss or disclosure of an asset

c) An illegal act

d) A weakness or vulnerability that can cause a security breach

4. A notice placed on the common room wall about the usage conditions of Wi-Fi is a ______ access control?

a) Preventive

b) Corrective

c) Compensating

d) Driective

5. Which of the following is true about private key cryptography?

a) It is scalable

b) It is faster than public key cryptography

c) It offers nonrepudiation

d) Different keys are used for encryption and decryption

6. Which of the following models employs sensitivity labels such as top secret and secret?

a) RBAC

b) DAC

c) MAC

d) Rule Based Access Control

7. A digital certificate endorsed by a CA contains the issuer name, public key of david.cooper@itpro.com as well as the serial number, period of validity and the signature algorithm used. Which of the following is NOT true about this certificate?

a) It is only valid as long as the validity period mentioned

b) The subject’s public key can now be used by the general public to decrypt messages

c) It certifies that David Cooper is the subject

d) The signature algorithm mentioned must be used to decrypt the public key

8. Which of the following is a MORE serious concern for biometric authentication systems?

a) False positives

b) False negatives

c) True positive

d) True negative

9. An organization wants to test a software but does not have access to its source code. Which of the following is NOT a valid type of testing?

a) DAST

b) Blackbox

c) Fuzzing

d) SAST

10. Demonstrating to someone that you know the password to a lock without sharing it with that person is an example of?

a) Split-knowledge

b) Zero-knowledge proof

c) Work function

d) Secure proofing

Solution:

1. In an organization, the primary purpose of a security procedure is to __________.

a) Guide in decision making with regards to security

b) Train employees and ensure consistency in security related business processes

c) Indicate expected user behaviour

d) Provide recommendations on implementing security processes

Explanation: A security procedure trains employees and ensures consistency in security related business processes. It streamlines security related business processes to ensure minimal variations and also offers consistency in the implementation of security controls. Guidance in decision making is provided by policies, and standards are used to indicate expected user behaviour. Recommendations on implementing security processes is part of guidelines which are optional in nature.

2. Which of the following is a possible oversight which can happen with job rotation?

a) Privilege creep

b) Lack of separation of duties

c) Collusion

d) All of the above

Explanation: Privilege creep occurs when an employee accumulates access and privileges across job rotations because their privileges are not periodically reviewed and updated. They accumulate privileges which they don’t even need but still possess. Lack of separation of duties may compromise security but is not related to job rotation. Similarly, collusion can occur regardless of job rotation.

3. Which of the following BEST describes exposure?

a) A flaw or weakness of an asset or a safeguard

b) Damage, loss or disclosure of an asset

c) An illegal act

d) A weakness or vulnerability that can cause a security breach

Explanation: Exposure refers to a weakness or vulnerability that can cause a security breach i.e. the adverse event has not actually occurred, but it is an estimation of the adverse consequences of such an event. A flaw or weakness of the asset or the safeguard is called a vulnerability and if a threat has already been realized then it is called experienced exposure.

4. A notice placed on the common room wall about the usage conditions of Wi-Fi is a ______ access control?

a) Preventive

b) Corrective

c) Compensating

d) Driective