ISC2 CISSP Practice Questions with Explanations

Correct answer: D

Physical assets in a BIA are tangible items the organization owns and needs to continue operations. Supplies kept at a remote facility are physical assets that support business continuity. Personal belongings are not organizational assets, DR revenues are financial metrics not physical assets, and cloud-based applications are logical/virtual assets, not physical ones.

Why the other options are wrong:

• A. Personal belongings belong to staff members, not the organization, and are not considered organizational assets in a BIA.
• B. DR line-item revenues are financial projections or accounting entries, not physical assets.
• C. Cloud-based applications are logical or virtual assets hosted remotely, not physical assets owned by the organization.

Correct answer: B

When assessing audit capability, the most critical activity is determining whether audit records contain sufficient information to support investigations and compliance. Sufficient information is foundational-without it, auditing is ineffective regardless of storage capacity or response procedures. While storage and procedures matter, the quality and completeness of logged data is the primary concern for audit effectiveness.

Why the other options are wrong:

• A. Investigating suspicious activity is a response action that comes after audit records are deemed adequate.
• C. Storage allocation is important but secondary; inadequate storage becomes irrelevant if the records captured lack necessary detail.
• D. Security plan responses to audit failures are important for incident management but don't directly assess whether current audit capability is sufficient.

Correct answer: A

Role-based access control (RBAC) is specifically designed to simplify permission assignment by grouping users with similar job responsibilities into roles, then assigning permissions to those roles. This reduces administrative overhead and scales well. DAC places control with individual owners, content-dependent access is based on data sensitivity, and rule-based access uses conditional logic-none directly address simplifying bulk assignment for similar job roles.

Why the other options are wrong:

• B. Discretionary access control requires individual owners to manage permissions, making it less efficient for assigning permissions to many similar users.
• C. Content-dependent access control bases decisions on data content characteristics, not user job responsibilities.
• D. Rule-based access control applies conditional logic but doesn't inherently simplify group assignment by job role.

Correct answer: A

Jurisdiction is the primary challenge in cybercrime enforcement because attacks cross borders instantly, making it unclear which country's laws apply and which law enforcement agency has authority. This fundamental jurisdictional ambiguity complicates investigation, prosecution, and enforcement more than other factors. While understaffing, extradition, and language barriers exist, they are secondary issues compared to the core jurisdictional problem.

Why the other options are wrong:

• B. Understaffing is a resource issue but not the primary structural reason criminal law is difficult to enforce in cybercrime.
• C. Extradition treaty enforcement is challenging but is a consequence of jurisdictional issues, not the primary reason.
• D. Language barriers exist but are manageable through translation and are not the fundamental obstacle to enforcement.

Correct answer: A

WPA2 uses the Extensible Authentication Protocol (EAP) framework to provide stronger authentication and encryption than earlier standards. EAP enables various authentication methods (EAP-TLS, EAP-PEAP, etc.) for secure Wi-Fi access. IPsec, SSL, and SSH are protocols for different purposes-IPsec operates at the network layer for VPNs, while SSL/SSH operate at transport or application layers, not as WPA2's core authentication mechanism.

Why the other options are wrong:

• B. IPsec is a network-layer security protocol for VPNs, not the protocol WPA2 uses for Wi-Fi protection.
• C. SSL operates at the transport layer for HTTPS and other protocols, not as WPA2's authentication mechanism.
• D. SSH is an application-layer protocol for secure remote access, not the protocol underlying WPA2 wireless security.

Correct answer: D

The security kernel is the minimal subset of the operating system responsible for enforcing security policy and mediating all access to protected resources. It provides the security interfaces between hardware, the OS, and applications. While the reference monitor is a conceptual model for authorization decisions and the TCB includes all security-relevant components, the security kernel is the specific architectural component that implements these interfaces and protections at the OS level.

Why the other options are wrong:

• A. The reference monitor is a conceptual model describing how access control should work, not the actual OS component providing the interfaces.
• B. The Trusted Computing Base is a broader concept encompassing all security- relevant components, not the specific architectural component providing interfaces.
• C. Time separation is a scheduling technique for isolating processes, not the component providing security interfaces among hardware, OS, and applications.

Correct answer: D

Risk management is the process that systematically balances the costs of implementing protective security measures against the benefits and improvements to mission capability and operational resilience. It involves assessing risks, evaluating countermeasures, and making informed decisions about resource allocation for security controls. Performance testing measures capability, security audits evaluate compliance, and risk assessment is a component of risk management but not the overarching balancing process.

Why the other options are wrong:

• A. Performance testing evaluates system or application capability but doesn't address the balance between security costs and mission gains.
• B. Risk assessment identifies and analyzes risks but is a component within risk management, not the overarching balancing process.
• C. Security audit evaluates compliance with policies and standards but doesn't directly balance protective costs with mission capability gains.

Correct answer: B

Under Extended Identity principles, the clothing retailer acts as an identity provider (IdP) that authenticates its own users using industry-standard protocols and then sends security assertions or credentials to partner businesses, which act as service providers. This federated identity model allows the IdP to vouch for user identity to multiple service providers without those providers needing to authenticate the user directly. User Self Service is not a valid IAM role, and the clothing retailer cannot be the Service Provider for its own employees accessing partner resources.

Why the other options are wrong:

• A. User Self Service is not a standard IAM role in federated identity models, and this flow incorrectly positions the clothing retailer in a non-standard role.
• C. This reverses the roles-the clothing retailer cannot be a Service Provider for its own users; it must be the IdP that authenticates them.
• D. Access Control Provider is not a standard IAM role, and this doesn't reflect the actual federated identity pattern where an IdP authenticates users for multiple service providers.

Correct answer: A

Least privilege principle means granting users and administrators only the minimum access necessary to perform their job functions. Option A directly describes this by limiting a single administrator to only core functions they need, rather than giving broad access. This is the foundational security concept that minimizes potential damage from compromised accounts or insider threats.

Why the other options are wrong:

• B. Inspecting all incoming and outgoing packets describes intrusion detection/prevention, not least privilege access control.
• C. Regularly updating routing configurations is a network maintenance task unrelated to least privilege.
• D. Keeping network segments private is network segmentation, which is a defense-in- depth strategy but not the definition of least privilege.

Correct answer: D

Deduplication is the best solution for redundant and unusable data filling a SAN. It identifies and eliminates duplicate data blocks, storing only one copy and using pointers for references. This directly addresses the problem of redundant data consuming storage space while maintaining data availability and is more effective than compression for datasets with high redundancy.

Why the other options are wrong:

• A. Compression reduces file size but doesn't eliminate redundant copies of the same data across the SAN.
• B. Caching improves performance for frequently accessed data but doesn't reduce overall storage consumption.
• C. Replication creates additional copies of data, which would worsen the storage problem rather than solve it.

Correct answer: B

Multiprotocol Label Switching (MPLS) uses label switching where the first router determines the entire path (Label Switched Path) the packet will travel, and subsequent routers simply forward based on labels rather than making independent routing decisions. This provides deterministic routing and improved performance compared to traditional hop-by-hop IP routing.

Why the other options are wrong:

• A. SONET is a physical layer optical networking standard for transmission, not a path- determination protocol.
• C. FCoE is a protocol for encapsulating Fibre Channel traffic over Ethernet, not a WAN routing technology.
• D. SIP is a signaling protocol for initiating multimedia sessions, not a packet routing or path-determination mechanism.

Correct answer: A

A File Integrity Checker specifically monitors and detects changes to files by comparing current file attributes (hash values, timestamps, permissions) against baseline records. This is the primary tool designed to recognize and alert on unauthorized modifications to content, making it the best answer for detecting unauthorized changes.

Why the other options are wrong:

• B. While a SIEM system can aggregate log data about changes, it is not specifically designed to detect file content modifications.
• C. Audit logs record events but require manual review and don't automatically detect unauthorized file changes.
• D. An IDS detects network-based attacks and intrusions, not file content modifications on storage systems.

Correct answer: B

User Acceptance Testing (UAT) before implementation is a standard component of change management that verifies changes function as intended and meet business requirements before deploying to production. This validates the change's readiness and reduces risk of failed deployments.

Why the other options are wrong:

• A. Technical review by business owner is not standard change management terminology; technical reviews are typically performed by IT teams.
• C. Cost-benefit analysis is performed before implementation to justify the change, not after implementation.
• D. While business continuity testing is important, it is not a core component of the change management process itself.

Correct answer: B

Single-pass wipe provides the best balance between security and vendor payment maximization. It securely overwrites all data on functioning drives in one pass, preventing data recovery while keeping the drives operational and functional enough for the vendor to accept them at higher value. Multi-pass wipes take longer and may cause drive wear, while degaussing renders drives inoperable (receiving minimum payment) and pinning is not a sanitization method.

Why the other options are wrong:

• A. Pinning is not a recognized data sanitization method.
• C. Multi-pass wipes provide more security but take longer and cause additional drive wear, reducing the vendor's willingness to pay premium prices.
• D. Degaussing destroys the drive's functionality, resulting in the lowest vendor payment rather than the most money.

Correct answer: C

SOC 2 Type 2 is the best certification for vendors handling and processing company data because it evaluates controls over time (at least 6 months) and includes a detailed audit report assessing the effectiveness of security, availability, processing integrity, confidentiality, and privacy controls. This provides comprehensive assurance of ongoing vendor compliance and control effectiveness.

Why the other options are wrong:

• A. SOC 1 Type 1 focuses on financial reporting controls and is relevant for auditors, not data security assessment.
• B. SOC 2 Type 1 is a point-in-time assessment and doesn't evaluate control effectiveness over time.
• D. SOC 3 is a general-use report for public distribution and lacks the detailed controls assessment needed for vendor evaluation.

Correct answer: B

Peer-to-Peer (P2P) file sharing applications are considered high-risk because they enable direct sharing of files between users without centralized control or security inspection, providing a direct vector for malware and virus distribution. Users often unknowingly download infected files, and the decentralized nature makes it difficult to implement security controls.

Why the other options are wrong:

• A. While instant messaging can transmit malicious content, it is not the primary vector for malware and viruses compared to P2P file sharing.
• C. Email applications are monitored and filtered by security gateways in most organizations; P2P applications bypass these protections.
• D. End-to-end applications are not a specific application category and are not inherently high-risk for malware distribution.

Correct answer: B

In NIST and similar reference architectures, mobile devices are typically tracked in Tier 1, which represents edge devices and endpoints that connect to the organization's network. Tier 0 is usually reserved for the core data center/cloud infrastructure, while Tiers 2 and 3 represent increasingly remote or specialized systems. Mobile devices as user-accessible endpoints fit squarely within Tier 1's scope.

Why the other options are wrong:

• A. Tier 0 typically represents core infrastructure and data centers, not mobile endpoint devices.
• C. Tier 2 usually represents intermediate systems and processing layers, not individual user devices.
• D. Tier 3 is typically the outermost or specialized tier, not the primary endpoint tracking tier.

Correct answer: A

Encrypting data in transit and at rest using current cryptographic algorithms is the foundational and BEST comprehensive approach to protecting data assets. This addresses the core confidentiality concern across all states of data. While the other options are important security controls, encryption is the primary technical mechanism that prevents unauthorized access to sensitive information regardless of where an attacker breaches the system.

Why the other options are wrong:

• B. Monitoring adherence to policies is important but is a detective control, not a preventive protection mechanism for data itself.
• C. MFA and SoD are important access controls but do not directly protect data from being read if accessed.
• D. DMZ and network architecture protect against unauthorized network access but do not protect data if network perimeter is breached.

Correct answer: C

Human Resources is the BEST positioned business unit to initiate provisioning and deprovisioning because they manage the employee lifecycle-hiring, role changes, and termination. HR has authoritative knowledge of when employees join, their job functions, and when they leave, making them the natural source for access requirements and removal requests. IT executes these requests but should not initiate them independently.

Why the other options are wrong:

• A. The training department is responsible for employee training, not account lifecycle management.
• B. Internal audit provides oversight and compliance verification, not operational provisioning decisions.
• D. IT executes provisioning/deprovisioning but should not initiate these actions without proper authorization from HR.

Correct answer: C

A mantrap (also called a mantrap or turnstile) is a physical security control specifically designed to prevent piggybacking-the unauthorized entry of unauthorized persons by following an authorized person through a secured access point. It allows only one person per authentication event to pass through, making it impossible for someone to slip through behind an authorized user.

Why the other options are wrong:

• A. While mantraps do control traffic flow, that is a secondary effect, not the primary security purpose.
• B. Mantraps have no relevance to air flow control in facilities.
• D. Preventing rapid movement is not the purpose; controlled, single-person entry is the goal.

Correct answer: C

In the Do phase of PDCA, the organization implements and executes the business continuity policy, controls, processes, and procedures that were planned in the Plan phase. This is the execution/implementation phase where the documented strategies and frameworks are actually deployed operationally across the organization.

Why the other options are wrong:

• A. This describes the Act phase, which involves corrective actions and improvements based on review results.
• B. This describes the Check phase, which monitors performance and reports results to management.
• D. This describes the Plan phase, where objectives and procedures are initially established.

Correct answer: C

SOC 2 Type 2 is the industry-recognized document used as a baseline reference for data security and business operations assessments. SOC 2 reports address security, availability, processing integrity, confidentiality, and privacy controls. Type 2 includes testing over a period of time, making it more comprehensive for security assessments than Type 1. This is the standard used for evaluating service provider controls over sensitive business operations.

Why the other options are wrong:

• A. SOC 1 Type 2 focuses on financial reporting controls, not data security and general business operations.
• B. SOC 1 Type 1 is limited in scope and time period, and addresses financial controls specifically.
• D. SOC 2 Type 1 is a point-in-time report and less comprehensive than Type 2 for ongoing assessment purposes.

Correct answer: A

An organization losing control of their network devices represents the HIGHEST risk because it gives attackers complete operational control of the infrastructure. This enables them to conduct any attack-stealing data, disrupting services, planting malware, and maintaining persistence. The other scenarios are consequences or precursors to this state but do not grant the same level of comprehensive system compromise.

Why the other options are wrong:

• B. Network flooding (DDoS) causes availability disruption but does not give attackers control of the network itself.
• C. Disrupted management communications is a tactical limitation but does not give attackers control of the actual network devices.
• D. Accessing topology information is valuable reconnaissance but does not provide operational control of network devices.

Correct answer: B

SOC 1 (Service Organization Control 1) is the reporting type that requires a service organization to describe its system and define control objectives and controls relevant to users' internal control over financial reporting. SOC 1 replaced the older SAS 70 standard and specifically addresses financial reporting controls at service organizations. Type 1 or Type 2 SOC 1 reports fulfill this requirement.

Why the other options are wrong:

• A. SAS 70 is the predecessor standard that SOC 1 replaced; it is no longer the current reporting standard.
• C. SOC 2 addresses security, availability, and confidentiality controls, not financial reporting controls specifically.
• D. SOC 3 is a public report summary derived from SOC 2, not the primary financial reporting control report.

Correct answer: C

Automated programs that test for known vulnerability patterns are the best method for validating code against injection and overflow attacks because they can comprehensively scan all code, identify known vulnerabilities quickly, and be run continuously throughout development. Manual team reviews (A) are labor-intensive and may miss vulnerabilities, reusing production code (B) doesn't validate new code for vulnerabilities, and updating code editing tools (D) is preventative but doesn't validate existing code.

Why the other options are wrong:

• A. Manual reviews are slower, less comprehensive, and more prone to human error than automated scanning.
• B. Reusing existing code doesn't validate it against injection and overflow vulnerabilities.
• D. Updating tools is preventative but doesn't actively test or validate code for known vulnerabilities.

Correct answer: A

The correct priority order in information security ethics is public safety first (greatest impact), then duties to individuals, duties to the profession, and finally duties to principals/employers. This hierarchy ensures that public welfare supersedes all other considerations, individual rights are protected before professional interests, and professional ethics take precedence over employer directives when conflicts arise.

Why the other options are wrong:

• B. Placing duties to principals before duties to individuals incorrectly prioritizes employer interests over individual welfare.
• C. This places duties to the profession ahead of duties to individuals, which reverses the correct priority.
• D. This inverts multiple priority levels, placing profession before individuals and principals before profession.

Correct answer: D

ITIL (Information Technology Infrastructure Library) is the comprehensive service management framework best designed to help IT organizations reduce costs, mitigate risk, and improve customer service through standardized best practices across the entire IT lifecycle. While Lean Six Sigma (B) and ITSM (C) focus on improvement and management respectively, ITIL provides the complete framework. Kanban (A) is primarily a workflow visualization tool.

Why the other options are wrong:

• A. Kanban is a workflow management tool, not a comprehensive service management framework.
• B. Lean Six Sigma focuses on process improvement and efficiency but isn't a complete service management framework.
• C. ITSM is a general category; ITIL is the specific best-practice library that implements ITSM principles.

Correct answer: A

In-house team lacks resources to support an on- premise solution. Companies choose IDaaS solutions primarily because their in-house teams lack the resources, expertise, or capacity to support an on-premise identity management solution. IDaaS outsources the burden to a specialized vendor, reducing operational overhead. Option B is false (third-party solutions aren't inherently more secure), C is incorrect (vendors don't eliminate risk, they share it), and D contradicts the reason for choosing a cloud solution.

Why the other options are wrong:

• B. Third-party solutions are not inherently more secure than well-implemented on- premise solutions.
• C. IDaaS transfers some risk to the vendor but doesn't eliminate organizational responsibility for security.
• D. In-house development provides more control but requires more resources, which contradicts the typical reason for choosing IDaaS.

Correct answer: C

Cross-Site Scripting (XSS) is the correct answer because it specifically involves injecting malicious scripts that execute in a user's browser when visiting a compromised website, allowing attackers to steal session cookies and other sensitive data. SQLi (A) targets databases, XML (B) attacks XML parsers, and CSRF (D) exploits authenticated sessions but doesn't necessarily involve script execution on compromised sites.

Why the other options are wrong:

• A. SQL injection targets database queries, not browser script execution or cookie theft via compromised websites.
• B. XML external entity attacks target XML parsers, not browser sessions or cookie theft mechanisms.
• D. CSRF exploits existing sessions but typically doesn't involve executing scripts on compromised websites to steal cookies.

Correct answer: B

Cross-Site Request Forgery (CSRF) is the correct answer because it specifically describes an attack where an attacker uses a malicious URL and social engineering to exploit a victim's existing authenticated browser session with a web application without their knowledge or consent. The attack leverages the fact that the user is already logged in. Clickjacking (A) involves UI overlay tricks, XSS (C) involves script injection, and Injection (D) is a broad category affecting databases.

Why the other options are wrong:

• A. Clickjacking overlays UI elements to trick users into clicking unintended targets, not exploiting existing sessions via malicious URLs.
• C. XSS involves injecting scripts into web pages; CSRF exploits trusted sessions without script injection.
• D. Injection is too broad a category and typically refers to SQL/command injection, not session exploitation via malicious URLs.

Correct answer: C

Cipher Feedback (CFB) mode has the ability to function as a stream cipher because it converts block ciphers into stream ciphers by feeding back ciphertext to generate a keystream. CBC (A) is block-oriented with error propagation, ECB (B) is a basic block cipher mode without stream capabilities, and Feistel (D) is a cipher structure, not an encryption mode that functions as a stream cipher.

Why the other options are wrong:

• A. CBC is a block cipher mode designed for block-by-block encryption, not stream cipher operation.
• B. ECB operates on fixed blocks independently and does not function as a stream cipher.
• D. Feistel is a cipher design structure, not an operational mode that can function as a stream cipher.

Correct answer: A

Process is the key trait of crisis management in a DR test context, as crisis management requires following structured, documented processes and procedures to respond effectively to incidents during the disaster recovery exercise. Crisis management depends on predetermined, well-defined processes rather than anticipation alone. Strategic (C) and wide focus (D) relate more to planning phases, while anticipate (B) is preparatory rather than a crisis management trait.

Why the other options are wrong:

• B. Anticipate is a planning activity that occurs before crisis situations, not a trait of crisis management itself.
• C. Strategic thinking involves planning and scope, not the tactical execution needed during active crisis management.
• D. Wide focus applies to overall DR planning, not the focused, process-driven response during crisis management.

Correct answer: B

A reference monitor is a security concept that validates and enforces access control policies based on the organization's security model. It ensures that access requests comply with organizational rules and policies before granting or denying access. The reference monitor is a key abstract component in security architecture that mediates all access attempts.

Why the other options are wrong:

• A. Operational security and unit member safety are not the primary purpose of a reference monitor.
• C. Cyber hygiene and system health maintenance are not the core function of a reference monitor.
• D. Quality design principles and quality by design are separate from the specific role of a reference monitor in enforcing access control policies.

Correct answer: B

Security control volatility specifically refers to the likelihood or frequency of change in a security control over time. It measures how often a control is modified, updated, or replaced, which is important for assessing the stability and consistency of a security program. High volatility indicates frequent changes, while low volatility indicates stable controls.

Why the other options are wrong:

• A. Impact of a security control is measured separately from volatility.
• C. Unpredictability is related to but distinct from volatility; volatility is specifically about the rate of change.
• D. Stability is the inverse concept; volatility measures the degree of change, not the absence of it.

Correct answer: A

Planning is a recognized high-level phase in SDLC auditing that forms the foundation for all subsequent audit activities. It involves defining audit scope, objectives, timelines, and resources. While risk assessment, due diligence, and requirements are important activities, Planning is the primary high-level phase that initiates the audit process in SDLC.

Why the other options are wrong:

• B. Risk assessment is typically a component within planning or analysis phases, not a primary high-level SDLC audit phase.
• C. Due diligence is a general principle rather than a specific high-level audit phase.
• D. Requirements are part of the SDLC itself, not a high-level audit phase for auditing the SDLC.

Correct answer: B

Data sovereignty refers to the legal and regulatory concept that data is subject to the laws of the country where it is physically stored and processed. It defines where data is geographically located within cloud infrastructure and the compliance implications of that location. This is critical for organizations managing data across multiple jurisdictions.

Why the other options are wrong:

• A. Data privacy rights refer to individual rights regarding personal data, not the geographic location of data storage.
• C. A data warehouse is a specific technology for storing and managing structured data, not a term for geographic data location.
• D. Data subject rights refer to individual rights under regulations like GDPR, not the geographic storage location.

Correct answer: A

The security design process within SDLC ensures that proper security controls, security objectives, and security goals are properly initiated from the beginning of the development lifecycle. This foundational step establishes the security framework before implementation proceeds, ensuring that security is built in rather than added later.

Why the other options are wrong:

• B. System test is part of testing and verification phases, not the security design process initiation.
• C. Fault mitigation is a quality assurance concern, not a primary component of the security design process.
• D. While validation is important, the security design process primarily focuses on proper initiation of controls, objectives, and goals rather than validation activities.

Correct answer: B

Exercising due diligence with regard to all risk management information allows organizations to tailor controls appropriately to their specific risks, environment, and requirements. This risk-based approach is more effective than blindly following standards or choosing controls based on stringency alone, as it ensures controls address the organization's actual threat landscape and risk profile.

Why the other options are wrong:

• A. Using only industry best practices without customization may not address organization-specific risks.
• C. Choosing the most stringent standard based on location can result in unnecessary costs and controls that don't fit the organization's actual risk.
• D. While risk assessment is important, this option doesn't emphasize the due diligence process of analyzing all risk management information to tailor controls.

Correct answer: D

Recovery Point Objective (RPO) is the maximum tolerable amount of data loss, expressed as the maximum time interval between data backups. It defines the point in time to which data must be recovered-essentially, how much data loss is acceptable if a system fails. An RPO of one hour means losing no more than one hour's worth of data is acceptable.

Why the other options are wrong:

• A. RPO is not about the minimum amount of data to recover; it's about the acceptable time window of data loss.
• B. RPO is not about the time it takes to recover data; that is Recovery Time Objective (RTO).
• C. RPO is a constraint, not a goal to recover a percentage; it defines the maximum acceptable data loss interval.

Correct answer: A

A successful brute force password attack on the SSH port of the SDN controller would grant an attacker administrative access to the controller. Since the controller in an SDN architecture is the central point of control for all network switching and routing decisions, compromising it gives complete control over network behavior and traffic flows. This is the most critical single point of failure in SDN.

Why the other options are wrong:

• B. Sending control messages from a compromised host is limited to that host's access level and doesn't necessarily grant complete control of the SDN architecture.
• C. A RADIUS token replay attack affects authentication but not necessarily the SDN controller itself or complete network control.
• D. Sniffing traffic from a compromised host provides information but does not grant complete control of the SDN infrastructure.

Correct answer: A

Disabling unnecessary ports and services directly reduces the attack surface by eliminating potential entry points for attackers. Each open port and running service represents a potential vulnerability that could be exploited. This is a foundational security principle that minimizes exposure without impacting necessary functionality.

Why the other options are wrong:

• B. Group accounts are a separate access control concern unrelated to network attack surface reduction.
• C. Uninstalling default software may help but is less direct and systematic than disabling ports and services.
• D. Removing user accounts addresses identity management rather than network attack surface.

Correct answer: B

A Trusted Platform Module (TPM) is a hardware-based security module specifically designed to securely generate, store, and protect cryptographic keys. TPMs provide tamper-resistant storage and are the industry standard for protecting sensitive key material in certificate authorities and other security-critical applications.

Why the other options are wrong:

• A. Physical security alone does not provide cryptographic protection or prevent unauthorized key extraction if the device is compromised.
• C. Encrypted flash drives are portable but lack the tamper-resistance and hardware security features of TPM.
• D. PKI is the framework for managing certificates, not a storage mechanism for private keys.

Correct answer: C

Defense-in-depth is a layered security approach using multiple overlapping controls to protect assets. The combination of physical barriers, card and PIN access systems, cameras, alarms, and security guards represents multiple defensive layers working together-if one fails, others remain active to prevent unauthorized access.

Why the other options are wrong:

• A. Access control refers to specific mechanisms for granting or denying access, not the layered approach described.
• B. SIEM is a technology for monitoring and analyzing security events, not a physical security approach.
• D. Security perimeter describes the boundary being protected, not the multi-layered approach to protection.

Correct answer: D

Individual participation is the principle that allows individuals to access and review personal information held about them. When a patient requests their medical records from a web portal, they are directly exercising their right to view personal information maintained by the organization, which is a core tenet of Fair Information Practices.

Why the other options are wrong:

• A. Purpose specification defines why data is collected, not how individuals access their own data.
• B. Collection limitation concerns what data is gathered, not patient access rights.
• C. Use limitation restricts how collected data is used, not the ability to access personal records.

Correct answer: D

Submitting the request through official company channels ensures proper authorization and compliance with information security policies. Former employees no longer have legitimate access needs, and distributing confidential policies requires verification that such disclosure is authorized by management and compliant with organizational policy.

Why the other options are wrong:

• A. Screen viewing is not a secure distribution method and does not provide proper authorization verification.
• B. Emailing confidential policy to a former employee violates least privilege and may breach confidentiality requirements.
• C. Ignoring the request is unprofessional; proper channels should be used to formally deny or approve based on policy.

Correct answer: C

Black box testing should be conducted when the final source code is complete because the test simulates an external attacker with no internal knowledge of the system. Testing on complete code ensures all functionality is present and the results accurately reflect real-world attack scenarios. Conducting it prematurely on incomplete code produces unreliable results.

Why the other options are wrong:

• A. Black box testing focuses on security vulnerabilities, not functional compliance testing.
• B. Enumerating known vulnerabilities is vulnerability scanning, not black box testing methodology.
• D. While incident response may trigger security reviews, black box testing should be part of regular development lifecycle, not reactive-only.

Correct answer: A

The organization developing the code signs it to ensure code integrity and authenticity. Code signing provides cryptographic proof that the code has not been tampered with and comes from the legitimate source. This is an organizational responsibility typically performed through formal release processes and certificate authorities controlled by the organization.

Why the other options are wrong:

• B. Quality control groups verify functionality and compliance but do not typically sign code for integrity.
• C. Individual developers create code but do not formally sign releases; this is an organizational function.
• D. Data owners manage information assets but are not responsible for code signing practices.

Correct answer: C

Runtime Application Self-Protection (RASP) is specifically designed to monitor and dynamically respond to threats as they occur within running web applications. RASP operates at the application level during runtime to detect and block malicious activity in real-time, making it the best technology for active threat response.

Why the other options are wrong:

• A. Field-level tokenization protects data by replacing sensitive values but does not monitor for threats or respond dynamically.
• B. Vulnerability scanners identify security weaknesses during testing but do not monitor or respond to runtime threats.
• D. SAML is an authentication and authorization protocol unrelated to monitoring or responding to web application threats.

Correct answer: C

Address Space Layout Randomization (ASLR) is the most efficient and modern mitigation against buffer overflow attacks. ASLR randomizes memory addresses where code and data are loaded, making it extremely difficult for attackers to predict target addresses for exploits. While other options like process isolation and access control provide some defense-in-depth benefits, ASLR is specifically designed to defeat buffer overflow techniques and is the most direct technical countermeasure.

Why the other options are wrong:

• A. Access control mechanisms protect resources but do not prevent the technical exploitation of buffer overflows.
• B. Process isolation limits damage from successful exploits but does not prevent the overflow itself from occurring.
• D. Processor states are not a direct mechanism for preventing buffer overflow attacks.

Correct answer: C

Implementing and reviewing risk-based alerts is the best option to reduce overall risk because it provides real-time detection of suspicious account creation and privileged access activities, rather than waiting for the next quarterly review. Risk-based alerts can immediately flag unauthorized account creation within minutes, as occurred in the scenario where an account was created one hour after the review. This approach catches anomalies quickly rather than relying on periodic manual reviews alone.

Why the other options are wrong:

• A. Bi-annual reviews still leave large gaps where unauthorized accounts can persist undetected for months.
• B. Policies alone do not prevent violations; they require active monitoring and enforcement mechanisms.
• D. Increased logging provides better forensic capability but does not actively detect and alert on suspicious activities in real-time.