CISSP CISSP 2 — Questions and Answers
Question 1: Which access control model uses security labels and clearance levels to enforce mandatory access controls?
- Role-Based Access Control (RBAC)
- Bell-LaPadula Model (Correct answer)
- Biba Integrity Model
- Clark-Wilson Model
Correct answer: Bell-LaPadula Model
Bell-LaPadula enforces confidentiality using classification labels and clearances, with 'no read up, no write down' rules.
Question 2: A security engineer needs to ensure that a cryptographic key is never stored in plaintext anywhere. Which technique best addresses this requirement?
- Key escrow
- Key wrapping (Correct answer)
- Key rotation
- Key stretching
Correct answer: Key wrapping
Key wrapping encrypts a cryptographic key with another key so the plaintext key is never exposed in storage.
Question 3: During a penetration test, the tester finds an application concatenating user input directly into SQL queries. Which vulnerability class is this?
- Cross-site scripting (XSS)
- Buffer overflow
- SQL injection (Correct answer)
- Path traversal
Correct answer: SQL injection
SQL injection occurs when untrusted input is inserted directly into SQL queries, allowing attackers to manipulate database commands.
Question 4: What is the PRIMARY goal of a Business Impact Analysis (BIA)?
- Identify security vulnerabilities in systems
- Determine recovery time objectives for critical processes (Correct answer)
- Establish the organization's risk appetite
- Define security policies and procedures
Correct answer: Determine recovery time objectives for critical processes
A BIA identifies critical business functions and determines RTOs, RPOs, and financial impacts of disruptions.
Question 5: Which protocol provides authentication and encryption for remote access but operates at the network layer?
- SSL/TLS
- SSH
- IPsec (Correct answer)
- RADIUS
Correct answer: IPsec
IPsec operates at the network layer (Layer 3) and provides authentication and encryption for IP traffic, commonly used in VPNs.
Question 6: An organization discovers that an employee has been accessing files outside their job role for six months. Which preventive control would have been MOST effective?
- Security awareness training
- Principle of least privilege enforcement (Correct answer)
- Intrusion detection system
- Data loss prevention (DLP)
Correct answer: Principle of least privilege enforcement
Enforcing least privilege would have restricted the employee's access to only the files required for their job duties.
Question 7: In PKI, what is the role of a Certificate Revocation List (CRL)?
- Encrypt certificates before transmission
- Publish a list of certificates no longer trusted before expiration (Correct answer)
- Store private keys for recovery purposes
- Validate certificate chain of trust
Correct answer: Publish a list of certificates no longer trusted before expiration
A CRL is published by a CA and lists certificates that have been revoked prior to their scheduled expiration date.
CISSP CISSP 2
Which access control model uses security labels and clearance levels to enforce mandatory access controls?