Practice for the CISSP exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: During an investigation, your SOC discovers that attackers poisoned your company's DNS cache, redirecting users to a mal. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CISSP practice test →
What you will practice
- During an investigation, your SOC discovers that attackers poisoned your company's DNS cache, redirecting use…
- During a post-incident review, investigators discover that an employee's compromised workstation was used to…
- Your organization is retiring thousands of solid-state drives (SSDs) from a data center that previously store…
- Your organization conducts quarterly vulnerability scans and an annual penetration test to comply with PCI DS…
- Your organization is migrating its analytics platform to a cloud provider that stores healthcare data regulat…
- Your organization runs multiple virtual machines (VMs) for regulated workloads (finance, healthcare, and R&D)…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. During an investigation, your SOC discovers that attackers poisoned your company's DNS cache, redirecting users to a malicious site that stole credentials. At which OSI layer does DNS cache poisoning primarily occur?
Answer: E. Layer 7
DNS cache poisoning primarily occurs at Layer 7 because it manipulates the application service logic into returning malicious IP mappings. Even though DNS relies on lower layer transport protocols, the actual exploitation targets the application layer.
Q2. During a post-incident review, investigators discover that an employee's compromised workstation was used to exfiltrate sensitive engineering data to an external cloud service. The SOC already had inbound firewall rules and an IDS at the p…
Answer: A. Deploy egress filtering to restrict outbound connections and detect abnormal data transfers
The correct choice is deploying egress filtering because it inspects and restricts outbound traffic to prevent unauthorized data transfers. Adding another intrusion detection system is a detective control, whereas egress filtering acts preventively against outbound data loss.
Q3. Your organization is retiring thousands of solid-state drives (SSDs) from a data center that previously stored regulated financial and healthcare data. Executives want the most cost-effective disposal process, while compliance officers ins…
Answer: E. Physically shred or incinerate the SSDs through a certified destruction vendor with a certificate of destruction
Physical destruction via a certified vendor guarantees data cannot be recovered and provides legally defensible documentation. Software methods fail on solid state drives due to wear leveling. When zero recovery is required, always choose physical destruction over wiping or degaussing for flash media.
Q4. Your organization conducts quarterly vulnerability scans and an annual penetration test to comply with PCI DSS. The latest penetration test exploited a critical flaw in the e-commerce gateway, exposing real customer data. The security team…
Answer: E. Conduct a targeted re-test by an independent assessor and document the results for audit evidence
Auditors require formal, verifiable proof that a vulnerability is closed, which an independent retest provides. Updating policies improves future processes but does not satisfy immediate compliance evidence needs. When regulators ask for proof, prioritize actionable validation and documentation over strategic planning.
Q5. Your organization is migrating its analytics platform to a cloud provider that stores healthcare data regulated under HIPAA. The new system must enforce access based on user attributes such as job title, project, location, and clearance le…
Answer: H. Attribute-Based Access Control (ABAC)
Attribute based access control evaluates user, object, and environment attributes dynamically at runtime, perfectly satisfying context aware requirements. Role based access control lacks this dynamic flexibility and leads to role explosion. Match the model to scenarios requiring fine grained, auditable control.
Q6. Your organization runs multiple virtual machines (VMs) for regulated workloads (finance, healthcare, and R&D) on the same hypervisor cluster managed by a public-cloud provider. A recent risk assessment flagged the possibility of cross-VM d…
Answer: E. Segregate high-sensitivity workloads onto dedicated physical hosts under a private-cloud or single-tenant model
Moving high sensitivity workloads to dedicated physical hosts eliminates the underlying virtualization isolation risk. You cannot secure or monitor a public cloud hypervisor you do not control. In shared environments, encryption and intrusion detection fail to mitigate hardware side channel attacks.
Q7. You are the CISO of a multinational healthcare organization. During a system upgrade, engineers discover a misconfiguration that has quietly exposed unencrypted patient data to an internal analytics vendor for the past six months. Fixing i…
Answer: E. Immediately report the exposure to regulators as required under HIPAA and initiate breach-response procedures
Regulations mandate immediate reporting of unauthorized protected health information disclosure upon discovery, regardless of proven misuse. Delaying notification violates legal and ethical duties. For the exam, always prioritize strict compliance timelines over executive concerns regarding reputational damage or operational downtime.
Q8. Your enterprise security stack includes a third-party network-monitoring tool whose code-signing certificate has just been revoked after the vendor admitted a supply-chain compromise inserted malware into updates. Thousands of your servers…
Answer: C. Revoke all trust relationships and remove the compromised software, prioritizing containment over monitoring continuity
A compromised software update mechanism is an active threat requiring immediate containment by removing the software and revoking trust. Waiting for vendor guidance leaves malicious code running, which constitutes negligence. Always prioritize cutting the attack path over maintaining operational uptime.
Q9. Your organization recently suffered several minor security incidents despite good patching, awareness training, and antivirus coverage. The CEO wants to ensure "security is built into business decisions" rather than being an IT afterthough…
Answer: D. Establish a formal information security governance framework tied to enterprise risk management
Establishing a formal governance framework aligns security with enterprise risk and integrates it into strategic business decisions. Tactical controls like patching only address specific vulnerabilities. When executives demand strategic alignment, always select the governance option.
Q10. During a major data breach, your SOC has contained the incident and forensics is underway. Executives demand system restoration to resume operations immediately, while Legal warns that the investigation must preserve chain of custody for p…
Answer: D. Maintain containment and coordinate with Legal to ensure evidence integrity before initiating recovery
Maintaining containment and coordinating with legal ensures evidence integrity before recovery begins. Rushing system restoration risks contaminating the chain of custody, which ruins prosecution chances. Never skip forensic and legal validation steps during incident response.
Q11. Your company is integrating with a partner portal so employees can log in using their corporate Active Directory accounts. The partner requires federated authentication using XML-based assertions. Which technology is the BEST fit?
Answer: H. SAML
Security Assertion Markup Language is the best fit because it supports federated identity and uses XML-based tokens for passing authentication data. The requirement for XML assertions eliminates OpenID Connect, which relies on JSON.
Q12. A U.S. healthcare company processes patient data in Europe using a cloud provider. During a GDPR compliance review, executives ask who is legally responsible for deciding how and why the patient data is processed.
Answer: A. Data Controller
The correct choice is Data Controller because this role determines the purposes and means of processing personal data. Data processors act only on instructions from the controller, while custodians handle the technical implementation of internal security policies.
Q13. A large retail company processes credit card payments in the U.S. and is subject to multiple regulations. During an internal audit, management asks which compliance framework is specifically designed to ensure the security of payment cardh…
Answer: C. PCI DSS
The correct choice is PCI DSS because it explicitly regulates the security of payment cardholder data. Other distractors like HIPAA or GLBA govern healthcare records or financial institutions, so match the specific data type to its corresponding regulatory framework.
Q14. During a recent security audit, management found that employees were occasionally using unauthorized USB drives on company systems, posing a data leakage risk. The CISO wants to reduce the likelihood of data exfiltration but also identify…
Answer: B. Install Data Loss Prevention (DLP) software that logs and alerts on USB transfers
Data Loss Prevention systems provide the necessary visibility by logging and alerting on unauthorized USB transfers without entirely blocking functionality. While completely disabling USB ports prevents leakage, it lacks monitoring capabilities and usually disrupts legitimate business operations.
Q15. An organization recently suffered a security breach where an administrator's credentials were stolen and used to modify production systems. To reduce the impact of future incidents, the CISO decides to implement a Privileged Access Managem…
Answer: E. It automatically rotates, manages, and audits privileged credentials
A Privileged Access Management solution automatically rotates, manages, and audits administrative credentials to prevent unauthorized system modifications. While blocking external network access is helpful, it does not provide the core credential governance, strict accountability, and auditing capabilities required.
More CISSP drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.