CISSP Practice Test – 94 Free Exam Questions with Answers

Correct answer: A. Train developers on secure coding practices and enforce input validation in the application code

Secure coding practices and strict input validation directly resolve the root cause of injection vulnerabilities within the application itself. While a Web Application Firewall is a valuable compensating control, it does not actually fix the underlying flawed code and can potentially be bypassed.

Correct answer: A. Implementing Transport Layer Security (TLS) with digital certificates

Transport Layer Security with digital certificates provides both encryption and cryptographic integrity checks, ensuring data cannot be altered in transit. A host-based IDS only detects anomalies after they occur, while segmentation does not guarantee protection against active interception.

Correct answer: B. Integrate automated static and dynamic application security testing into the CI/CD pipeline

Integrating automated SAST and DAST directly into the pipeline continuously identifies vulnerabilities early without slowing down rapid deployments. Manual code reviews and penetration tests are valuable, but they do not scale effectively for fast-paced continuous integration and delivery environments.

Correct answer: D. Block the malicious domain and URLs through the organization's email and web filters

Blocking the malicious domain and URLs at technical filters is the most effective immediate containment step to halt active exploitation. User training and email reminders are important preventative measures, but they are long-term solutions and will not stop the ongoing attack.

Correct answer: C. Fingerprint biometrics with device certificates

Combining fingerprint biometrics with device certificates implements robust multi-factor authentication using something you are and something you have. SMS-based passwords are easily intercepted via SIM swapping, and both factors must be independent types to provide true multi-factor assurance.

Correct answer: B. Enforce strict change management with a Change Advisory Board (CAB) review

Enforcing strict change management with Change Advisory Board oversight directly prevents unauthorized code from bypassing risk evaluation before deployment. Automated regression testing is important, but it is a technical control that fails to address the core governance failure.

Correct answer: C. Business Continuity Plan

The Business Continuity Plan directly addresses keeping critical business operations running during a disruption. For the exam, distinguish BCP from Disaster Recovery; BCP focuses on business survival, while DRP focuses specifically on restoring IT infrastructure.

Correct answer: D. Record a detailed chain of custody documenting who handled the evidence and when

A documented chain of custody legally proves that evidence was handled properly and not tampered with after collection. While write blockers and forensic imaging preserve data integrity, chain of custody is the absolute requirement for legal admissibility in court.

Correct answer: A. Implementing and managing strong access controls for applications that process cardholder data

In the Infrastructure as a Service shared responsibility model, the customer always retains accountability for securing their applications, data, and access controls. You cannot outsource regulatory liability, so relying on provider audits or notifications does not mitigate your direct compliance risk.

Correct answer: A. Conduct a Business Impact Analysis (BIA) to identify critical processes and dependencies

Conducting a Business Impact Analysis identifies critical business processes, dependencies, and recovery time objectives. For the exam, remember the standard lifecycle order: the BIA establishes what matters most before you assess risks or update disaster recovery site contracts.

Correct answer: C. Elliptic Curve Cryptography (ECC)

Elliptic Curve Cryptography provides strong security with much smaller key sizes, making it computationally efficient for mobile devices. For the exam, when you see a scenario requiring strong cryptography with lightweight processing constraints, immediately look for ECC.

Correct answer: A. Network Access Control (NAC)

Network Access Control enforces pre-admission security checks to block unauthorized or non-compliant devices from connecting. Intrusion prevention systems and firewalls act after the device connects, which fails the requirement to stop the connection beforehand.

Correct answer: C. Use the provider's cryptographic erasure function

Cryptographic erasure destroys the encryption keys protecting the data, rendering the ciphertext permanently unreadable. In cloud environments, you rarely have direct physical access to the underlying storage media to perform traditional overwriting or block-level wiping.

Correct answer: A. Static application security testing (SAST)

Static application security testing analyzes source code without executing it to find flaws like insecure functions. Dynamic application security testing evaluates a running application from the outside, whereas fuzzing actively throws random data at it.

Correct answer: A. Review and sign a data processing agreement (DPA) with the cloud vendor to ensure compliance obligations are met

A Data Processing Agreement establishes the legal and contractual obligations required for regulatory compliance before sharing sensitive data. While technical controls like encryption and audits are essential, management must ensure contractual compliance gaps are closed before migration begins.

Correct answer: B. Deploying mantraps with biometric authentication

A mantrap provides a strong physical preventive control by physically preventing more than one person from entering at a time. Cameras are only detective controls, and relying solely on guards or training leaves security dependent on inconsistent human behavior.

Correct answer: A. Hot site

A hot site provides the fully operational and immediately available infrastructure required to meet a recovery time objective of just a few minutes. While warm sites offer better cost efficiency, they require too much time to activate, making them unsuitable for critical financial processing.

Correct answer: D. Ensure the safety and accountability of all on-site personnel before focusing on systems recovery

Human life and safety always rank above data recovery, system restoration, or executive updates. Even under immense pressure from management, a security leader must first ensure all personnel are safe and fully accounted for before activating technical recovery procedures like failovers.

Correct answer: B. Activate the incident response plan

Activating the incident response plan is the correct next step because it orchestrates the formal containment, forensic, and communication efforts required. While disconnecting the server seems logical, a CISO must ensure the structured process governs technical actions rather than acting hastily.

Correct answer: A. Implement Data Loss Prevention (DLP) with endpoint blocking of removable media

Endpoint data loss prevention is correct because it acts as a preventive control capable of actively blocking unauthorized file transfers to removable media. Options like random audits and SIEM monitoring are strictly detective controls, while policies alone lack technical enforcement.

Correct answer: C. FM-200 or clean-agent suppression systems

Clean agent systems like FM-200 are the best choice because they suppress fires quickly without leaving residue or destroying electronic equipment. While carbon dioxide also protects equipment, it poses a lethal threat to personnel, violating the fundamental requirement of life safety.

Correct answer: C. OpenID Connect

OpenID Connect is the best fit because it layers identity and authentication capabilities on top of the OAuth 2.0 framework. While OAuth 2.0 handles authorization delegation, it does not natively verify user identity, making OpenID Connect the standard for federated social logins.

Correct answer: D. Document the chain of custody with signatures, timestamps, and transfer details for every handler

Documenting the chain of custody with signatures and timestamps legally proves who handled the evidence and guarantees its integrity for court. Hashing and secure lockers preserve data physically, but they do not prove the human handling history required for admissibility.

Correct answer: A. Select baseline

In the NIST Risk Management Framework, selecting baseline controls is the immediate next step after categorizing the system. You must select the appropriate security controls based on impact level before you can implement or document them.

Correct answer: A. Administrative / Preventive

Security awareness training is an administrative control, and its goal here is to prevent future incidents by changing user behavior. Whenever the exam mentions training or policies, immediately categorize it as an administrative and preventive control.

Correct answer: C. COBIT

The correct choice is COBIT because it is a framework focused specifically on IT governance and aligning business objectives. Expect NIST or ISO 27001 as strong distractors here, but those focus strictly on security operations and risk management rather than broad governance.

Correct answer: C. Implement Online Certificate Status Protocol (OCSP) for real-time revocation validation

The correct choice is OCSP because it provides real-time certificate revocation validation directly from the certificate authority. CRLs are a tempting distractor, but remember they are published periodically and cannot guarantee the immediate status checks regulators require.

Correct answer: C. Management commissioning a third-party risk assessment before deploying a new payment system

The correct choice is commissioning a third-party risk assessment because due diligence is the proactive investigation of risks before taking action. Approving policies and implementing encryption demonstrate due care, which represents the ongoing operational actions taken to maintain security.

Correct answer: C. Report the violation to appropriate authorities or internal compliance even if it could harm the company's reputation

The ISC squared code of ethics mandates protecting society and the public before employer interests. Reporting serious violations through proper channels is required, regardless of financial justifications. For the exam, always eliminate options that prioritize reputation, cost, or convenience over legal and ethical duties.

Correct answer: B. Conduct a root cause analysis to determine why privilege escalation was possible

Conducting a root cause analysis is the correct first step because a security manager must strategically understand why a vulnerability was exploited before deploying fixes. Implementing privileged access management tools immediately is a tactical reaction that might miss broader systemic issues.

Correct answer: A. Disconnect the affected workstation from the network immediately

Disconnecting the affected workstation is correct because incident response priorities dictate stopping an active data exfiltration immediately to prevent further loss. While capturing a forensic image is important, it happens after containment to prevent ongoing unauthorized data leakage.

Correct answer: B. Implement separation of duties and restrict production access via a controlled change management process

Implementing separation of duties and enforcing a change management process is correct because it addresses the underlying process gap rather than just punishing users. Revoking access immediately is a reactive technical fix that fails to establish the necessary governance for production environments.

Correct answer: A. Review data residency and privacy requirements for each jurisdiction involved

Reviewing data residency and privacy requirements for each jurisdiction is correct because a security manager must perform due diligence to understand legal constraints before designing cloud architecture. Technical controls like encryption are implemented only after confirming these regulatory obligations.

Correct answer: A. Require digital signatures and encryption at the file level before transfer

Requiring digital signatures and file-level encryption is correct because applying controls directly to the data ensures end-to-end confidentiality and integrity outside the secure tunnel. Relying solely on a VPN provides transport security but leaves data exposed once it reaches the endpoint.

Correct answer: A. Implement RAID with regular database replication across multiple sites

Implementing RAID with regular database replication is correct because combining hardware redundancy with cross-site replication ensures continuous availability and protects data integrity. Nightly backups or uninterruptible power supplies alone cannot guarantee seamless operational continuity during hardware failures.

Correct answer: B. S/MIME

S/MIME integrates directly into enterprise email systems like Exchange to provide end-to-end encryption and digital signatures. While TLS secures the transmission channel, it does not protect the data at rest or provide user-level non-repudiation.

Correct answer: C. SOC 2 Type II

A SOC 2 Type II report verifies the operational effectiveness of security controls over time. For vendor risk assessments, remember that SOC 1 focuses strictly on financial reporting, whereas SOC 2 focuses directly on security and availability.

Correct answer: A. Personal Information Protection and Electronic Documents Act (PIPEDA)

PIPEDA is the Canadian federal privacy law regulating how private-sector organizations handle personal data. Match the jurisdiction to the scenario, recognizing that HIPAA applies to the United States and FIPPA typically governs Canadian public sector entities.

Correct answer: B. The retailer is the Data Controller; the marketing company is the Data Processor

Under the GDPR, the data controller determines why and how personal data is processed, while the processor acts on their behalf. Focus on who holds ultimate decision authority over the data, as that entity retains legal compliance accountability.

Correct answer: B. Use symmetric encryption for bulk data and asymmetric encryption for key exchange

Hybrid encryption uses fast symmetric algorithms for bulk data and asymmetric algorithms to securely exchange those keys. Relying purely on asymmetric encryption for large volumes of data would create severe performance bottlenecks and limit scalability.

Correct answer: D. ECC (Elliptic Curve Cryptography)

Elliptic Curve Cryptography provides strong security with much smaller key sizes, making it highly efficient for mobile devices. RSA requires significantly larger keys to match this strength, demanding more computational overhead and draining battery life.

Correct answer: C. Senior Management / Executive Management

Senior management holds ultimate accountability for organizational security and must allocate the necessary funding and staffing. Responsibility for daily operations can be delegated downward to a security manager, but final accountability remains with executives.

Correct answer: B. Dynamic Application Security Testing (DAST)

Dynamic Application Security Testing evaluates a running application from the outside without requiring underlying source code access. Conversely, Static Application Security Testing analyzes source code internally during early development phases rather than evaluating live runtime behavior.

Correct answer: A. Input validation and client-side encryption

Input validation and client-side encryption operate directly within the user interface layer to protect data before it reaches backend servers. Database parameterization and role-based access control are backend controls that secure server-side data rather than client-facing interfaces.

Correct answer: B. Implementing continuous authentication and micro-segmentation

Implementing continuous authentication and micro-segmentation directly enforces the core Zero Trust philosophy of never trusting implicitly. Traditional security approaches rely on strong perimeter firewalls or VPN tunnels, which incorrectly assume internal network traffic is completely safe.

Correct answer: A. Contain the attack by disconnecting the server from the network

The first priority is containment to stop ongoing data exfiltration and limit further business impact. While preserving volatile evidence is critical, you must stop the bleeding first; letting attackers continue stealing data just to gather perfect logs is unacceptable.

Correct answer: F. Implement continuous identity verification and microsegmentation with policy-based access enforcement

Continuous identity verification and microsegmentation with policy-based enforcement successfully cover all three required Zero Trust outcomes. Single sign-on or multifactor authentication only validates the initial login and fails to stop lateral movement once a device connects.

Correct answer: G. Parallel test, activate the alternate site and process live transactions while production continues

A parallel test activates the alternate site and processes live transactions while production continues, balancing operational readiness with minimal disruption. Full interruption tests carry unacceptable risk, while simulations lack the real transaction processing required by executives.

Correct answer: A. SOC 2

A SOC 2 report is the correct choice because it assesses service providers against the Trust Services Criteria, which include security, availability, and confidentiality. Do not let the word financial mislead you into choosing SOC 1, which focuses strictly on financial reporting controls.

Correct answer: A. Data Owner, defines classification, determines sensitivity, and sets requirements for use

The Data Owner holds ultimate responsibility for classifying information and setting protection requirements, aligning with the Data Controller role under GDPR. Custodians handle the day-to-day technical enforcement, but they do not dictate the classification rules.

Correct answer: B. Temporarily suspend use of the data and notify Legal for GDPR compliance assessment

Temporarily suspending data use and notifying Legal is the correct answer because regulatory compliance always supersedes operational convenience. For the exam, remember that technical controls like encryption do not cure a missing legal basis for processing data.

Correct answer: B. Deter: Detect: Delay: Respond

Proactive physical security dictates deterring an attacker first, then detecting them if they proceed, and delaying their progress. Responding is always the final step, as you cannot neutralize a physical threat until after it has been identified.

Correct answer: C. The shorter the MTD, the higher the recovery cost

A short Maximum Tolerable Downtime requires faster recovery methods, which significantly increases overall costs. For the exam, remember that zero downtime requires expensive redundant hot sites, whereas longer tolerance windows allow cheaper cold site alternatives.

Correct answer: B. Common Vulnerability Scoring System (CVSS)

The Common Vulnerability Scoring System provides standardized numerical severity scores to help organizations analyze trends and prioritize remediation efforts. However, the Common Vulnerabilities and Exposures list is actually required to identify which specific system weaknesses are emerging globally.

Correct answer: A. The SIEM's correlation rules or data feeds may have failed

A sudden lack of alerts from an active SIEM usually points to a failure in data ingestion or correlation rules. Silence indicates a potential loss of visibility, not improved security. If logs are not feeding the engine, the tool cannot detect threats.

Correct answer: B. Chief Executive Officer (CEO)

Senior management, such as the CEO, is ultimately accountable for allocating adequate resources to security initiatives. While the CISO handles implementation, executive leadership must provide the budget and staff to execute the program.

Correct answer: B. Implement a reverse proxy to isolate backend systems from direct Internet access

A reverse proxy isolates backend systems by terminating external connections and forwarding only validated requests. This prevents attackers from pivoting. Deploying an IDS only detects intrusions, whereas a proxy actively prevents network traversal.

Correct answer: A. Contain the incident by isolating the infected server from the network

The immediate next step is to contain the incident by isolating the infected server, which stops the malware from spreading further. Eradication and recovery happen later; you must always stop the bleeding before performing actual cleanup.

Correct answer: H. Mitigate, implement strong fraud detection controls to reduce the annual loss

Mitigation is the best choice because implementing strong fraud controls reduces the annual loss expectancy to a tolerable three million dollars, safeguarding the massive revenue projection. Transferring the risk fails because the insurance cap leaves a massive exposure.

Correct answer: G. Implement the control, it is cost-effective and reduces impact to an acceptable level

Implementing the control is justified because the two million dollar annual loss reduction far exceeds the four hundred thousand dollar cost. A positive return on investment dictates action. Do not delay a clear quantitative decision by requesting unnecessary qualitative rankings.

Correct answer: C. Deploy a centralized Public Key Infrastructure (PKI) with automated certificate issuance and revocation

A centralized Public Key Infrastructure with automated lifecycle management is correct because it directly resolves certificate sprawl and enforces governance across the enterprise. Manual reviews or relying solely on hardware security modules fail to provide comprehensive lifecycle automation.

Correct answer: D. Contain the infection by isolating the impacted servers from the network

Isolating the impacted servers is the correct next step because containment halts active spread and limits further damage before eradication begins. Jumping straight to eradication or recovery risks missing infection vectors or reintroducing the malware.

Correct answer: G. Mandatory Access Control (MAC)

Mandatory Access Control is correct because it enforces strict, centrally defined rules based on clearance levels and data classification to provide the highest confidentiality assurance. Unlike discretionary access control, users cannot change permissions on files they do not own.

Correct answer: B. Encrypt all EU personal data at rest and in transit using industry-standard algorithms

Addressing legal and regulatory requirements like establishing a data processing agreement is the critical first step to avoid massive fines. Technical controls like encryption and DLP are important safeguards, but they do not fulfill the structural compliance mandates demanded by regulators.

Correct answer: E. Layer 7

DNS cache poisoning primarily occurs at Layer 7 because it manipulates the application service logic into returning malicious IP mappings. Even though DNS relies on lower layer transport protocols, the actual exploitation targets the application layer.

Correct answer: A. Deploy egress filtering to restrict outbound connections and detect abnormal data transfers

The correct choice is deploying egress filtering because it inspects and restricts outbound traffic to prevent unauthorized data transfers. Adding another intrusion detection system is a detective control, whereas egress filtering acts preventively against outbound data loss.

Correct answer: E. Physically shred or incinerate the SSDs through a certified destruction vendor with a certificate of destruction

Physical destruction via a certified vendor guarantees data cannot be recovered and provides legally defensible documentation. Software methods fail on solid state drives due to wear leveling. When zero recovery is required, always choose physical destruction over wiping or degaussing for flash media.

Correct answer: E. Conduct a targeted re-test by an independent assessor and document the results for audit evidence

Auditors require formal, verifiable proof that a vulnerability is closed, which an independent retest provides. Updating policies improves future processes but does not satisfy immediate compliance evidence needs. When regulators ask for proof, prioritize actionable validation and documentation over strategic planning.

Correct answer: H. Attribute-Based Access Control (ABAC)

Attribute based access control evaluates user, object, and environment attributes dynamically at runtime, perfectly satisfying context aware requirements. Role based access control lacks this dynamic flexibility and leads to role explosion. Match the model to scenarios requiring fine grained, auditable control.

Correct answer: E. Segregate high-sensitivity workloads onto dedicated physical hosts under a private-cloud or single-tenant model

Moving high sensitivity workloads to dedicated physical hosts eliminates the underlying virtualization isolation risk. You cannot secure or monitor a public cloud hypervisor you do not control. In shared environments, encryption and intrusion detection fail to mitigate hardware side channel attacks.

Correct answer: E. Immediately report the exposure to regulators as required under HIPAA and initiate breach-response procedures

Regulations mandate immediate reporting of unauthorized protected health information disclosure upon discovery, regardless of proven misuse. Delaying notification violates legal and ethical duties. For the exam, always prioritize strict compliance timelines over executive concerns regarding reputational damage or operational downtime.

Correct answer: C. Revoke all trust relationships and remove the compromised software, prioritizing containment over monitoring continuity

A compromised software update mechanism is an active threat requiring immediate containment by removing the software and revoking trust. Waiting for vendor guidance leaves malicious code running, which constitutes negligence. Always prioritize cutting the attack path over maintaining operational uptime.

Correct answer: D. Establish a formal information security governance framework tied to enterprise risk management

Establishing a formal governance framework aligns security with enterprise risk and integrates it into strategic business decisions. Tactical controls like patching only address specific vulnerabilities. When executives demand strategic alignment, always select the governance option.

Correct answer: D. Maintain containment and coordinate with Legal to ensure evidence integrity before initiating recovery

Maintaining containment and coordinating with legal ensures evidence integrity before recovery begins. Rushing system restoration risks contaminating the chain of custody, which ruins prosecution chances. Never skip forensic and legal validation steps during incident response.

Correct answer: H. SAML

Security Assertion Markup Language is the best fit because it supports federated identity and uses XML-based tokens for passing authentication data. The requirement for XML assertions eliminates OpenID Connect, which relies on JSON.

Correct answer: A. Data Controller

The correct choice is Data Controller because this role determines the purposes and means of processing personal data. Data processors act only on instructions from the controller, while custodians handle the technical implementation of internal security policies.

Correct answer: C. PCI DSS

The correct choice is PCI DSS because it explicitly regulates the security of payment cardholder data. Other distractors like HIPAA or GLBA govern healthcare records or financial institutions, so match the specific data type to its corresponding regulatory framework.

Correct answer: B. Install Data Loss Prevention (DLP) software that logs and alerts on USB transfers

Data Loss Prevention systems provide the necessary visibility by logging and alerting on unauthorized USB transfers without entirely blocking functionality. While completely disabling USB ports prevents leakage, it lacks monitoring capabilities and usually disrupts legitimate business operations.

Correct answer: E. It automatically rotates, manages, and audits privileged credentials

A Privileged Access Management solution automatically rotates, manages, and audits administrative credentials to prevent unauthorized system modifications. While blocking external network access is helpful, it does not provide the core credential governance, strict accountability, and auditing capabilities required.

Correct answer: D. Availability and Safety

Availability and safety represent the highest priorities in Industrial Control Systems because operational failure directly risks human life and physical infrastructure. Unlike corporate information technology environments, industrial systems prioritize continuous machinery operation over strict data confidentiality.

Correct answer: B. White Hat Hacker

A white hat hacker operates with explicit authorization to identify system weaknesses and improve organizational security defenses. The key distinguishing factors are proper permission and protective intent, whereas unauthorized attackers lack approval and typically exploit systems maliciously.

Correct answer: F. Systems must be restored within 8 hours and data loss must not exceed 30 minutes

Systems must be recovered within the eight-hour recovery time objective, and data loss cannot exceed thirty minutes. The maximum tolerable downtime represents the absolute deadline before severe business impact.

Correct answer: C. Segment the network into small logical zones with identity-based access control

Dividing the network into small logical zones with identity-based access controls directly limits lateral movement. In a Zero Trust architecture, segmenting assets restricts an attacker's ability to pivot after compromising a single device.

Correct answer: F. Mantraps and reinforced internal doors

Physical barriers like mantraps and reinforced doors delay intruders, providing critical time for guards to respond. This enforces the detect, delay, and respond sequence. Motion lights only detect, while patrols respond.

Correct answer: D. Have data owners define and approve classification levels based on business and legal requirements

Data owners must define and approve classification levels because they understand the business impact and legal requirements. Custodians handle technical enforcement later. If you enforce inconsistent labels first, you fail to solve the governance gap.

Correct answer: D. Class C

Class C extinguishers use non-conductive agents like carbon dioxide for energized electrical fires. Using water or conductive chemicals risks electrocution and severe equipment damage. Always prioritize human safety around high-voltage server racks.

Correct answer: B. Time synchronization between clients and the Key Distribution Center (KDC)

Kerberos relies on strict time synchronization between clients and the KDC to embed timestamps in tickets. If an attacker replays an old ticket, the server rejects the expired timestamp. Asymmetric encryption does not inherently stop replay attacks.

Correct answer: C. Replace stored card numbers with tokens generated by a PCI-compliant payment processor

Tokenization replaces sensitive card numbers with non-sensitive tokens, drastically reducing compliance scope. The payment processor maps tokens back to primary account numbers. Unlike encryption, tokenization removes sensitive data from internal systems.

Correct answer: G. Ensure the data processing agreement (DPA) addresses GDPR/HIPAA responsibilities

Ensuring the Data Processing Agreement addresses all regulatory responsibilities is the most critical step to legally bind the vendor to compliance. A SOC 2 report shows security posture, but without a legally binding DPA, your organization remains solely liable for data breaches.

Correct answer: D. Vulnerability

The analyst's statement accurately describes a vulnerability, which is an inherent weakness or lack of a preventive safeguard like encryption. The threat is the malicious actor utilizing the SQL injection technique, while the risk is the potential business impact of the stolen data.

Correct answer: F. PASTA

The correct choice is PASTA because it is a risk-centric methodology that aligns technical threats with business impact. STRIDE is a common distractor; remember it categorizes technical threat types rather than prioritizing based on business risk.

Correct answer: G. Mandate use of a PKI with certificates issued by globally trusted Certificate Authorities, with all key management retained by the bank

The correct choice works because mandating PKI with internally managed keys ensures legal nonrepudiation and limits supply chain risk. Relying on vendor compliance reports or blockchain fails to provide the recognized legal standing and strict key control required by regulators.

Correct answer: H. Recommend a parallel test of the DR site to validate RTO compliance without full interruption of production

The correct choice is recommending a parallel test because it validates recovery capabilities without disrupting production operations. Simulation tests are merely tabletop exercises and will not satisfy regulatory demands for actual demonstrated recovery capability.

Correct answer: H. SAML

The correct choice is SAML because it uses XML-based assertions to provide federated single sign-on across organizational boundaries. OpenID Connect is a tempting distractor, but remember it relies on JSON web tokens instead of XML for modern authentication.