Free ISC2 CISSP practice questions

Sample question 1. A team deploys its web application to a platform as a service offering, where the provider runs the operating system and language runtime. A penetration test finds an injection flaw in the application code. Who is responsible for fixing it?

1. The provider, because a PaaS provider is responsible for every layer of security from the hardware up to the application.
2. The customer, because in PaaS the application code and configuration are the customer’s.
3. Both parties equally, so neither should act until the contract is reviewed to decide who pays for the fix.
4. The penetration testing firm, because it found the flaw and is best placed to write the code change.

Sample question 2. An audit of 4,000 Linux servers finds tens of thousands of SSH authorized keys, many with no known owner, some belonging to staff who left years ago and some granting root access to automated processes. What should the security manager do FIRST?

1. Disable SSH keys everywhere and return to password authentication for every administrative login.
2. Rotate each server’s SSH host key pair so that stolen host keys become useless.
3. Leave existing keys in place because removing them may break automation.
4. Inventory all authorized keys, assign owners, remove orphaned keys and bring provisioning under central management.

Sample question 3. An access control matrix has subjects as rows and objects as columns. A security architect wants a structure that, for each user, lists every object that user may access and the rights held. Which structure is this?

1. An access control list, attached to each object and naming the subjects that may use it.
2. A security label, assigned to each object to show its classification and compartments.
3. A role definition, grouping the permissions needed for a job function across many users at once.
4. A capability list, held for each subject and naming the objects it may use.