Updated Jan-2026 CISSP Exam Practice Test Questions [Q278-Q298]

The correct answer is Rijndael algorithm. By definition, the others are incorrect.

* Answer “Employees must be unaware of the monitoring activity” is incorrect because employees must be made aware of the monitoring if it is to be legal
* answer “All employees must agree with the monitoring policy” is incorrect because employees do not have to agree with the policy
* answer “Results of the monitoring cannot be used against the employee” is incorrect because the results of monitoring might be used against the employee if the corporate policy is violated.

Senior management has the primary responsibility to ensure that security objectives are aligned with organizational goals. Senior management is the highest level of authority and decision-making in an organization, and it sets the vision, mission, strategy, and objectives for the organization. Senior management is also responsible for establishing the security governance framework, which defines the roles, responsibilities, policies, standards, and procedures for security management. Senior management should ensure that the security function supports and enables the organizational goals, and that the security objectives are consistent, measurable, and achievable. Senior management should also provide adequate resources, guidance, and oversight for the security function, and communicate the security expectations and requirements to all stakeholders. The information security department, the audit committee, and all users have some roles and responsibilities in ensuring that security objectives are aligned with organizational goals, but they are not the primary ones. The information security department is responsible for implementing, maintaining, and monitoring the security controls and processes, and reporting on the security performance and incidents. The audit committee is responsible for reviewing and verifying the effectiveness and compliance of the security controls and processes, and providing recommendations for improvement. All users are responsible for following the security policies and procedures, and reporting any security issues or violations.

Explanation/Reference:
Explanation:
Archive bit 1 = On (the archive bit is set).
Archive bit 0 = Off (the archive bit is NOT set).
A full backup backs up all files regardless of whether the archive bit is 1 or 0 and sets the archive bit to 0.
When the archive bit is set to ON, it indicates a file that has changed and needs to be backed up.
Differential backups back up all files that have changed since the last full backup – all files that have their archive bit value set to 1. Differential backups do not change the archive bit value when they backup a file; they leave the archive bit value set to 1.
Incorrect Answers:
B: Backs up data labeled with archive bit 1 and changes the data label to archive bit 0. – This is the behavior of an incremental backup, not a differential backup.
C: Backs up data labeled with archive bit 0 and leaves the data labeled as archive bit 0. – If the archive bit is set to 0 (Off), it will only be backed up with a Full backup. Differential and incremental backups will not back up the file.
D: Backs up data labeled with archive bit 0 and changes the data label to archive bit 1. – If the archive bit is set to 0 (Off), it will only be backed up with a Full backup. Differential and incremental backups will not back up the file.
References:
https://en.wikipedia.org/wiki/Archive_bit

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. A free implementation of this protocol is available from the Massachusetts Institute of Technology. Kerberos is available in many commercial products as well. Kerberos was created by MIT as a solution to these network security problems. The Kerberos protocol uses strong cryptography so that a client can prove its identity to a server (and vice versa) across an insecure network connection. After a client and server has used Kerberos to prove their identity, they can also encrypt (confidentiality) all of their communications to assure privacy and data integrity as they go about their business.

A security kernel is defined as the hardware, firmware, and software elements of a trusted computing base that implements the reference monitor concept. A reference monitor is a system component that enforces access controls on an object. Therefore, the reference monitor concept is an abstract machine that mediates all access of subjects to objects. The Security Kernel must: Mediate all accesses Be protected from modification Be verified as correct. -Ronald Krutz The CISSP PREP Guide (gold edition) pg 262

The form of attack that could be represented by the given scenario is a masquerading attack that sends packets intended for 10.102.10.6 to 10.102.10.2. A masquerading attack is a type of spoofing attack that involves impersonating another host or user to gain unauthorized access or privileges on a network or system. In this case, the attacker is masquerading as the gateway router by sending a false ARP reply to 10.102.10.2, claiming that the MAC address of 10.102.10.6 is the same as the MAC address of the gateway router. This causes
10.102.10.2 to update its ARP cache with the wrong information and send packets intended for 10.102.10.6 to the gateway router instead. The attacker can then intercept, modify, or redirect the packets to 10.102.10.6 or another host. A Denial of Service (DoS) attack against the gateway router or 10.102.10.2, or a transport layer attack that prevents the resolution of 10.102.10.6 address are not the forms of attack that could be represented by the given scenario, as they are more related to disrupting or blocking the network or system availability or functionality. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 6: Secure Network Architecture and Securing Network Components, page 358; CISSP Official (ISC)2 Practice Tests, Third Edition, Domain 4: Communication and Network Security, Question 4.9, page 186.

Convenience -Using single sign-on users have to type their passwords only once when they first log in to access all the network resources; and Centralized
Administration as some single sign-on systems are built around a unified server administration system. This allows a single administrator to add and delete accounts across the entire network from one user interface.
The following answers are incorrect:
Convenience – alone this is not the correct answer.
Centralized Data or Network Administration – these are thrown in to mislead the student.
Neither are a benefit to SSO, as these specifically should not be allowed with just an SSO.
References: TIPTON, Harold F. & KRAUSE, MICKI, Information Security Management
Handbook, 4th Edition, Volume 1, page 35
TIPTON, Harold F. & HENRY, Kevin, Official (ISC)2 Guide to the CISSP CBK, 2007, page
180

Security is more of a concern in distributed systems since there are
vulnerabilities associated with the network and the many locations
from which unauthorized access to the computing resources can
occur. The other answers are characteristics of a DDP architecture.

The Full Backup Method makes a complete backup of every file on the server every time it is run. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 69.

The retina, a thin nerve (1/50th of an inch) on the back of the eye, is the part of the
eye which senses light and transmits impulses through the optic nerve to the brain – the equivalent
of film in a camera. Blood vessels used for biometric identification are located along the neural
retina, the outermost of retina’s four cell layers.
The following answers are incorrect:
The amount of light reaching the retina The amount of light reaching the retina is not used in the
biometric scan of the retina.
The amount of light reflected by the retina The amount of light reflected by the retina is not used in
the biometric scan of the retina.
The pattern of light receptors at the back of the eye This is a distractor
The following reference(s) were/was used to create this question:
Reference: Retina Scan Technology.
ISC2 Official Guide to the CBK, 2007 (Page 161)

Section: Security Operations

A honeypot is a decoy system or network that is designed to attract and trap potential attackers. It is intentionally vulnerable and set up to mimic valuable assets or services to lure attackers into interacting with it. By monitoring the activities within the honeypot, security professionals can gather valuable information and evidence about the zero-day attack.

The TLS Protocol is comprised of the TLS Record and Handshake
Protocols. The TLS Record Protocol is layered on top of a transport
protocol such as TCP and provides privacy and reliability to the
communications. The privacy is implemented by encryption using
symmetric key cryptography such as DES or RC4. The secret key is
generated anew for each connection; however, the Record Protocol
can be used without encryption. Integrity is provided through the
use of a keyed Message Authentication Code (MAC) using hash
algorithms such as SHA or MD5.
The TLS Record Protocol is also used to encapsulate a higher-level
protocol such as the TLS Handshake Protocol. This Handshake Protocol
is used by the server and client to authenticate each other. The
authentication can be accomplished using asymmetric key cryptography
such as RSA or DSS. The Handshake Protocol also sets up the
encryption algorithm and cryptographic keys to enable the application
protocol to transmit and receive information.

Wire and cash transfers of $10,000 or more in a single transaction
must be reported to government officials.
Actions in answers “Subpoena of electronic records”, “Monitoring of Internet communications”, and c are permitted under the Patriot Act.
In answers “Subpoena of electronic records” and “Monitoring of Internet communications”, the government has new powers to subpoena electronic records and to monitor Internet traffic. In monitoring information, the government can require the assistance of ISPs and network operators. This monitoring can
even extend into individual organizations. In the Patriot Act, Congress permits investigators to gather information about electronic mail without having to show probable cause that the person to be monitored
had committed a crime or was intending to commit a crime. In
answer c, the items cited now fall under existing search and seizure
laws. A new twist is delayed notification of a search warrant. Under
the Patriot Act, if it suspected that notification of a search warrant
would cause a suspect to flee, a search can be conducted before notification of a search warrant is given.
In a related matter, the US and numerous other nations have
signed the Council of Europes Cybercrime Convention. In the
US, participation in the Convention has to be ratified by the Senate.
In essence, the Convention requires the signatory nations to spy on
their own residents, even if the action being monitored is illegal in
the country in which the monitoring is taking place.

Pivoting refers to method used by penetration testers that uses compromised system to attack other systems on the same network to avoid restrictions such as firewall configurations, which may prohibit direct access to all machines. For example, an attacker compromises a web server on a corporate network, the attacker can then use the compromised web server to attack other systems on the network. These types of attacks are often called multilayered attacks. Pivoting is also known as island hopping.
Pivoting can further be distinguished into proxy pivoting and VPN pivoting: Proxy pivoting generally describes the practice channeling traffic through a compromised target using a proxy payload on the machine and launching attacks from this computer.[1] This type of pivoting is restricted to certain TCP and UDP ports that are supported by the proxy. VPN pivoting enables the attacker to create an encrypted layer 2 tunnel into the compromised machine to route any network traffic through that target machine, for example to run a vulnerability scan on the internal network through the compromised machine, effectively giving the attacker full network access as if they were behind the firewall.
Typically, the proxy or VPN applications enabling pivoting are executed on the target computer as the payload (software) of an exploit.
The following answers are incorrect: Black Box Method Black-box testing is a method of software testing that tests the functionality of an application as opposed to its internal structures or workings (see white-box testing). Specific knowledge of the application’s code/internal structure and programming knowledge in general is not required. The tester is only aware of what the software is supposed to do, but not how i.e. when he enters a certain input, he gets a certain output; without being aware of how the output was produced in the
first place. Test cases are built around specifications and requirements, i.e., what the application is
supposed to do. It uses external descriptions of the software, including specifications,
requirements, and designs to derive test cases. These tests can be functional or non-functional,
though usually functional. The test designer selects valid and invalid inputs and determines the
correct output. There is no knowledge of the test object’s internal structure.
For Penetration testing it means that you have no knowledge of the target. You may only get an IP
address or a Domain Name and from that very limited amount of knowledge you must attempt to
find all that you can.
White Box Method
In penetration testing, white-box testing refers to a methodology where a white hat hacker has full
knowledge of the system being attacked. The goal of a white-box penetration test is to simulate a
malicious insider who has some knowledge and possibly basic credentials to the target system.
Grey Box Method
Gray-box testing is a combination of white-box testing and black-box testing. Aim of this testing is
to search for the defects if any due to improper structure or improper usage of applications.
In the context of the CEH this also means an internal test of company networks.
The following reference(s) were/was used to create this question:
https://en.wikipedia.org/wiki/Exploit_%28computer_security%29#Pivoting
https://en.wikipedia.org/wiki/Black-box_testing
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition
((ISC)2 Press) (Kindle Locations 4656-4657). Auerbach Publications. Kindle Edition.

This protocol was created by VISA and MasterCard as a common effort to make the buying process over the Internet secure through the distribution line of those companies. It is located in layer 7 of the OSI model.
SET uses a system of locks and keys along with certified account IDs for both consumers and merchants. Then, through a unique process of “encrypting” or scrambling the information exchanged between the shopper and the online store,
SET ensures a payment process that is convenient, private and most of all secure.
Specifically, SET:
*
Establishes industry standards to keep your order and payment information confidential.
*
Increases integrity for all transmitted data through encryption.
*
Provides authentication that a cardholder is a legitimate user of a branded payment card account.
*
Provides authentication that a merchant can accept branded payment card transactions through its relationship with an acquiring financial institution.
*
Allows the use of the best security practices and system design techniques to protect all legitimate parties in an electronic commerce transaction.
The SET process relies strongly on the use of certificates and digital signatures for the process of authentication and integrity of the information.

The concept that software developers should consider when using open-source software libraries is that open source libraries contain known vulnerabilities, and adversaries regularly exploit those vulnerabilities in the wild. Open source software libraries are collections of reusable code or functions that are publicly available and free to use or modify by anyone. Open source software libraries can reduce the development time of a software product, as they provide ready-made solutions or features that the software developers can integrate into their own code. However, open source software libraries also pose security risks, as they may contain known vulnerabilities that are publicly disclosed and documented, and that adversaries can easily exploit to compromise the software product or the system. Software developers should consider this concept when using open source software libraries, and they should perform due diligence, such as checking the reputation, quality, and security of the open source software libraries, updating them regularly, and testing them for vulnerabilities or compatibility issues. Open source software libraries cannot be used by everyone, and there is no common understanding that the vulnerabilities in these libraries will not be exploited, as this is a false and naive assumption that ignores the reality and the nature of the cyberthreat landscape. Open source software libraries are not constantly updated, making it unlikely that a vulnerability exists for an adversary to exploit, as this is also a false and optimistic assumption that overlooks the fact that some open source software libraries may be outdated, abandoned, or poorly maintained by their developers or communities. Open source software libraries do not contain unknown vulnerabilities, so they should not be used, as this is a false and pessimistic assumption that disregards the benefits and the potential of the open source software libraries, and that implies that proprietary or closed source software libraries are free of vulnerabilities, which is not true.
References: Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 21: Software Development Security, page 2016.