PART 1 - FREE EXAM PRACTICE CISSP ISC2

PART 1 (QUESTION 1 - 20 ) CISSP ISC2 BY COACH HERY PURNAMA

CISSP (Certified Information Systems Security Professional) adalah sertifikasi keamanan siber tingkat global paling bergengsi yang dikelola oleh ISC2. Sertifikasi ini ditujukan bagi profesional senior untuk merancang, mengelola, dan mengevaluasi program keamanan informasi perusahaan.

Syarat dan Ketentuan Utama

• Pengalaman Kerja: Minimal 5 tahun pengalaman kerja di 2 atau lebih dari 8 domain keamanan siber (gelar sarjana/magister atau sertifikasi tertentu dapat menggantikan 1 tahun pengalaman).

• Associate of ISC2: Jika belum memiliki pengalaman 5 tahun penuh, Anda tetap bisa mengikuti ujian; setelah lulus, Anda menjadi Associate hingga pengalaman terpenuhi.

• Endorsement: Setelah lulus ujian, Anda memerlukan proses pengesahan (endorsement) dari anggota ISC2 yang aktif.

• Biaya Tahunan (AMF): Membayar biaya pemeliharaan tahunan sekitar USD 135 setelah resmi tersertifikasi.

8 Domain Ujian CISSP

• Security and Risk Management (Keamanan dan Manajemen Risiko)

• Asset Security (Keamanan Aset)

• Security Architecture and Engineering (Arsitektur dan Rekayasa Keamanan)

• Communication and Network Security (Keamanan Komunikasi dan Jaringan)

• Identity and Access Management / IAM (Manajemen Identitas dan Akses)

• Security Assessment and Testing (Penilaian dan Pengujian Keamanan)

• Security Operations (Operasi Keamanan)

• Software Development Security (Keamanan Pengembangan Perangkat Lunak)

Format Ujian

• Metode: Ujian adaptif komputer (CAT - Computer Adaptive Testing).

• Jumlah Soal: 100 – 150 soal (pilihan ganda dan skenario).

• Durasi: Maksimal 3 jam.

• Skor Kelulusan: Minimum 700 dari skala 1000.

• Bahasa: Tersedia dalam bahasa Inggris (belum tersedia dalam bahasa Indonesia).

 

Part 1 – 50 QUESTIONs And Answer CISSP (Certified Information Security System Professional ) ISC2

 

QUESTION 1

 

In Federated Identity Management (FIM), which of the following represents the concept of federation?

 

A. Collection, maintenance, and deactivation of user objects and attributes in one or more systems, directories or applications

 

B. Collection of information logically grouped into a single entity

 

C. Collection of information for common identities in a system

 

D. Collection of domains that have established trust among themselves

 

Explanation

• Correct Answer (D): Collection of domains that have established trust among themselves.

• Why it is correct: In the context of CISSP (Domain 5: Identity and Access Management - IAM) and Federated Identity Management (FIM), a federation represents a trust relationship established between multiple distinct security domains or organizations. This arrangement allows users to single sign-on (SSO) and access resources across different organizations or domains without needing a separate account in each system, typically utilizing federation protocols like SAML, OAuth, or OpenID Connect.

 

• Incorrect Answer (A):

• Why it is wrong: This option describes directory services or identity repository management (such as user provisioning, maintenance, and deactivation in an LDAP or Active Directory), which handles user objects within a system rather than cross-domain trust relationships.

 

• Incorrect Answer (B):

• Why it is wrong: This is a generic description of data organization or database entity grouping, not related to identity federation or multi-domain trust.

 

• Incorrect Answer (C):

• Why it is wrong: This refers to centralized identity repositories or single-system identity stores containing common user profiles, whereas federation specifically focuses on trust interactions across multiple separate domains.

 

 

 

 

QUESTION 2

 

 

A company is enrolled in a hard drive reuse program where decommissioned equipment is sold back to the vendor when it is no longer needed. The vendor pays more money for functioning drives than equipment that is no longer operational. Which method of data sanitization would provide the most secure means of preventing unauthorized data loss, while also receiving the most money from the vendor?

 

A. Pinning

 

B. Single-pass wipe

 

C. Multi-pass wipes

 

 

D. Degaussing

Explanation (CISSP / ISC2 Context)

• Correct Answer (C): Multi-pass wipes

• Why it is correct: In the context of CISSP (Domain 2: Asset Security), the organization wants to resell media while preserving its functional state to maximize return on investment (ROI). Software overwriting using multi-pass wiping renders data unrecoverable against standard forensic techniques while maintaining the drive's physical integrity and operational status.

 

• Incorrect Answer (A): Pinning

• Why it is wrong: Pinning is not a recognized data sanitization or media destruction method in information security.

 

• Incorrect Answer (B): Single-pass wipe

• Why it is wrong: A single-pass overwrite leaves a lower margin of safety compared to multi-pass wiping, making multi-pass wipes the preferred and more secure logical sanitization option among the choices provided.

 

• Incorrect Answer (D): Degaussing

• Why it is wrong: Degaussing disrupts magnetic fields and destroys the drive's internal track timing/formatting mechanisms, rendering hard drives completely inoperable. This would result in the vendor paying less money since the drive is no longer functional.

 

 

 

QUESTION 3

 

 

What is the benefit of using Network Admission Control (NAC)?

 

 

A. NAC only supports Windows operating systems (OS).

 

B. NAC supports validation of the endpoint's security posture prior to allowing the session to go into an authorized state.

 

 

C. NAC can require the use of certificates, passwords, or a combination of both before allowing network admission.

 

D. Operating system (OS) versions can be validated prior to allowing network access.

Explanation (CISSP / ISC2 Context)

• Correct Answer (B): NAC supports validation of the endpoint's security posture prior to allowing the session to go into an authorized state.

• Why it is correct: In the context of CISSP (Domain 4: Communication and Network Security), Network Admission Control (NAC) is designed to inspect and evaluate the security posture of an endpoint (such as checking for up-to-date antivirus definitions, patches, and compliance policies) before granting it access to the network resources.

 

• Incorrect Answer (A):

• Why it is wrong: NAC solutions are vendor-agnostic and support multiple operating systems (such as macOS, Linux, iOS, and Android), not just Windows.

 

• Incorrect Answer (C):

• Why it is wrong: While authentication mechanisms like certificates or passwords can be part of network access control, this option describes standard authentication protocols (such as 802.1X or RADIUS authentication) rather than the comprehensive posture validation and compliance checking that defines NAC functionality.

 

• Incorrect Answer (D):

• Why it is wrong: Although checking OS versions can be a component of posture validation, this option is too narrow. NAC evaluates the overall security posture of the endpoint, which encompasses patches, firewall status, anti-malware versions, and compliance rules as a whole, making option B the most complete and accurate definition of NAC benefits.

 

 

Here is the text from the image with the green option bolded:

 

QUESTION 5

 

 

A bank failed to meet service-level agreements (SLA) with customers after suffering from a database failure of the transaction processing system (TPS) that resulted in delayed financial deposits. A regulatory agency overseeing the bank would like to determine if the cause of the delay was a material weakness. Which of the following documents is MOST relevant for the regulatory agency to review?

 

A. Business continuity plan (BCP)

 

 

B. Business impact analysis (BIA)

 

C. Continuity of Operations Plan (COOP)

 

D. Enterprise resource planning (ERP)

Explanation (CISSP / ISC2 Context)

• Correct Answer (A): Business continuity plan (BCP)

• Why it is correct: In the context of CISSP (Domain 1: Security and Risk Management), the Business Continuity Plan (BCP) contains the overarching strategy, procedures, and operational recovery plans required to sustain business operations during a disruption. Regulators review the BCP to assess whether controls, failover mechanisms, and recovery procedures were properly designed and executed, helping them determine if the SLA failure resulted from a material weakness in governance or planning.

 

• Incorrect Answer (B): Business impact analysis (BIA)

• Why it is wrong: The BIA is a preliminary analysis process used to identify critical business functions, Maximum Tolerable Downtime (MTD), and Recovery Time Objectives (RTO). It is an input used to build the BCP, not the operational plan executed during an actual incident.

 

• Incorrect Answer (C): Continuity of Operations Plan (COOP)

• Why it is wrong: COOP primarily focuses on maintaining essential government agency operations or restoring operations at alternate physical sites during catastrophic emergencies. While similar in concept, BCP is the standard comprehensive framework used for business and financial institutions.

 

• Incorrect Answer (D): Enterprise resource planning (ERP)

• Why it is wrong: An ERP is an integrated business software application system used to manage day-to-day business operations (such as accounting, supply chain, and HR), not a governance or continuity planning document.

 

 

Here is the text from the image with the green option bolded:

 

QUESTION 6

 

 

The development team has been tasked with collecting data from biometric devices. The application will support a variety of collection data streams. During the testing phase, the team utilizes data from an old production database in a secure testing environment. What principle has the team taken into consideration?

 

A. Biometric data cannot be changed.

 

B. The biometric devices are unknown.

 

C. Biometric data must be protected from disclosure.

 

 

D. Separate biometric data streams require increased security.

Explanation (CISSP / ISC2 Context)

• Correct Answer (C): Biometric data must be protected from disclosure.

• Why it is correct: In the context of CISSP (Domain 2: Asset Security / Domain 8: Software Development Security), biometric data is classified as highly sensitive Personally Identifiable Information (PII) because biological characteristics cannot be reset or changed if compromised. By performing testing strictly within a secure testing environment when using actual production-derived biometric data, the development team is ensuring confidentiality and preventing unauthorized disclosure or exposure of sensitive identity attributes.

 

• Incorrect Answer (A): Biometric data cannot be changed.

• Why it is wrong: While it is a factual characteristic of biometrics that physical traits cannot easily be changed or revoked like passwords, this statement describes a property of biometrics rather than the security principle the team considered by placing the data in a secure testing environment.

 

• Incorrect Answer (B): The biometric devices are unknown.

• Why it is wrong: The QUESTION specifies that the application supports a variety of data streams, but the unknown status of physical devices is irrelevant to why the team secured the test environment for production data.

 

• Incorrect Answer (D): Separate biometric data streams require increased security.

• Why it is wrong: Data streams refer to how data is transmitted or collected rather than the underlying privacy and protection requirements governing sensitive PII at rest during software development and testing phases.

 

 

 

 

QUESTION 7

 

 

When developing an external facing web-based system, which of the following would be the MAIN focus of the security assessment prior to implementation and production?

 

A. Ensuring Secure Sockets Layer (SSL) certificates are signed by a certificate authority

 

B. Ensuring Secure Sockets Layer (SSL) certificates are internally signed

 

C. Assessing the Uniform Resource Locator (URL)

 

D. Ensuring that input validation is enforced

 

Explanation (CISSP / ISC2 Context)

• Correct Answer (D): Ensuring that input validation is enforced

• Why it is correct: In the context of CISSP (Domain 8: Software Development Security), external-facing web applications are prime targets for injection attacks (such as SQL injection and Cross-Site Scripting). Proper input validation is a foundational defense mechanism that ensures untrusted user input is validated, sanitized, or rejected before it is processed by the application, making it the primary focus during security assessments prior to production.

 

• Incorrect Answer (A):

• Why it is wrong: While obtaining SSL/TLS certificates from a trusted Certificate Authority is essential for secure communication in transit (Domain 4), it relates to transport layer security rather than pre-implementation application code security assessments.

 

• Incorrect Answer (B):

• Why it is wrong: Internally signed certificates are typically restricted to internal testing or development environments and would trigger trust warnings for external users, making them inappropriate for public-facing web systems.

 

• Incorrect Answer (C):

• Why it is wrong: Assessing URLs is not the primary focus of application security reviews; evaluations must center on core security controls such as input validation, session management, and access controls.

 

QUESTION 8

 

A healthcare organization utilizes three data classification categories: unrestricted sharing, restricted sharing, and internal use only. Which scenario best illustrates proper alignment with sound enterprise data classification practices?

 

A. An employee code of conduct document labeled as restricted sharing is displayed in a public hallway accessible to patients.

 

B. An employee code of conduct document labeled as internal use only is displayed in a public waiting area.

 

C. A memorandum concerning a newly identified security breach labeled as internal use only is posted on a wall inside the staff lunchroom.

 

D. An electronic health record containing personally identifiable information labeled as restricted sharing is located in the staff lunchroom.

Explanation (CISSP / ISC2 Context)

• Correct Answer (C): A memorandum concerning a newly identified security breach labeled as internal use only is posted on a wall inside the staff lunchroom.

• Why it is correct: In the context of CISSP (Domain 2: Asset Security), effective data classification and handling require that sensitive information is restricted to authorized personnel. A security breach memorandum contains internal operational information meant solely for staff. Displaying it in an employee-only lunchroom ensures that physical and environmental access controls match the data's "internal use only" classification level.

 

• Incorrect Answer (A):

• Why it is wrong: Placing restricted documents in public hallways where patients and visitors have unrestricted access violates the core principle of confidentiality and proper asset handling.

 

• Incorrect Answer (B):

• Why it is wrong: A public waiting area is accessible by unauthorized individuals, meaning that exposing internal-use documents there breaches basic physical security and classification controls.

 

• Incorrect Answer (D):

• Why it is wrong: Electronic health records (EHR) containing sensitive personally identifiable information (PII) require strict handling, privacy controls, and secure storage. Leaving them exposed in a lunchroom setting represents a failure in safeguarding sensitive data.

 

 

QUESTION 9

 

 

What is the FIRST step for an organization to take before allowing personnel to access social media from a corporate device or user account?

 

A. Publish an acceptable usage policy.

 

 

B. Publish a social media guidelines document.

 

C. Deliver security awareness training.

 

D. Document a procedure for accessing social media sites.

Explanation (CISSP / ISC2 Context)

• Correct Answer (A): Publish an acceptable usage policy.

• Why it is correct: In the context of CISSP (Domain 1: Security and Risk Management / Security Governance), establishing administrative controls through policies is always the foundational first step. An Acceptable Use Policy (AUP) defines the rules, boundaries, and expected behavior regarding what is and is not permitted on corporate devices or networks before technical controls, guidelines, or training are deployed.

 

• Incorrect Answer (B):

• Why it is wrong: While a social media guidelines document helps shape employee conduct, policies must be established and published first as the governing baseline for organizational compliance.

 

• Incorrect Answer (C):

• Why it is wrong: Security awareness training must educate employees on existing policies (like the AUP); therefore, the policy must be defined and published before training can effectively take place.

 

• Incorrect Answer (D):

• Why it is wrong: Procedures describe step-by-step instructions for performing tasks, which flow downward from policies and standards. Establishing the governing policy comes before writing operational procedures.

 

 

 

QUESTION 10

 

An organization has experienced multiple distributed denial-of-service (DDoS) attacks in recent months that have impacted their public-facing web and e-commerce sites that were previously all on-premises. After an analysis of the problems, the network engineers have recommended that the organization implement additional name service providers and redundant network paths. What is another recommendation that helps ensure the future availability of their web and e-commerce sites?

 

A. Move all cloud-based operations back to on-premises to mitigate attacks.

 

B. Move all websites to a new location.

 

C. Review current detection strategies and employ signature-based techniques.

 

D. Review the service-level agreements (SLA) with their cloud service providers.

Explanation (CISSP / ISC2 Context)

• Correct Answer (D): Review the service-level agreements (SLA) with their cloud service providers.

• Why it is correct: In the context of CISSP (Domain 1: Security and Risk Management & Domain 4: Communication and Network Security), ensuring high availability and resilience against DDoS attacks when leveraging cloud resources requires establishing and reviewing formal contractual commitments. Service-Level Agreements (SLAs) define uptime guarantees, response times, mitigation responsibilities, and performance parameters provided by cloud vendors during volumetric attacks.

 

• Incorrect Answer (A):

• Why it is wrong: Moving cloud-based operations back to on-premises infrastructure decreases overall bandwidth capacity and flexibility, making the organization significantly more susceptible to large-scale DDoS attacks compared to cloud infrastructure that scales dynamically.

 

• Incorrect Answer (B):

• Why it is wrong: Simply relocating websites without changing underlying architectural controls, redundancy mechanisms, or cloud provider protections does not solve DDoS vulnerabilities.

 

• Incorrect Answer (C):

• Why it is wrong: Signature-based detection techniques are ineffective against many modern DDoS attacks (such as volumetric flooding or zero-day application-layer floods) because DDoS traffic often mimics legitimate requests rather than matching known static signature patterns. Anomaly-based or behavioral detection is required instead.

 

 

QUESTION 11

 

 

A company is attempting to enhance the security of its user authentication processes. After evaluating several options, the company has decided to utilize Identity as a Service (IDaaS). Which of the following factors leads the company to choose an IDaaS as their solution?

 

A. In-house team lacks resources to support an on-premise solution.

 

 

B. Third-party solutions are inherently more secure.

 

C. Third-party solutions are known for transferring the risk to the vendor.

 

D. In-house development provides more control.

Explanation (CISSP / ISC2 Context)

• Correct Answer (A): In-house team lacks resources to support an on-premise solution.

• Why it is correct: In the context of CISSP (Domain 5: Identity and Access Management - IAM & Domain 3: Security Architecture and Engineering), organizations often choose cloud-based Identity as a Service (IDaaS) when internal resources, specialized staff, or infrastructure are insufficient to securely build, maintain, and manage an on-premise identity infrastructure (such as Active Directory Federation Services or local multi-factor authentication servers).

 

• Incorrect Answer (B):

• Why it is wrong: Third-party solutions are not inherently more secure simply by virtue of being cloud-based; security depends heavily on proper configuration, integration, and cloud provider controls.

 

• Incorrect Answer (C):

• Why it is wrong: While organizations can outsource operational management and technical controls to a cloud provider, ultimate risk cannot be transferred. Under risk management principles, the organization remains ultimately accountable for the security and privacy of its data and user identities.

 

• Incorrect Answer (D):

• Why it is wrong: In-house development or management provides more control, but if an organization lacks the resources to support an on-premise solution, choosing in-house control contradicts the premise of moving to an outsourced IDaaS model.

 

 

QUESTION 12

 

 

What is the PRIMARY purpose of creating and reporting metrics for a security awareness, training, and education program?

 

A. Measure the effect of the program on the organization's workforce.

 

 

B. Make all stakeholders aware of the program's progress.

 

C. Facilitate supervision of the periodic training events.

 

D. Comply with legal regulations and document due diligence in security practices.

Explanation (CISSP / ISC2 Context)

• Correct Answer (A): Measure the effect of the program on the organization's workforce.

• Why it is correct: In the context of CISSP (Domain 1: Security and Risk Management - Security Awareness and Training), metrics are primarily used to evaluate effectiveness, track behavioral changes, and determine whether the security awareness training is successfully reducing human risk and improving the security posture of the workforce.

 

• Incorrect Answer (B):

• Why it is wrong: While informing stakeholders is a secondary benefit, reporting metrics is not solely about progress updates; it must directly measure behavioral impact and program efficacy.

 

• Incorrect Answer (C):

• Why it is wrong: Facilitating supervision or attendance tracking of training events is an administrative management function, whereas metrics aim to evaluate the actual outcome and risk reduction achieved by the training.

 

• Incorrect Answer (D):

• Why it is wrong: Compliance and due diligence are important byproducts of training records, but the fundamental primary purpose of creating metrics for an awareness program is to measure and improve workforce behavior and security readiness.

 

 

QUESTION 13

 

 

A security practitioner detects an Endpoint attack on the organization's network. What is the MOST reasonable approach to mitigate future Endpoint attacks?

 

A. Remove all non-essential client-side web services from the network.

 

B. Harden the client image before deployment.

 

 

C. Screen for harmful exploits of client-side services before implementation.

 

D. Block all client-side web exploits at the perimeter.

Explanation (CISSP / ISC2 Context)

• Correct Answer (B): Harden the client image before deployment.

• Why it is correct: In the context of CISSP (Domain 3: Security Architecture and Engineering / Domain 7: Security Operations), endpoint security relies heavily on secure configuration baselines. Hardening the client image (such as removing unnecessary services, disabling default accounts, applying patches, and enforcing security configurations) before deploying endpoints to users is the foundational best practice to minimize attack surfaces and mitigate future endpoint attacks.

 

• Incorrect Answer (A):

• Why it is wrong: Removing all non-essential client-side web services is often operationally impractical and does not directly address standard endpoint hardening principles.

 

• Incorrect Answer (C):

• Why it is wrong: Screening for exploits before implementation focuses on code or vulnerability scanning rather than the overarching system hardening needed to protect operational endpoints.

 

• Incorrect Answer (D):

• Why it is wrong: Relying solely on perimeter defenses to block client-side web exploits is insufficient because endpoints are mobile, can connect outside the corporate network, and require native host-based protections and hardening.

 

 

QUESTION 14

 

 

The initial security categorization should be done early in the system life cycle and should be reviewed periodically. Why is it important for this to be done correctly?

 

A. It determines the functional and operational requirements.

 

B. It determines the security requirements.

 

 

C. It affects other steps in the certification and accreditation process.

 

D. The system engineering process works with selected security controls.

Explanation (CISSP / ISC2 Context)

• Correct Answer (B): It determines the security requirements.

• Why it is correct: In the context of CISSP (Domain 1: Security and Risk Management & Domain 3: Security Architecture and Engineering), security categorization (evaluating information types based on confidentiality, integrity, and availability in frameworks like NIST SP 800-60 / 800-37) serves as the foundational step that directly dictates the appropriate baseline security controls and requirements needed to protect the system throughout its lifecycle.

 

• Incorrect Answer (A):

• Why it is wrong: Functional and operational requirements are driven primarily by business needs, user stories, and operational objectives rather than security categorization.

 

• Incorrect Answer (C):

• Why it is wrong: While categorization does influence subsequent steps in certification and accreditation (Risk Management Framework), option B identifies the direct foundational purpose: it determines the exact security requirements and control baselines required for the system.

 

• Incorrect Answer (D):

• Why it is wrong: System engineering processes implement selected controls, but the selection and tailoring of those controls stem directly from the security categorization process.

 

 

QUESTION 15

 

 

Commercial off-the-shelf (COTS) software presents which of the following additional security concerns?

 

A. Vendors take on the liability for COTS software vulnerabilities.

 

B. In-house developed software is inherently less secure.

 

C. COTS software is inherently less secure.

 

D. Exploits for COTS software are well documented and publicly available.

 

Explanation (CISSP / ISC2 Context)

• Correct Answer (D): Exploits for COTS software are well documented and publicly available.

• Why it is correct: In the context of CISSP (Domain 8: Software Development Security & Domain 3: Security Architecture and Engineering), Commercial off-the-shelf (COTS) software is widely distributed and used across many organizations. Because the source code and platform details are common knowledge, vulnerabilities and exploits for COTS software are frequently discovered, well-documented, and publicly available (e.g., via CVE databases), making unpatched COTS systems prime targets for attackers who can easily script and automate attacks against them.

 

• Incorrect Answer (A):

• Why it is wrong: Software vendors typically disclaim liability for security vulnerabilities or breaches in their End User License Agreements (EULAs), meaning the organization using the software retains ultimate liability and risk.

 

• Incorrect Answer (B):

• Why it is wrong: In-house developed software is not inherently less secure; security depends entirely on the adherence to secure coding practices and the Software Development Life Cycle (SDLC). Furthermore, this is not a specific security concern introduced by COTS software.

 

• Incorrect Answer (C):

• Why it is wrong: COTS software is not inherently less secure than custom software; many commercial products undergo rigorous security testing. The distinct concern with COTS is its widespread visibility and public knowledge of its codebase vulnerabilities.

 

 

 

QUESTION 16

 

 

A Chief Information Security Officer (CISO) is considering various proposals for evaluating security weaknesses and vulnerabilities at the source code level. Which of the following items BEST equips the CISO to make smart decisions for the organization?

 

A. The Common Weakness Risk Analysis Framework (CWRAF)

 

 

B. The Common Vulnerabilities and Exposures (CVE)

 

C. The Common Weakness Enumeration (CWE)

 

D. The Open Web Application Security Project (OWASP) Top Ten

Explanation (CISSP / ISC2 Context)

• Correct Answer (A): The Common Weakness Risk Analysis Framework (CWRAF)

• Why it is correct: In the context of CISSP (Domain 8: Software Development Security & Domain 1: Security and Risk Management), the Common Weakness Risk Analysis Framework (CWRAF) provides a structured, quantitative, and risk-based approach to help organizations evaluate software weaknesses (CWEs) based on their specific business context and risk profile. This empowers a CISO to make informed, risk-prioritized decisions regarding source code vulnerabilities.

 

• Incorrect Answer (B):

• Why it is wrong: The Common Vulnerabilities and Exposures (CVE) dictionary is a catalog of known, published cybersecurity vulnerabilities in deployed software/hardware products, not a framework for evaluating source code weaknesses and risk analysis.

 

• Incorrect Answer (C):

• Why it is wrong: Common Weakness Enumeration (CWE) provides a formal dictionary or taxonomy of software weakness types, but it does not provide the risk analysis and decision-making framework needed to evaluate business-specific risk at the executive level. CWRAF works hand-in-hand with CWE to provide that risk context.

 

• Incorrect Answer (D):

• Why it is wrong: The OWASP Top Ten lists the most critical web application security risks, but it is an awareness document rather than a comprehensive risk analysis framework designed to evaluate source-code-level weaknesses across an enterprise.

 

 

QUESTION 17

 

An organization has approved deployment of a virtual environment for the development servers and has established controls for restricting access to resources. In order to implement best security practices for the virtual environment, the security team MUST also implement which of the following steps?

 

A. Implement a dedicated management network for the hypervisor.

 

B. Deploy Terminal Access Controller Access Control System Plus (TACACS+) for authentication.

 

C. Implement complex passwords using Privileged Access Management (PAM).

 

D. Capture network traffic for the network interface.

Explanation (CISSP / ISC2 Context)

• Correct Answer (A): Implement a dedicated management network for the hypervisor.

• Why it is correct: In the context of CISSP (Domain 3: Security Architecture and Engineering & Domain 4: Communication and Network Security), securing a virtualized environment requires separating management traffic from guest virtual machine data traffic. Establishing a dedicated, isolated management network (out-of-band or secured VLAN) for hypervisor administration protects the core management interface from attacks originating from the virtual machines or general networks.

 

• Incorrect Answer (B):

• Why it is wrong: While TACACS+ provides robust authentication, authorization, and accounting (AAA) typically used for network device administration, it is not the foundational hypervisor isolation step mandated as a primary architectural control for virtualized environments.

 

• Incorrect Answer (C):

• Why it is wrong: Privileged Access Management (PAM) is useful, but simply stating complex passwords with PAM does not address the crucial network segregation and architectural isolation needed for hypervisor security.

 

• Incorrect Answer (D):

• Why it is wrong: Capturing network traffic (packet sniffing) is a monitoring or troubleshooting tool, not a proactive architectural security control required for deploying virtual environments.

 

 

QUESTION 18

 

 

Which of the following factors should be considered characteristics of Attribute Based Access Control (ABAC) in terms of the attributes used?

 

A. Mandatory Access Control (MAC) and Discretionary Access Control (DAC)

 

B. Discretionary Access Control (DAC) and Access Control List (ACL)

 

C. Role Based Access Control (RBAC) and Mandatory Access Control (MAC)

 

D. Role Based Access Control (RBAC) and Access Control List (ACL)

 

Explanation (CISSP / ISC2 Context)

• Correct Answer (D): Role Based Access Control (RBAC) and Access Control List (ACL)

• Why it is correct: In the context of CISSP (Domain 5: Identity and Access Management - IAM), Attribute-Based Access Control (ABAC)—sometimes referred to as Policy-Based Access Control (PBAC)—is a flexible model where access decisions are evaluated based on combinations of attributes (such as user attributes, resource/object attributes, action attributes, and environmental conditions). Because ABAC is a generalized, highly extensible model, it can subsume or incorporate characteristics of other access control models, such as using roles (RBAC) or explicit object permissions (ACLs) as part of its evaluated rule set.

 

• Incorrect Answer (A):

• Why it is wrong: Mandatory Access Control (MAC) relies strictly on fixed security labels and clearance levels (lattice-based models), which fundamentally differs from the dynamic, attribute-driven evaluation of ABAC.

 

• Incorrect Answer (B):

• Why it is wrong: DAC allows the owner of a resource to decide access, which is an independent access control paradigm rather than a defining attribute characteristic of ABAC.

 

• Incorrect Answer (C):

• Why it is wrong: MAC relies on system-enforced labels, which cannot be dynamically combined with arbitrary contextual attributes in the way ABAC evaluates conditions.

 

 

QUESTION 19

 

 

Which of the following services can be deployed via a cloud service or on-premises to integrate with Identity as a Service (IDaaS) as the authoritative source of user identities?

 

A. Multi-factor authentication (MFA)

 

B. Directory

 

 

C. User database

 

D. Single sign-on (SSO)

Explanation (CISSP / ISC2 Context)

• Correct Answer (B): Directory

• Why it is correct: In the context of CISSP (Domain 5: Identity and Access Management - IAM), directory services (such as Microsoft Active Directory, Azure AD/Entra ID, or LDAP directories) serve as the authoritative repositories and source of truth for user identities, accounts, and attributes. Organizations often deploy directories either on-premises (synchronizing via tools like Azure AD Connect) or natively in the cloud to integrate with Identity as a Service (IDaaS) solutions.

 

• Incorrect Answer (A):

• Why it is wrong: Multi-factor authentication (MFA) is an authentication verification mechanism/control rather than an authoritative repository or source of user identities.

 

• Incorrect Answer (C):

• Why it is wrong: While a general user database stores user information, "Directory" is the specific architectural term and standard enterprise service (supporting LDAP/Kerberos/protocols) used as the authoritative identity store integrated with IDaaS.

 

• Incorrect Answer (D):

• Why it is wrong: Single sign-on (SSO) is an access control capability that allows users to authenticate once to access multiple applications; it consumes identity information rather than acting as the authoritative source repository.

 

 

QUESTION 20

 

 

Which of the following protection is provided when using a Virtual Private Network (VPN) with Authentication Header (AH)?

 

A. Sender non-repudiation

 

 

B. Multi-factor authentication (MFA)

 

C. Payload encryption

 

D. Sender confidentiality

Explanation (CISSP / ISC2 Context)

• Correct Answer (A): Sender non-repudiation

• Why it is correct: In the context of CISSP (Domain 4: Communication and Network Security & Domain 3: Security Architecture and Engineering), IPsec provides two core protocols: Authentication Header (AH) and Encapsulating Security Payload (ESP). AH provides data integrity, data origin authentication, and protection against replay attacks, which together support non-repudiation (ensuring a sender cannot deny having sent a message) when implemented with asymmetric digital signatures, distinguishing it from ESP which primarily focuses on confidentiality via encryption.

 

• Incorrect Answer (B):

• Why it is wrong: Multi-factor authentication (MFA) is an identity verification method used during login or session establishment (Domain 5), not a packet-level cryptographic service provided by the IPsec AH protocol.

 

• Incorrect Answer (C):

• Why it is wrong: Payload encryption is not provided by Authentication Header (AH). AH explicitly provides integrity and authentication, but leaves the payload unencrypted. Confidentiality and payload encryption are handled by ESP (Encapsulating Security Payload).

 

• Incorrect Answer (D):

• Why it is wrong: Sender confidentiality refers to keeping communication private and hidden from eavesdroppers, which requires encryption (provided by ESP). Since AH does not encrypt traffic, it does not provide confidentiality.

 

Lanjut Ke PART 2 CISSP >

Ikuti kelas bootcamp persiapan ujian CISSP bersama Hery Purnama daftar melalui whatsapp 081223344506