Try ISC2 CISSP

Q1.A startup's board requires the security team to reduce a high-rated insider threat risk. The security team's options include implementing DLP software ($120,000 annually), purchasing insider threat insurance ($40,000 annually), or formally accepting the risk. The ALE for the insider threat is $60,000. What is the most defensible recommendation?

• A.Transfer the risk through $40,000 insurance because it costs less than ALE and satisfies the board's requirement to reduce risk
• B.Implement DLP controls because technical controls always provide more durable protection than insurance transfer
• C.Accept the risk because ALE is low enough to be within normal operating loss expectations
• D.Implement DLP controls and purchase insurance simultaneously to achieve maximum risk reduction

Domain: Security and Risk Management

Q2.A red team discovers that a web server's service account has unconstrained Kerberos delegation enabled. The red team compromises the web server and extracts TGTs for every user who has authenticated to that server in the past hour. They then use these TGTs to access the organization's internal file server and email system as those users. What is the specific Active Directory misconfiguration that enabled this attack?

• A.Unconstrained Kerberos delegation on the service account, which causes user TGTs to be forwarded to and cached on the delegating host, where they can be extracted and replayed
• B.Constrained Kerberos delegation misconfiguration that inadvertently allows the service to delegate to all services rather than only the specified allowed services
• C.Missing SPN registration on the service account, which forces the system to fall back to NTLM authentication and expose password hashes instead of Kerberos tickets
• D.AdminSDHolder ACL misconfiguration that allowed the service account to modify the protected users group and grant itself delegation rights

Domain: Identity and Access Management

Q3.A national electric utility performs a security review of its energy management system (EMS). The security consultant recommends implementing an air gap between the EMS and the corporate network. The utility argues that a full air gap prevents necessary remote diagnostics. Which approach BEST balances the operational requirement for remote access with the security requirement to minimize IT/OT connectivity?

• A.A data diode combined with a DMZ-hosted jump server, allowing one-way data flow from OT to IT and restricting remote access to a controlled authenticated session boundary
• B.A site-to-site VPN between the corporate network and the OT network, encrypted with AES-256-GCM to prevent eavesdropping on diagnostic traffic
• C.SNMP read-only polling from the IT network directly to OT devices, because read-only access cannot be used to modify PLC configurations
• D.TLS-encrypted sessions between IT and OT networks, because encryption eliminates the confidentiality risk of direct IT/OT connectivity

Domain: Security Architecture and Engineering

Q4.A vulnerability scanner reports 200 vulnerabilities. A security analyst sorts by CVSS Base Score and begins remediating from the top. A week later the most critical vulnerability — a 9.8 in a server with no internet exposure on an isolated research network — has been remediated first, while a 7.2 in an internet-facing authentication system remains open. A senior analyst challenges this prioritization approach. What is the core limitation of relying solely on CVSS Base Score for prioritization?

• A.CVSS Base Scores measure intrinsic vulnerability severity independent of deployment context; they do not account for asset exposure, criticality, or compensating controls in the actual environment
• B.CVSS Base Scores are inaccurate for server vulnerabilities because the scoring formula was designed for workstation and endpoint environments
• C.CVSS scores are only reliable for the first 30 days after publication because vendors update scores as new exploit code is released
• D.Sorting by CVSS Base Score is the correct primary approach; the senior analyst is wrong to challenge a recognized industry standard

Domain: Security Assessment and Testing

Q5.A sophisticated threat actor compromised a widely used build tool in the software supply chain of a major security vendor. The attacker modified the build tool so that during the compilation process it injected malicious code into the vendor's software binaries. The resulting trojanized software was digitally signed with the vendor's legitimate certificate and distributed to thousands of customers. This attack pattern is an example of which supply chain attack type?

• A.Build pipeline poisoning, in which the build toolchain itself is compromised to inject malicious code into artifacts before they are signed and distributed
• B.Dependency confusion, in which an attacker publishes a higher-versioned package under a name that shadows an internal package, causing the build system to fetch the malicious public package
• C.Package registry compromise, in which the attacker gains administrative access to the package registry and replaces legitimate published packages with malicious versions
• D.Typosquatting, in which the attacker registers a package with a name visually similar to a popular library to trick developers into accidentally importing the malicious package

Domain: Software Development Security