Question 180
A process exploit attempts to execute attacker bytes from a data-only memory page. Which response best addresses the central security requirement with a defensible, risk-based design?
- Enforce execute permissions such as NX/DEP with complementary memory-safety mitigations
- Use full disk encryption as the only runtime defense
- Use verified boot/UEFI Secure Boot with controlled signing trust and recovery
- Disable address randomization to simplify debugging
Explanation
Correct Answer
A:Non-executable data pages impede certain injected code execution.
Incorrect Answers
B:Disk encryption does not govern in-memory execution.
C:Secure Boot helps detect unauthorized boot components before operating-system load. Enforce execute permissions such as NX/DEP with complementary memory-safety mitigations.
D:Predictable memory layouts help attackers.
Question 181
An attacker replaces a boot loader on a stolen laptop but the disk remains encrypted. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rely on a desktop antivirus launched after boot
- Disable firmware signature enforcement to avoid update trouble
- Enforce execute permissions such as NX/DEP with complementary memory-safety mitigations
- Use verified boot/UEFI Secure Boot with controlled signing trust and recovery
Explanation
Correct Answer
D:Secure Boot helps detect unauthorized boot components before operating-system load.
Incorrect Answers
A:A compromised bootloader can execute before antivirus.
B:Unsigned loaders defeat boot trust.
C:Non-executable data pages impede certain injected code execution. Use verified boot/UEFI Secure Boot with controlled signing trust and recovery.
Question 182
A cloud HSM service is considered for highly sensitive payment signing keys. Which response best addresses the central security requirement with a defensible, risk-based design?
- Export all private keys to developer workstations
- Use verified boot/UEFI Secure Boot with controlled signing trust and recovery
- Keep private signing keys within approved isolated cryptographic boundary and limit operations by role
- Store private key material in application logs
Explanation
Correct Answer
C:Isolation reduces key extraction risk and separates use from raw key access.
Incorrect Answers
A:Uncontrolled exports broaden compromise pathways.
B:Secure Boot helps detect unauthorized boot components before operating-system load. Keep private signing keys within approved isolated cryptographic boundary and limit operations by role.
D:Logs are not a protected key store.
Question 183
A remote fleet management system must determine whether a device booted approved firmware before granting high privilege. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assume an asset tag proves firmware integrity
- Use hardware-rooted attestation and evaluate trusted measurements before access
- Accept the device's self-written text claim as attestation
- Keep private signing keys within approved isolated cryptographic boundary and limit operations by role
Explanation
Correct Answer
B:Hardware attestation can provide evidence of measured device state.
Incorrect Answers
A:Inventory labels do not prove boot measurements.
C:Unverified claims are spoofable.
D:Isolation reduces key extraction risk and separates use from raw key access. Use hardware-rooted attestation and evaluate trusted measurements before access.
Question 184
After a prior tpm finding, a global logistics firm reports that the approved safeguard is implemented: “Use a trusted platform module with measured boot and protected key operations where supported.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Store measured-boot secrets in plain configuration files
- Run this adjacent but different test as the sole proof: Check attestation signatures, measurement reference and freshness
- Validate measured-boot attestation and key-bound operations on a test device
- Accept a signed change ticket saying: Use a trusted platform module with measured boot and protected key operations where supported
Explanation
Correct Answer
C:Attestation evidence confirms hardware trust assumptions.
Incorrect Answers
A:Software-only files lack hardware binding. Validate measured-boot attestation and key-bound operations on a test device.
B:Cryptographic verification is required for hardware state trust. It tests hardware trust, while this case requires evidence about tpm.
D:Validate measured-boot attestation and key-bound operations on a test device. Attestation evidence confirms hardware trust assumptions.
Question 185
A company adopts IaaS and assumes the provider manages guest OS patches and application identity. Which response best addresses the central security requirement with a defensible, risk-based design?
- Map patching, runtime hardening and access duties to the IaaS shared-responsibility model
- Rely only on provider physical security audits
- Transfer every cloud security duty to the procurement team
- Isolate management planes and harden hypervisors against guest-to-host escape
Explanation
Correct Answer
A:IaaS customers normally retain substantial guest workload responsibilities.
Incorrect Answers
B:Physical assurance does not patch a guest OS.
C:Contracting does not implement tenant controls.
D:The virtualization boundary must protect host control from workloads. Map patching, runtime hardening and access duties to the IaaS shared-responsibility model.
Question 186
A distributed database is available in two locations but clients experience conflicting writes during a partition. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assume multi-site replication guarantees one global write order
- Choose consistency and conflict-handling semantics that match business requirements
- Increase network bandwidth and ignore conflict resolution
- Segment OT from IT and use safety-aware assessment and change controls
Explanation
Correct Answer
B:Replication and availability do not automatically provide serializable writes.
Incorrect Answers
A:Asynchronous replication can conflict.
C:Faster links do not create transaction semantics.
D:OT priorities include process safety and deterministic availability. Choose consistency and conflict-handling semantics that match business requirements.
Question 187
An industrial control system cannot tolerate ordinary corporate scan traffic or unplanned reboot. Which response best addresses the central security requirement with a defensible, risk-based design?
- Apply service identity, mutual authentication and per-service authorization at communication boundaries
- Run aggressive authenticated scans during peak manufacturing
- Segment OT from IT and use safety-aware assessment and change controls
- Use open flat routing from corporate Wi-Fi into controllers
Explanation
Correct Answer
C:OT priorities include process safety and deterministic availability.
Incorrect Answers
A:Internal network placement is not a substitute for workload identity. Segment OT from IT and use safety-aware assessment and change controls.
B:Scanning may disrupt fragile controllers.
D:Lateral access endangers production.
Question 188
Application containers run with host privileges and unrestricted mounts although isolation is required. Which response best addresses the central security requirement with a defensible, risk-based design?
- Treat containers as fully independent hardware machines
- Run as unprivileged principals with minimal capabilities, controlled mounts and signed images
- Apply service identity, mutual authentication and per-service authorization at communication boundaries
- Grant privileged mode to resolve ordinary file permission errors
Explanation
Correct Answer
B:Container isolation relies on host kernel boundaries and constrained runtime capabilities.
Incorrect Answers
A:Containers typically share host-kernel attack surface.
C:Internal network placement is not a substitute for workload identity. Run as unprivileged principals with minimal capabilities, controlled mounts and signed images.
D:Privilege undermines isolation.
Question 189
Dozens of services trust any request from the internal cluster network. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assign scoped function identity, validate input and limit event-source/secret permissions
- Apply service identity, mutual authentication and per-service authorization at communication boundaries
- Allow every internal source to invoke every service
- Use only centralized perimeter TLS termination
Explanation
Correct Answer
B:Internal network placement is not a substitute for workload identity.
Incorrect Answers
A:Serverless shifts host management but leaves customer code and permissions in scope. Apply service identity, mutual authentication and per-service authorization at communication boundaries.
C:Broad lateral access amplifies compromise.
D:Internal east-west calls may remain unauthenticated.
Question 190
A function processes untrusted input and shares a wildcard cloud role with unrelated workflows. Which response best addresses the central security requirement with a defensible, risk-based design?
- Choose consistency and conflict-handling semantics that match business requirements
- Assign scoped function identity, validate input and limit event-source/secret permissions
- Use one all-powerful role for every function
- Assume the platform automatically validates all business input
Explanation
Correct Answer
B:Serverless shifts host management but leaves customer code and permissions in scope.
Incorrect Answers
A:Replication and availability do not automatically provide serializable writes. Assign scoped function identity, validate input and limit event-source/secret permissions.
C:Wildcard roles magnify compromise.
D:Managed execution does not supply application validation.
Certified Information Systems Security Professional (CISSP) Practice Tests