ISC CISSP Practice Test 24

Question 230

A team begins building a secure service without documenting confidentiality or audit requirements. Which response best addresses the central security requirement with a defensible, risk-based design?

Capture testable security requirements at initiation and link them to business risks
Treat a vulnerability scanner as the requirement specification
Plan secure data disposition, access revocation and dependency removal during retirement
Write requirements only after production incidents

Explanation

Correct Answer

Late requirements cause expensive redesign and omitted controls.

Incorrect Answers

Tools do not encode full business needs.

End of service does not mean residual data or privileges disappear. Capture testable security requirements at initiation and link them to business risks.

Reactive discovery is costly.

Question 231

An application architecture exposes a privileged admin API through the normal user path. Which response best addresses the central security requirement with a defensible, risk-based design?

Hide the admin API with an obscure URL
Design separate trust boundaries and authorization enforcement before deployment
Use controlled signed release artifacts, authorized change gates and rollback readiness
Wait for penetration testing to create architecture

Explanation

Correct Answer

Secure architecture decisions are cheaper before coding and infrastructure lock-in.

Incorrect Answers

Obscurity is not authorization.

Deployment must preserve the verified build and its authorization history. Design separate trust boundaries and authorization enforcement before deployment.

Tests should validate an existing secure design.

Question 232

A software team claims security controls work because they were installed. Which response best addresses the central security requirement with a defensible, risk-based design?

Declare requirements met without negative tests
Design separate trust boundaries and authorization enforcement before deployment
Accept vendor setup screenshots alone
Verify implemented behavior against specific acceptance criteria using controlled tests

Explanation

Correct Answer

Deployment evidence is not operational effectiveness evidence.

Incorrect Answers

A missing deny path may remain exploitable.

Secure architecture decisions are cheaper before coding and infrastructure lock-in. Verify implemented behavior against specific acceptance criteria using controlled tests.

Screenshots show configuration, not bypass resistance.

Question 233

A release pipeline sends production code without reviewing artifact provenance or approvals. Which response best addresses the central security requirement with a defensible, risk-based design?

Allow production engineers to replace binaries manually
Use controlled signed release artifacts, authorized change gates and rollback readiness
Verify implemented behavior against specific acceptance criteria using controlled tests
Assume passing development tests authorizes every production release

Explanation

Correct Answer

Deployment must preserve the verified build and its authorization history.

Incorrect Answers

Uncontrolled substitution breaks integrity.

Deployment evidence is not operational effectiveness evidence. Use controlled signed release artifacts, authorized change gates and rollback readiness.

Change control and artifact identity are separate checks.

Question 234

A decommissioned application leaves unrevoked service credentials and stored customer records. Which response best addresses the central security requirement with a defensible, risk-based design?

Delete only the visible user interface
Use controlled signed release artifacts, authorized change gates and rollback readiness
Keep all old credentials valid for possible future use
Plan secure data disposition, access revocation and dependency removal during retirement

Explanation

Correct Answer

End of service does not mean residual data or privileges disappear.

Incorrect Answers

Back-end secrets and data remain.

Deployment must preserve the verified build and its authorization history. Plan secure data disposition, access revocation and dependency removal during retirement.

Stale accounts invite exploitation.

Question 235

A troubleshooting team blames TLS certificates for a service that cannot complete a TCP three-way handshake. Which response best addresses the central security requirement with a defensible, risk-based design?

Isolate transport reachability and handshake state before testing TLS application authentication
Renew every certificate before checking port reachability
Increase DNS record TTL without testing SYN/SYN-ACK
Apply authenticated port/VLAN assignment and layer-3 access policies between segments

Explanation

Correct Answer

The OSI/TCP-IP layers help distinguish routing or TCP failure from upper-layer TLS negotiation.

Incorrect Answers

A certificate change cannot fix a missing TCP path.

Caching is unrelated to transport handshake failure.

VLAN membership alone does not forbid inter-VLAN routing. Isolate transport reachability and handshake state before testing TLS application authentication.

Question 236

An IPv6-only client can resolve a legacy system's A record but cannot open a native IPv4 socket. Which response best addresses the central security requirement with a defensible, risk-based design?

Use a supported DNS64/NAT64 or dual-stack transition architecture where appropriate
Assume an IPv6 default gateway translates every IPv4 packet
Put an IPv4 literal into an AAAA record
Filter accepted prefixes and validate routing policy with origin/path protections where available

Explanation

Correct Answer

IPv6 and IPv4 addresses are not directly interoperable without supported transition mechanisms.

Incorrect Answers

Ordinary routing does not perform protocol translation.

An address record must represent its proper address family.

Routing control security constrains who can steer destinations. Use a supported DNS64/NAT64 or dual-stack transition architecture where appropriate.

Question 237

A reverse proxy negotiates TLS but accepts any server certificate from a downstream service. Which response best addresses the central security requirement with a defensible, risk-based design?

Validate chain, name, validity and revocation as appropriate for mutually authenticated secure sessions
Treat a successful TCP connection as TLS identity validation
Disable certificate validation to prevent outages
Broker access per application based on identity, device posture and context instead of trusting network adjacency

Explanation

Correct Answer

Encryption without peer authentication remains vulnerable to impostor endpoints.

Incorrect Answers

Transport establishment does not verify a certificate.

The workaround removes peer authentication.

Resource-specific access reduces implicit lateral privilege. Validate chain, name, validity and revocation as appropriate for mutually authenticated secure sessions.

Question 238

Two site-to-site VPN peers negotiate IKE but the expected subnets cannot communicate. Which response best addresses the central security requirement with a defensible, risk-based design?

Validate IPsec traffic selectors, security associations, routing and protected subnets
Isolate transport reachability and handshake state before testing TLS application authentication
Open application ports while ignoring tunnel selectors
Assume IKE success guarantees all routes and selectors

Explanation

Correct Answer

IKE negotiation alone does not prove correct packet encapsulation for the intended networks.

Incorrect Answers

The OSI/TCP-IP layers help distinguish routing or TCP failure from upper-layer TLS negotiation. Validate IPsec traffic selectors, security associations, routing and protected subnets.

Firewall changes cannot repair incorrect encrypted traffic selection.

An established IKE SA can coexist with broken child SA policy.

Question 239

A compromised workstation in a user VLAN can directly reach the finance database subnet. Which response best addresses the central security requirement with a defensible, risk-based design?

Add more VLAN names but permit all routing between them
Use a supported DNS64/NAT64 or dual-stack transition architecture where appropriate
Implement restrictive inter-segment policy with default-deny and approved application flows
Run antivirus scans without restricting lateral paths

Explanation

Correct Answer

Segmentation limits east-west lateral movement when endpoints fail.

Incorrect Answers

Logical labels alone do not isolate traffic.

IPv6 and IPv4 addresses are not directly interoperable without supported transition mechanisms. Implement restrictive inter-segment policy with default-deny and approved application flows.

Malware controls are complementary, not network segmentation.

Question 240

A contractor can reach all internal services after connecting to an enterprise VPN. Which response best addresses the central security requirement with a defensible, risk-based design?

Treat possession of a VPN IP as permanent authorization
Expose every service through one unrestricted internal router
Filter accepted prefixes and validate routing policy with origin/path protections where available
Broker access per application based on identity, device posture and context instead of trusting network adjacency

Explanation

Correct Answer

Resource-specific access reduces implicit lateral privilege.

Incorrect Answers

Network address does not prove continued entitlement.

Wide routing increases attack paths.

Routing control security constrains who can steer destinations. Broker access per application based on identity, device posture and context instead of trusting network adjacency.

Certified Information Systems Security Professional (CISSP) Practice Tests

ISC CISSP Practice Test 22 - 10 Questions (Last Reviewed 23-Oct-2026)
ISC CISSP Practice Test 23 - 10 Questions (Last Reviewed 22-Oct-2026)
ISC CISSP Practice Test 24 - 10 Questions (Last Reviewed 21-Oct-2026)
ISC CISSP Practice Test 25 - 10 Questions (Last Reviewed 20-Oct-2026)
ISC CISSP Practice Test 26 - 10 Questions (Last Reviewed 19-Oct-2026)

Pass Your ISC CISSP Exam Easy!

Question 230

Explanation

Correct Answer

Incorrect Answers

Question 231

Explanation

Correct Answer

Incorrect Answers

Question 232

Explanation

Correct Answer

Incorrect Answers

Question 233

Explanation

Correct Answer

Incorrect Answers

Question 234

Explanation

Correct Answer

Incorrect Answers

Question 235

Explanation

Correct Answer

Incorrect Answers

Question 236

Explanation

Correct Answer

Incorrect Answers

Question 237

Explanation

Correct Answer

Incorrect Answers

Question 238

Explanation

Correct Answer

Incorrect Answers

Question 239

Explanation

Correct Answer

Incorrect Answers

Question 240

Explanation

Correct Answer

Incorrect Answers

Certified Information Systems Security Professional (CISSP) Practice Tests