ISC CISSP Practice Test 28

Question 270

An incident review documented this traffic monitoring exposure: A SOC has backbone bandwidth charts but cannot link suspicious flows to source and destination identities. The response team proposed only “Assume total interface bytes identify a malicious caller” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?

Aggregate utilization lacks per-flow attribution.
Ordinary routing does not perform protocol translation.
App secrets do not control routing.
Correlation becomes unreliable.

Explanation

Correct Answer

Aggregate utilization lacks per-flow attribution. The relevant alternative is aggregate utilization lacks per-flow attribution.

Incorrect Answers

Ordinary routing does not perform protocol translation. That does not establish aggregate utilization lacks per-flow attribution.

App secrets do not control routing. The actual criticized measure is aggregate utilization lacks per-flow attribution.

This describes the limitation of a different proposed action (Store unsynchronized logs without timestamps); it does not identify the main defect in Assume total interface bytes identify a malicious caller.

Question 271

An incident review documented this osi/tcp-ip exposure: A lateral attacker exploits IPv4 ARP spoofing to redirect traffic inside a local subnet. The response team proposed only “Renew the TLS certificate as the only response to ARP poisoning” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?

TLS may protect application data but does not prevent redirect via forged ARP mappings.
TTL does not authenticate Ethernet ARP messages.
A single flat domain destroys segmentation.
Logical labels alone do not isolate traffic.

Explanation

Correct Answer

TLS may protect application data but does not prevent redirect via forged ARP mappings. The missing change involves tLS may protect application data but does not prevent redirect via forged ARP mappings.

Incorrect Answers

TTL does not authenticate Ethernet ARP messages. The actual criticized measure is tLS may protect application data but does not prevent redirect via forged ARP mappings.

A single flat domain destroys segmentation. The actual criticized measure is tLS may protect application data but does not prevent redirect via forged ARP mappings.

Logical labels alone do not isolate traffic. That does not establish tLS may protect application data but does not prevent redirect via forged ARP mappings.

Question 272

An incident review documented this ipv4/ipv6 exposure: IPv6-enabled endpoints accept a rogue router advertisement and select an attacker-controlled default gateway. The response team proposed only “Disable only IPv4 DHCP” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?

IPv4 DHCP does not govern IPv6 RA processing.
App secrets do not control routing.
Address privacy does not authenticate announcements.
Shared secrets remain difficult to revoke for one user.

Explanation

Correct Answer

IPv4 DHCP does not govern IPv6 RA processing. The missing change involves iPv4 DHCP does not govern IPv6 RA processing.

Incorrect Answers

App secrets do not control routing. The actual criticized measure is iPv4 DHCP does not govern IPv6 RA processing.

Address privacy does not authenticate announcements. The actual criticized measure is iPv4 DHCP does not govern IPv6 RA processing.

Shared secrets remain difficult to revoke for one user. That does not establish iPv4 DHCP does not govern IPv6 RA processing.

Question 273

An incident review documented this tls exposure: A web gateway accepts a certificate with the right subject name even after the issuing CA has revoked it. The response team proposed only “Trust any self-signed certificate with a familiar common name” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?

TLS hides content from simple port-based policies.
Anyone can create a matching untrusted certificate.
Confidentiality of transport does not establish present identity.
A misconfigured peer can leak or hijack routes.

Explanation

Correct Answer

Anyone can create a matching untrusted certificate. The missing change involves anyone can create a matching untrusted certificate.

Incorrect Answers

TLS hides content from simple port-based policies. The actual criticized measure is anyone can create a matching untrusted certificate.

Confidentiality of transport does not establish present identity. The actual criticized measure is anyone can create a matching untrusted certificate.

A misconfigured peer can leak or hijack routes. That does not establish anyone can create a matching untrusted certificate.

Question 274

An incident review documented this ipsec exposure: Two partner sites negotiate IPsec but unexpectedly accept weak fallback suites with obsolete ciphers. The response team proposed only “Allow any crypto suite so the tunnel always connects” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?

Wide routing increases attack paths.
Unprotected keys undermine mutual authentication.
A certificate change cannot fix a missing TCP path.
Availability through weak algorithms is not adequate security.

Explanation

Correct Answer

Availability through weak algorithms is not adequate security. The missing change involves availability through weak algorithms is not adequate security.

Incorrect Answers

Wide routing increases attack paths. The actual criticized measure is availability through weak algorithms is not adequate security.

Unprotected keys undermine mutual authentication. The actual criticized measure is availability through weak algorithms is not adequate security.

A certificate change cannot fix a missing TCP path. That does not establish availability through weak algorithms is not adequate security.

Question 275

A campus switch permits rogue DHCP responses from user ports. Which response best addresses the central security requirement with a defensible, risk-based design?

Apply network access control with authenticated device/user identity and posture-based segment assignment
Rely only on endpoint DNS settings
Enable route redistribution on every access port
Use DHCP snooping on untrusted access ports and limit authorized server paths

Explanation

Correct Answer

Switch protections constrain address assignment attacks at layer two.

Incorrect Answers

NAC can make admission conditional rather than blindly trusting physical connection. Use DHCP snooping on untrusted access ports and limit authorized server paths.

DNS configuration does not block rogue DHCP offers.

Uncontrolled redistribution is unrelated and risky.

Question 276

An unmanaged personal laptop joins a sensitive wired enterprise port without endpoint assessment. Which response best addresses the central security requirement with a defensible, risk-based design?

Protect endpoint agent tamper controls and detect stale or missing telemetry
Use a public guest SSID on the sensitive switch port
Apply network access control with authenticated device/user identity and posture-based segment assignment
Treat an Ethernet cable as sufficient authorization

Explanation

Correct Answer

NAC can make admission conditional rather than blindly trusting physical connection.

Incorrect Answers

Agent coverage requires actual running protection and health monitoring. Apply network access control with authenticated device/user identity and posture-based segment assignment.

Naming networks guest does not enforce NAC.

Physical link does not establish endpoint trust.

Question 277

Managed laptops report healthy EDR status while their sensors can be stopped by local users. Which response best addresses the central security requirement with a defensible, risk-based design?

Give all users rights to disable local protection
Design diversity and independence for critical network paths and test failover
Count installed licenses only
Protect endpoint agent tamper controls and detect stale or missing telemetry

Explanation

Correct Answer

Agent coverage requires actual running protection and health monitoring.

Incorrect Answers

Uncontrolled disablement defeats the control.

Redundancy without common-mode analysis can fail simultaneously. Protect endpoint agent tamper controls and detect stale or missing telemetry.

A license does not show an agent is active.

Question 278

A secure office sends a sensitive link over copper between buildings exposed to electromagnetic interference and tapping. Which response best addresses the central security requirement with a defensible, risk-based design?

Apply network access control with authenticated device/user identity and posture-based segment assignment
Assume ordinary copper conduit guarantees confidentiality
Use Wi-Fi without authentication for the same sensitive link
Evaluate fiber or protected transmission routes with physical security and encryption

Explanation

Correct Answer

Media choice affects interference, tapping opportunities and reach.

Incorrect Answers

NAC can make admission conditional rather than blindly trusting physical connection. Evaluate fiber or protected transmission routes with physical security and encryption.

Physical cable shielding does not encrypt content.

Unprotected radio expands exposure.

Question 279

Two core routers appear redundant but use the same power feed and control-plane software defect. Which response best addresses the central security requirement with a defensible, risk-based design?

Use only monitoring to replace failover capability
Count interfaces without checking upstream dependencies
Design diversity and independence for critical network paths and test failover
Apply network access control with authenticated device/user identity and posture-based segment assignment

Explanation

Correct Answer

Redundancy without common-mode analysis can fail simultaneously.

Incorrect Answers

Alerts do not provide alternate forwarding.

Multiple ports can share one failure domain.

NAC can make admission conditional rather than blindly trusting physical connection. Design diversity and independence for critical network paths and test failover.

Question 280

An edge router accepts unauthorized BGP prefixes from a transit peer and diverts client traffic. Which response best addresses the central security requirement with a defensible, risk-based design?

Design diversity and independence for critical network paths and test failover
Accept every route from any adjacent peer
Apply accepted prefix filtering, max-prefix limits and suitable routing security controls at the peer boundary
Increase link bandwidth to fix route origin trust

Explanation

Correct Answer

Route exchange needs policy validation to limit accidental or malicious announcements.

Incorrect Answers

Redundancy without common-mode analysis can fail simultaneously. Apply accepted prefix filtering, max-prefix limits and suitable routing security controls at the peer boundary.

Unrestricted announcements enable leaks and hijack paths.

Capacity does not validate reachability information.

Certified Information Systems Security Professional (CISSP) Practice Tests

ISC CISSP Practice Test 26 - 10 Questions (Last Reviewed 19-Oct-2026)
ISC CISSP Practice Test 27 - 10 Questions (Last Reviewed 18-Oct-2026)
ISC CISSP Practice Test 28 - 10 Questions (Last Reviewed 17-Oct-2026)
ISC CISSP Practice Test 29 - 10 Questions (Last Reviewed 16-Oct-2026)
ISC CISSP Practice Test 30 - 10 Questions (Last Reviewed 15-Oct-2026)

Pass Your ISC CISSP Exam Easy!

Question 270

Explanation

Correct Answer

Incorrect Answers

Question 271

Explanation

Correct Answer

Incorrect Answers

Question 272

Explanation

Correct Answer

Incorrect Answers

Question 273

Explanation

Correct Answer

Incorrect Answers

Question 274

Explanation

Correct Answer

Incorrect Answers

Question 275

Explanation

Correct Answer

Incorrect Answers

Question 276

Explanation

Correct Answer

Incorrect Answers

Question 277

Explanation

Correct Answer

Incorrect Answers

Question 278

Explanation

Correct Answer

Incorrect Answers

Question 279

Explanation

Correct Answer

Incorrect Answers

Question 280

Explanation

Correct Answer

Incorrect Answers

Certified Information Systems Security Professional (CISSP) Practice Tests