ISC CISSP Practice Test 30

Question 290

An incident review documented this switches and routers exposure: An edge router accepts unauthorized BGP prefixes from a transit peer and diverts client traffic. The response team proposed only “Accept every route from any adjacent peer” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?

Capacity does not validate reachability information.
Unrestricted announcements enable leaks and hijack paths.
Multiple ports can share one failure domain.
Uncontrolled disablement defeats the control.

Explanation

Correct Answer

Unrestricted announcements enable leaks and hijack paths. The missing change involves unrestricted announcements enable leaks and hijack paths.

Incorrect Answers

Capacity does not validate reachability information. The actual criticized measure is unrestricted announcements enable leaks and hijack paths.

Multiple ports can share one failure domain. That does not establish unrestricted announcements enable leaks and hijack paths.

Uncontrolled disablement defeats the control. The actual criticized measure is unrestricted announcements enable leaks and hijack paths.

Question 291

An incident review documented this nac exposure: Unmanaged contractor laptops can join the internal office Ethernet without health or identity checks. The response team proposed only “Trust the wall jack as an employee identity” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?

Uncontrolled redistribution is unrelated and risky.
Operations convenience widens exposure.
Jack location does not identify the endpoint.
Multiple ports can share one failure domain.

Explanation

Correct Answer

Jack location does not identify the endpoint. The missing change involves jack location does not identify the endpoint.

Incorrect Answers

Uncontrolled redistribution is unrelated and risky. The actual criticized measure is jack location does not identify the endpoint.

This describes the limitation of a different proposed action (Disable endpoint posture checks whenever the lobby is busy); it does not identify the main defect in Trust the wall jack as an employee identity.

Multiple ports can share one failure domain. That does not establish jack location does not identify the endpoint.

Question 292

Employees use a shared VPN credential on unmanaged devices to administer critical systems. Which response best addresses the central security requirement with a defensible, risk-based design?

Expose RDP to the entire internet
Trust every user after possession of a shared VPN password
Use individually attributable SSH or equivalent secure management with centralized AAA and least privilege
Require individual phishing-resistant authentication, device checks and narrowly scoped sessions

Explanation

Correct Answer

Remote access expands the attack surface beyond the enterprise perimeter.

Incorrect Answers

Open administration interfaces invite exploitation.

Shared credentials defeat accountability and selective revocation.

Privileged management requires encrypted channels and auditable identity. Require individual phishing-resistant authentication, device checks and narrowly scoped sessions.

Question 293

An executive video call includes sensitive negotiations but meeting links are forwarded without admission control. Which response best addresses the central security requirement with a defensible, risk-based design?

Use authenticated meeting admission, end-to-end encryption where available and controlled recordings
Assume transport encryption stops invited-but-unauthorized attendees
Limit partner tunnels to approved prefixes, authenticated peers and monitored service paths
Publish the recording publicly while restricting live attendees

Explanation

Correct Answer

Real-time media confidentiality depends on participant trust as well as encryption.

Incorrect Answers

An authenticated channel does not authorize all participants.

Tunnels should not create unbounded transitive trust. Use authenticated meeting admission, end-to-end encryption where available and controlled recordings.

Post-call disclosure defeats confidentiality.

Question 294

A supplier asks for a permanent site-to-site tunnel that routes its entire network into production. Which response best addresses the central security requirement with a defensible, risk-based design?

Design delay-tolerant authentication, encrypted transport and independent recovery for intermittent links
Limit partner tunnels to approved prefixes, authenticated peers and monitored service paths
Omit partner credential rotation and exit controls
Permit all partner prefixes because IPsec is encrypted

Explanation

Correct Answer

Tunnels should not create unbounded transitive trust.

Incorrect Answers

Constrained media can cause latency and availability problems while still needing security. Limit partner tunnels to approved prefixes, authenticated peers and monitored service paths.

Permanent trust can outlive the contract.

Encryption does not constrain which internal networks are reachable.

Question 295

A remote-access VPN uses a weak pre-shared key shared across several locations. Which response best addresses the central security requirement with a defensible, risk-based design?

Limit partner tunnels to approved prefixes, authenticated peers and monitored service paths
Disable perfect forward secrecy to reduce management effort
Deploy modern authenticated VPN profiles with per-peer credentials and strong algorithms
Keep the weak secret because the network is private

Explanation

Correct Answer

VPN security rests on identity, crypto and policy, not tunnel existence.

Incorrect Answers

Tunnels should not create unbounded transitive trust. Deploy modern authenticated VPN profiles with per-peer credentials and strong algorithms.

Weaker key separation can expand historical exposure.

Shared key compromise can expose sessions.

Question 296

Network admins log in to switches using shared local accounts over plaintext Telnet. Which response best addresses the central security requirement with a defensible, risk-based design?

Use individually attributable SSH or equivalent secure management with centralized AAA and least privilege
Use a single shared root-equivalent account on every device
Keep Telnet and hide it on another port
Require individual phishing-resistant authentication, device checks and narrowly scoped sessions

Explanation

Correct Answer

Privileged management requires encrypted channels and auditable identity.

Incorrect Answers

Shared identity prevents attribution and broadens compromise.

Port changes do not add encryption.

Remote access expands the attack surface beyond the enterprise perimeter. Use individually attributable SSH or equivalent secure management with centralized AAA and least privilege.

Question 297

A remote field office depends on a high-latency satellite backhaul for authentication and monitoring. Which response best addresses the central security requirement with a defensible, risk-based design?

Configure timeouts based only on fiber LAN latency
Use individually attributable SSH or equivalent secure management with centralized AAA and least privilege
Assume satellite links cannot be intercepted due to altitude
Design delay-tolerant authentication, encrypted transport and independent recovery for intermittent links

Explanation

Correct Answer

Constrained media can cause latency and availability problems while still needing security.

Incorrect Answers

Improper thresholds create false failures.

Privileged management requires encrypted channels and auditable identity. Design delay-tolerant authentication, encrypted transport and independent recovery for intermittent links.

Radio transmissions require cryptographic protection.

Question 298

Remote administrators authenticate to a VPN with passwords that have been repeatedly phished. Which response best addresses the central security requirement with a defensible, risk-based design?

Trust an access attempt if it comes from a familiar cafe IP
Limit partner tunnels to approved prefixes, authenticated peers and monitored service paths
Require phishing-resistant MFA and device-context access conditions appropriate to the privileged path
Increase password length alone and retain password-only VPN

Explanation

Correct Answer

Credential theft is more likely without origin-bound authentication.

Incorrect Answers

Source IP does not prove user identity.

Tunnels should not create unbounded transitive trust. Require phishing-resistant MFA and device-context access conditions appropriate to the privileged path.

Stronger passwords can still be phished.

Question 299

Sensitive executive video conferences can be joined with a leaked permanent meeting link. Which response best addresses the central security requirement with a defensible, risk-based design?

Reuse public dial-in credentials for all board sessions
Use meeting access controls, participant authentication and appropriate end-to-end encryption requirements
Design delay-tolerant authentication, encrypted transport and independent recovery for intermittent links
Disable the waiting room for unknown external participants

Explanation

Correct Answer

Transport encryption alone does not stop unauthorized invitees joining.

Incorrect Answers

Persistent shared joining secrets can leak.

Constrained media can cause latency and availability problems while still needing security. Use meeting access controls, participant authentication and appropriate end-to-end encryption requirements.

Unvetted access enables eavesdropping.

Question 300

An external support vendor requests a permanent tunnel that routes its entire corporate network to production. Which response best addresses the central security requirement with a defensible, risk-based design?

Advertise all production CIDRs without review
Rely on a vendor contract with no technical route restriction
Scope third-party VPN routes and firewall policies to necessary destinations, identities and review periods
Use authenticated meeting admission, end-to-end encryption where available and controlled recordings

Explanation

Correct Answer

A tunnel should not become unrestricted mutual network trust.

Incorrect Answers

Broad routes enlarge the vendor blast radius.

Contracts do not enforce packet access.

Real-time media confidentiality depends on participant trust as well as encryption. Scope third-party VPN routes and firewall policies to necessary destinations, identities and review periods.

Certified Information Systems Security Professional (CISSP) Practice Tests

ISC CISSP Practice Test 28 - 10 Questions (Last Reviewed 17-Oct-2026)
ISC CISSP Practice Test 29 - 10 Questions (Last Reviewed 16-Oct-2026)
ISC CISSP Practice Test 30 - 10 Questions (Last Reviewed 15-Oct-2026)
ISC CISSP Practice Test 31 - 10 Questions (Last Reviewed 14-Oct-2026)
ISC CISSP Practice Test 32 - 10 Questions (Last Reviewed 13-Oct-2026)

Pass Your ISC CISSP Exam Easy!

Question 290

Explanation

Correct Answer

Incorrect Answers

Question 291

Explanation

Correct Answer

Incorrect Answers

Question 292

Explanation

Correct Answer

Incorrect Answers

Question 293

Explanation

Correct Answer

Incorrect Answers

Question 294

Explanation

Correct Answer

Incorrect Answers

Question 295

Explanation

Correct Answer

Incorrect Answers

Question 296

Explanation

Correct Answer

Incorrect Answers

Question 297

Explanation

Correct Answer

Incorrect Answers

Question 298

Explanation

Correct Answer

Incorrect Answers

Question 299

Explanation

Correct Answer

Incorrect Answers

Question 300

Explanation

Correct Answer

Incorrect Answers

Certified Information Systems Security Professional (CISSP) Practice Tests