Question 310
An incident review documented this remote access exposure: Remote administrators authenticate to a VPN with passwords that have been repeatedly phished. The response team proposed only “Increase password length alone and retain password-only VPN” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Source IP does not prove user identity.
- Post-call disclosure defeats confidentiality.
- Radio transmissions require cryptographic protection.
- Stronger passwords can still be phished.
Explanation
Correct Answer
D:Stronger passwords can still be phished. The relevant alternative is stronger passwords can still be phished.
Incorrect Answers
A:Source IP does not prove user identity. The actual criticized measure is stronger passwords can still be phished.
B:This describes the unrelated voice/video decision rather than the named faulty measure Increase password length alone and retain password-only VPN.
C:Cryptographic protection of radio transmissions addresses wireless confidentiality, but it does not eliminate phishing of VPN passwords; phishing-resistant authentication is needed.
Question 311
An incident review documented this voice/video exposure: Sensitive executive video conferences can be joined with a leaked permanent meeting link. The response team proposed only “Reuse public dial-in credentials for all board sessions” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Persistent shared joining secrets can leak.
- Open administration interfaces invite exploitation.
- Radio transmissions require cryptographic protection.
- Unvetted access enables eavesdropping.
Explanation
Correct Answer
A:Persistent shared joining secrets can leak. The relevant alternative is persistent shared joining secrets can leak.
Incorrect Answers
B:Open administration interfaces invite exploitation. The actual criticized measure is persistent shared joining secrets can leak.
C:Radio-link encryption protects transmission confidentiality. It does not revoke leaked permanent conference joining credentials or require per-meeting access authorization.
D:This describes the limitation of a different proposed action (Disable the waiting room for unknown external participants); it does not identify the main defect in Reuse public dial-in credentials for all board sessions.
Question 312
An incident review documented this third-party tunnels exposure: An external support vendor requests a permanent tunnel that routes its entire corporate network to production. The response team proposed only “Advertise all production CIDRs without review” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- An authenticated channel does not authorize all participants.
- Open administration interfaces invite exploitation.
- Contracts do not enforce packet access.
- Broad routes enlarge the vendor blast radius.
Explanation
Correct Answer
D:Broad routes enlarge the vendor blast radius. The missing change involves broad routes enlarge the vendor blast radius.
Incorrect Answers
A:An authenticated channel does not authorize all participants. That does not establish broad routes enlarge the vendor blast radius.
B:Open administration interfaces invite exploitation. The actual criticized measure is broad routes enlarge the vendor blast radius.
C:Contracts do not enforce packet access. The actual criticized measure is broad routes enlarge the vendor blast radius.
Question 313
An internal application uses one shared privileged account for all administrators. Which response best addresses the central security requirement with a defensible, risk-based design?
- Enforce device identity and posture before permitting sensitive application access
- Keep the shared account but change its display name weekly
- Assign individually accountable roles with narrowly authorized system actions
- Give every user local root rights
Explanation
Correct Answer
C:System access requires named identities and separation of privileges.
Incorrect Answers
A:A valid user does not automatically imply a trustworthy device. Assign individually accountable roles with narrowly authorized system actions.
B:Renaming does not provide user attribution.
D:Broad administration increases impact.
Question 314
An employee moves a managed laptop into an untrusted network and the device posture becomes noncompliant. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assign individually accountable roles with narrowly authorized system actions
- Allow all personal devices into regulated segments
- Enforce device identity and posture before permitting sensitive application access
- Trust any device with the right hostname
Explanation
Correct Answer
C:A valid user does not automatically imply a trustworthy device.
Incorrect Answers
A:System access requires named identities and separation of privileges. Enforce device identity and posture before permitting sensitive application access.
B:Unmanaged endpoints increase exposure.
D:Device names can be forged and do not establish trusted device identity.
Question 315
Badge holders can enter every building floor despite separate restricted areas. Which response best addresses the central security requirement with a defensible, risk-based design?
- Enforce application roles and object-level authorization independent of UI visibility
- Remove all visitor logs because doors are locked
- Assume one entrance badge authorizes all interior zones
- Assign physical access rights by role, zone and approved time window
Explanation
Correct Answer
D:Physical access should follow business need and explicit authorization.
Incorrect Answers
A:Authorization checks must happen on server actions, not merely hide buttons. Assign physical access rights by role, zone and approved time window.
B:Locks do not provide full access accountability.
C:Outer entry does not establish need-to-know.
Question 316
A help desk role can use an application's admin API although it only needs read-only support features. Which response best addresses the central security requirement with a defensible, risk-based design?
- Hide the admin button in the front end
- Rely only on an authenticated login session
- Enforce application roles and object-level authorization independent of UI visibility
- Assign individually accountable roles with narrowly authorized system actions
Explanation
Correct Answer
C:Authorization checks must happen on server actions, not merely hide buttons.
Incorrect Answers
A:API calls can bypass UI controls.
B:Authentication does not grant every application action.
D:System access requires named identities and separation of privileges. Enforce application roles and object-level authorization independent of UI visibility.
Question 317
Microservices exchange long-lived shared API keys that no owner rotates. Which response best addresses the central security requirement with a defensible, risk-based design?
- Enforce device identity and posture before permitting sensitive application access
- Issue distinct scoped workload identities with managed short-lived credentials or certificates
- Grant service accounts administrator rights for compatibility
- Put one shared API key in every container image
Explanation
Correct Answer
B:Machine identity also requires lifecycle, issuance and revocation.
Incorrect Answers
A:A valid user does not automatically imply a trustworthy device. Issue distinct scoped workload identities with managed short-lived credentials or certificates.
C:Overly broad machine privileges magnify compromise.
D:Copied secrets propagate across workloads.
Question 318
After a prior systems finding, a cloud service provider reports that the approved safeguard is implemented: “Assign individually accountable roles with narrowly authorized system actions.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Review actual role grants and attribute a test action to one named administrator
- Run this adjacent but different test as the sole proof: Invoke the admin API as a support role and verify a deny response
- Accept a signed change ticket saying: Assign individually accountable roles with narrowly authorized system actions
- Use the completion of this alternative as proof: Keep the shared account but change its display name weekly
Explanation
Correct Answer
A:Attribution and scope prove access control.
Incorrect Answers
B:Direct API tests detect broken access control. It tests applications, while this case requires evidence about systems.
C:Review actual role grants and attribute a test action to one named administrator. Attribution and scope prove access control.
D:Renaming does not provide user attribution. Review actual role grants and attribute a test action to one named administrator.
Question 319
After a prior devices finding, a regulated financial institution reports that the approved safeguard is implemented: “Enforce device identity and posture before permitting sensitive application access.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Enforce device identity and posture before permitting sensitive application access
- Test a noncompliant and compliant device using the same authorized user
- Run this adjacent but different test as the sole proof: Invoke the admin API as a support role and verify a deny response
- Use the completion of this alternative as proof: Trust any device with the right hostname
Explanation
Correct Answer
B:Context testing isolates the device-control decision.
Incorrect Answers
A:Test a noncompliant and compliant device using the same authorized user. Context testing isolates the device-control decision.
C:Direct API tests detect broken access control. It tests applications, while this case requires evidence about devices.
D:Device names can be forged and do not establish trusted device identity. Test a noncompliant and compliant device using the same authorized user.
Question 320
After a prior facilities finding, a global logistics firm reports that the approved safeguard is implemented: “Assign physical access rights by role, zone and approved time window.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Assign physical access rights by role, zone and approved time window
- Run this adjacent but different test as the sole proof: Test a noncompliant and compliant device using the same authorized user
- Use the completion of this alternative as proof: Assume one entrance badge authorizes all interior zones
- Attempt restricted-area access using a general employee badge
Explanation
Correct Answer
D:Negative entry tests verify zoning.
Incorrect Answers
A:Attempt restricted-area access using a general employee badge. Negative entry tests verify zoning.
B:Context testing isolates the device-control decision. It tests devices, while this case requires evidence about facilities.
C:Outer entry does not establish need-to-know. Attempt restricted-area access using a general employee badge.
Certified Information Systems Security Professional (CISSP) Practice Tests