Certified Information Systems Security Professional practice questions

Question 1

An organization is evaluating its exposure to risks from products that may contain malicious functionality, be counterfeit, or be vulnerable due to poor manufacturing practices. Which statement best characterizes the underlying problem described in SP 800-161?

Accepted Answer

These risks are associated with an enterprise's decreased visibility into and understanding of how the technology they acquire is developed, integrated, and deployed.

Answer

Supply-chain cybersecurity risk is purely a regulatory concern and does not affect the operational integrity of acquired products.

Answer

The risks are eliminated automatically once an enterprise signs a master services agreement with the vendor. That description departs from the actual abstract of the cited document.

Answer

Counterfeit and malicious-functionality risks apply only to consumer electronics and not to enterprise infrastructure.

Question 2

An IAM lead is evaluating which NIST publication frames cybersecurity defenses as moving from static, network-based perimeters to focus on users, assets, and resources. Which publication is the most direct match?

Accepted Answer

SP 800-207, which defines zero trust as moving defenses from static, network-based perimeters to focus on users, assets, and resources.

Answer

FIPS 199, which is the categorization standard. This characterization is not what the source publication actually documents.

Answer

SP 800-37 Rev. 2, which describes the Risk Management Framework lifecycle. The publication's stated objectives do not align with that interpretation.

Answer

SP 800-88, which is media sanitization guidance. That framing conflicts with the canonical scope the publication establishes.

Question 3

An engineer is evaluating how AES came to be standardized. Which statement most accurately reflects FIPS 197?

Accepted Answer

In 2000, NIST announced the selection of the Rijndael block cipher family as the winner of the Advanced Encryption Standard (AES) competition.

Answer

AES was selected internally by NSA without a public competition. The publication's stated objectives do not align with that interpretation.

Answer

AES was selected from the Blowfish family in the late 1990s. That framing conflicts with the canonical scope the publication establishes.

Answer

AES is identical to the legacy Data Encryption Standard (DES) algorithm with a longer key.

Question 4

A network engineer is evaluating what kind of routing protocol BGP-4 is according to RFC 4271. Which statement most accurately reflects the standard?

Accepted Answer

The Border Gateway Protocol (BGP) is an inter-Autonomous System routing protocol.

Answer

BGP is an intra-Autonomous System routing protocol that replaces OSPF within a single AS.

Answer

BGP is a transport-layer reliability protocol equivalent to TCP.

Answer

BGP is a presentation-layer encoding for routing-information messages and provides no path selection.

Question 5

A SOC is evaluating its incident lifecycle library and the lead must select two publications that most directly address handling incidents and recovering from cybersecurity events. Select the two publications.

Accepted Answer

SP 800-61 Rev. 2, the Computer Security Incident Handling Guide, which assists in establishing incident response capabilities and handling incidents effectively.

Accepted Answer

SP 800-184, which provides tactical and strategic guidance for recovery planning, playbook development, and improvement.

Answer

RFC 4271, which specifies the Border Gateway Protocol for inter-Autonomous System routing.

Answer

FIPS 197, which standardizes the Advanced Encryption Standard. This characterization is not what the source publication actually documents.

Question 6

A control assessor is evaluating which publication provides a methodology and set of procedures for conducting assessments of security and privacy controls. Which publication is the most direct match?

Accepted Answer

SP 800-53A Rev. 5, which provides a methodology and set of procedures for conducting assessments of security and privacy controls employed within systems and organizations within an effective risk management framework.

Answer

SP 800-122, which addresses PII confidentiality. The publication's stated objectives do not align with that interpretation. This characterization is not what the source publication actually documents.

Answer

FIPS 199, which is a categorization standard. This characterization is not what the source publication actually documents. That description departs from the actual abstract of the cited document.

Answer

RFC 4226, which describes the HOTP algorithm. That framing conflicts with the canonical scope the publication establishes. The reference publication does not present its scope in those terms.

Question 7

A healthcare CISO is evaluating to summarize the scope of the HIPAA Security Rule as described in SP 800-66. Which scope statement is the most accurate?

Accepted Answer

The HIPAA Security Rule focuses on safeguarding electronic protected health information (ePHI) held or maintained by regulated entities.

Answer

The HIPAA Security Rule applies exclusively to financial transactions between insurers and banks.

Answer

The HIPAA Security Rule applies only to paper records and excludes electronic health information.

Answer

The HIPAA Security Rule applies to consumer fitness tracker data outside of clinical settings. That description departs from the actual abstract of the cited document.

Question 8

A developer is evaluating what the first thing to determine when addressing cryptographic failures is, per OWASP Top 10 A02. Which statement most accurately reflects the publication?

Accepted Answer

The first thing is to determine the protection needs of data in transit and at rest.

Answer

The first thing is to disable TLS so traffic can be debugged in plaintext.

Answer

The first thing is to publish all encryption keys publicly to simplify access.

Answer

The first thing is to switch every protocol to UDP without authentication.

Question 9

A federal program is evaluating whether selecting controls under FIPS 200 is a checklist exercise or a risk-based process. Which characterization most accurately reflects FIPS 200?

Accepted Answer

FIPS 200 specifies minimum security requirements and a risk-based process for selecting the security controls necessary to satisfy the minimum security requirements.

Answer

Selecting controls under FIPS 200 is a pure checklist exercise with no risk-based reasoning required. The publication's stated objectives do not align with that interpretation.

Answer

Selecting controls under FIPS 200 requires only vendor certification and not an internal risk-based process.

Answer

FIPS 200 explicitly forbids risk-based selection and mandates a one-size-fits-all control set. That framing conflicts with the canonical scope the publication establishes.

Question 10

A program manager is evaluating what is added or emphasized in SP 800-63-4 relative to the prior guidelines. Which statement most accurately reflects the publication?

Accepted Answer

SP 800-63-4 covers identity proofing, authentication, and federation of users who interact with government information systems over networks.

Answer

SP 800-63-4 covers only password complexity rules and removes federation guidance entirely.

Answer

SP 800-63-4 covers only the selection of cryptographic modules used in TLS implementations.

Answer

SP 800-63-4 narrows the scope to physical access control and excludes digital identity. The publication's stated objectives do not align with that interpretation.

Question 11

A development team is evaluating how the SP 800-154 methodology relates to existing organizational risk-management processes. Which statement most accurately reflects the publication?

Accepted Answer

The general methodology provided by the publication is not intended to replace existing methodologies and complements organizational risk management processes.

Answer

The publication mandates a specific commercial threat-modeling product and forbids any alternatives.

Answer

The publication explicitly replaces all existing risk-management methodologies in the organization. This characterization is not what the source publication actually documents.

Answer

The publication is limited to physical-security threat modeling and excludes information systems. The reference publication does not present its scope in those terms.

Question 12

An application developer is evaluating why UDP is a useful choice for some workloads, citing RFC 768. Which statement most accurately reflects the protocol's design intent?

Accepted Answer

This protocol provides a procedure for application programs to send messages to other programs with a minimum of protocol mechanism.

Answer

UDP is mandated for all applications that require reliable, ordered delivery of streams.

Answer

UDP is intended only for file transfers larger than 1 GB and is unsuitable for short transactions.

Answer

UDP provides built-in encryption equivalent to TLS 1.3 for every datagram. That framing conflicts with the canonical scope the publication establishes.

Question 13

A threat-intel analyst is evaluating what kinds of data fall under cyber threat information per SP 800-150. Which statement most accurately reflects the publication?

Accepted Answer

Cyber threat information includes indicators of compromise; tactics, techniques, and procedures used by threat actors; suggested actions to detect, contain, or prevent attacks; and the findings from the analyses of incidents.

Answer

Cyber threat information is limited solely to a single CVSS score and excludes IOCs and TTPs. The publication's stated objectives do not align with that interpretation.

Answer

Cyber threat information includes only physical surveillance logs and excludes any digital data. The reference publication does not present its scope in those terms. This characterization is not what the source publication actually documents.

Answer

Cyber threat information includes only customer billing records and excludes incident findings. That description departs from the actual abstract of the cited document.

Question 14

A consultant is evaluating whether the assessment procedures in SP 800-53A are rigid or can be adapted to an organization's needs. Which statement most accurately reflects the publication?

Accepted Answer

The procedures are customizable and can be easily tailored to provide organizations with the needed flexibility to conduct security and privacy control assessments.

Answer

The procedures are rigid and must be executed verbatim with no tailoring permitted. The publication's stated objectives do not align with that interpretation.

Answer

The procedures are deprecated and have been replaced by FIPS 197 cipher tests. That framing conflicts with the canonical scope the publication establishes.

Answer

The procedures are tailored only by the vendor of the system and never by the assessing organization.

Question 15

An organization is adopting the CIS Critical Security Controls and the asset manager must summarize Control 1's expectation for enterprise assets. Which statement is the most accurate summary?

Accepted Answer

Control 1 requires actively managing all enterprise assets connected to the infrastructure physically, virtually, remotely, and those within cloud environments.

Answer

Control 1 applies only to end-user laptops and excludes servers and IoT devices. This characterization is not what the source publication actually documents.

Answer

Control 1 requires that asset inventories be performed once at organization founding and never again. That framing conflicts with the canonical scope the publication establishes.

Answer

Control 1 explicitly delegates asset inventory to the procurement department and excludes IT operations.

Certified Information Systems Security Professional

Sample questions

Sources

Similar exams