Use these multiple-choice questions to test your understanding of CISSP. Each question bank contains 20 practice questions designed to assess your understanding of key ideas.
A key factor to remember is that guessing is better than not answering questions.
Each individual question in the CISSP exam is a four-choice question with a correct answer. Some are simple and clear, such as asking you to choose a definition. Some involve more, such as asking you to choose appropriate concepts or best practices. Some questions present a plan or situation for you and ask you to choose the best answer.
Q1. What is system certification?
A. Formal acceptance of a stated system configuration
B. A technical evaluation of each part of a computer system to assess its compliance with security standards
C. A functional evaluation of the manufacturer’s goals for each hardware and software component to meet integration standards
D. A manufacturer’s certificate stating that all components were installed and configured correctly
Answer: B
Q2. What is system accreditation?
A. Formal acceptance of a stated system configuration
B. A functional evaluation of the manufacturer’s goals for each hardware and software component to meet integration standards
C. Acceptance of test results that prove the computer system enforces the security policy
D. The process to specify secure communication between machines
Answer: A
Q3. What is a closed system?
A. A system designed around final, or closed, standards
B. A system that includes industry standards
C. A proprietary system that uses unpublished protocols
D. Any machine that does not run Windows
Answer: C
Q4. Which best describes a confined process?
A. A process that can run only for a limited time
B. A process that can run only during certain times of the day
C. A process that can access only certain memory locations
D. A process that controls access to an object
Answer: C
Q5. What is an access object?
A. A resource a user or process wishes to access
B. A user or process that wishes to access a resource
C. A list of valid access rules
D. The sequence of valid access types
Answer: A
Q6. What is a security control?
A. A security component that stores attribute that describe an object
B. A document that lists all data classification types
C. A list of valid access rules
D. A mechanism that limits access to an object
Answer: D
Q7. For what type of information system security accreditation are the applications and systems at a specific, self-contained location evaluated?
A. System accreditation
B. Site accreditation
C. Application accreditation
D. Type accreditation
Answer: B
Q8. How many major categories do the TCSEC criteria define?
A. Two
B. Three
C. Four
D. Five
Answer: C
Q9. What is a trusted computing base (TCB)?
A. Hosts on your network that support secure transmissions
B. The operating system kernel and device drivers
C. The combination of hardware, software, and controls that work together to enforce a security policy
D. The software and controls that certify a security policy
Answer: C
Q10. What is a security perimeter? (Choose all that apply.)
A. The boundary of the physically secure area surrounding your system
B. The imaginary boundary that separates the TCB from the rest of the system
C. The network where your firewall resides
D. Any connections to your computer system
Answer: AB
Q11. What part of the TCB validates access to every resource prior to granting the requested access?
A. TCB partition
B. Trusted library
C. Reference monitor
D. Security kernel
Answer: C
Q12. What is the best definition of a security model?
A. A security model states policies an organization must follow.
B. A security model provides a framework to implement a security policy.
C. A security model is a technical evaluation of each part of a computer system to assess its concordance with security standards.
D. A security model is the process of formal acceptance of a certified configuration.
Answer: B
Q13. Which security models are built on a state machine model?
A. Bell-LaPadula and Take-Grant
B. Biba and Clark-Wilson
C. Clark-Wilson and Bell-LaPadula
D. Bell-LaPadula and Biba
Answer: D
Q14. Which security model(s) address(es) data confidentiality?
A. Bell-LaPadula
B. Biba
C. Clark-Wilson
D. Both A and B
Answer: A
Q15. Which Bell-LaPadula property keeps lower-level subjects from accessing objects with a higher security level?
A. * (star) Security Property
B. No write up property
C. No read up property
D. No read down property
Answer: C
Comments