I85PREP
⌘ K
CSIS study materials
CSIS study resources

CSIS practice questions

One question at a time. Build your CSIS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Fundamentals and Governance

Which element of the CIA triad is violated when an unauthorised user alters a payroll record?

  1. Availability
  2. Integrity Correct answer.
  3. Non-repudiation
  4. Confidentiality

Explanation

Integrity is the property that data remains accurate and complete and has not been changed by anyone not authorised to do so. Unauthorised modification attacks integrity, regardless of whether the data was also disclosed.

Question 2Security Fundamentals and Governance

The principle of least privilege requires that a user be granted:

  1. the same access as others in the department
  2. full access to all systems for a limited trial period
  3. only the access needed to perform assigned duties Correct answer.
  4. access that matches the highest classification of data in the department

Explanation

Least privilege limits each identity to the minimum access required for its current tasks, which shrinks the damage a compromised or misused account can cause. Access is granted per job need rather than by department convention or seniority.

Question 3Security Fundamentals and Governance

Which of the following is an example of the 'something you know' authentication factor?

  1. A fingerprint scan
  2. A smart card
  3. A memorised passphrase Correct answer.
  4. A one-time code from an authenticator app

Explanation

Authentication factors fall into knowledge, possession and inherence categories. A memorised passphrase is knowledge held in the user's memory, while tokens, cards and biometrics belong to other categories.

Question 4Security Fundamentals and Governance

Which of the following is a preventive control?

  1. Restoring files from backup after a ransomware event
  2. A firewall rule blocking inbound traffic Correct answer.
  3. Reviewing audit logs each morning
  4. Recording failed login attempts

Explanation

Preventive controls stop an event from occurring, whereas detective controls identify events and corrective controls restore normal operation afterwards. A firewall rule that blocks traffic acts before the event can take effect.

Question 5Security Fundamentals and Governance

The primary purpose of a data classification scheme is to:

  1. determine the retention period for backup tapes
  2. identify which employees created each record
  3. reduce the total volume of stored records
  4. set handling requirements that match the data's sensitivity Correct answer.

Explanation

Classification labels data so that proportionate controls for storage, transmission, sharing and disposal can be applied consistently. The label drives handling rules rather than storage volume or authorship tracking.

Question 6Security Fundamentals and Governance

Defence in depth means:

  1. outsourcing all monitoring to a managed provider
  2. relying on the single strongest available control
  3. placing all security controls at the network perimeter
  4. layering independent controls so one failure is not fatal Correct answer.

Explanation

Defence in depth assumes any single control can fail and therefore places overlapping controls at different layers and points in time. Independence between layers is what prevents one failure from becoming a total compromise.

Question 7Security Fundamentals and Governance

Which property makes a cryptographic hash useful for verifying file integrity?

  1. The hash can be decrypted with the original key
  2. A small change to the input produces a very different digest Correct answer.
  3. Hashes can be reversed to recover the original input
  4. Hashing a file compresses it for storage

Explanation

Hashes are one-way functions with an avalanche effect, so any alteration to the input yields an unrelated digest. A recipient can recompute the digest and compare it with the expected value to detect modification.

Question 8Security Fundamentals and Governance

An asset is worth $200,000. A single incident would destroy 25% of its value, and such an incident is expected once every five years. What is the annualised loss expectancy?

  1. $4,000
  2. $40,000
  3. $50,000
  4. $10,000 Correct answer.

Explanation

The single loss expectancy is the asset value multiplied by the exposure factor, giving $50,000. The annualised rate of occurrence is one event in five years, or 0.2, and multiplying gives an annualised loss expectancy of $10,000.

Question 9Security Fundamentals and Governance

An organisation purchases a cyber insurance policy to cover breach costs. Which risk treatment option does this represent?

  1. Transfer Correct answer.
  2. Acceptance
  3. Avoidance
  4. Mitigation

Explanation

Transfer shifts the financial consequence of a risk to a third party, typically through insurance or contractual terms. The risk itself still exists, but the loss is borne by someone else in exchange for a premium.

Question 10Security Fundamentals and Governance

Which statement best distinguishes a standard from a procedure?

  1. A standard is reviewed annually, while a procedure is never revised
  2. A standard states a requirement, while a procedure gives steps Correct answer.
  3. A standard applies only to executives, while a procedure applies to all staff
  4. A standard is optional guidance, while a procedure is mandatory

Explanation

Standards are mandatory statements of what must be achieved, usually expressed as requirements or baselines. Procedures are operational documents describing how those requirements are carried out step by step.

Question 11Security Fundamentals and Governance

Who is accountable for determining the classification and access rules for a data set?

  1. The IT custodian responsible for operating the storage platform
  2. The security operations centre analysts
  3. The internal audit function
  4. The data owner in the business unit Correct answer.

Explanation

The data owner is the business role with authority over a data set and is accountable for its classification and access decisions. Custodians implement those decisions technically but do not own them.

Question 12Security Fundamentals and Governance

A hospital assigns permissions to job titles such as 'nurse' and 'radiologist' rather than to individuals. Which access control model is in use?

  1. Role-based access control Correct answer.
  2. Mandatory access control based on clearances
  3. Discretionary access control owned by the data creator
  4. Attribute-based access control using many attributes

Explanation

Role-based access control grants permissions to roles and then assigns users to roles, which simplifies administration and supports least privilege. Permission assignment follows the job title, not an individual's discretion or a system-wide label comparison.

Question 13Security Fundamentals and Governance

Why does separation of duties reduce fraud risk?

  1. No single person can both commit and conceal a fraudulent act Correct answer.
  2. It limits the number of accounts each user must hold
  3. It requires all staff to take annual awareness training
  4. It ensures every action is logged by the system

Explanation

Separation of duties splits a sensitive process among different people so that collusion would be needed to abuse it. It therefore removes the ability of one individual to act and then cover the evidence.

Question 14Security Fundamentals and Governance

A digital signature created with a sender's private key allows a recipient to verify:

  1. the sender's identity and that the message was not altered Correct answer.
  2. that the message contains no malware
  3. that the message will be delivered only once
  4. that the message was encrypted in transit

Explanation

A signature binds the signer's private key to the message contents, so successful verification confirms who signed and that the content is unchanged. It also supports non-repudiation because only the key holder could have produced it.

Question 15Security Fundamentals and Governance

Recovery time objective (RTO) is best described as:

  1. the maximum acceptable data loss measured in time
  2. the interval between continuity tests
  3. the time needed to complete a full backup cycle
  4. the target time within which a service must be restored Correct answer.

Explanation

RTO defines the maximum tolerable elapsed time to restore a service after disruption and drives recovery capability design. It is expressed as a restoration deadline, not as an amount of lost data.

Question 16Security Fundamentals and Governance

After an analyst confirms that a host is actively spreading malware across the network, which incident response step should come next?

  1. Eradication of the malware
  2. Containment of the affected host Correct answer.
  3. Lessons-learned review
  4. Full recovery from backup

Explanation

Containment limits the spread of an active incident and must precede eradication and recovery, which can only be performed safely once the scope is stable. Lessons learned is the final phase, after recovery.

Question 17Security Fundamentals and Governance

What problem does asymmetric cryptography solve that symmetric cryptography alone cannot?

  1. Protection against weak password choices
  2. Reduction of storage space needed for keys
  3. Secure key exchange between parties who share no secret Correct answer.
  4. Faster bulk encryption of large files

Explanation

Symmetric systems require both parties to already hold the same secret, creating a distribution problem. Public key cryptography allows a shared session key to be established over an untrusted channel without prior secret sharing.

Question 18Security Fundamentals and Governance

Which measure best indicates that a security awareness programme is working?

  1. The number of awareness emails sent each quarter
  2. The total headcount that attended the launch event
  3. The number of posters displayed in the office
  4. A sustained fall in successful phishing simulations Correct answer.

Explanation

Awareness effectiveness should be judged by changes in measurable behaviour, such as a declining click and credential-entry rate in simulations. Activity counts show effort rather than the outcome the programme is meant to produce.

Question 19Security Fundamentals and Governance

Before granting a supplier access to internal systems, the strongest first step is to:

  1. ask the supplier to sign a marketing partnership agreement
  2. assess the supplier's security controls against defined criteria Correct answer.
  3. give the supplier a temporary administrator account
  4. add the supplier to the internal staff directory

Explanation

Third-party risk management requires due diligence against agreed security criteria before access is extended, so that residual risk is understood and accepted by accountable management. Contractual and access steps follow only once the assessment is satisfactory.

Question 20Security Fundamentals and Governance

In a mandatory access control system, access decisions are driven primarily by:

  1. the time of day and location of the request
  2. the resource owner's discretion
  3. a user's job function within the department
  4. the subject's clearance compared with the object's label Correct answer.

Explanation

Mandatory access control applies system-wide labels to objects and clearances to subjects, and the security policy alone decides whether access is allowed. Neither the data owner nor the user can override that comparison.

Question 21Security Fundamentals and Governance

A certificate was issued to a business partner, but the partner's private key was compromised this morning. Which mechanism lets relying parties learn of this before the certificate expires?

  1. Revocation status published through CRL or OCSP Correct answer.
  2. Rotating the CA signing key
  3. Re-issuing it with a longer validity period
  4. Publishing it to a public directory

Explanation

Certificate revocation lists and the online certificate status protocol publish the status of a certificate so that validators can reject it immediately after a compromise. Short validity periods and re-issuance reduce exposure but do not communicate revocation.

Question 22Security Fundamentals and Governance

A control reduces the likelihood of an incident but cannot eliminate it. The risk that remains after the control is applied is called:

  1. Risk appetite
  2. Risk transfer
  3. Inherent risk
  4. Residual risk Correct answer.

Explanation

Residual risk is the exposure that persists once existing controls have been taken into account. Management must decide whether that remaining level falls within the organisation's risk tolerance.

Question 23Security Fundamentals and Governance

Which design choice is most consistent with a zero trust architecture?

  1. Using a single strong perimeter firewall as the main control
  2. Granting standing access so users avoid repeated prompts
  3. Trusting all traffic that originates from the internal network
  4. Authenticating and authorising every request regardless of origin Correct answer.

Explanation

Zero trust removes implicit trust based on network location and evaluates each request against policy using identity and context. Every access is authenticated and authorised explicitly and with least privilege.

Question 24Security Fundamentals and Governance

A business impact analysis establishes that a process can be unavailable for at most eight hours before the harm becomes unacceptable. That figure is the:

  1. maximum tolerable downtime Correct answer.
  2. service level agreement
  3. recovery point objective
  4. annualised loss expectancy in currency

Explanation

Maximum tolerable downtime is the longest outage the business can absorb, and recovery objectives must be set at or below it. It is derived from impact analysis rather than from technical recovery capability.

Question 25Access Control and Identity Management

A user types a username into a login form before supplying a password. Which function does the username entry perform?

  1. Authorization
  2. Accountability
  3. Federated identity
  4. Identification Correct answer.

Explanation

Identification is the act of claiming an identity to a system, which is later verified during authentication. Authorization determines what the verified identity may do, while accountability depends on logging actions to an identified subject.

Question 26Access Control and Identity Management

An organization issues employees a USB security key that must be inserted during login. Which authentication factor does this represent?

  1. A possession factor Correct answer.
  2. A knowledge factor
  3. An inherence factor
  4. A location factor

Explanation

Authentication factors are grouped by type: knowledge (memorized secrets), possession (physical objects), inherence (biometrics), and context such as location. A hardware key is something the user has, so it is a possession factor, and pairing it with a password gives two distinct factors.

Question 27Access Control and Identity Management

Which principle states that a user should be granted only the access required to perform assigned job duties, and no more?

  1. Mandatory access control
  2. Defense in depth
  3. Least privilege Correct answer.
  4. Separation of duties

Explanation

Least privilege limits rights to the minimum necessary for the job function, reducing the damage a compromised or misused account can cause. Separation of duties instead splits a sensitive task among multiple people, and mandatory access control is a label-based enforcement model.

Question 28Access Control and Identity Management

In which access control model does the owner of a resource decide who may access it?

  1. Role-based access control
  2. Attribute-based access control
  3. Mandatory access control
  4. Discretionary access control Correct answer.

Explanation

Discretionary access control leaves access decisions to the resource owner's discretion, typically through object permissions the owner sets. Mandatory access control instead uses system-enforced labels and clearances, and role-based control derives rights from job roles.

Question 29Access Control and Identity Management

Which structure stores, for a single file, a list of the users and groups permitted to access it along with the rights each holds?

  1. Capability table
  2. Access control matrix
  3. Access control list Correct answer.
  4. Role hierarchy

Explanation

An access control list is bound to the object and enumerates the subjects allowed to use it with their permissions. A capability table is bound to a subject and lists the objects that subject may use, while the access control matrix is the abstract model that combines both views.

Question 30Access Control and Identity Management

Which biometric metric identifies the threshold at which false acceptance and false rejection rates are equal?

  1. Crossover error rate Correct answer.
  2. False acceptance rate
  3. Template capacity
  4. False rejection rate

Explanation

The crossover error rate, also called the equal error rate, is the sensitivity setting where the false acceptance rate and false rejection rate intersect. It is used to compare biometric systems, since a lower value indicates a more accurate system.

Question 31Access Control and Identity Management

An analyst holds a Top Secret clearance but is denied access to a Top Secret project she is not assigned to. Which concept explains the denial?

  1. Implicit deny
  2. Least privilege
  3. Separation of duties
  4. Need-to-know Correct answer.

Explanation

Need-to-know restricts access to information required for a specific task, independent of the clearance level the person holds. Clearance establishes eligibility, while need-to-know establishes whether there is an actual requirement to see the material.

Question 32Access Control and Identity Management

Which statement best describes how mandatory access control enforces access decisions?

  1. Subject clearance is compared with the object label Correct answer.
  2. Resource owners assign permissions to users at their discretion
  3. Users are granted permissions through assigned job roles
  4. Access is granted based on attributes evaluated at request time

Explanation

Mandatory access control compares a subject's clearance and category memberships with the object's classification label, and the system rather than the owner enforces the outcome. Owner discretion describes discretionary control, roles describe role-based control, and request-time attribute evaluation describes attribute-based control.

Question 33Access Control and Identity Management

A bank wants teller permissions to change automatically when an employee transfers to the loan department. Which approach best achieves this?

  1. Move the employee from the teller role to the loan role Correct answer.
  2. Add the employee to the domain administrators group
  3. Create a second account for the employee with the new access
  4. Grant the employee individual permissions on each affected file

Explanation

In role-based access control, rights attach to roles, so changing the user's role membership updates access consistently without editing individual object permissions. Direct per-file grants and duplicate accounts leave stale rights behind and weaken accountability.

Question 34Access Control and Identity Management

In a Kerberos environment, what does a client receive from the key distribution center after successful initial authentication?

  1. A one-time password synchronized with the server clock
  2. A ticket-granting ticket (TGT) for services Correct answer.
  3. A SAML assertion signed by the identity provider
  4. A public key certificate bound to the client's account

Explanation

Initial authentication yields a ticket-granting ticket, which the client presents to the ticket-granting service to obtain service tickets for specific resources. Kerberos relies on symmetric keys and timestamps rather than SAML assertions or one-time passwords.

Question 35Access Control and Identity Management

Which characteristic distinguishes TACACS+ from RADIUS?

  1. TACACS+ is defined only for remote dial-in user service
  2. TACACS+ uses UDP and encrypts only the password field
  3. TACACS+ combines authentication and authorization into one exchange
  4. TACACS+ encrypts the entire payload and separates AAA functions Correct answer.

Explanation

TACACS+ runs over TCP, encrypts the full body of each packet, and separates authentication, authorization, and accounting into distinct exchanges. RADIUS uses UDP, encrypts only the password field, and combines authentication with authorization.

Question 36Access Control and Identity Management

What is the role of the identity provider in a SAML-based web single sign-on exchange?

  1. It hosts the protected application and enforces authorization decisions
  2. It authenticates the user and issues a signed assertion Correct answer.
  3. It stores hashed credentials for the relying party's local directory
  4. It issues short-lived OAuth access tokens to the client application

Explanation

In SAML the identity provider authenticates the subject and issues a signed assertion that the service provider consumes to establish a session. The service provider hosts the application, and OAuth tokens or local credential stores are separate mechanisms.

Question 37Access Control and Identity Management

A developer proposes using a bare OAuth 2.0 access token to prove a user's identity to a new API. What is the primary security concern?

  1. OAuth 2.0 tokens cannot be transmitted over TLS
  2. OAuth 2.0 tokens never expire and cannot be revoked
  3. OAuth tokens grant delegated authorization, not user identity Correct answer.
  4. OAuth 2.0 requires the resource owner's password to be shared with each API

Explanation

An OAuth access token conveys delegated authorization to a resource rather than proof of who the user is, so treating it as an identity assertion invites token substitution and audience confusion. An identity layer such as OpenID Connect should be used when authentication is required.

Question 38Access Control and Identity Management

How does OpenID Connect extend OAuth 2.0 for authentication?

  1. It encrypts the access token with the client's shared password
  2. It requires users to present a client certificate to the authorization server
  3. It adds a signed ID token carrying user identity claims Correct answer.
  4. It replaces bearer tokens with Kerberos service tickets

Explanation

OpenID Connect layers authentication onto OAuth 2.0 by introducing the ID token, a signed JSON Web Token that carries claims about the subject and the authentication event. The access token remains the artifact for authorization.

Question 39Access Control and Identity Management

An administrator tightens a biometric sensor's matching threshold. What is the expected effect?

  1. FAR rises and FRR falls
  2. FAR falls and FRR rises Correct answer.
  3. Neither rate changes; the crossover rate is fixed
  4. Both rates decrease

Explanation

Tightening the threshold makes the sensor reject more marginal samples, which lowers the chance an impostor is accepted while raising the chance a legitimate user is rejected. The false acceptance and false rejection rates therefore move in opposite directions as sensitivity changes.

Question 40Access Control and Identity Management

An employee leaves the company. Which action most directly limits the risk of unauthorized access through the departed employee's accounts?

  1. Increasing the password complexity policy for all staff
  2. Disabling the employee's accounts on the last working day Correct answer.
  3. Reviewing the employee's access log for the past 90 days
  4. Rotating the organization's public key infrastructure certificates

Explanation

Timely deprovisioning disables or removes the accounts so credentials tied to the former employee can no longer be used. Log review is detective and after the fact, and broad password policy changes do not eliminate the orphaned credentials.

Question 41Access Control and Identity Management

Requiring that the person who creates a vendor record cannot also approve payments to that vendor is an example of which control?

  1. Job rotation
  2. Separation of duties Correct answer.
  3. Mandatory vacation
  4. Least privilege

Explanation

Separation of duties splits a sensitive process so that no single person can complete it alone, preventing fraud and undetected error. Least privilege limits the breadth of each person's rights but does not by itself require two different people in a process.

Question 42Access Control and Identity Management

Which practice best reduces risk from administrative accounts shared among a team?

  1. Disabling auditing so administrators are not deterred from using the accounts
  2. Granting each administrator a second account with the same rights
  3. Vaulting credentials with check-out, rotation, and session recording Correct answer.
  4. Storing the credentials in a spreadsheet protected by a password

Explanation

A privileged access management vault controls who may check out a credential, rotates it after use, and records the session, restoring individual accountability for shared administrative access. Plaintext shared storage or silencing audits preserves the original risk.

Question 43Access Control and Identity Management

Which method is appropriate for storing user passwords for later verification?

  1. A salted, deliberately slow hash such as bcrypt or Argon2 Correct answer.
  2. A single unsalted SHA-256 hash for all accounts
  3. Reversible encryption using a key stored on the same server
  4. Plain text in a file readable only by the database service account

Explanation

Salted, deliberately slow hashes make offline guessing expensive and prevent precomputed rainbow-table attacks and hash comparison across accounts. Reversible storage, plaintext, and fast unsalted hashes all expose credentials if the store is breached.

Question 44Access Control and Identity Management

A system applies the rules 'no read down' and 'no write up'. Which goal do these rules serve?

  1. Non-repudiation by binding actions to signing keys
  2. Confidentiality by preventing classified data from flowing to lower levels
  3. Availability by ensuring critical services remain online
  4. Integrity, by keeping low-integrity data out of higher levels Correct answer.

Explanation

These are the Biba model's rules, which protect integrity: subjects may not read data of lower integrity and may not write to objects of higher integrity, so contamination cannot flow upward. Bell-LaPadula uses the mirror-image rules to protect confidentiality.

Question 45Access Control and Identity Management

Which mechanism is central to the Clark-Wilson integrity model?

  1. Access is granted when the subject's attributes satisfy a policy expression
  2. Each object carries a list of users and their permitted operations
  3. Subjects are assigned clearance labels that dominate object labels
  4. Users change data only through well-formed transactions Correct answer.

Explanation

Clark-Wilson protects integrity with constrained data items, transformation procedures, and separation of duty, so users act on data only through certified well-formed transactions. Label dominance belongs to mandatory access control, attribute evaluation to attribute-based control, and per-object user lists to ACLs.

Question 46Access Control and Identity Management

Why is compromise of the Kerberos key distribution center considered a severe risk?

  1. It exposes user passwords in plaintext to every workstation on the network
  2. An attacker with the KDC keys can forge valid-looking tickets Correct answer.
  3. It permanently disables timestamp-based replay protection
  4. It forces all services to fall back to NTLM authentication

Explanation

Service tickets are encrypted with key material known to the key distribution center, so an attacker holding those keys can mint arbitrary tickets, including long-lived ones, that services will accept. This is why the KDC and its service account keys are among the most sensitive assets in the domain.

Question 47Access Control and Identity Management

An enterprise federates with a business partner's identity provider. What risk arises from this arrangement?

  1. SAML assertions travel in cleartext and cannot be signed
  2. The enterprise must store partner user passwords in its own directory
  3. Users must maintain separate credentials for every federated application
  4. Weak authentication at the partner can grant enterprise access Correct answer.

Explanation

Federation makes the enterprise dependent on the partner's authentication, so the partner's credential and multi-factor strength become part of the enterprise's effective security posture. This transitive trust means a weakness on the partner side can translate directly into unauthorized enterprise access.

Question 48Access Control and Identity Management

Which access control approach best supports a policy such as 'permit access only during business hours from a managed device in the finance department'?

  1. Discretionary access control based on file ownership
  2. Role-based access control with a finance role only
  3. Attribute-based control over subject, resource, and context Correct answer.
  4. Mandatory access control using classification labels only

Explanation

Attribute-based access control evaluates attributes of the subject, resource, action, and environment, so department, device posture, and time can be combined in one policy. Role-based control captures department membership but not time or device state, and ownership or labels capture only one dimension.

Question 49Cryptography and Key Management

Which of the following is a symmetric block cipher?

  1. ECDSA
  2. Diffie-Hellman
  3. AES Correct answer.
  4. RSA

Explanation

AES is a symmetric block cipher, so the same key is used for encryption and decryption. RSA and ECDSA are asymmetric algorithms, and Diffie-Hellman is a key agreement method rather than a cipher.

Question 50Cryptography and Key Management

A cryptographic hash function used for integrity verification produces output that is:

  1. Variable in length and equal to the input size
  2. Reversible by the recipient with a shared key
  3. Encrypted with the sender's private key
  4. Fixed in length regardless of input size Correct answer.

Explanation

A hash function compresses an input of arbitrary length into a digest of fixed length, such as 256 bits for SHA-256. That fixed output size is what makes digests comparable and usable in integrity checks.