I85PREP
⌘ K
CNITSEC CISP study materials
CNITSEC CISP study resources

CNITSEC CISP practice questions

One question at a time. Build your CNITSEC CISP understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security foundations, governance and Chinese context

China’s Cybersecurity Law establishes which nationwide baseline system for protecting networks according to their importance and risk?

  1. A voluntary industry code that applies only to listed companies
  2. The classified protection of cybersecurity (MLPS) system Correct answer.
  3. A requirement that every organization obtain an ISC2 CISSP certificate
  4. A ban on all cross-border scientific research collaboration

Explanation

The Cybersecurity Law requires the state to implement the classified protection of cybersecurity (网络安全等级保护制度, MLPS). Network operators must fulfill protection obligations under that system so networks are guarded against interference, destruction, and unauthorized access. CISP regulation items test this as the legal backbone of GB/T 22239-style graded protection, not as a private certification scheme.

Question 2Security foundations, governance and Chinese context

Which organization issues the CISP (注册信息安全专业人员) personnel-registration qualification in China?

  1. (ISC)²
  2. The American Bankers Association
  3. China Information Technology Security Evaluation Center (CNITSEC) Correct answer.
  4. ISO/IEC JTC 1

Explanation

CISP is CNITSEC’s registered information-security professional qualification, administered through the personnel-registration service on itsec.gov.cn. It is not ISC2 CISSP and not ABA’s Certified IRA Services Professional, even though those programs also use the CISP letters. Candidates complete authorized training, sit CNITSEC’s exam, and then complete registration review.

Question 3Security foundations, governance and Chinese context

Under China’s Cybersecurity Law, network operators are expected to implement which kind of baseline duty?

  1. Only encrypt marketing emails, with no internal security management required
  2. Internal security management, technical safeguards, and measures that prevent unauthorized access and data leakage Correct answer.
  3. Publish source code of all business applications to the public internet
  4. Disable all logging so that personal information is never stored

Explanation

The Cybersecurity Law requires network operators to fulfill classified-protection duties, including internal security management and technical measures that keep networks free from interference, destruction, and unauthorized access and that prevent network data from being leaked, stolen, or altered. CISP tests this as an ongoing operator obligation, not a one-time product purchase. Logging, backup, and malicious-code prevention are typical supporting measures rather than things to disable.

Question 4Security foundations, governance and Chinese context

How does China’s Cybersecurity Law treat critical information infrastructure (CII) relative to ordinary networks?

  1. CII is exempt from classified protection because it is already secret
  2. CII receives key protection on top of the classified protection of cybersecurity Correct answer.
  3. CII operators may ignore personnel and backup requirements that apply to others
  4. CII is defined as any website that uses a content delivery network

Explanation

The Cybersecurity Law places CII under key protection on the basis of the classified protection (MLPS) system. CII covers important industries and other systems whose destruction, loss of function, or data leakage could seriously harm national security, the national economy and people’s livelihood, or the public interest. Extra CII duties (specialized management, background review, disaster backup, and so on) add to-not replace-graded protection.

Question 5Security foundations, governance and Chinese context

Under China’s Cryptography Law, commercial cryptography (商用密码) is used primarily to protect which kind of information?

  1. Information that is not a state secret Correct answer.
  2. Only Top Secret state secrets held by intelligence agencies
  3. Publicly posted marketing slogans that need no confidentiality
  4. Paper archives that are never processed electronically

Explanation

The Cryptography Law distinguishes core and ordinary cryptography, which protect state secrets, from commercial cryptography, which protects information that is not a state secret. CISP supporting-technology and regulation items treat SM2, SM3, and SM4 as commercial-cryptography algorithms in this non-secret business and government-service space. CII operators are expected to use commercial cryptography in accordance with law when protecting CII.

Question 6Security foundations, governance and Chinese context

GB/T 22239-2019 (MLPS 2.0 baseline) splits each grade’s security requirements into which two kinds of requirement?

  1. Safety integrity levels and quality management clauses
  2. General security requirements and security extension requirements Correct answer.
  3. Only encryption requirements and only physical-key requirements
  4. Open-source license terms and patent-indemnity terms

Explanation

GB/T 22239-2019 specifies general security requirements that apply regardless of system form, plus extension requirements for distinctive technologies and scenarios. The published extensions cover cloud computing, mobile internet, Internet of Things, and industrial control systems. General requirements themselves split into technical classes (physical environment, communication network, regional boundary, computing environment, security management center) and management classes.

Question 7Security foundations, governance and Chinese context

According to GB/T 22240-2020, a classified-protection object is Grade III (第三级) when damage would cause which outcome?

  1. Only general harm to a private individual’s lawful rights, with no effect on public order or national security
  2. Serious harm to social order or the public interest, or harm to national security Correct answer.
  3. Particularly serious harm to national security as the sole matching outcome
  4. No harm of any kind because Grade III systems are considered harmless

Explanation

GB/T 22240-2020 grades objects by the harmed interest and the degree of harm. Grade III applies when damage would seriously harm social order or the public interest, or would harm national security. Grade I is limited to general harm to private lawful rights; Grade V is reserved for particularly serious harm to national security. CISP regulation items use this object-and-degree table, not GB 17859’s older English nicknames, as the operational grading rule.

Question 8Security foundations, governance and Chinese context

Which set of measures matches the extra protection expected of critical information infrastructure operators under China’s Cybersecurity Law?

  1. No specialized security organization, no personnel review, and no disaster backup for important systems
  2. A specialized security management body, security background review for the responsible person and key posts, and disaster-recovery backup of important systems and databases Correct answer.
  3. Replacing all Chinese commercial cryptography with undocumented home-made ciphers
  4. Publishing CII network diagrams and administrator passwords to improve transparency

Explanation

On top of MLPS, the Cybersecurity Law requires CII operators to set up specialized security management and a responsible person, review the security background of that person and key-post staff, provide regular training and skills assessment, and perform disaster-recovery backup of important systems and databases. Those duties exist because CII failure can harm national security or the public interest. CISP asks candidates to recognize this as a stricter operator regime, not as optional best practice.

Question 9Identity, access and cryptographic protection

SM4, a Chinese commercial-cryptography algorithm, is which type of algorithm?

  1. A cryptographic hash function
  2. A symmetric block cipher Correct answer.
  3. An elliptic-curve public-key signature algorithm
  4. A password-hashing key-stretching function such as bcrypt

Explanation

SM4 (GB/T 32907) is a symmetric block cipher: the same secret key encrypts and decrypts fixed-size blocks of data. In the commercial-cryptography suite it is the counterpart to algorithms such as AES, while SM3 is the hash and SM2 is the public-key algorithm. CISP items often start by forcing this type classification before asking about key length or use cases.

Question 10Identity, access and cryptographic protection

What is the primary cryptographic role of SM3?

  1. Public-key encryption of large video files
  2. A cryptographic hash (digest) function for integrity and as a building block in signatures Correct answer.
  3. A stream cipher that replaces TLS record encryption by itself
  4. A physical lock standard for data-center cages

Explanation

SM3 (GB/T 32905) is a cryptographic hash algorithm. It maps arbitrary-length input to a fixed-length digest and is used for integrity checking, as the hash inside digital signatures, and in other constructions such as message authentication. Hashing is one-way and is not a substitute for a public-key or symmetric encryption scheme when confidentiality of bulk data is the goal.

Question 11Identity, access and cryptographic protection

SM2 is BEST described as which kind of commercial-cryptography algorithm?

  1. An elliptic-curve public-key algorithm used for digital signature, key exchange, and public-key encryption Correct answer.
  2. A 128-bit symmetric block cipher identical to SM4
  3. A 256-bit hash function identical to SM3
  4. A one-time pad that requires no key management

Explanation

SM2 (GB/T 32918 series) is China’s elliptic-curve public-key algorithm. The suite includes digital signature, key exchange, and public-key encryption. Because it is asymmetric, each party has a public verification/encryption key and a private signing/decryption key. CISP expects this to be distinguished from SM3 (hash) and SM4 (symmetric block cipher).

Question 12Identity, access and cryptographic protection

AES and SM4 are similar in which fundamental respect?

  1. Both are public-key algorithms based on integer factorization
  2. Both are symmetric block ciphers used to protect confidentiality of data with a shared secret key Correct answer.
  3. Both output only a 256-bit one-way digest and cannot encrypt
  4. Both are hash-based signature schemes with no encryption mode

Explanation

AES and SM4 are both symmetric block ciphers: parties share a secret key and encrypt data in blocks. AES is an international standard with 128-bit blocks and 128-, 192-, or 256-bit keys; SM4 uses a 128-bit block and a 128-bit key. CISP uses the comparison to place SM4 in the same functional family as AES, not in the RSA or hash families.

Question 13Identity, access and cryptographic protection

RSA and SM2 differ MOST clearly in which respect?

  1. RSA is a hash function, while SM2 is a symmetric cipher
  2. RSA’s security is based on the difficulty of factoring large integers; SM2 is an elliptic-curve public-key scheme Correct answer.
  3. RSA can only encrypt 128-bit blocks with a 128-bit shared secret
  4. SM2 cannot produce digital signatures, while RSA can

Explanation

RSA is a public-key algorithm whose hardness assumption is integer factorization of a modulus n = p × q. SM2 is a public-key algorithm on elliptic curves, used for signatures, key exchange, and encryption. Both can support signatures and encryption, but they are not hashes or shared-secret block ciphers. CISP conceptual items stop at this family distinction rather than claiming an unverified numeric “equivalent RSA key size.”

Question 14Identity, access and cryptographic protection

In a public-key digital signature scheme (including SM2 or RSA signatures), which key is used to create the signature?

  1. The signer’s private key Correct answer.
  2. The verifier’s private key
  3. A publicly posted symmetric session key known to all readers
  4. The hash algorithm’s IV, used as if it were a signature key

Explanation

The signer uses their private key so that only they could have produced the signature. Anyone with the corresponding public key can verify it, which supports authenticity, integrity of the signed digest, and non-repudiation of origin. Using a verifier’s private key or a published symmetric key would destroy that binding. Hash functions supply the digest that is signed; they are not the signature key.

Question 15Identity, access and cryptographic protection

Which pair of parameters is specified for the SM4 block cipher in GB/T 32907?

  1. 64-bit block and 56-bit key, like DES
  2. 128-bit block and 128-bit key Correct answer.
  3. 256-bit block and no key, like a hash
  4. Variable-length public modulus with primes p and q

Explanation

SM4 encrypts 128-bit blocks under a 128-bit secret key. That matches the functional niche of AES-128 (128-bit block, 128-bit key) even though the internal structure differs. DES-style 64-bit blocks and 56-bit keys, hash-style unkeyed digests, and RSA moduli describe other algorithms. CISP crypto items use these numbers because they are stated in the SM4 standard, not because they are guessed from AES.

Question 16Identity, access and cryptographic protection

Which access-control model grants permissions according to the roles assigned to a user rather than to each user individually or to security labels?

  1. Discretionary access control (DAC) only, with no grouping
  2. Mandatory access control (MAC) based solely on classification labels
  3. Role-based access control (RBAC) Correct answer.
  4. An open anonymous model with no authentication

Explanation

RBAC assigns permissions to roles (job functions) and then assigns users to those roles. That scales better than per-user DAC ACLs for large organizations and is different from MAC, where a central policy compares object labels with subject clearances. CISP supporting-technology items expect candidates to keep DAC (owner discretion), MAC (labels), and RBAC (roles) distinct.

Question 17Security foundations, governance and Chinese context

In information security, the CIA triad refers to which three core properties of information and systems?

  1. Confidentiality, integrity, and availability Correct answer.
  2. Certification, inspection, and authorization
  3. Cryptography, identity, and auditing
  4. Classification, isolation, and authentication

Explanation

The CIA triad is confidentiality (preventing unauthorized disclosure), integrity (preventing unauthorized modification), and availability (ensuring authorized access when needed). CISP fundamentals treat these three properties as the baseline for stating security requirements and selecting controls. Other desirable properties such as authenticity or non-repudiation extend the triad; they do not replace it.

Question 18Security foundations, governance and Chinese context

What does defense in depth require when protecting an information system?

  1. A single strong perimeter firewall so internal controls can be minimized
  2. Multiple complementary layers of people, process, and technology controls Correct answer.
  3. Encrypting all data so access control and monitoring can be omitted
  4. Moving every control into the application layer and removing network safeguards

Explanation

Defense in depth assumes that any one control can fail, so independent layers should overlap. IATF, which CISP teaches as an information-assurance technical framework, builds this idea around people, technology, and operations rather than one perimeter device. Complementary layers (physical, network, host, application, data, and process) reduce the chance that a single bypass causes total compromise.

Question 19Security foundations, governance and Chinese context

The Information Assurance Technical Framework (IATF) organizes information assurance around which three elements?

  1. Hardware, software, and firmware
  2. People, technology, and operations Correct answer.
  3. Policy, budget, and procurement
  4. Confidentiality, privacy, and anonymity

Explanation

IATF, developed as U.S. NSA guidance and taught in the CISP knowledge system, treats information assurance as the combination of people, technology, and operations. People include training, awareness, and roles; technology includes mechanisms in computing environments, boundaries, and infrastructure; operations include the day-to-day processes that keep those mechanisms effective. CISP items often pair this triad with IATF's layered technical focus areas rather than with the CIA triad.

Question 20Security foundations, governance and Chinese context

In the P2DR information-security model taught in CISP fundamentals, what does the first “P” represent as the center of the model?

  1. Privacy
  2. Patching
  3. Policy Correct answer.
  4. Penetration testing

Explanation

P2DR is Policy, Protection, Detection, and Response. Policy sits at the center and states what must be protected and to what degree; protection, detection, and response mechanisms then implement that policy. CISP materials contrast this with purely technical checklists: without a policy core, tools have no agreed objective.

Question 21Security foundations, governance and Chinese context

China’s “three synchronizations” (三同步) principle for information-system security requires security work to be done in which relationship to informatization?

  1. Security design may wait until after the production system is fully accepted
  2. Security is planned, built, and put into operation in step with the information system Correct answer.
  3. Only classified systems need security, and only after a breach has occurred
  4. Security operations can be outsourced so planning and construction need no security input

Explanation

The three-synchronization principle requires security to be planned, constructed, and operated (or used) in parallel with the information system itself. CISP engineering content uses this rule to reject “bolt-on security after go-live.” If requirements, design, and operations skip security, later retrofits are more expensive and leave gaps.

Question 22Security foundations, governance and Chinese context

Compared with PDRR (protect, detect, respond/react, recover), China’s WPDRRC model adds which pair of activities at the front and back of the cycle?

  1. Wireless protection and remote wipe
  2. Whitelisting and red-team reporting
  3. Warning (early warning) and counterattack Correct answer.
  4. Waterfall planning and certification

Explanation

WPDRRC extends dynamic protection models used in Chinese information-assurance teaching by adding warning (预警) before protection and counterattack (反击) after recovery. The six links-warning, protect, detect, respond, recover, counterattack-are meant to be time-ordered and dynamic. CISP fundamentals expect candidates to recognize this as a China-oriented elaboration of PDR/PDRR, not as a replacement for CIA.

Question 23Security foundations, governance and Chinese context

The P2DR timing goal commonly taught in CISP is that a system remains practically protected against a given attack when which relationship holds?

  1. Detection time plus response time is greater than protection time
  2. Protection time is greater than detection time plus response time Correct answer.
  3. Backup time is greater than recovery time plus failover time
  4. Encryption time is greater than key-generation time plus hashing time

Explanation

P2DR treats security as a race in time: if the time required to break protection (Pt) is longer than the time to detect the attack (Dt) plus the time to respond (Rt), defenders can interrupt the attack before it succeeds. The inequality is therefore Pt > Dt + Rt. CISP uses this to justify investing in faster detection and response, not only thicker static protection.

Question 24Cyber-risk identification and analysis

ISO/IEC 27001 specifies requirements for which kind of management system?

  1. An environmental management system for factory emissions
  2. An information security management system (ISMS) Correct answer.
  3. A food-safety HACCP system
  4. A project-schedule management system limited to Gantt charts

Explanation

ISO/IEC 27001 is the international standard for establishing, implementing, maintaining, and continually improving an information security management system. CISP management-domain teaching uses it as the systematic counterpart to purely technical controls. An ISMS is risk-based and organization-wide, not a single product or a Gantt chart.

Question 25Cyber-risk identification and analysis

In the PDCA cycle used by ISO/IEC 27001, what is the main purpose of the Plan phase?

  1. To establish the ISMS, including context, risk assessment, and treatment planning Correct answer.
  2. To retire the ISMS after the first internal audit
  3. To skip risk assessment because controls will be chosen at random
  4. To operate production changes with no documented objectives

Explanation

Plan is where the organization sets ISMS scope and objectives, understands context and interested parties, assesses information-security risk, and plans risk treatment. Do then implements those plans; Check evaluates performance; Act improves the system. CISP uses PDCA as the management rhythm rather than as a one-time project plan.

Question 26Cyber-risk identification and analysis

In a typical information-security document hierarchy, which statement is MOST accurate?

  1. A guideline is a mandatory law that overrides national statutes
  2. A policy states management intent and direction; procedures describe how to carry the policy out Correct answer.
  3. A procedure always has higher authority than the organization’s security policy
  4. Standards and procedures are optional captions on marketing slides only

Explanation

Policies express management’s intent, objectives, and high-level rules. Standards set mandatory technical or operational criteria, and procedures give step-by-step instructions that implement policy. CISP management items expect this hierarchy so candidates do not treat a work instruction as if it were the board-level policy, or vice versa.

Question 27Cyber-risk identification and analysis

After information-security risks are identified and assessed, which set lists the standard risk-treatment choices?

  1. Mitigate (reduce), accept, transfer, or avoid Correct answer.
  2. Ignore, delay indefinitely, or increase the threat
  3. Classify every risk as Grade V and stop operations
  4. Replace risk assessment with a single antivirus purchase

Explanation

Risk treatment selects how the organization will handle assessed risk: reduce it with controls, accept residual risk within appetite, transfer it (for example through insurance or contracts), or avoid it by stopping the activity. ISO/IEC 27001 planning requires these decisions to be documented and then implemented in the Do phase. CISP management questions often pair treatment with ownership, not with buying a tool and stopping analysis.

Question 28Cyber-risk identification and analysis

Who should normally be accountable for classifying an information asset and accepting residual risk to that asset?

  1. The asset owner (the business or process owner responsible for the asset) Correct answer.
  2. Any intern who happens to have a login
  3. An external attacker who discovered the asset
  4. The help-desk ticket queue with no named owner

Explanation

Asset ownership assigns a named business or process owner who knows the asset’s value and can classify it and accept residual risk. Security teams advise and implement controls, but they do not silently become owners of every business database. CISP management teaching links classification to handling rules (storage, transmission, disposal) that the owner must enforce.

Question 29Cyber-risk identification and analysis

What is the PRIMARY purpose of an organization-wide security-awareness program?

  1. To replace technical controls so firewalls can be turned off
  2. To help personnel understand their security responsibilities and recognize common threats Correct answer.
  3. To guarantee that no phishing email will ever be received
  4. To satisfy a logo requirement on the company intranet only

Explanation

Awareness and training reduce human-factor risk by teaching people their duties, acceptable use, and how to spot phishing, social engineering, and mishandling of information. ISO/IEC 27001 and MLPS management requirements both expect regular education, not a one-time poster. Awareness complements technical controls; it does not make those controls optional.

Question 30Cyber-risk identification and analysis

In ISO/IEC 27001 PDCA, which activities belong in the Check phase?

  1. Writing the first draft of the ISMS scope and stopping there
  2. Monitoring, measurement, internal audit, and management review of ISMS performance Correct answer.
  3. Implementing new firewalls with no evaluation of whether they work
  4. Deleting audit records so that nonconformities cannot be found

Explanation

Check evaluates whether the ISMS and its controls are effective. Typical activities are monitoring and measurement, internal audit, and management review, which then feed Act (corrective action and improvement). CISP management items use this split so candidates do not confuse planning (Plan) or implementation (Do) with evaluation. Destroying evidence would defeat Check entirely.

Question 31Security integration, physical environment and media

A mantrap (interlocking door / 互锁门) at a computer-room entrance is PRIMARILY intended to do which of the following?

  1. Increase air humidity for tape libraries
  2. Control and verify physical entry so that tailgating into the protected space is harder Correct answer.
  3. Replace all CCTV cameras and visitor logs
  4. Provide the room’s only fire-exit path with no emergency override

Explanation

A mantrap allows one person to be identified and authorized in an inner space before the second door opens, reducing tailgating. Physical-environment requirements in MLPS-style baselines include physical access control at computer-room entrances. Mantraps complement, rather than replace, logging, cameras, and emergency-egress design.

Question 32Security integration, physical environment and media

Why do computer rooms use uninterruptible power supplies (UPS) as part of physical and environmental protection?

  1. To keep critical systems available through short power interruptions and to allow orderly shutdown or generator transfer Correct answer.
  2. To heat the room so that air conditioning can be removed
  3. To replace fire detection and suppression
  4. To encrypt data at rest on every disk automatically

Explanation

UPS units protect availability by bridging short outages, filtering power quality problems, and giving time to start generators or shut systems down cleanly. MLPS physical-environment requirements include power-supply protection for higher grades. A UPS is not a heater, a fire system, or a disk-encryption product.

Question 33Security integration, physical environment and media

Which action is a core host-hardening practice in a computing environment?

  1. Enabling every unused network service so that more ports are open for convenience
  2. Removing or disabling unused services, applying patches, and enforcing least-privilege accounts Correct answer.
  3. Sharing a single administrator password among all operators and vendors
  4. Turning off all authentication so users are never delayed

Explanation

Hardening reduces the attack surface of operating systems and hosts: unused services go away, known vulnerabilities are patched, and accounts run with least privilege. CISP computing-environment content treats this as a baseline before adding monitoring. Opening every service, sharing admin passwords, or disabling authentication increases host risk.

Question 34Security integration, physical environment and media

When a disk that stored sensitive data is retired, which disposal approach BEST protects confidentiality of residual data?

  1. Deleting the file icons from the desktop and selling the disk immediately
  2. Sanitizing the media with approved overwrite, cryptographic erase, degaussing (for magnetic media), or physical destruction matched to the sensitivity Correct answer.
  3. Formatting only the first partition and keeping the rest unmodified
  4. Mailing the raw disk to an unknown recycler with no contract or destruction certificate

Explanation

Desktop deletion and ordinary format usually leave recoverable data. Sanitization must match media type and sensitivity: overwrite or cryptographic erase for reusable disks, degaussing for some magnetic media, and physical destruction when reuse is not allowed. CISP physical/computing items treat media handling as part of the data lifecycle, not as an afterthought.

Question 35Security integration, physical environment and media

In a virtualized computing environment, what is a VM escape attack?

  1. A guest virtual machine breaking isolation to attack the hypervisor or other guests Correct answer.
  2. A user logging out of a remote desktop session
  3. Scheduled live migration of a VM for maintenance
  4. Compressing a VM snapshot to save storage

Explanation

VM escape is a failure of guest isolation: code in a virtual machine reaches the hypervisor or another guest. Virtualization security therefore hardens the hypervisor, patches guest tools, and restricts management interfaces. Ordinary logout, live migration, and snapshot compression are operations, not escape attacks.

Question 36Security integration, physical environment and media

A Trusted Platform Module (TPM) on a host is PRIMARILY used to support which computing-environment goal?

  1. Hardware-rooted key storage and measured/trusted boot integrity Correct answer.
  2. Increasing CPU clock speed beyond the vendor rating
  3. Replacing the need for any operating-system access control
  4. Providing unlimited off-site disaster recovery capacity

Explanation

A TPM is a hardware root of trust that can store keys and record measurements of firmware and boot components. Those measurements support trusted or measured boot and help detect unauthorized firmware or boot-loader changes. CISP computing-environment material treats trusted computing as complementary to OS access control, not a substitute for it.

Question 37Security integration, physical environment and media

For a data center full of energized electronic equipment, which fire-suppression approach is generally MORE appropriate than ordinary water sprinklers as the primary agent?

  1. A clean-agent or other approved gaseous system designed for occupied IT spaces, plus detection and emergency power-off procedures Correct answer.
  2. Flooding the raised floor with untreated river water as soon as an alarm sounds
  3. Relying only on portable water hoses aimed at live racks
  4. Disabling all fire detection so that false alarms cannot occur

Explanation

Water on live electrical equipment can destroy systems and create shock hazards, so computer rooms typically use early detection plus clean-agent or other approved gaseous suppression designed for IT spaces. Physical-environment baselines also still require fire detection, compartmentation, and safe evacuation. The goal is to protect people first and then limit equipment damage.

Question 38Application and data protection

Which secure-coding practice is the FIRST line of defense against injection attacks in application software?

  1. Trusting all client-side input because the user interface looks simple
  2. Validating, encoding, and handling untrusted input on the server using safe APIs Correct answer.
  3. Disabling authentication so attackers have fewer error messages to read
  4. Storing all passwords in source code comments

Explanation

Injection flaws occur when untrusted input is interpreted as code or queries. Server-side validation, output encoding, and safe APIs (such as parameterized queries) stop that interpretation. Client-side checks are easy to bypass, so they are not sufficient. CISP software-security items treat input handling as a design and implementation control, not as a user-interface cosmetic.

Question 39Application and data protection

A buffer overflow in native software is BEST described as which problem?

  1. Writing more data into a buffer than it can hold, which can overwrite adjacent memory and allow crashes or code execution Correct answer.
  2. Using HTTPS instead of HTTP
  3. Compressing log files to save disk space
  4. A user choosing a long but unique passphrase

Explanation

Buffer overflows happen when a program copies data past the end of an allocated buffer, overwriting control data or other variables. Attackers may use this for denial of service or to hijack execution. Defenses include bounds checking, memory-safe languages, stack canaries, NX/DEP, and ASLR. CISP software-security teaching treats overflow as a classic implementation flaw, not as a networking or password-length issue.

Question 40Application and data protection

What does a secure software development lifecycle (secure SDLC) require?

  1. Adding a penetration test only after years of production incidents
  2. Integrating security activities into requirements, design, implementation, testing, release, and maintenance Correct answer.
  3. Forbidding all testing so that schedules never slip
  4. Leaving threat analysis until the product is already retired

Explanation

Secure SDLC builds security into every lifecycle phase instead of treating it as a pre-release surprise. Typical activities include security requirements, threat modeling, secure coding, code review, security testing, and vulnerability handling after release. CISP software-security domain teaching aligns this with the three-synchronization idea: security is planned and built with the software, not bolted on after incidents.

Question 41Application and data protection

Which control MOST directly prevents classic SQL injection in an application that queries a relational database?

  1. Building SQL strings by concatenating raw user input
  2. Using parameterized queries or prepared statements so user data is not interpreted as SQL Correct answer.
  3. Displaying database error stacks to every anonymous visitor
  4. Granting the application a database administrator account for all queries

Explanation

Parameterized queries keep user data out of the SQL parser’s code path, so injected fragments cannot change query structure. Concatenation of raw input is the usual root cause of SQL injection. Least-privilege database accounts and hidden errors help limit damage but do not by themselves stop injection. CISP network and software items both treat this as a standard application-layer defense.

Question 42Application and data protection

In STRIDE threat modeling, the “S” (spoofing) threat is BEST mitigated by which control family?

  1. Authentication and identity proofing so an entity cannot easily pretend to be another Correct answer.
  2. Encrypting backups to reduce information disclosure if tapes are stolen
  3. Adding spare servers to absorb a volumetric denial-of-service flood
  4. Removing all timestamps from logs

Explanation

STRIDE’s spoofing threat is pretending to be another user, process, or system. Authentication, strong identity, and anti-replay protections address it. The other STRIDE letters cover tampering, repudiation, information disclosure, denial of service, and elevation of privilege. CISP software-security teaching uses STRIDE as a design-time prompt, not as a substitute for testing.

Question 43Application and data protection

A web application’s database account can read, write, drop tables, and create new database users. Which software-security principle is MOST clearly violated?

  1. Least privilege Correct answer.
  2. Open-source licensing
  3. Ergonomic color contrast
  4. Mandatory vacation for developers

Explanation

Least privilege requires each component to have only the rights it needs. A typical web application needs limited DML on specific objects, not the ability to drop tables or create users. Excess privilege turns a later injection or stolen credential into a full database compromise. Other listed items are unrelated to this account-design defect.

Question 44Application and data protection

Which practice BEST reduces software supply-chain risk for a production application?

  1. Pulling unsigned, unaudited dependencies from unknown mirrors on every build with no lockfile
  2. Inventorying components, preferring signed trusted packages, scanning known vulnerabilities, and controlling build pipelines Correct answer.
  3. Copying production secrets into public CI logs for convenience
  4. Disabling all update mechanisms so vulnerable libraries never change

Explanation

Supply-chain attacks target dependencies, build systems, and update channels. Defenses include a software inventory (such as an SBAC/SBOM-style list), verified publishers and signatures, vulnerability scanning, locked versions, and a controlled CI/CD path. Never-updating leaves known holes in place; unaudited unsigned pulls maximize insertion risk. CISP software-security content treats third-party code as part of the trusted computing base.

Question 45Network boundaries and protected communication

What is the PRIMARY purpose of a network firewall at a security boundary?

  1. To enforce an allowed-traffic policy between network zones and block unauthorized flows Correct answer.
  2. To replace endpoint antivirus on every host
  3. To provide application source-code review
  4. To increase wireless transmit power

Explanation

A firewall mediates traffic using a policy, typically at a regional boundary between trust zones. Packet-filter, stateful, proxy, and next-generation firewalls differ in inspection depth, but all exist to allow authorized flows and deny others. Host antivirus, code review, and RF power are different controls. CISP network-security items place firewalls in boundary protection alongside IDS/IPS.

Question 46Network boundaries and protected communication

A volumetric distributed denial-of-service (DDoS) attack is intended to harm which CIA property FIRST?

  1. Availability Correct answer.
  2. Confidentiality of data at rest on an offline tape
  3. Non-repudiation of a paper contract
  4. The physical tamper-evidence of a safe

Explanation

DDoS overwhelms bandwidth, sessions, or application capacity so legitimate users cannot use the service, which is an availability failure. Confidentiality and integrity may be secondary concerns in some attacks, but the defining DDoS goal is to deny service. SYN flood, UDP flood, and HTTP floods are common examples taught in CISP attack-and-defense material.

Question 47Network boundaries and protected communication

How does an intrusion prevention system (IPS) differ from a traditional passive intrusion detection system (IDS)?

  1. An IPS can block or reset malicious traffic in line, while a passive IDS mainly alerts Correct answer.
  2. An IDS always encrypts the attacker’s packets for them
  3. An IPS replaces the need for any firewall policy
  4. A passive IDS can physically lock the data-center door

Explanation

A passive IDS inspects a copy of traffic and generates alerts. An IPS sits in line (or otherwise enforces) and can drop, reset, or quarantine sessions that match malicious patterns. False positives are more dangerous for IPS because they can block legitimate business. Firewalls still enforce zone policy; IPS does not lock doors.

Question 48Network boundaries and protected communication

Which application attack sends crafted input that changes a database query’s structure, for example by appending OR 1=1?

  1. SQL injection Correct answer.
  2. ARP spoofing on a local switch
  3. A cable cut in a fiber duct
  4. A clean-agent fire-suppression discharge

Explanation

SQL injection inserts attacker-controlled fragments into SQL so the database executes a different query, often bypassing authentication or extracting rows. It is an application-layer input-handling failure. Network spoofing, physical cable damage, and fire systems are different incident classes. CISP expects both the attack name and the parameterized-query defense.

Question 49Network boundaries and protected communication

Cross-site scripting (XSS) is BEST described as which attack?

  1. Injecting script that other users’ browsers execute in the context of a vulnerable web application Correct answer.
  2. Guessing a user’s database administrator password by brute force against SSH
  3. Flooding a network with UDP packets to exhaust bandwidth
  4. Degaussing a backup tape

Explanation

XSS delivers attacker script into pages that other users load, so the script runs with the site’s origin privileges in the victim browser. That can steal session cookies, rewrite pages, or perform actions as the user. Defenses include context-aware output encoding, strict Content Security Policy, and avoiding dangerous sinks. It is not a volumetric flood or a physical media attack.

Question 50Network boundaries and protected communication

A stateful inspection firewall differs from a simple stateless packet filter MAINLY because it:

  1. Tracks connection or session state so return traffic can be allowed as part of an established flow Correct answer.
  2. Can only filter on source MAC addresses and never on ports
  3. Must be installed as a userspace application on every laptop
  4. Ignores TCP flags and treats every packet as an independent new connection

Explanation

Stateless filters decide each packet from header fields alone. Stateful inspection keeps a table of allowed connections (for example TCP three-way handshake completion) and permits matching return packets without writing a symmetric any-source rule. That improves both security and manageability at network boundaries. Ignoring state is what a simple packet filter does.