CISSP Security Practice

Security and Risk Management covers governance, risk, compliance, ethics, and business continuity planning.

Least privilege limits access to the minimum required for legitimate work.

Detective controls such as monitoring and alarms identify incidents after or during an event.

Risk assessment evaluates threats, vulnerabilities, and impact so organizations can choose appropriate responses.

Residual risk is the leftover risk after mitigation; management must accept, avoid, transfer, or continue to mitigate it.

A policy is high-level direction from management; procedures, standards, and guidelines support it.

Separation of duties splits sensitive tasks among multiple people so no one person can act alone.

Defense in depth uses overlapping controls so failure of one layer does not expose the asset.

Confidentiality ensures only authorized parties can access sensitive data. It prevents unauthorized disclosure through controls such as encryption and access permissions. Availability keeps systems accessible, integrity prevents unauthorized modification, and authentication verifies identity, so confidentiality is the goal that directly matches the question.

Integrity protects data from unauthorized alteration and verifies it is accurate and trustworthy.

Availability means systems and data are accessible when needed, supported by redundancy and recovery controls.

Authentication confirms who the user is; authorization then determines what the user may do.

Authorization assigns access based on policy after identity has been verified.

Digital signatures provide non-repudiation by linking a signed message to a specific private key holder.

Cryptography provides confidentiality, integrity, authentication, and non-repudiation. Encryption protects data from disclosure, hashes detect modification, digital signatures verify senders, and key-based systems support these goals. It does not replace identity management, eliminate every attack, or improve network speed.

Symmetric algorithms such as AES use one shared secret key for both operations.

Anyone can encrypt with the recipient public key, but only the recipient private key can decrypt it.

A hash creates a fixed-size fingerprint so changes to data can be detected.

Firewalls inspect packets and allow or block traffic according to policy.

VLANs isolate traffic at Layer 2 and can reduce attack surface without changing physical wiring.

TLS encrypts web traffic and is used by HTTPS to protect data in transit.

A VPN encrypts traffic between a remote user and the network, protecting data in transit.

A DMZ sits between trusted and untrusted networks and contains public-facing services.

Asset Security covers classification, ownership, retention, and secure handling of data.

IAM combines identity lifecycle, authentication, authorization, and auditing controls. It manages who users are, what they may access, and how actions are recorded, usually through policies and role assignments. A firewall, encryption method, or backup service addresses only one part of security rather than the full identity and access framework.

Directory services such as Active Directory centralize identity information and access policies.

Knowledge factors include passwords, PINs, and answers to security questions.

Possession factors include smart cards, tokens, phones, and hardware keys.

Inherence factors use biometric traits such as fingerprints, face, or iris patterns.

SSO improves usability by letting one authenticated session work across trusted applications.

MFA combines categories such as knowledge, possession, and inherence to strengthen authentication.

Privileged access management limits, rotates, and audits privileged credentials. It reduces risk by giving administrators only the elevated access they need and by monitoring how that access is used. Deleting all admin accounts breaks operations, giving every user admin rights increases risk, and blocking remote access is not the purpose of PAM.

A SIEM collects security events from many sources and helps analysts detect incidents.

SOAR stands for Security Orchestration, Automation, and Response. It connects security tools and automates response workflows so teams can handle alerts faster and consistently. The other options expand the letters differently and are not the standard industry definition.

Vulnerability scans identify missing patches and misconfigurations without confirming exploitation.

Penetration testing goes beyond scanning by attempting to exploit vulnerabilities and validate impact.

Containment isolates affected systems to stop damage before eradication and recovery.

BCP focuses on continuing essential business processes, while DRP focuses on IT recovery.

DRP defines recovery objectives, priorities, and procedures for technology after disruption.

Validating input and using parameterized queries prevent attackers from injecting malicious commands.

The CIA triad is confidentiality, integrity, and availability. Authentication supports access control but is not one of the three objectives.

DAC, MAC, and RBAC are access control models. HTTP is a network protocol.

Common factor categories include knowledge, possession, inherence, and location. Knowledge is something you know, possession is something you have, inherence is something you are, and location can be a contextual factor. All four are recognized categories, so every option is correct.

AES, 3DES, and Blowfish are symmetric. RSA is an asymmetric algorithm.

RSA, ECC, and Diffie-Hellman are asymmetric. Asymmetric algorithms use a public key and a private key pair for encryption and digital signatures. AES is a symmetric algorithm that uses one shared secret key, so it does not belong in the asymmetric group.

Preparation, detection, containment, eradication, recovery, and lessons learned are common incident response phases.

Input validation, least privilege, and secure defaults reduce vulnerabilities. Skipping tests increases risk.

Confidentiality restricts access to authorized users only; availability is the goal that keeps systems accessible.

A vulnerability is a weakness, while an exploit is a technique or tool that takes advantage of a vulnerability.

Residual data on old media can leak information, so sanitization or destruction is required.

Symmetric algorithms are typically faster, which is why hybrid systems use asymmetric keys to exchange symmetric session keys.

Least privilege grants only the access users need, and administrative rights are tightly controlled.

Integrity ensures data remains accurate and unchanged by unauthorized parties.

Authentication verifies identity before authorization grants access. The user proves who they are with credentials such as a password, token, or biometric. After identity is confirmed, authorization decides what resources that user may use, and auditing records the activity.

A VPN creates a secure encrypted tunnel for remote access.

RBAC assigns permissions through roles, simplifying administration for large user populations.

The DRP defines recovery objectives and procedures after a disruptive event.

Preventive controls stop incidents, detective controls find them, and corrective controls repair damage.

AES is symmetric, RSA is asymmetric, and hashes verify integrity.

Authentication verifies identity, authorization grants rights, and auditing provides accountability.