Chapitre 25
Examen blanc
n° 1

Who is ultimately responsible for the security of an organization's information?

1. The CISO
2. Senior management
3. The security operations team
4. Each user

In Bell-LaPadula, the star (*) property enforces which rule?

1. No read up
2. No write down
3. No read down
4. No write up

Which port does LDAPS use?

1. 389
2. 443
3. 636
4. 3389

During evidence collection on a running system, what should be captured FIRST?

1. The hard drive
2. RAM and registers/cache
3. Backup tapes
4. Remote archives

Which method is appropriate to sanitize a solid-state drive?

1. Degaussing
2. Cryptographic erasure or physical destruction
3. A single quick format
4. Moving files to the recycle bin

Which biometric error is most serious from a security standpoint?

1. False rejection (Type I)
2. False acceptance (Type II)
3. Enrollment delay
4. Low throughput

Which report proves a provider's controls operated effectively over the past year?

1. SOC 2 Type I
2. SOC 2 Type II
3. SOC 3
4. A marketing whitepaper

Which is the MOST effective defense against SQL injection?

1. Hiding the DB version
2. Parameterized queries and input validation
3. Renaming tables
4. Disabling the firewall

A company researches risks thoroughly but implements no controls, then suffers a breach. Which is accurate?

1. Due care but not due diligence
2. Due diligence but not due care
3. Both
4. Neither is relevant

A firewall crashes. Which failure mode protects the network's assets?

1. Fail-open
2. Fail-closed
3. Fail to allow-all
4. Display debug info

Which attack forges ARP replies to intercept LAN traffic?

1. SYN flood
2. ARP poisoning
3. VLAN hopping
4. Smurf

What is the correct order of the first three ISC2 incident steps?

1. Response, detection, recovery
2. Detection, response, mitigation
3. Mitigation, detection, response
4. Reporting, detection, response

Under GDPR, a breach must be reported to the supervisory authority within what timeframe?

1. 24 hours
2. 48 hours
3. 72 hours
4. 30 days

Which combination is TRUE multi-factor authentication?

1. Password + security question
2. Two passwords
3. Password + hardware token code
4. PIN + passphrase

Which algorithm provides RSA-equivalent strength with much shorter keys?

1. 3DES
2. ECC
3. MD5
4. Blowfish

A vulnerability scan differs from a penetration test in that a scan:

1. Exploits weaknesses
2. Identifies weaknesses without exploiting them
3. Is always manual
4. Requires no authorization

Who is responsible for classifying data?

1. The database administrator
2. The data owner
3. The CISO
4. The auditor

A full backup on Sunday plus daily incrementals: how many sets restore Thursday?

1. 2
2. 5
3. 1
4. 7

Which VPN protocol is obsolete due to weak encryption?

1. IPsec
2. PPTP
3. SSL/TLS VPN
4. L2TP/IPsec

What does the "A" in ACID stand for?

1. Availability
2. Atomicity
3. Authentication
4. Access

A CISSP's client asks her to hide a breach that endangers the public. Which canon prevails?

1. Serve the client diligently
2. Protect society and the infrastructure
3. Advance the profession
4. Preserve confidentiality

Which TPM capability releases a key only if the boot measurements match?

1. Binding
2. Sealing
3. Escrow
4. Remote wipe

OAuth 2.0 is fundamentally a protocol for what?

1. Authentication
2. Authorization
3. Encryption
4. Auditing

Which DR test carries the most risk and requires management approval?

1. Checklist
2. Tabletop
3. Parallel
4. Full interruption

A control costs $10,000/year to prevent an ALE of $2,000. What is BEST?

1. Implement it for due diligence
2. Accept the risk
3. Transfer via insurance and implement
4. Reject the assessment

At which OSI layer does a router operate?

1. Layer 2
2. Layer 3
3. Layer 4
4. Layer 7

Which fire suppression agent is banned for ozone depletion?

1. FM-200
2. Inergen
3. Halon
4. CO₂

In a gray box penetration test, the tester has:

1. No information
2. Partial knowledge
3. Complete knowledge
4. Only source code

Under GDPR, which technique takes data entirely out of scope?

1. Pseudonymization
2. True anonymization
3. Encryption with escrow
4. Masking

Which malware propagates across a network without a host file?

1. Virus
2. Worm
3. Trojan
4. Logic bomb

Which threat modeling framework maps six threat categories to six properties?

1. PASTA
2. STRIDE
3. DREAD
4. Trike

Which access control model lets the resource owner decide access?

1. MAC
2. DAC
3. RBAC
4. ABAC

Which mode of DES should never be used because patterns show through?

1. CBC
2. ECB
3. CTR
4. OFB

Which vulnerability exploits the gap between check and use?

1. Buffer overflow
2. TOCTOU race condition
3. SQL injection
4. CSRF

Which cloud control is stateful and applied to an instance?

1. Network ACL
2. Security group
3. VLAN
4. VXLAN

Which is the most dangerous scan result?

1. False positive
2. False negative
3. True positive
4. True negative

Which recovery site activates in minutes but costs the most?

1. Cold
2. Warm
3. Hot
4. Reciprocal

How long does patent protection last?

1. Life + 70 years
2. 20 years from filing
3. 10 years renewable
4. Indefinitely

A digital signature is created by encrypting what with the sender's private key?

1. The whole message
2. The message hash
3. The recipient's public key
4. A session key

In Kerberos, what is issued after initial authentication?

1. A service ticket
2. A TGT
3. An ACL
4. A certificate

Which Wi-Fi security introduces SAE?

1. WEP
2. WPA
3. WPA2
4. WPA3

Which data state is hardest to protect?

1. At rest
2. In transit
3. In use
4. In escrow

Which control is DETECTIVE and reveals fraud?

1. Encryption
2. Mandatory vacations
3. A firewall
4. Least privilege

SLE × ARO equals what?

1. EF
2. ALE
3. AV
4. MTD

Which code review method follows six formal steps?

1. Pair programming
2. Fagan inspection
3. Fuzzing
4. Regression testing

Which model uses well-formed transactions and the access triple?

1. Bell-LaPadula
2. Biba
3. Clark-Wilson
4. Brewer-Nash

Reading an access matrix by column (per object) gives what?

1. A capability table
2. An ACL
3. A security label
4. A role

Which device separates broadcast domains?

1. Hub
2. Layer 2 switch
3. Router
4. Repeater

What protects against a COTS vendor going out of business?

1. Source code escrow
2. A firewall
3. A honeypot
4. A VPN

Which suppression system is preferred in data centers to avoid accidental water damage?

1. Wet pipe
2. Dry pipe
3. Pre-action
4. Deluge

Which document is advisory rather than mandatory?

1. Standard
2. Baseline
3. Guideline
4. Procedure

Which EAL corresponds to "methodically designed, tested, and reviewed"?

1. EAL2
2. EAL4
3. EAL6
4. EAL7

Which technology is specifically designed to resist phishing?

1. SMS codes
2. Security questions
3. FIDO2 / passkeys
4. Static passwords

CVSS provides what?

1. A unique vulnerability identifier
2. A severity score from 0 to 10
3. A firewall rule
4. An algorithm

Which converged protocols support VoIP?

1. SIP and RTP/SRTP
2. FCoE and iSCSI
3. DNP3 and Modbus
4. SMTP and IMAP

When returning to the primary site, which functions move back FIRST?

1. The most critical
2. The least critical
3. All at once
4. Only the database

Which term describes residual data after deletion?

1. Retention
2. Data remanence
3. Replication
4. Aggregation

Which risk response is buying cybersecurity insurance?

1. Mitigation
2. Avoidance
3. Transference
4. Acceptance

Which IPsec component provides encryption?

1. AH
2. ESP
3. IKE only
4. SOCKS

What is the degree of a relation?

1. Number of rows
2. Number of columns
3. Number of tables
4. Number of keys

What does OIDC add to OAuth 2.0?

1. A hardware token
2. An authentication layer (id_token)
3. A firewall
4. A vault

Which RFC 1918 range is valid?

1. 169.254.0.0/16
2. 172.16.0.0/12
3. 127.0.0.0/8
4. 224.0.0.0/4

Which technology correlates logs across the organization?

1. SOAR
2. SIEM
3. IDS
4. DNS

Which auditor characteristic is fundamental?

1. Reports to the audited team
2. Independence from the audited function
3. Also administers the systems
4. Owns the assets

Which principle states security should not depend on algorithm secrecy?

1. Kerckhoffs's principle
2. Least privilege
3. Defense in depth
4. Separation of duties

Which is the FIRST phase of the BCP?

1. BIA
2. Continuity planning
3. Project scope and planning
4. Approval and implementation

Which classification level maps to "exceptionally grave damage"?

1. Secret
2. Top Secret
3. Confidential
4. Unclassified

Which control grants admin rights only for the duration of a task?

1. Permanent admin accounts
2. Just-in-time elevation
3. Shared root
4. Disabling MFA

Which firewall architecture uses two firewalls with a buffer zone?

1. Screened host
2. Screened subnet (DMZ)
3. Single-homed
4. Router only

What is a legal hold?

1. An encryption method
2. A suspension of destruction for relevant data
3. A backup rotation
4. A firewall rule

Which defense best mitigates XSS?

1. Output encoding and CSP
2. Longer passwords
3. Disabling cookies
4. Degaussing

Which standard certifies an ISMS?

1. ISO 27002
2. NIST 800-53
3. ISO 27001
4. CIS Controls

Which is the recommended humidity range for a data center?

1. 10–20%
2. 40–60%
3. 70–90%
4. Below 10%

Which attack tries one common password against many accounts?

1. Brute force
2. Password spraying
3. Credential stuffing
4. Rainbow table

Which team makes red and blue collaborate?

1. Purple
2. White
3. Green
4. Gold

Which is the correct TCP handshake?

1. ACK, SYN, SYN/ACK
2. SYN, SYN/ACK, ACK
3. SYN, ACK, FIN
4. SYN/ACK, SYN, ACK

Enticement is legal; entrapment is:

1. Also legal
2. Illegal, inducing a crime
3. A backup method
4. A honeypot type

Which repository tracks configuration items and their relationships?

1. Data dictionary
2. CMDB
3. Risk register
4. BIA

Which law governs export of dual-use commercial encryption?

1. ITAR
2. EAR
3. FISMA
4. HIPAA

Which memory protection randomizes address layout?

1. DEP
2. ASLR
3. Process isolation
4. Ring 3

Which term describes accumulating rights across role changes?

1. Privilege escalation
2. Privilege creep
3. Separation of duties
4. Break-glass

Which protocol transmits credentials in clear text?

1. CHAP
2. PAP
3. EAP-TLS
4. Kerberos

Which testing analyzes source code without executing it?

1. DAST
2. SAST
3. IAST
4. Fuzzing

Which backup does NOT clear the archive bit?

1. Full
2. Incremental
3. Differential
4. None

Which maturity model is maintained by OWASP for software assurance?

1. CMMI
2. SAMM
3. ITIL
4. COBIT

Which investigation requires "beyond a reasonable doubt"?

1. Administrative
2. Civil
3. Criminal
4. Regulatory

Which RAID level tolerates two simultaneous disk failures?

1. RAID 0
2. RAID 1
3. RAID 5
4. RAID 6

What is the fundamental requirement for accountability?

1. Shared accounts
2. Individual, attributable identities
3. Anonymous access
4. No logging

Which CASB mode works without agents, ideal for BYOD?

1. Forward proxy
2. Reverse proxy
3. Log collection
4. Endpoint DLP

Which document defines the scope and prohibited actions of a pentest?

1. Rules of engagement
2. SLA
3. BIA
4. Incident response plan

Ransomware that also exfiltrates and threatens to publish data uses:

1. Single extortion
2. Double extortion
3. Amplification
4. Spoofing

The most effective protection for unnecessary personal data is to:

1. Encrypt it
2. Not collect it
3. Isolate it
4. Anonymize it later

Which framework added the "Govern" function?

1. NIST CSF 2.0
2. ISO 27001
3. COBIT
4. PCI DSS

Which key encrypts a confidential message to Bob?

1. Alice's private key
2. Alice's public key
3. Bob's public key
4. Bob's private key

Which is the primary concern with SSO?

1. Too many passwords
2. One compromised identity unlocks all services
3. Cannot be cloud-based
4. Disables logging

Which fiber type spans the longest distance?

1. Multimode
2. Single-mode
3. Cat6a
4. Coaxial

Which incident step addresses the root cause?

1. Detection
2. Recovery
3. Remediation
4. Reporting

Which SOC report is public and marketing-oriented?

1. SOC 1
2. SOC 2
3. SOC 3
4. SOC 2 Type I

In relational databases, cardinality is the number of:

1. Columns
2. Rows
3. Tables
4. Keys

Which risk analysis uses anonymous expert consensus?

1. Delphi technique
2. Fagan inspection
3. Monte Carlo
4. Reduction analysis

Which suppression agent is lethal at extinguishing concentrations?

1. FM-200
2. CO₂
3. Water
4. Inergen

Which model uses labels and need-to-know, enforced by the system?

1. DAC
2. MAC
3. RBAC
4. Rule-based

Which protocol secures LDAP queries?

1. LDAP on 389
2. LDAPS on 636
3. Kerberos on 88
4. SMTP on 25

Which metric is the average time between failures?

1. MTTR
2. MTBF
3. MTTF
4. RTO

Which term means adapting a control baseline to the organization?

1. Scoping
2. Tailoring
3. Benchmarking
4. Accreditation

Which duty applies only to a professional's employers and clients?

1. Canon I
2. Canon II
3. Canon III
4. Canon IV

What is the block size of AES?

1. 64 bits
2. 128 bits
3. 256 bits
4. Variable

Which is forward-looking and warns of rising risk?

1. KPI
2. KRI
3. Raw metric
4. ROI

Which EAP method is strongest, using certificates on both sides?

1. LEAP
2. EAP-TLS
3. PAP
4. EAP-MD5

Which attack uses two 802.1Q tags to reach another VLAN?

1. ARP poisoning
2. Double tagging (VLAN hopping)
3. MAC flooding
4. SYN flood

Which order is correct from most to least volatile?

1. Disk, RAM, registers
2. Registers/cache, RAM, swap, disk
3. Archives, disk, RAM
4. RAM, archives, registers

Which is one of the four Agile Manifesto values?

1. Documentation over working software
2. Working software over comprehensive documentation
3. Plan over change
4. Process over people

PCI DSS is BEST described as:

1. A US federal law
2. An EU regulation
3. A contractual obligation
4. A voluntary framework with no enforcement

Which model changes access rights based on prior access history?

1. Bell-LaPadula
2. Biba
3. Brewer-Nash
4. Graham-Denning

Which component enforces the access decision (the "door")?

1. PAP
2. PDP
3. PEP
4. PIP

Which server should be placed in the DMZ?

1. The internal database
2. The public web server
3. The domain controller
4. The backup server

Which activity continuously replays known attack techniques?

1. BAS
2. An annual pentest
3. RUM
4. A vulnerability scan

Which roles apply under GDPR: a retailer decides purposes, a vendor processes?

1. Retailer processor, vendor controller
2. Retailer controller, vendor processor
3. Both joint controllers
4. Vendor is data subject

What must precede any correlation of logs across systems?

1. Encryption
2. Time synchronization (NTP)
3. Compression
4. Deduplication

Which control category are job rotation and mandatory vacations?

1. Technical preventive
2. Administrative detective
3. Physical deterrent
4. Technical corrective

Which attack explains why 2DES is not used?

1. Birthday attack
2. Meet-in-the-middle
3. Rainbow table
4. Downgrade

SAML is BEST described as:

1. An authorization framework for APIs
2. An XML-based federation protocol for enterprise SSO
3. A password vault
4. A firewall protocol

Which practice prevents secrets from entering a code repository?

1. Secrets scanning
2. Load balancing
3. Degaussing
4. Broadcasting the SSID

Who declares a disaster and activates the DR plan?

1. The first technician
2. Management, per defined criteria
3. Any user
4. The backup software

A vulnerability cannot be fixed in time. The correct action is to:

1. Ignore it silently
2. Document a signed exception with compensating controls
3. Shut down the business
4. Delete the finding