Free CISSP-ISSMP Practice Test

NIST Special Publication 800-50, "Building an Information Technology Security Awareness and Training Program," outlines a four-step program management lifecycle. The first two foundational steps are Program Design and Material Development. Program Design (D) is the initial strategic phase that involves conducting a needs assessment and creating the program plan. Following the design, Material Development (B) is the phase where the actual awareness and training content is created. These two steps are critical as they establish the foundation for the entire program before it can be implemented or its effectiveness can be measured.

A. Awareness and Training Material Effectiveness: This corresponds to the final post-implementation and evaluation phase of the lifecycle, which occurs after the program has been designed, developed, and implemented.
C. Awareness and Training Material Implementation: This is the third step in the lifecycle, focusing on the delivery of the program. It is dependent on the successful completion of the design and development phases.

1. National Institute of Standards and Technology (NIST). (2003). Special Publication (SP) 800-50: Building an Information Technology Security Awareness and Training Program. Section 4, "Awareness and Training Program," pp. 11-15. This section details the four-step lifecycle:

Section 4.1, "Design," states, "The first step in the awareness and training life cycle is to design the program."

Section 4.2, "Development," states, "The second step in the life cycle is to develop the awareness and training materials."

Section 4.3, "Implementation," and Section 4.4, "Post-Implementation," describe the subsequent steps that options A and C refer to.

2. Wilson, M., & Hash, J. (2003). NIST Special Publication 800-84: Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities. Section 3.3, "Training," p. 15. This document references the NIST SP 800-50 model, reinforcing that training programs require a systematic approach starting with design and development of materials tailored to specific roles and responsibilities.

3. University of Washington, Tacoma. Course T INFO 442, "Information Assurance and Cybersecurity." Course materials frequently reference the NIST security awareness program lifecycle, emphasizing the foundational importance of the design and development phases before a program can be implemented and maintained (evaluated).

A maintenance hook, also commonly known as a backdoor, is a hardware or software mechanism intentionally engineered into a system. Developers or administrators install these hooks to bypass normal security controls, such as authentication, for debugging, testing, or maintenance purposes. While intended for legitimate use, they represent a significant architectural vulnerability because if discovered by an attacker, they provide a direct, unauthorized path into the system, circumventing all established security protections.

B. Lack of parameter checking: This is a common software implementation flaw where input is not validated, leading to vulnerabilities like buffer overflows, not an intentionally installed bypass mechanism.
C. Time of Check to Time of Use (TOC/TOU) attack: This is a race condition vulnerability that exploits the time delay between a security check and the use of a resource, not a pre-installed maintenance feature.
D. Covert channel: This is an unintended communication path that violates security policy to exfiltrate information, not a mechanism designed for system maintenance.

1. National Institute of Standards and Technology (NIST). (2021). Glossary of Terms. Computer Security Resource Center (CSRC). Retrieved from https://csrc.nist.gov/glossary/term/backdoor.

Reference Detail: The NIST Glossary defines a "Backdoor" as "A mechanism for bypassing a security mechanism in a system, network, or application." The term "maintenance hook" is a well-established synonym for a backdoor created for maintenance purposes.

2. Anderson, R. J. (2008). Security Engineering: A Guide to Building Dependable Distributed Systems (2nd ed.). Wiley.

Reference Detail: Chapter 24, "System-on-Chip Security," discusses how hardware maintenance interfaces like JTAG can act as powerful backdoors if left unsecured, fitting the description of a hardware-based maintenance hook.

3. Pfleeger, C. P., & Pfleeger, S. L. (2003). Security in Computing (3rd ed.). Prentice Hall.

Reference Detail: Chapter 4, "Programs and Programming," discusses "Salami attacks, trapdoors, and other tricks." A trapdoor (or backdoor) is explicitly described as a secret entry point into a program, allowing circumvention of normal security procedures, often left by the original programmer for testing or maintenance.

4. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE, 63(9), 1278–1308. https://doi.org/10.1109/PROC.1975.9939

Reference Detail: Section I.A.4, "Design Principles," discusses the principle of "Open Design." The paper implicitly warns against security through obscurity, which is the principle that maintenance hooks and backdoors rely on. It highlights that the system's security should not depend on the secrecy of its implementation, which these hooks violate.

The unauthorized sharing of an individual's collected personal and financial information with a third party is a direct violation of privacy principles. Privacy laws govern how organizations collect, use, disclose, and manage personally identifiable information (PII). In many jurisdictions, specific regulations like the Gramm-Leach-Bliley Act (GLBA) in the U.S. require financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. Disclosing Mark's details to another company without a proper legal basis, such as explicit consent, violates his right to privacy.

A. Copyright law: Protects original works of authorship, such as software, books, and artistic creations, not an individual's personal data.
B. Trademark law: Protects brand identifiers like names, symbols, and logos used in commerce, which is unrelated to customer data.
D. Security law: Pertains to the implementation of safeguards to protect data from unauthorized access or breach, not the improper but authorized sharing of data.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (Special Publication 800-53, Revision 5). In Appendix J, "Privacy Control Catalog," NIST defines privacy risks as arising from the "collection, storage, use, and dissemination of PII," which directly aligns with the scenario. The act of sharing data is a dissemination issue governed by privacy principles.

2. Gramm-Leach-Bliley Act (GLBA). (1999). 15 U.S.C. §§ 6801-6809. This U.S. federal law requires financial institutions—companies that offer consumers financial products or services like loans, financial or investment advice, or insurance—to explain their information-sharing practices to their customers and to safeguard sensitive data. The "Financial Privacy Rule" (15 U.S.C. §§ 6801-6809) specifically restricts when a financial institution may disclose a consumer's nonpublic personal information (NPI) to nonaffiliated third parties.

3. Solove, D. J., & Schwartz, P. M. (2014). Information Privacy Law (5th ed.). Wolters Kluwer. This academic legal textbook extensively covers the distinction between privacy and security. On page 2, it clarifies that privacy is about "the appropriate use of personal information," while security is about "protecting information from unauthorized access." The company's action is an issue of inappropriate use/disclosure.

4. United States Copyright Office. (n.d.). What is Copyright? Retrieved from copyright.gov. Circular 1, "Copyright Basics," Section "What Works Are Protected," explicitly lists literary, dramatic, musical, and artistic works. Personal data is not included in this scope.

The definition provided in the question is the standard legal and business definition of a trade secret. A trade secret encompasses confidential business information, such as a formula, process, or compilation of data, that provides an enterprise with a competitive edge. Its protection is contingent on the information remaining confidential and the owner taking reasonable steps to maintain its secrecy. Unlike patents, trade secrets are not registered with a government body and can be protected indefinitely as long as they are not publicly disclosed.

A. Utility model: A utility model is a publicly registered intellectual property right for an invention, which requires disclosure, contradicting the "not generally known" criterion of the question.
B. Cookie: A cookie is a standard piece of web technology used for session management and tracking; it is not, by itself, a secret business process or formula.
C. Copyright: Copyright protects the specific expression of an idea (e.g., source code, a document) rather than the underlying secret idea, process, or method itself.

1. United States Code, Title 18, Section 1839(3). The Defend Trade Secrets Act defines a "trade secret" as information including "patterns, plans, compilations, program devices, formulas, designs... methods, techniques, processes..." where the owner has taken reasonable measures to keep it secret and the information derives economic value from not being generally known.

2. World Intellectual Property Organization (WIPO). (n.d.). Trade Secrets. WIPO defines trade secrets as "IP rights on confidential information which may be sold or licensed... The subject matter of trade secrets is usually defined in broad terms and includes... any confidential business information which provides an enterprise a competitive edge."

3. Lemley, M. A. (2008). The Surprising Virtues of Treating Trade Secrets as IP Rights. Stanford Law Review, 61(2), 311-352. In the introduction (p. 313), the article discusses the nature of trade secrets as information that "derives independent economic value... from not being generally known" and is subject to reasonable efforts to maintain secrecy, aligning with the question's definition. (Available via Stanford Law School).

4. Cornell Law School Legal Information Institute (LII). Trade Secret. The LII defines a trade secret as "any practice or process of a company that is generally not known outside of the company. Information considered a trade secret gives the company a competitive advantage over its competitors."

In Configuration Management (CM), a variant is a Configuration Item (CI) that shares the same core functionality as another CI but differs in specific, non-functional attributes. Variants are created to support different environments, platforms, or customer requirements while originating from a common baseline. For example, a software application might have variants for the Windows and macOS operating systems. Both variants perform the same essential functions but are compiled and packaged differently to run on their respective platforms. This concept allows for the parallel management of similar, but not identical, CIs.

A. A CI that has the same name as another CI but shares no relationship. This describes a naming conflict or a data integrity issue within the Configuration Management Database (CMDB), not the specific CM concept of a variant.
B. A CI that particularly refers to a hardware specification. A hardware specification is an attribute or a type of CI. While a piece of hardware can have variants (e.g., with different processors), this option does not define the relationship itself.
D. A CI that particularly refers to a software version. A version typically represents a sequential, temporal evolution of a CI (e.g., v1.0 followed by v1.1). A variant represents a parallel divergence from a baseline, not a successor. ---

1. Conradi, R., & Westfechtel, B. (1998). Version models for software configuration management. ACM Computing Surveys (CSUR), 30(2), 232–282. In Section 2.1, "Basic Terminology," a variant is defined as "one of two or more objects that are functionally equivalent, but differ in non-functional properties (e.g., the underlying hardware/software platform)." This directly supports the correct answer. (DOI: https://doi.org/10.1145/280277.280280)

2. Crnkovic, I., Asklund, U., & Dahlqvist, A. P. (2003). Implementing and Integrating Software Configuration Management. Artech House. In Chapter 2, "Basic SCM Concepts," the authors distinguish between revisions (historical) and variants (parallel), stating that variants "are developed in parallel for different customers or for different platforms." This aligns with the concept of having the same essential functionality with minor differences.

3. University of Waterloo. (n.d.). ECE 452: Real-Time Operating Systems - Lecture 10: Software Development Process. Courseware. In the section on Configuration Management, a variant is described as "a version for a different platform," which exemplifies a CI with the same core function but differing in a specific manner.

The core concern is that a single individual could unilaterally compromise the network by creating an unauthorized remote access point. Separation of duties is the most effective control to mitigate this specific risk. This principle ensures that no single person has the authority and capability to execute a critical task from start to finish. By requiring two or more individuals to complete the process of configuring and enabling remote access (e.g., one to configure, another to approve and activate), the organization prevents unilateral actions and reduces the risk of fraud or error by a single person.

B. Implement RBAC: Role-Based Access Control (RBAC) assigns permissions based on job roles. While it organizes access, it does not prevent a single individual within a privileged role from misusing their authorized permissions.
C. Implement three way authentication: This refers to multi-factor authentication, which strengthens user identity verification for logging in. It does not prevent an already authenticated and authorized administrator from misconfiguring the system.
D. Implement least privileges: This principle limits a user's access to the minimum required for their job. However, a network administrator's "least privilege" would likely still include the ability to configure remote access, not preventing its misuse.

1. National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations.

Control AC-5, Separation of Duties: "Separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion. The organization separates duties of individuals to ensure that no single individual can control all aspects of a process or transaction and to prevent errors and fraudulent or malicious activity." (Page 121) This directly supports the choice of Separation of Duties for preventing unilateral actions.

2. Purdue University, The CERIAS Security Policy Manual.

Section on Separation of Duties: "Separation of duties is the concept of having more than one person required to complete a task. In business, this is achieved by dividing a task among two or more people. This is an internal control intended to prevent fraud and error." This academic source reinforces that the principle is designed to prevent the exact scenario described in the question.

3. Ross, R., McEvilley, M., & Oren, J. C. (2016). Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems. NIST Special Publication 800-160, Vol. 1.

Appendix F, F.3.1 Access Control: This document discusses the relationship between controls. It implicitly differentiates Least Privilege (limiting permissions) from Separation of Duties (dividing responsibilities for a process), stating, "Separation of duty policies can be used to mitigate the risk of a single user, acting alone, from performing a malicious act." (Page F-5)

The scenario describes the practice of "turning employees among numerous job positions" as a method to improve security. This is the definition of job rotation, an administrative control designed to prevent and detect fraudulent or malicious activities by a single individual. By moving employees through different roles, the organization limits the time any one person has exclusive control over sensitive functions, making it more difficult to conceal unauthorized actions. It also serves as a detective control, as the next person in the role may uncover irregularities.

B. Job responsibility: This defines the duties and tasks of a specific role but does not involve the movement of personnel between different roles for security purposes.
C. Screening candidates: This is a pre-employment control to verify the background and qualifications of potential hires, not a control applied to existing employees by moving them between jobs.
D. Separation of duties: This is a preventive control that divides a critical task among multiple individuals to ensure no single person can execute it alone. Job rotation complements this but is a distinct practice.

1. (ISC)² CISSP CBK Reference, 6th Edition. In Domain 1: Security and Risk Management, the section on "Personnel Security Policies and Procedures" describes job rotation (or rotation of duties) as a control to limit the amount of time an individual can work in a specific, sensitive position. It is identified as both a deterrent and a detective control. (Specifically covered in the personnel security section).

2. NIST Special Publication 800-12 Rev. 1, An Introduction to Information Security. Section 4.3.2, "Operational Controls," discusses controls implemented and executed by people. Job rotation is a classic example of an operational/administrative control used to reduce the risk of fraud and system abuse.

3. Whitman, M. E., & Mattord, H. J. (2019). Principles of Information Security (6th ed.). Cengage Learning. Chapter 5, "Planning for Security," details personnel security policies. It defines job rotation as "the requirement that every employee be able to perform the work of another employee." It further explains that this practice can help uncover fraud and collusion.

4. Von Solms, R., & Van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97-102. This academic article discusses the evolution of security controls. It implicitly supports the use of traditional administrative controls like job rotation and separation of duties as foundational elements of a robust cybersecurity program. DOI: https://doi.org/10.1016/j.cose.2013.04.004

The scenario describes a classic conflict of interest. A conflict of interest arises when an individual's personal interests—in this case, a familial relationship—could potentially compromise their professional judgment or duty. The project manager has a fiduciary responsibility to act in the best interest of the project and the organization, which includes impartial vendor selection based on merit (e.g., price, quality). The relative's request creates a competing personal interest that could improperly influence this professional obligation. According to professional ethics, such as the ISC2 Code of Ethics, this situation must be disclosed to the appropriate parties to ensure transparency and fair dealing.

B. Bribery: This is incorrect because bribery involves the offering, soliciting, or receiving of something of value to influence an action. The scenario only mentions a request for a "favor."
C. Illegal practice: A conflict of interest is an ethical issue and is not inherently illegal. It only becomes illegal if it violates specific laws (e.g., anti-corruption statutes) or leads to illegal acts.
D. Irresponsible practice: While failing to manage a conflict of interest is irresponsible, the term "conflict of interest" is the specific and precise description of the ethical situation itself.

1. ISC2 Code of Professional Ethics: The code mandates ethical conduct. The canon to "Act honorably, honestly, justly, responsibly, and legally" implicitly covers avoiding and disclosing conflicts of interest. The guidance for this canon often includes the need to "Disclose to appropriate parties any conflicts of interest." (Source: ISC2, Inc., ISC2 Code of Professional Ethics, Canon I).

2. Davis, M. (2014). "Conflict of Interest". In E. N. Zalta (Ed.), The Stanford Encyclopedia of Philosophy (Winter 2014 ed.). Metaphysics Research Lab, Stanford University. This source defines a conflict of interest as "a set of conditions in which professional judgment concerning a primary interest (such as a patient’s welfare or the validity of research) tends to be unduly influenced by a secondary interest (such as financial gain)." The family relationship represents a secondary interest.

3. Project Management Institute (PMI). (2017). Code of Ethics and Professional Conduct. While from PMI, its principles are universally applicable to professional management roles like the ISSMP. Section 3.3.1 states, "We inform ourselves about and uphold the policies, rules, regulations and laws that govern our work, professional, and volunteer activities." Section 3.3.3 requires practitioners to "Proactively and fully disclose any real or potential conflicts of interest to the appropriate stakeholders."

The Data Owner is a senior-level management role with ultimate responsibility for a specific data asset. Their primary duties are governance-focused, not technical. This includes determining the data's value and sensitivity to assign an appropriate classification level (A). They are accountable for the data's protection but delegate the day-to-day technical implementation of security controls, such as backups and access control management, to a Data Custodian (B). As business needs and the data's context evolve, the owner must periodically review and adjust the classification to ensure it remains accurate and relevant (C).

D. Running regular backups and routinely testing the validity of the backup data. This is a technical, operational task. It is the responsibility of the Data Custodian, who implements and manages the security controls mandated by the Data Owner. ---

1. National Institute of Standards and Technology (NIST) Special Publication 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations. Appendix D, "Roles and Responsibilities," defines the Information/Data Owner as being responsible for "establishing the rules for appropriate use and protection of the subject information/data (e.g., rules of behavior)," which encompasses classification (A), and "providing input...regarding the security requirements" which are then implemented by others (implying delegation, B).

2. University of California, Berkeley, Information Security Office, Roles and Responsibilities Policy. Section III, "Definitions," outlines the responsibilities. The "Data Proprietor (Owner)" is responsible for "assigning the initial classification to their data" (A), "periodically reviewing classification and access privileges" (C), and may "delegate day-to-day management to a Data Custodian" (B). The policy explicitly assigns "backing up data in their charge" to the Data Custodian role, making (D) an incorrect choice for the owner.

3. EDUCAUSE, Data Governance Toolkit. The toolkit's section on "Roles and Responsibilities" describes the Data Owner as a "senior university official" who has "policy-level responsibility for controlling access to and use of a particular institutional data element." This high-level responsibility includes classification and policy setting, while the Data Custodian is defined as having "operational-level responsibility for the management and security of institutional data," including tasks like backups. This aligns with A, B, and C being owner responsibilities and D being a custodian responsibility.

From a formal project management and systems engineering perspective, a project should have a single, integrated change control system. This system consists of the processes, tools, and procedures used to manage, review, approve, and document all changes to project baselines (e.g., scope, schedule, cost). The purpose of having one integrated system is to ensure that all changes are evaluated consistently for their impact across the entire project, preventing uncoordinated and unapproved modifications. The system itself is a singular, cohesive framework for a given project or organization.

A. 3: This number does not correspond to a standard, recognized classification of change control systems or their core functions within official project management frameworks.
B. 4: This is incorrect as there is only one integrated system. This option likely arises from a common confusion with the four primary components of a Configuration Management System (CMS): 1) Identification, 2) Control, 3) Status Accounting, and 4) Audit. Change control is a key part of the 'Control' component.
C. 2: This number does not align with any standard categorization of change control systems in authoritative project management or security management literature.

1. Project Management Institute (PMI). A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition. Newtown Square, PA: Project Management Institute, 2017.

Section 4.6, "Perform Integrated Change Control," describes this as a singular process for reviewing all change requests and managing changes to deliverables and project documents. It does not enumerate multiple types of systems but rather one integrated approach.

2. International Organization for Standardization (ISO). ISO 21500:2012, Guidance on project management.

Section 4.3.10, "Control changes," describes a single, consistent process for managing changes. The standard advocates for one defined procedure, stating, "All change requests should be recorded and then assessed, and the decision to approve, reject or defer the request should be communicated to all affected stakeholders." This implies a singular system.

3. Pankratz, G. Systems Engineering and Management for Sustainable Development Volume 1. Karlsruhe, Germany: Karlsruher Institut für Technologie (KIT) Scientific Publishing, 2012.

Page 111, Section 4.2.2, "Configuration Management," details the four classic functions of a Configuration Management System as "Configuration Identification," "Configuration Control," "Configuration Status Accounting," and "Configuration Audits." This source supports the reasoning for why the number '4' is a common but incorrect answer to the question asked.