CISSP practice test — think like the risk owner

The ISC2 Code of Professional Ethics lists four canons in priority order, and the first canon, protecting society, the common good, necessary public trust and confidence, and the infrastructure, governs when canons conflict. Acting honorably is the second canon and does not override public safety. Service to principals (the client) is the third canon and is explicitly subordinate to the first two. Advancing the profession is the fourth and lowest-priority canon. Every CrushCert question includes an explanation like this.

Aggregation (and inference) can make a collection more sensitive than its parts, so the compiled dataset must be classified at the level of what it reveals. A dataset does not simply inherit its component classification when the combination creates new sensitive information. Individual shipments being observable does not make the full customer profile public.

With Online Certificate Status Protocol (OCSP) stapling the server periodically obtains a time-stamped, CA-signed status and includes it in the TLS handshake, so clients get fresh revocation data with no extra round trip. Direct OCSP queries add latency and leak browsing activity to the CA. Certificate revocation lists (CRLs) can be large and are poorly suited to per-connection download. Skipping revocation checks leaves clients trusting a compromised certificate.

A low signal-to-noise ratio with adequate signal means the noise floor is high, so the fix is to find the interfering source (motors, microwave units, rogue radios) or move to a cleaner channel. Raising transmit power can worsen co-channel interference elsewhere and does not reduce the noise. A faster access point still contends with the same noise. An additional service set identifier changes nothing about the radio environment.

Access to assets cannot be provisioned, controlled, or reviewed correctly until the organization knows what assets exist and how sensitive they are, so inventory and classification come first. DLP agents and MFA are useful controls, but applied before classification they protect everything equally and may miss what matters most. Copying the parent company's ACLs assumes the new unit's data, roles, and owners are the same, which has not been established.

Backup verification means proving data can be restored, so the meaningful evidence is the outcome of periodic test restores, including whether files were intact and how long recovery took. Job completion logs only show that a copy operation ran, not that the copy is usable. Capacity reports show room exists, not that backups are recoverable. A vendor's durability commitment is a contractual promise rather than measured evidence of the organization's own recovery capability.

The order of volatility directs responders to capture the most short-lived data first: registers and cache, then RAM and network state, then running processes, then disk, and finally backups and archives. Memory contents and process state vanish the moment the system loses power, so they are collected first. A disk image and logs on disk are far less volatile, and backup tapes are the least volatile source of all.

Branch protection with mandatory review and signed commits ensures that no single person can introduce code to the production branch unnoticed and that commit authorship is verifiable. A local linter catches style issues and is easily skipped. More frequent builds would deploy malicious changes faster, not prevent them. Encryption at rest protects confidentiality of the code but does nothing to control what gets merged.

Due diligence before closing lets the acquirer understand the target's risks, liabilities, and control gaps, and factor them into the price and integration plan. Migrating users and applying policies are integration tasks that depend on first knowing the target's posture. Connecting networks before assessment can expose the acquirer to the target's existing compromises and is a common post-acquisition failure.

FIDO2 and WebAuthn credentials sign a challenge that includes the origin of the site the browser is actually on, so a proxy phishing site receives a signature it cannot replay against the real site. TOTP and SMS codes are simply typed by the user and relayed by the adversary-in-the-middle in real time. Number-matching push notifications reduce accidental approvals, but the user still approves a session the attacker initiated through the proxy.