A company is developing a web application that will be used by customers. The application will store sensitive customer data. The security team wants to implement session management to prevent session hijacking. Which control is most effective?

Use a single sign-on (SSO) solution to reduce the number of sessions.

Implement secure session management with random session IDs, secure cookies, and binding the session to the user's IP address.

Use HTTPS to encrypt all traffic between the client and server.

Use a short session timeout and require re-authentication for sensitive actions.

A company issues laptops to employees who work remotely. The laptops contain sensitive client data. The company wants to ensure that if a laptop is lost or stolen, the data cannot be accessed, and the device can be rendered unusable. Which control is most effective for this scenario?

Enable full-disk encryption (FDE) on all laptops and implement a remote wipe capability.

Install tracking software that can locate the laptop via GPS.

Require a strong BIOS password on each laptop.

Use a cable lock to physically secure the laptop when in use.

A company is designing a new office building. The security team wants to implement physical access control that can adapt to different security levels for different areas. For example, the lobby should be accessible to the public, the main office area to employees, and the server room to a select few. Which physical access control approach is most appropriate?

Use a security guard at the main entrance and rely on them to check credentials for all areas.

Use biometric readers for all areas, regardless of security level.

Use physical keys for each area, with different keys for different employees.

Use a single electronic access control system with different reader types and permissions for each area.

A company is deploying a new web application for internal use. The security team wants to ensure that users are who they claim to be, that they can only perform actions they are authorized to do, and that all actions are recorded for later review. Which set of controls should be implemented?

Use multi-factor authentication (MFA) for login, and configure the application to log all user actions with timestamps and user IDs.

Implement role-based access control (RBAC) to define permissions, and require MFA for all users.

Implement single sign-on (SSO) with SAML, and enable detailed logging of user activity.

Implement MFA for authentication, RBAC for authorization, and comprehensive audit logging of all user actions.

Certified Information Systems Security Professional

Domain 5Objective 1

5.1 - Control Physical and Logical Access to Assets CISSP Practice Questions (Page 3)

Part of the Identity and Access Management (IAM) domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 2–3 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

13%of the exam

Questions 11–15

11expert · medium
A company is developing a web application that will be used by customers. The application will store sensitive customer data. The security team wants to implement session management to prevent session hijacking. Which control is most effective?
Select an answer first
12application · medium
A company issues laptops to employees who work remotely. The laptops contain sensitive client data. The company wants to ensure that if a laptop is lost or stolen, the data cannot be accessed, and the device can be rendered unusable. Which control is most effective for this scenario?
Select an answer first
13foundation · medium
Which physical security control is specifically used to verify an individual's identity based on a unique biological characteristic?
Select an answer first
14expert · medium
A company is designing a new office building. The security team wants to implement physical access control that can adapt to different security levels for different areas. For example, the lobby should be accessible to the public, the main office area to employees, and the server room to a select few. Which physical access control approach is most appropriate?
Select an answer first
15application · medium
A company is deploying a new web application for internal use. The security team wants to ensure that users are who they claim to be, that they can only perform actions they are authorized to do, and that all actions are recorded for later review. Which set of controls should be implemented?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.

5.1 - Control Physical and Logical Access to Assets CISSP Practice Questions (Page 3)

Questions 11–15

A company is developing a web application that will be used by customers. The application will store sensitive customer data. The security team wants to implement session management to prevent session hijacking. Which control is most effective?

A company issues laptops to employees who work remotely. The laptops contain sensitive client data. The company wants to ensure that if a laptop is lost or stolen, the data cannot be accessed, and the device can be rendered unusable. Which control is most effective for this scenario?

Which physical security control is specifically used to verify an individual's identity based on a unique biological characteristic?

A company is deploying a new web application for internal use. The security team wants to ensure that users are who they claim to be, that they can only perform actions they are authorized to do, and that all actions are recorded for later review. Which set of controls should be implemented?

Keep studying — Identity and Access Management (IAM)