CISSP Security and Risk Management — 40 Questions

Question 1

Which THREE of the following are data subject rights under the GDPR? (Select THREE)

Accepted Answer

Right to object to processing. The GDPR grants data subjects specific rights, which include the right to object to processing (Article 21), the right to data portability (Article 20), and the right to erasure (Article 17). The 'Right to data ownership' and 'Right to remuneration' are not recognized GDPR data subject rights.

Answer

Right to rectification

Answer

Right to remuneration

Question 2

A security analyst is evaluating risks using a qualitative matrix. The likelihood is rated as 'high' and the impact as 'medium'. What is the overall risk level typically assigned in a 3x3 matrix?

Accepted Answer

High. Qualitative risk matrices are not universally standardized. For example, in some 3x3 matrices (such as a simple multiplicative 1-3 scale where Low=1, Med=2, High=3), High (3) x Medium (2) equals 6, which falls into the 'Medium' band (typically 4-6). In other frameworks, like NIST SP 800-30, High x Medium maps to 'High'. Because CISSP is a vendor-neutral exam that does not mandate a single proprietary risk matrix layout, this question is highly subjective and ambiguous.

Answer

Medium

Answer

Critical

Answer

Low

Question 3

Which THREE of the following are elements of the AAA framework in security?

Accepted Answer

Accounting. The AAA framework in security consists of three core elements: Authentication (verifying identity), Authorization (granting permissions), and Accounting (tracking user activities and resource usage). Therefore, options A, B, and C are the correct three elements.

Answer

Auditing

Answer

Availability

Question 4

According to the ISC2 Code of Ethics, which TWO canons are listed in the correct order of priority (highest to lowest)?

Accepted Answer

Protect society. The ISC2 Code of Ethics canons must be observed in the following strict order of priority:
1. Protect society, the common good, necessary public trust and confidence, and the infrastructure.
2. Act honorably, honestly, justly, responsibly, and legally.
3. Provide diligent and competent service to principals.
4. Advance and protect the profession.

Answer

Act honorably

Answer

Provide diligent service

Answer

Act honestly

Answer

Advance the profession

Question 5

An organization is implementing a new access control system. Which of the following represents the correct order of the AAA framework components?

Accepted Answer

Authentication, Authorization, Accounting. The AAA framework stands for Authentication, Authorization, and Accounting, in that order. First, a user's identity is verified, then permissions are checked, and finally activities are logged.

Answer

Authorization, Authentication, Accounting

Answer

Authentication, Accounting, Authorization

Answer

Accounting, Authentication, Authorization

Question 6

A security analyst is evaluating the risk of a data breach. The asset value of the database is $100,000, and the exposure factor is 0.5. If the annual rate of occurrence is 0.2, what is the annualized loss expectancy (ALE)?

Accepted Answer

$10,000. SLE = AV * EF = $100,000 * 0.5 = $50,000. ALE = SLE * ARO = $50,000 * 0.2 = $10,000.

Answer

$100,000

Answer

$50,000

Answer

$20,000

Question 7

Under the ISC2 Code of Ethics, which canon takes precedence over all others?

Accepted Answer

Protect society, the common good, and the infrastructure. The first canon is to protect society, the common good, and the public trust. It is the highest priority.

Answer

Provide diligent and competent service to principals

Answer

Act honorably, honestly, justly, responsibly, and legally

Answer

Advance and protect the profession

Question 8

A company is migrating its critical application to a cloud provider. Which disaster recovery strategy provides the shortest recovery time objective (RTO) and recovery point objective (RPO)?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and real-time data synchronization, minimizing RTO and RPO.

Answer

Warm site

Answer

Cold site

Answer

Reciprocal agreement

Question 9

Which governance framework provides guidance specifically for aligning IT services with business needs and includes a service lifecycle?

Accepted Answer

ITIL. ITIL (Information Technology Infrastructure Library) is a set of practices for IT service management that focuses on aligning IT services with business needs.

Answer

ISO/IEC 27001

Answer

NIST Cybersecurity Framework

Answer

COBIT 2019

Question 10

In a qualitative risk assessment, a risk with a likelihood rating of 'High' and an impact rating of 'Critical' would typically fall into which category?

Accepted Answer

High risk. In a typical 5x5 risk matrix, high likelihood and critical impact place the risk in the 'High' or 'Extreme' risk category, requiring immediate action.

Answer

Medium risk

Answer

Low risk

Answer

De minimis risk

Question 11

Which of the following is an example of a security policy?

Accepted Answer

All employees must use multi-factor authentication. A policy is a high-level mandatory statement that reflects management's intent. 'All employees must use multi-factor authentication' is a mandatory directive.

Answer

Step 1: Log in, Step 2: Enter code, Step 3: Access system

Answer

It is recommended to change passwords every 90 days

Answer

Use passwords of at least 12 characters with mixed case and numbers

Question 12

Under GDPR, which of the following is a valid lawful basis for processing personal data?

Accepted Answer

Vital interests. GDPR Article 6 lists lawful bases including consent, contract, legal obligation, vital interests, public task, and legitimate interests. 'Vital interests' is a valid basis.

Answer

Corporate policy

Answer

Profit motive

Answer

Marketing preference

Question 13

A hospital is subject to HIPAA. Which of the following is required when sharing protected health information (PHI) with a third-party billing company?

Accepted Answer

Business Associate Agreement. Under HIPAA, covered entities must have a Business Associate Agreement (BAA) with business associates that handle PHI.

Answer

Annual audit report

Answer

Patient consent

Answer

Data Protection Impact Assessment

Question 14

In a quantitative risk analysis, if the single loss expectancy (SLE) is $15,000 and the annual rate of occurrence (ARO) is 0.5, what is the annualized loss expectancy (ALE)?

Accepted Answer

$7,500. ALE = SLE * ARO = $15,000 * 0.5 = $7,500.

Answer

$30,000

Answer

$15,000

Answer

$75,000

Question 15

Which of the following is a key objective of a business impact analysis (BIA)?

Accepted Answer

Determine the maximum tolerable downtime for critical processes. BIA identifies critical business processes and their recovery requirements such as RTO, RPO, and maximum tolerable downtime.

Answer

Implement security controls

Answer

Identify vulnerabilities in the network

Answer

Test the disaster recovery plan

Question 16

Under the Sarbanes-Oxley Act (SOX), which of the following is an example of an IT general control that supports financial reporting?

Accepted Answer

Change management process for the financial system. IT general controls (ITGC) include access controls, change management, backup and recovery, and computer operations. Change management ensures that changes to financial systems are authorized and tested.

Answer

Data encryption for customer PII

Answer

Firewall rule to block unauthorized traffic

Answer

Automated calculation of interest on loans

Question 17

A security manager is choosing a risk response for a high-impact, high-likelihood risk. Which TWO responses are most appropriate? (Select TWO)

Accepted Answer

Risk mitigation. For high-impact, high-likelihood risks, avoidance (eliminating the activity) or mitigation (reducing impact/likelihood) are common. Transfer (insurance) may also be used but is less comprehensive. Acceptance is for low risks.

Answer

Risk research

Answer

Risk acceptance

Answer

Risk deferral

Question 18

A company is implementing PCI DSS compliance. Which THREE requirements are part of the PCI DSS? (Select THREE)

Accepted Answer

Encrypt transmission of cardholder data across open, public networks. PCI DSS has 12 requirements including installing firewalls, encrypting cardholder data, and restricting physical access. Implementing MFA for all users is not a specific requirement (though it may be part of access control).

Answer

Use only approved encryption algorithms for stored data

Answer

Implement multi-factor authentication for all employees

Question 19

Which of the following is the primary purpose of the CIA triad in information security?

Accepted Answer

To define the core objectives of information security. The CIA triad—Confidentiality, Integrity, and Availability—provides a foundational model for developing security policies and ensuring that data is protected from unauthorized access, tampering, and downtime.

Answer

To establish a framework for risk management

Answer

To ensure compliance with regulatory requirements

Answer

To balance security controls with usability

Question 20

An organization is implementing a new access control system. The security team wants to ensure that users cannot deny having performed an action. Which security principle is being addressed?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a party cannot deny the authenticity of their signature or the sending of a message. In access control, this is often achieved through audit logs and digital signatures.

Answer

Availability

Answer

Integrity

Answer

Confidentiality