CISSP Security and Risk Management — All Questions With Answers

Question 1mediummulti select

Read the full Security and Risk Management explanation →

Which THREE of the following are data subject rights under the GDPR? (Select THREE)

Question 2hardmultiple choice

Read the full Security and Risk Management explanation →

A security analyst is evaluating risks using a qualitative matrix. The likelihood is rated as 'high' and the impact as 'medium'. What is the overall risk level typically assigned in a 3x3 matrix?

Question 3easymulti select

Study the full AAA explanation →

Which THREE of the following are elements of the AAA framework in security?

Question 4mediummulti select

Read the full Security and Risk Management explanation →

According to the ISC2 Code of Ethics, which TWO canons are listed in the correct order of priority (highest to lowest)?

Question 5easymultiple choice

Study the full AAA explanation →

An organization is implementing a new access control system. Which of the following represents the correct order of the AAA framework components?

Question 6easymultiple choice

Read the full Security and Risk Management explanation →

A security analyst is evaluating the risk of a data breach. The asset value of the database is $100,000, and the exposure factor is 0.5. If the annual rate of occurrence is 0.2, what is the annualized loss expectancy (ALE)?

Question 7mediummultiple choice

Read the full Security and Risk Management explanation →

Under the ISC2 Code of Ethics, which canon takes precedence over all others?

Question 8mediummultiple choice

Read the full Security and Risk Management explanation →

A company is migrating its critical application to a cloud provider. Which disaster recovery strategy provides the shortest recovery time objective (RTO) and recovery point objective (RPO)?

Question 9mediummultiple choice

Read the full Security and Risk Management explanation →

Which governance framework provides guidance specifically for aligning IT services with business needs and includes a service lifecycle?

Question 10mediummultiple choice

Read the full Security and Risk Management explanation →

In a qualitative risk assessment, a risk with a likelihood rating of 'High' and an impact rating of 'Critical' would typically fall into which category?

Question 11easymultiple choice

Read the full Security and Risk Management explanation →

Which of the following is an example of a security policy?

Question 12mediummultiple choice

Read the full Security and Risk Management explanation →

Under GDPR, which of the following is a valid lawful basis for processing personal data?

Question 13hardmultiple choice

Read the full Security and Risk Management explanation →

A hospital is subject to HIPAA. Which of the following is required when sharing protected health information (PHI) with a third-party billing company?

Question 14hardmultiple choice

Read the full Security and Risk Management explanation →

In a quantitative risk analysis, if the single loss expectancy (SLE) is $15,000 and the annual rate of occurrence (ARO) is 0.5, what is the annualized loss expectancy (ALE)?

Question 15mediummultiple choice

Read the full Security and Risk Management explanation →

Which of the following is a key objective of a business impact analysis (BIA)?

Question 16hardmultiple choice

Read the full Security and Risk Management explanation →

Under the Sarbanes-Oxley Act (SOX), which of the following is an example of an IT general control that supports financial reporting?

Question 17mediummulti select

Read the full Security and Risk Management explanation →

A security manager is choosing a risk response for a high-impact, high-likelihood risk. Which TWO responses are most appropriate? (Select TWO)

Question 18hardmulti select

Read the full Security and Risk Management explanation →

A company is implementing PCI DSS compliance. Which THREE requirements are part of the PCI DSS? (Select THREE)

Question 19easymultiple choice

Read the full Security and Risk Management explanation →

Which of the following is the primary purpose of the CIA triad in information security?

Question 20mediummultiple choice

Read the full Security and Risk Management explanation →

An organization is implementing a new access control system. The security team wants to ensure that users cannot deny having performed an action. Which security principle is being addressed?

Question 21hardmultiple choice

Read the full Security and Risk Management explanation →

A company uses a qualitative risk analysis matrix where likelihood ranges from 1 to 5 and impact ranges from 1 to 5. A risk with a likelihood of 4 and an impact of 5 would fall into which risk level if the matrix defines high risk as scores above 15, medium as 10-15, and low as below 10?

Question 22mediummultiple choice

Read the full Security and Risk Management explanation →

During a business impact analysis (BIA), the recovery point objective (RPO) for a critical database is determined to be 2 hours. What does this mean?

Question 23mediummultiple choice

Read the full Security and Risk Management explanation →

Which of the following is a key requirement under the GDPR regarding personal data breaches?

Question 24easymultiple choice

Read the full Security and Risk Management explanation →

According to the ISC2 Code of Ethics, which of the following canons has the highest priority when resolving an ethical dilemma?

Question 25mediummultiple choice

Read the full Security and Risk Management explanation →

A security manager is calculating the annual loss expectancy (ALE) for a server valued at $50,000. The exposure factor (EF) is 40%, and the annual rate of occurrence (ARO) is 0.5. What is the ALE?

Question 26hardmultiple choice

Read the full Security and Risk Management explanation →

Under the PCI DSS, which of the following best describes a 'cardholder data environment' (CDE)?

Question 27easymultiple choice

Study the full AAA explanation →

Which component of the AAA framework is responsible for determining what resources a user can access and what actions they can perform?

Question 28mediummultiple choice

Read the full Security and Risk Management explanation →

An organization is implementing a BCP. After completing the BIA, which of the following is the next logical step in the planning process?

Question 29mediummultiple choice

Read the full Security and Risk Management explanation →

Which of the following is a key difference between a policy and a guideline in information security governance?

Question 30hardmultiple choice

Read the full Security and Risk Management explanation →

A healthcare organization covered by HIPAA wants to share protected health information (PHI) with a third-party billing service. What must be in place to comply with HIPAA?

Question 31mediummulti select

Read the full Security and Risk Management explanation →

A security auditor is reviewing an organization's governance framework. Which TWO of the following are commonly used frameworks for IT governance and security management?

Question 32hardmulti select

Read the full Security and Risk Management explanation →

A company is recovering from a ransomware attack. Which THREE of the following are key considerations when restoring data from backups to ensure integrity and minimal downtime?

Question 33easymulti select

Read the full Security and Risk Management explanation →

Which TWO of the following are examples of risk response strategies?

Question 34easymultiple choice

Read the full Security and Risk Management explanation →

Which of the following is the PRIMARY purpose of the confidentiality principle in the CIA triad?

Question 35easymultiple choice

Read the full Security and Risk Management explanation →

An organization is implementing a new governance framework to align IT with business goals. Which framework is specifically designed for IT service management?

Question 36mediummultiple choice

Read the full Security and Risk Management explanation →

A security team is performing a quantitative risk analysis for a server valued at $100,000. The exposure factor is 0.4 and the annual rate of occurrence is 2. What is the annualized loss expectancy (ALE)?

Question 37mediummultiple choice

Read the full Security and Risk Management explanation →

Under the GDPR, what is the maximum time frame for notifying the supervisory authority of a personal data breach?

Question 38mediummultiple choice

Read the full Security and Risk Management explanation →

Which of the following is the correct order of priority for the ISC2 Code of Ethics Canons?

Question 39easymultiple choice

Read the full Security and Risk Management explanation →

Which document provides detailed step-by-step instructions for performing a specific security task?

Question 40mediummultiple choice

Read the full Security and Risk Management explanation →

A company decides to purchase cyber insurance to cover potential losses from data breaches. Which risk response strategy does this represent?

Question 41hardmultiple choice

Read the full Security and Risk Management explanation →

Under HIPAA, what is the primary purpose of a Business Associate Agreement (BAA)?

Question 42mediummultiple choice

Read the full Security and Risk Management explanation →

Which of the following is the PRIMARY goal of a Business Impact Analysis (BIA) in business continuity planning?

Question 43mediummultiple choice

Read the full Security and Risk Management explanation →

A company is implementing PCI DSS compliance. Which requirement is related to protecting cardholder data at rest?

Question 44hardmultiple choice

Read the full Security and Risk Management explanation →

An organization has identified a risk with a high likelihood and high impact. Management decides to implement controls to reduce the likelihood. After controls, the risk is reassessed as medium likelihood and medium impact. What is the residual risk?

Question 45mediummulti select

Read the full Security and Risk Management explanation →

Which TWO of the following are lawful bases for processing personal data under the GDPR? (Select two)

Question 46hardmulti select

Read the full Security and Risk Management explanation →

Which THREE of the following are key components of a disaster recovery plan for a hot site? (Select three)

Question 47mediummulti select

Read the full Security and Risk Management explanation →

Which TWO of the following are examples of non-repudiation controls? (Select two)

Question 48mediummultiple choice

Read the full Security and Risk Management explanation →

A security analyst is evaluating the risk of a data breach in a healthcare organization. The asset value of the patient database is $500,000, and the exposure factor is 0.2. The annual rate of occurrence is estimated at 0.1. What is the annualized loss expectancy (ALE)?

Question 49easymultiple choice

Read the full Security and Risk Management explanation →

Which of the following is the correct order of the ISC2 Code of Ethics canons from highest to lowest priority?

Question 50mediummultiple choice

Read the full Security and Risk Management explanation →

An organization is implementing a new access control system. They want to ensure that users are who they claim to be, that actions can be traced to individuals, and that access rights are managed appropriately. Which framework encompasses all three of these goals?

Question 51hardmultiple choice

Read the full Security and Risk Management explanation →

Under the GDPR, a data controller experiences a personal data breach that is likely to result in a risk to the rights and freedoms of individuals. What is the maximum time frame within which the controller must notify the supervisory authority?

Question 52easymultiple choice

Read the full Security and Risk Management explanation →

Which type of risk remains after management has implemented controls to mitigate the identified risks?

Question 53mediummultiple choice

Read the full Security and Risk Management explanation →

A financial institution is required to comply with SOX. Which of the following is a key focus area for IT under SOX?

Question 54mediummultiple choice

Read the full Security and Risk Management explanation →

During a business impact analysis (BIA), which metric represents the maximum amount of time a business process can be disrupted before causing significant harm to the organization?

Question 55mediummultiple choice

Read the full Security and Risk Management explanation →

In qualitative risk analysis, a risk is assessed with a likelihood of 4 (on a scale of 1-5) and an impact of 5. The risk matrix defines scores of 15-25 as high. What is the risk rating?

Question 56easymultiple choice

Read the full Security and Risk Management explanation →

Which document is mandatory, high-level, and sets the direction for security within an organization?

Question 57hardmultiple choice

Read the full Security and Risk Management explanation →

Under HIPAA, a covered entity must have a Business Associate Agreement (BAA) with which of the following?

Question 58mediummultiple choice

Read the full Security and Risk Management explanation →

An organization wants to avoid a particular risk entirely by not engaging in the activity that creates the risk. Which risk response strategy is being used?

Question 59easymultiple choice

Read the full Security and Risk Management explanation →

Which component of the CIA triad ensures that information is not disclosed to unauthorized individuals, entities, or processes?

Question 60hardmultiple choice

Read the full Security and Risk Management explanation →

A company is designing a disaster recovery plan. They need to recover critical systems within 4 hours and lose no more than 15 minutes of data. Which combination of RTO and RPO should be specified?

Question 61mediummultiple choice

Read the full Security and Risk Management explanation →

Which governance framework is specifically designed to help organizations manage and protect their information assets by providing a comprehensive set of controls based on a risk management approach?

Question 62mediummultiple choice

Read the full Security and Risk Management explanation →

A company is implementing a hot site as a disaster recovery option. Which of the following best describes a hot site?

Question 63mediummulti select

Read the full Security and Risk Management explanation →

A security officer is developing a risk management plan. Which TWO of the following are valid risk response strategies? (Select TWO.)

Question 64hardmulti select

Read the full Security and Risk Management explanation →

Under the GDPR, which THREE of the following are rights of data subjects? (Select THREE.)

Question 65mediummulti select

Read the full Security and Risk Management explanation →

In the context of business continuity planning, which THREE of the following are typically identified during a business impact analysis (BIA)? (Select THREE.)

Question 66easymultiple choice

Read the full Security and Risk Management explanation →

An organization's security policy requires that all data at rest must be encrypted. Which security principle is primarily being addressed?

Question 67mediummultiple choice

Read the full Security and Risk Management explanation →

A company is implementing a risk management program. They have identified a critical server with an asset value of $50,000. The exposure factor due to a potential threat is 40%, and the annual rate of occurrence is 2. What is the Annualized Loss Expectancy (ALE)?

Question 68mediummultiple choice

Read the full Security and Risk Management explanation →

During a Business Impact Analysis (BIA), the maximum amount of time a business process can be unavailable before causing significant harm is determined. Which metric represents this?

Question 69hardmultiple choice

Read the full Security and Risk Management explanation →

A security manager is evaluating risk responses for a high-likelihood, low-impact risk. The cost of mitigation exceeds the potential loss. Which risk response strategy is most appropriate?

Question 70easymultiple choice

Read the full Security and Risk Management explanation →

Under the ISC2 Code of Ethics, which canon has the highest priority?

Question 71mediummultiple choice

Read the full Security and Risk Management explanation →

An organization is required to report a personal data breach to the supervisory authority within 72 hours. Which regulation imposes this requirement?

Question 72hardmultiple choice

Read the full Security and Risk Management explanation →

A company's disaster recovery plan includes an agreement with another company to provide backup computing facilities in case of a disaster. The agreement allows the second company to use the facilities for its own operations if needed. This arrangement is best described as:

Question 73mediummulti select

Read the full Security and Risk Management explanation →

Which THREE of the following are valid risk response strategies?

Question 74hardmulti select

Read the full Security and Risk Management explanation →

CISSP Security and Risk Management — All Questions With Answers

Which THREE of the following are data subject rights under the GDPR? (Select THREE)

A security analyst is evaluating risks using a qualitative matrix. The likelihood is rated as 'high' and the impact as 'medium'. What is the overall risk level typically assigned in a 3x3 matrix?

Which THREE of the following are elements of the AAA framework in security?

According to the ISC2 Code of Ethics, which TWO canons are listed in the correct order of priority (highest to lowest)?

An organization is implementing a new access control system. Which of the following represents the correct order of the AAA framework components?

A security analyst is evaluating the risk of a data breach. The asset value of the database is $100,000, and the exposure factor is 0.5. If the annual rate of occurrence is 0.2, what is the annualized loss expectancy (ALE)?

Under the ISC2 Code of Ethics, which canon takes precedence over all others?

A company is migrating its critical application to a cloud provider. Which disaster recovery strategy provides the shortest recovery time objective (RTO) and recovery point objective (RPO)?

Which governance framework provides guidance specifically for aligning IT services with business needs and includes a service lifecycle?

In a qualitative risk assessment, a risk with a likelihood rating of 'High' and an impact rating of 'Critical' would typically fall into which category?

Which of the following is an example of a security policy?

Under GDPR, which of the following is a valid lawful basis for processing personal data?

A hospital is subject to HIPAA. Which of the following is required when sharing protected health information (PHI) with a third-party billing company?

In a quantitative risk analysis, if the single loss expectancy (SLE) is $15,000 and the annual rate of occurrence (ARO) is 0.5, what is the annualized loss expectancy (ALE)?

Which of the following is a key objective of a business impact analysis (BIA)?

Under the Sarbanes-Oxley Act (SOX), which of the following is an example of an IT general control that supports financial reporting?

A security manager is choosing a risk response for a high-impact, high-likelihood risk. Which TWO responses are most appropriate? (Select TWO)

A company is implementing PCI DSS compliance. Which THREE requirements are part of the PCI DSS? (Select THREE)

Which of the following is the primary purpose of the CIA triad in information security?

An organization is implementing a new access control system. The security team wants to ensure that users cannot deny having performed an action. Which security principle is being addressed?

A company uses a qualitative risk analysis matrix where likelihood ranges from 1 to 5 and impact ranges from 1 to 5. A risk with a likelihood of 4 and an impact of 5 would fall into which risk level if the matrix defines high risk as scores above 15, medium as 10-15, and low as below 10?

During a business impact analysis (BIA), the recovery point objective (RPO) for a critical database is determined to be 2 hours. What does this mean?

Which of the following is a key requirement under the GDPR regarding personal data breaches?

According to the ISC2 Code of Ethics, which of the following canons has the highest priority when resolving an ethical dilemma?

A security manager is calculating the annual loss expectancy (ALE) for a server valued at $50,000. The exposure factor (EF) is 40%, and the annual rate of occurrence (ARO) is 0.5. What is the ALE?

Under the PCI DSS, which of the following best describes a 'cardholder data environment' (CDE)?

Which component of the AAA framework is responsible for determining what resources a user can access and what actions they can perform?

An organization is implementing a BCP. After completing the BIA, which of the following is the next logical step in the planning process?

Which of the following is a key difference between a policy and a guideline in information security governance?

A healthcare organization covered by HIPAA wants to share protected health information (PHI) with a third-party billing service. What must be in place to comply with HIPAA?

A security auditor is reviewing an organization's governance framework. Which TWO of the following are commonly used frameworks for IT governance and security management?

A company is recovering from a ransomware attack. Which THREE of the following are key considerations when restoring data from backups to ensure integrity and minimal downtime?

Which TWO of the following are examples of risk response strategies?

Which of the following is the PRIMARY purpose of the confidentiality principle in the CIA triad?

An organization is implementing a new governance framework to align IT with business goals. Which framework is specifically designed for IT service management?

A security team is performing a quantitative risk analysis for a server valued at $100,000. The exposure factor is 0.4 and the annual rate of occurrence is 2. What is the annualized loss expectancy (ALE)?

Under the GDPR, what is the maximum time frame for notifying the supervisory authority of a personal data breach?

Which of the following is the correct order of priority for the ISC2 Code of Ethics Canons?

Which document provides detailed step-by-step instructions for performing a specific security task?

A company decides to purchase cyber insurance to cover potential losses from data breaches. Which risk response strategy does this represent?

Under HIPAA, what is the primary purpose of a Business Associate Agreement (BAA)?

Which of the following is the PRIMARY goal of a Business Impact Analysis (BIA) in business continuity planning?

A company is implementing PCI DSS compliance. Which requirement is related to protecting cardholder data at rest?

An organization has identified a risk with a high likelihood and high impact. Management decides to implement controls to reduce the likelihood. After controls, the risk is reassessed as medium likelihood and medium impact. What is the residual risk?

Which TWO of the following are lawful bases for processing personal data under the GDPR? (Select two)

Which THREE of the following are key components of a disaster recovery plan for a hot site? (Select three)

Which TWO of the following are examples of non-repudiation controls? (Select two)

A security analyst is evaluating the risk of a data breach in a healthcare organization. The asset value of the patient database is $500,000, and the exposure factor is 0.2. The annual rate of occurrence is estimated at 0.1. What is the annualized loss expectancy (ALE)?

Which of the following is the correct order of the ISC2 Code of Ethics canons from highest to lowest priority?

An organization is implementing a new access control system. They want to ensure that users are who they claim to be, that actions can be traced to individuals, and that access rights are managed appropriately. Which framework encompasses all three of these goals?

Under the GDPR, a data controller experiences a personal data breach that is likely to result in a risk to the rights and freedoms of individuals. What is the maximum time frame within which the controller must notify the supervisory authority?

Which type of risk remains after management has implemented controls to mitigate the identified risks?

A financial institution is required to comply with SOX. Which of the following is a key focus area for IT under SOX?

During a business impact analysis (BIA), which metric represents the maximum amount of time a business process can be disrupted before causing significant harm to the organization?

In qualitative risk analysis, a risk is assessed with a likelihood of 4 (on a scale of 1-5) and an impact of 5. The risk matrix defines scores of 15-25 as high. What is the risk rating?

Which document is mandatory, high-level, and sets the direction for security within an organization?

Under HIPAA, a covered entity must have a Business Associate Agreement (BAA) with which of the following?

An organization wants to avoid a particular risk entirely by not engaging in the activity that creates the risk. Which risk response strategy is being used?

Which component of the CIA triad ensures that information is not disclosed to unauthorized individuals, entities, or processes?

A company is designing a disaster recovery plan. They need to recover critical systems within 4 hours and lose no more than 15 minutes of data. Which combination of RTO and RPO should be specified?

Which governance framework is specifically designed to help organizations manage and protect their information assets by providing a comprehensive set of controls based on a risk management approach?

A company is implementing a hot site as a disaster recovery option. Which of the following best describes a hot site?

A security officer is developing a risk management plan. Which TWO of the following are valid risk response strategies? (Select TWO.)

Under the GDPR, which THREE of the following are rights of data subjects? (Select THREE.)

In the context of business continuity planning, which THREE of the following are typically identified during a business impact analysis (BIA)? (Select THREE.)

An organization's security policy requires that all data at rest must be encrypted. Which security principle is primarily being addressed?

A company is implementing a risk management program. They have identified a critical server with an asset value of $50,000. The exposure factor due to a potential threat is 40%, and the annual rate of occurrence is 2. What is the Annualized Loss Expectancy (ALE)?

During a Business Impact Analysis (BIA), the maximum amount of time a business process can be unavailable before causing significant harm is determined. Which metric represents this?

A security manager is evaluating risk responses for a high-likelihood, low-impact risk. The cost of mitigation exceeds the potential loss. Which risk response strategy is most appropriate?

Under the ISC2 Code of Ethics, which canon has the highest priority?

An organization is required to report a personal data breach to the supervisory authority within 72 hours. Which regulation imposes this requirement?

A company's disaster recovery plan includes an agreement with another company to provide backup computing facilities in case of a disaster. The agreement allows the second company to use the facilities for its own operations if needed. This arrangement is best described as:

Which THREE of the following are valid risk response strategies?

Under GDPR, which TWO of the following are valid lawful bases for processing personal data?

CISSP Security and Risk Management — All Questions With Answers

Which THREE of the following are data subject rights under the GDPR? (Select THREE)

A security analyst is evaluating risks using a qualitative matrix. The likelihood is rated as 'high' and the impact as 'medium'. What is the overall risk level typically assigned in a 3x3 matrix?

Which THREE of the following are elements of the AAA framework in security?

According to the ISC2 Code of Ethics, which TWO canons are listed in the correct order of priority (highest to lowest)?