CISSP Security and Risk Management Practice Test 2 — 15 Questions

Question 1

Under the Sarbanes-Oxley Act (SOX), which of the following is an example of an IT general control that supports financial reporting?

Accepted Answer

Change management process for the financial system. IT general controls (ITGC) include access controls, change management, backup and recovery, and computer operations. Change management ensures that changes to financial systems are authorized and tested.

Answer

Data encryption for customer PII

Answer

Firewall rule to block unauthorized traffic

Answer

Automated calculation of interest on loans

Question 2

A security manager is choosing a risk response for a high-impact, high-likelihood risk. Which TWO responses are most appropriate? (Select TWO)

Accepted Answer

Risk mitigation. For high-impact, high-likelihood risks, avoidance (eliminating the activity) or mitigation (reducing impact/likelihood) are common. Transfer (insurance) may also be used but is less comprehensive. Acceptance is for low risks.

Answer

Risk research

Answer

Risk acceptance

Answer

Risk deferral

Question 3

A company is implementing PCI DSS compliance. Which THREE requirements are part of the PCI DSS? (Select THREE)

Accepted Answer

Encrypt transmission of cardholder data across open, public networks. PCI DSS has 12 requirements including installing firewalls, encrypting cardholder data, and restricting physical access. Implementing MFA for all users is not a specific requirement (though it may be part of access control).

Answer

Use only approved encryption algorithms for stored data

Answer

Implement multi-factor authentication for all employees

Question 4

Which of the following is the primary purpose of the CIA triad in information security?

Accepted Answer

To define the core objectives of information security. The CIA triad—Confidentiality, Integrity, and Availability—provides a foundational model for developing security policies and ensuring that data is protected from unauthorized access, tampering, and downtime.

Answer

To establish a framework for risk management

Answer

To ensure compliance with regulatory requirements

Answer

To balance security controls with usability

Question 5

An organization is implementing a new access control system. The security team wants to ensure that users cannot deny having performed an action. Which security principle is being addressed?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a party cannot deny the authenticity of their signature or the sending of a message. In access control, this is often achieved through audit logs and digital signatures.

Answer

Availability

Answer

Integrity

Answer

Confidentiality

Question 6

A company uses a qualitative risk analysis matrix where likelihood ranges from 1 to 5 and impact ranges from 1 to 5. A risk with a likelihood of 4 and an impact of 5 would fall into which risk level if the matrix defines high risk as scores above 15, medium as 10-15, and low as below 10?

Accepted Answer

High. In qualitative risk analysis using a 5x5 matrix, the score is typically the product of likelihood and impact. 4 x 5 = 20, which is above 15, indicating high risk.

Answer

Medium

Answer

Critical

Answer

Low

Question 7

During a business impact analysis (BIA), the recovery point objective (RPO) for a critical database is determined to be 2 hours. What does this mean?

Accepted Answer

Data backups must be taken at least every 2 hours. RPO defines the maximum acceptable data loss measured in time. An RPO of 2 hours means that data can be lost up to the last 2 hours before the disruption.

Answer

Data can be recovered from any point within the past 2 hours

Answer

The maximum tolerable downtime is 2 hours

Answer

The database must be fully recovered within 2 hours of a disaster

Question 8

Which of the following is a key requirement under the GDPR regarding personal data breaches?

Accepted Answer

Notify the supervisory authority within 72 hours. GDPR Article 33 requires data controllers to notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to rights and freedoms.

Answer

Conduct a privacy impact assessment within 30 days

Answer

Report the breach to law enforcement immediately

Answer

Notify affected individuals within 24 hours

Question 9

According to the ISC2 Code of Ethics, which of the following canons has the highest priority when resolving an ethical dilemma?

Accepted Answer

Protect society, the common good, and the public trust. The ISC2 Code of Ethics canons are in order of priority: 1. Protect society, the common good, and the public trust; 2. Act honorably and lawfully; 3. Provide diligent and competent service; 4. Advance and protect the profession. Therefore, option D is the highest priority canon.

Answer

Act honorably and lawfully

Answer

Provide diligent and competent service

Answer

Advance and protect the profession

Question 10

A security manager is calculating the annual loss expectancy (ALE) for a server valued at $50,000. The exposure factor (EF) is 40%, and the annual rate of occurrence (ARO) is 0.5. What is the ALE?

Accepted Answer

$10,000. SLE = AV x EF = $50,000 x 0.4 = $20,000. ALE = SLE x ARO = $20,000 x 0.5 = $10,000.

Answer

$100,000

Answer

$25,000

Answer

$20,000

Question 11

Under the PCI DSS, which of the following best describes a 'cardholder data environment' (CDE)?

Accepted Answer

Systems that store, process, or transmit cardholder data. The CDE includes people, processes, and technologies that store, process, or transmit cardholder data or sensitive authentication data. Segmentation is used to isolate the CDE from other networks.

Answer

A physical room where payment cards are stored

Answer

Any system that connects to the internet

Answer

A network segment that contains only point-of-sale devices

Question 12

Which component of the AAA framework is responsible for determining what resources a user can access and what actions they can perform?

Accepted Answer

Authorization. AAA stands for Authentication, Authorization, and Accounting. Authorization is the process of granting or denying access to resources based on policies.

Answer

Auditing

Answer

Authentication

Answer

Accounting

Question 13

An organization is implementing a BCP. After completing the BIA, which of the following is the next logical step in the planning process?

Accepted Answer

Develop recovery strategies. After the BIA identifies critical processes and recovery requirements, the next step is to develop strategies to meet those requirements, such as selecting recovery sites and technologies.

Answer

Test the plan

Answer

Conduct a risk assessment

Answer

Train personnel

Question 14

Which of the following is a key difference between a policy and a guideline in information security governance?

Accepted Answer

Policies are mandatory, while guidelines are recommended. Policies are high-level, mandatory statements that define the organization's security posture. Guidelines are recommendations that suggest best practices but are not mandatory.

Answer

Policies are created by IT, while guidelines are created by executives

Answer

Policies are technical, while guidelines are managerial

Answer

Policies are static, while guidelines are updated frequently

Question 15

A healthcare organization covered by HIPAA wants to share protected health information (PHI) with a third-party billing service. What must be in place to comply with HIPAA?

Accepted Answer

A business associate agreement (BAA). HIPAA requires covered entities to have a business associate agreement (BAA) with any third party that will handle PHI on their behalf. The BAA ensures the business associate will safeguard the PHI.

Answer

A memorandum of understanding (MOU)

Answer

A data processing agreement under GDPR

Answer

A consent form from each patient