CISSP Security and Risk Management Practice Test 2 — 15 Questions

Question 1

Which of the following is an example of a security policy?

Accepted Answer

All employees must use multi-factor authentication. A security policy is a high-level statement of management intent that mandates required behavior. 'All employees must use multi-factor authentication' is a directive, organization-wide requirement, which is the defining characteristic of a policy.

Answer

Step 1: Log in, Step 2: Enter code, Step 3: Access system

Answer

It is recommended to change passwords every 90 days

Answer

Use passwords of at least 12 characters with mixed case and numbers

Question 2

Under GDPR, which of the following is a valid lawful basis for processing personal data?

Accepted Answer

Vital interests. GDPR Article 6(1) lists six lawful bases for processing personal data: consent, contract, legal obligation, vital interests, public task, and legitimate interests. 'Vital interests' is one of these — it covers processing necessary to protect someone's life.

Answer

Corporate policy

Answer

Profit motive

Answer

Marketing preference

Question 3

A hospital is subject to HIPAA. Which of the following is required when sharing protected health information (PHI) with a third-party billing company?

Accepted Answer

Business Associate Agreement. Under HIPAA, any third party that creates, receives, maintains, or transmits protected health information on behalf of a covered entity is a Business Associate, and a Business Associate Agreement (BAA) is legally required before PHI can be shared. The billing company qualifies as a business associate, so a BAA must be in place.

Answer

Annual audit report

Answer

Patient consent

Answer

Data Protection Impact Assessment

Question 4

In a quantitative risk analysis, if the single loss expectancy (SLE) is $15,000 and the annual rate of occurrence (ARO) is 0.5, what is the annualized loss expectancy (ALE)?

Accepted Answer

$7,500. The Annualized Loss Expectancy (ALE) is calculated as SLE × ARO. With an SLE of $15,000 and an ARO of 0.5, the ALE is $15,000 × 0.5 = $7,500. This represents the expected yearly financial loss from a given risk, factoring in both the impact per incident and how often it is expected to occur.

Answer

$30,000

Answer

$15,000

Answer

$75,000

Question 5

Which of the following is a key objective of a business impact analysis (BIA)?

Accepted Answer

Determine the maximum tolerable downtime for critical processes. A BIA is a foundational step in business continuity planning (BCP) that identifies critical business functions and quantifies the impact of their disruption over time. Its primary output is the maximum tolerable downtime (MTD), also called maximum allowable outage, along with recovery time objectives (RTO) and recovery point objectives (RPO) for each critical process. Determining MTD lets the organization prioritize recovery efforts and justify continuity investments.

Answer

Implement security controls

Answer

Identify vulnerabilities in the network

Answer

Test the disaster recovery plan

Question 6

Under the Sarbanes-Oxley Act (SOX), which of the following is an example of an IT general control that supports financial reporting?

Accepted Answer

Change management process for the financial system. Under SOX, IT general controls (ITGCs) are the foundational controls that ensure the reliability, integrity, and security of the IT environment supporting financial reporting. A change management process for the financial system is a classic ITGC because it ensures that modifications to applications affecting financial data are authorized, tested, approved, and documented — directly protecting the accuracy and completeness of financial statements. SOX Section 404 requires management to assess and auditors to attest to the effectiveness of these internal controls over financial reporting (ICFR), and ITGCs like change management are a core part of that assessment.

Answer

Data encryption for customer PII

Answer

Firewall rule to block unauthorized traffic

Answer

Automated calculation of interest on loans

Question 7

A security manager is choosing a risk response for a high-impact, high-likelihood risk. Which TWO responses are most appropriate? (Select TWO)

Accepted Answer

Risk mitigation. Risk mitigation (A) is correct because for a high-impact, high-likelihood risk the organization should implement controls (e.g., firewalls, encryption, MFA, patching) to reduce the probability and/or impact to an acceptable level. Risk avoidance (C) is also correct because eliminating the activity or asset that generates the risk removes the exposure entirely, which is appropriate when the risk is too severe to tolerate. Risk research (B) is not a standard risk response in the mitigation/avoidance/transference/acceptance taxonomy and does not by itself reduce a high/high risk. Risk acceptance (D) is inappropriate because accepting a high-impact, high-likelihood risk leaves the organization exposed beyond tolerable levels. Risk deferral (E) is not a valid risk response; postponing action does not reduce the risk and is essentially a form of acceptance.

Answer

Risk research

Answer

Risk acceptance

Answer

Risk deferral

Question 8

A company is implementing PCI DSS compliance. Which THREE requirements are part of the PCI DSS? (Select THREE)

Accepted Answer

Encrypt transmission of cardholder data across open, public networks. Option C is correct because PCI DSS Requirement 4 mandates protecting cardholder data with strong cryptography during transmission over open, public networks such as the internet. Option D is correct because PCI DSS Requirement 9 requires restricting physical access to cardholder data and systems that store, process, or transmit it. Option E is correct because PCI DSS Requirement 1 requires installing and maintaining firewall and router configurations to protect cardholder data, including controlling traffic between trusted and untrusted networks. Option A is not a standalone PCI DSS requirement as phrased, since the standard addresses encryption of stored data under Requirement 3 but does not simply state 'use only approved encryption algorithms' as a requirement. Option B is not a PCI DSS requirement for all employees; MFA is required for remote access and certain non-console administrative access, not universally for every employee.

Answer

Use only approved encryption algorithms for stored data

Answer

Implement multi-factor authentication for all employees

Question 9

Which of the following is the primary purpose of the CIA triad in information security?

Accepted Answer

To define the core objectives of information security. The CIA triad—Confidentiality, Integrity, and Availability—provides a foundational model for developing security policies and ensuring that data is protected from unauthorized access, tampering, and downtime.

Answer

To establish a framework for risk management

Answer

To ensure compliance with regulatory requirements

Answer

To balance security controls with usability

Question 10

An organization is implementing a new access control system. The security team wants to ensure that users cannot deny having performed an action. Which security principle is being addressed?

Accepted Answer

Non-repudiation. Non-repudiation is the security principle that ensures a party to a communication or transaction cannot later deny having performed that action. It is typically achieved through digital signatures, audit logs, and cryptographic proof of origin and delivery. The question directly describes the inability to deny an action, which is the textbook definition of non-repudiation.

Answer

Availability

Answer

Integrity

Answer

Confidentiality

Question 11

A company uses a qualitative risk analysis matrix where likelihood ranges from 1 to 5 and impact ranges from 1 to 5. A risk with a likelihood of 4 and an impact of 5 would fall into which risk level if the matrix defines high risk as scores above 15, medium as 10-15, and low as below 10?

Accepted Answer

High. The risk score is calculated as likelihood × impact = 4 × 5 = 20. The matrix defines high risk as scores above 15, and 20 exceeds 15, so the risk falls into the High category. This is a straightforward application of the qualitative risk scoring formula used in the scenario.

Answer

Medium

Answer

Critical

Answer

Low

Question 12

Which of the following is a key requirement under the GDPR regarding personal data breaches?

Accepted Answer

Notify the supervisory authority within 72 hours. Under GDPR Article 33, a controller must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. This 72-hour window is the core regulatory deadline tested here. Notification to individuals (Article 34) is only required when the breach poses a high risk, and it has no fixed 24-hour deadline.

Answer

Conduct a privacy impact assessment within 30 days

Answer

Report the breach to law enforcement immediately

Answer

Notify affected individuals within 24 hours

Question 13

According to the ISC2 Code of Ethics, which of the following canons has the highest priority when resolving an ethical dilemma?

Accepted Answer

Protect society, the common good, and the public trust. The ISC2 Code of Ethics canons are in order of priority: 1. Protect society, the common good, and the public trust; 2. Act honorably and lawfully; 3. Provide diligent and competent service; 4. Advance and protect the profession. Therefore, option D is the highest priority canon.

Answer

Act honorably and lawfully

Answer

Provide diligent and competent service

Answer

Advance and protect the profession

Question 14

A security manager is calculating the annual loss expectancy (ALE) for a server valued at $50,000. The exposure factor (EF) is 40%, and the annual rate of occurrence (ARO) is 0.5. What is the ALE?

Accepted Answer

$10,000. ALE is calculated as SLE × ARO, where SLE = Asset Value × Exposure Factor. Here, SLE = $50,000 × 0.40 = $20,000, and ALE = $20,000 × 0.5 = $10,000. This quantifies the expected yearly monetary loss from the risk, which is the standard CISSP quantitative risk analysis formula.

Answer

$100,000

Answer

$25,000

Answer

$20,000

Question 15

Under the PCI DSS, which of the following best describes a 'cardholder data environment' (CDE)?

Accepted Answer

Systems that store, process, or transmit cardholder data. The cardholder data environment (CDE) is defined by PCI DSS as the people, processes, and technologies that store, process, or transmit cardholder data or sensitive authentication data, plus any systems that connect to or could impact the security of that environment. Option C captures the core definition accurately. This scope determines which systems must comply with PCI DSS requirements.

Answer

A physical room where payment cards are stored

Answer

Any system that connects to the internet

Answer

A network segment that contains only point-of-sale devices