CISSP Security and Risk Management Practice Test 3 — 15 Questions

Question 1

Which component of the AAA framework is responsible for determining what resources a user can access and what actions they can perform?

Accepted Answer

Authorization. Authorization is the AAA component that determines what resources a user can access and what actions they can perform after identity has been verified. It evaluates access policies, group memberships, and permissions to grant or deny specific operations. Authentication proves identity, accounting tracks activity, and auditing reviews logs — none of these define access rights.

Answer

Auditing

Answer

Authentication

Answer

Accounting

Question 2

An organization is implementing a BCP. After completing the BIA, which of the following is the next logical step in the planning process?

Accepted Answer

Develop recovery strategies. After the BIA identifies critical processes and recovery requirements, the next step is to develop strategies to meet those requirements, such as selecting recovery sites and technologies.

Answer

Test the plan

Answer

Conduct a risk assessment

Answer

Train personnel

Question 3

Which of the following is a key difference between a policy and a guideline in information security governance?

Accepted Answer

Policies are mandatory, while guidelines are recommended. Policies are formal, high-level statements that mandate specific behaviors or requirements across the organization; compliance is compulsory. Guidelines, in contrast, are non-mandatory recommendations or best practices that offer advice on how to achieve policy objectives. This distinction is fundamental to information security governance because it clarifies which documents carry enforcement weight and which are merely advisory.

Answer

Policies are created by IT, while guidelines are created by executives

Answer

Policies are technical, while guidelines are managerial

Answer

Policies are static, while guidelines are updated frequently

Question 4

A healthcare organization covered by HIPAA wants to share protected health information (PHI) with a third-party billing service. What must be in place to comply with HIPAA?

Accepted Answer

A business associate agreement (BAA). Under HIPAA, a covered entity sharing PHI with a third-party vendor that performs a function involving PHI must have a Business Associate Agreement (BAA) in place. The BAA contractually obligates the business associate to safeguard PHI and comply with HIPAA Privacy and Security Rules. This is a legal requirement, not optional.

Answer

A memorandum of understanding (MOU)

Answer

A data processing agreement under GDPR

Answer

A consent form from each patient

Question 5

A security auditor is reviewing an organization's governance framework. Which TWO of the following are commonly used frameworks for IT governance and security management?

Accepted Answer

ISO/IEC 27001. ISO/IEC 27001 (A) is correct because it is the internationally recognized standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS), directly addressing security management and governance controls. COBIT 2019 (D) is correct because it is ISACA's governance framework specifically designed for enterprise IT governance and management, providing control objectives and processes that align IT with business goals. PMBOK (B) is a project management body of knowledge focused on managing projects, not on IT governance or security management. TOGAF (C) is an enterprise architecture framework for designing and structuring IT architecture, not a governance or security management framework. Six Sigma (E) is a process improvement and quality management methodology aimed at reducing defects, not an IT governance or security framework.

Answer

PMBOK

Answer

TOGAF

Answer

Six Sigma

Question 6

Which TWO of the following are examples of risk response strategies?

Accepted Answer

Risk acceptance. Risk acceptance (A) is a valid risk response strategy because the organization consciously decides to acknowledge a risk and take no proactive action to mitigate it, often documenting the decision and setting aside contingency reserves. Risk avoidance (D) is also a valid risk response strategy because it involves eliminating the risk entirely by changing plans, such as discontinuing a risky activity, technology, or process. These two belong to the standard risk response categories (avoid, transfer, mitigate, accept), so they directly answer the question. In contrast, risk analysis (B) and risk identification (C) are earlier risk management process steps used to discover and evaluate risks, not strategies for responding to them, and risk communication (E) is an ongoing activity for sharing risk information among stakeholders rather than a response strategy itself.

Answer

Risk analysis

Answer

Risk identification

Answer

Risk communication

Question 7

Which of the following is the PRIMARY purpose of the confidentiality principle in the CIA triad?

Accepted Answer

Preventing unauthorized access to information. Confidentiality in the CIA triad ensures information is disclosed only to authorized parties, so its primary purpose is preventing unauthorized access to data. This is achieved through encryption, access controls, and classification. The other options describe integrity, authentication, and availability respectively.

Answer

Ensuring data is accurate and complete

Answer

Ensuring that users are who they claim to be

Answer

Guaranteeing that systems are available when needed

Question 8

An organization is implementing a new governance framework to align IT with business goals. Which framework is specifically designed for IT service management?

Accepted Answer

ITIL. ITIL (Information Technology Infrastructure Library) is the framework specifically designed for IT service management (ITSM), providing best practices for service strategy, design, transition, operation, and continual improvement. It focuses on aligning IT services with business needs through processes like incident, problem, change, and service-level management. COBIT is a governance framework, ISO/IEC 27001 is an information security management standard, and NIST CSF is a cybersecurity framework — none are ITSM-specific.

Answer

ISO/IEC 27001

Answer

COBIT 2019

Answer

NIST Cybersecurity Framework

Question 9

A security team is performing a quantitative risk analysis for a server valued at $100,000. The exposure factor is 0.4 and the annual rate of occurrence is 2. What is the annualized loss expectancy (ALE)?

Accepted Answer

$80,000. The ALE is calculated as SLE × ARO, where SLE = Asset Value × Exposure Factor. Here, SLE = $100,000 × 0.4 = $40,000, and ARO = 2, so ALE = $40,000 × 2 = $80,000. This represents the expected annual monetary loss from the risk event.

Answer

$40,000

Answer

$200,000

Answer

$160,000

Question 10

Under the GDPR, what is the maximum time frame for notifying the supervisory authority of a personal data breach?

Accepted Answer

72 hours. Article 33 of the GDPR requires that, in the case of a personal data breach, the controller notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of the breach. This 72-hour window is the maximum time frame specified by the regulation. If notification is not made within 72 hours, it must be accompanied by reasons for the delay.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 11

Which of the following is the correct order of priority for the ISC2 Code of Ethics Canons?

Accepted Answer

Protect society, act honorably, provide diligent service, advance the profession. The ISC2 Code of Ethics Canons are ordered by priority: Protect society, the common good, necessary public trust and confidence, and the infrastructure; Act honorably, honestly, justly, responsibly, and legally; Provide diligent and competent service to principals; and Advance and protect the profession. Option B correctly lists this order.

Answer

Advance the profession, protect society, act honorably, provide diligent service

Answer

Provide diligent service, protect society, act honorably, advance the profession

Answer

Act honorably, provide diligent service, protect society, advance the profession

Question 12

Which document provides detailed step-by-step instructions for performing a specific security task?

Accepted Answer

Procedure. A procedure is the most granular level of security documentation, providing explicit, sequential steps required to accomplish a specific task. It answers 'how' to implement a policy or standard, ensuring consistency and repeatability. Unlike policies (which are high-level management directives) or standards (which specify mandatory requirements), procedures are operational and action-oriented.

Answer

Policy

Answer

Standard

Answer

Guideline

Question 13

A company decides to purchase cyber insurance to cover potential losses from data breaches. Which risk response strategy does this represent?

Accepted Answer

Transfer. Purchasing cyber insurance shifts the financial impact of a breach to a third party (the insurer), which is the definition of risk transfer. The organization still owns the risk event but transfers the financial consequence. Accept, Avoid, and Mitigate describe retaining, eliminating, or reducing risk, respectively.

Answer

Accept

Answer

Avoid

Answer

Mitigate

Question 14

Under HIPAA, what is the primary purpose of a Business Associate Agreement (BAA)?

Accepted Answer

To require the business associate to comply with HIPAA Privacy and Security Rules. A Business Associate Agreement (BAA) is a contract required by HIPAA between a covered entity and a business associate that ensures the business associate will appropriately safeguard Protected Health Information (PHI). It mandates compliance with the HIPAA Privacy and Security Rules and specifies permitted uses and disclosures of PHI. The BAA does not transfer ownership or grant unrestricted rights to PHI.

Answer

To transfer ownership of PHI to the business associate

Answer

To authorize the use of PHI for marketing purposes

Answer

To allow the business associate to disclose PHI to any third party

Question 15

Which of the following is the PRIMARY goal of a Business Impact Analysis (BIA) in business continuity planning?

Accepted Answer

To determine the maximum acceptable outage for each process. The primary goal of a Business Impact Analysis (BIA) is to identify the critical business processes and determine the maximum acceptable outage (MAO) or maximum tolerable downtime (MTD) for each. This involves assessing the financial, operational, and legal impacts of disruptions over time. The BIA provides the data needed to set recovery time objectives (RTOs) and recovery point objectives (RPOs), which drive the overall business continuity strategy. Thus, determining the maximum acceptable outage is the core purpose of a BIA.

Answer

To test the disaster recovery plan

Answer

To assign roles and responsibilities during a disaster

Answer

To select a hot site vendor