CISSP Security and Risk Management Practice Test 3 — 15 Questions

Question 1

A security auditor is reviewing an organization's governance framework. Which TWO of the following are commonly used frameworks for IT governance and security management?

Accepted Answer

ISO/IEC 27001. COBIT 2019 is a framework for IT governance and management. ISO/IEC 27001 is an international standard for information security management systems.

Answer

PMBOK

Answer

TOGAF

Answer

Six Sigma

Question 2

A company is recovering from a ransomware attack. Which THREE of the following are key considerations when restoring data from backups to ensure integrity and minimal downtime?

Accepted Answer

Isolate the restored data from the production network until verified. Isolating the restored data from production prevents reinfection. Validating backup integrity ensures clean data. Testing the restoration process ensures the backups work. Encrypted backups require decryption keys.

Answer

Ensure encryption keys for backups are available

Answer

Restore data directly to production servers to save time

Question 3

Which TWO of the following are examples of risk response strategies?

Accepted Answer

Risk acceptance. Risk avoidance eliminates the risk by not performing the activity that gives rise to it. Risk acceptance acknowledges the risk and makes a conscious decision to accept its potential consequences without additional mitigation, often because the cost of mitigation exceeds the potential impact.

Answer

Risk analysis

Answer

Risk identification

Answer

Risk communication

Question 4

Which of the following is the PRIMARY purpose of the confidentiality principle in the CIA triad?

Accepted Answer

Preventing unauthorized access to information. Confidentiality ensures that information is not disclosed to unauthorized individuals, entities, or processes.

Answer

Ensuring data is accurate and complete

Answer

Ensuring that users are who they claim to be

Answer

Guaranteeing that systems are available when needed

Question 5

An organization is implementing a new governance framework to align IT with business goals. Which framework is specifically designed for IT service management?

Accepted Answer

ITIL. ITIL (Information Technology Infrastructure Library) provides best practices for IT service management.

Answer

ISO/IEC 27001

Answer

COBIT 2019

Answer

NIST Cybersecurity Framework

Question 6

A security team is performing a quantitative risk analysis for a server valued at $100,000. The exposure factor is 0.4 and the annual rate of occurrence is 2. What is the annualized loss expectancy (ALE)?

Accepted Answer

$80,000. SLE = AV × EF = $100,000 × 0.4 = $40,000. ALE = SLE × ARO = $40,000 × 2 = $80,000.

Answer

$40,000

Answer

$200,000

Answer

$160,000

Question 7

Under the GDPR, what is the maximum time frame for notifying the supervisory authority of a personal data breach?

Accepted Answer

72 hours. Article 33 of the GDPR requires notification within 72 hours of becoming aware of the breach.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 8

Which of the following is the correct order of priority for the ISC2 Code of Ethics Canons?

Accepted Answer

Protect society, act honorably, provide diligent service, advance the profession. The canons in order: 1. Protect society, the common good, and the public trust. 2. Act honorably, honestly, justly, responsibly, and legally. 3. Provide diligent and competent service to principals. 4. Advance and protect the profession.

Answer

Advance the profession, protect society, act honorably, provide diligent service

Answer

Provide diligent service, protect society, act honorably, advance the profession

Answer

Act honorably, provide diligent service, protect society, advance the profession

Question 9

Which document provides detailed step-by-step instructions for performing a specific security task?

Accepted Answer

Procedure. A procedure is a detailed, step-by-step document that describes how to perform a task.

Answer

Policy

Answer

Standard

Answer

Guideline

Question 10

A company decides to purchase cyber insurance to cover potential losses from data breaches. Which risk response strategy does this represent?

Accepted Answer

Transfer. Transfer involves shifting the risk to a third party, such as through insurance.

Answer

Accept

Answer

Avoid

Answer

Mitigate

Question 11

Under HIPAA, what is the primary purpose of a Business Associate Agreement (BAA)?

Accepted Answer

To require the business associate to comply with HIPAA Privacy and Security Rules. A BAA ensures that business associates handling PHI will appropriately safeguard the information.

Answer

To transfer ownership of PHI to the business associate

Answer

To authorize the use of PHI for marketing purposes

Answer

To allow the business associate to disclose PHI to any third party

Question 12

Which of the following is the PRIMARY goal of a Business Impact Analysis (BIA) in business continuity planning?

Accepted Answer

To determine the maximum acceptable outage for each process. The BIA identifies critical business processes and their recovery requirements, such as RTO and RPO.

Answer

To test the disaster recovery plan

Answer

To assign roles and responsibilities during a disaster

Answer

To select a hot site vendor

Question 13

A company is implementing PCI DSS compliance. Which requirement is related to protecting cardholder data at rest?

Accepted Answer

Protect stored cardholder data. PCI DSS Requirement 3 is to protect stored cardholder data, often through encryption or tokenization.

Answer

Restrict physical access to cardholder data

Answer

Encrypt transmission of cardholder data over open networks

Answer

Install and maintain a firewall configuration

Question 14

An organization has identified a risk with a high likelihood and high impact. Management decides to implement controls to reduce the likelihood. After controls, the risk is reassessed as medium likelihood and medium impact. What is the residual risk?

Accepted Answer

Medium likelihood, medium impact. Residual risk is the remaining risk after controls are applied. In this case, it is the medium likelihood and medium impact risk.

Answer

Low likelihood, low impact

Answer

High likelihood, high impact

Answer

Control risk is not a defined term

Question 15

Which TWO of the following are lawful bases for processing personal data under the GDPR? (Select two)

Accepted Answer

Consent of the data subject. Consent and legitimate interests are two of the lawful bases under Article 6 of the GDPR.

Answer

Data subject's employment status

Answer

Data subject's nationality

Answer

Profit maximization