CISSP Security and Risk Management Practice Test 4 — 15 Questions

Question 1

A security analyst is evaluating the risk of a data breach in a healthcare organization. The asset value of the patient database is $500,000, and the exposure factor is 0.2. The annual rate of occurrence is estimated at 0.1. What is the annualized loss expectancy (ALE)?

Accepted Answer

$10,000. ALE = ARO × SLE, and SLE = AV × EF = $500,000 × 0.2 = $100,000. Then ALE = 0.1 × $100,000 = $10,000.

Answer

$5,000

Answer

$50,000

Answer

$100,000

Question 2

Which of the following is the correct order of the ISC2 Code of Ethics canons from highest to lowest priority?

Accepted Answer

Protect society, act honorably, provide diligent service, advance the profession. The ISC2 Code of Ethics canons are, in priority order: Protect society, the common good, and the public trust; Act honorably, honestly, and justly; Provide diligent and competent service to principals; and Advance and protect the profession.

Answer

Act honorably, protect society, provide diligent service, advance the profession

Answer

Advance the profession, protect society, act honorably, provide diligent service

Answer

Provide diligent service, advance the profession, protect society, act honorably

Question 3

An organization is implementing a new access control system. They want to ensure that users are who they claim to be, that actions can be traced to individuals, and that access rights are managed appropriately. Which framework encompasses all three of these goals?

Accepted Answer

AAA framework. The AAA framework (Authentication, Authorization, and Accounting) covers identification/authentication, authorization (access rights), and accounting (audit trails for non-repudiation).

Answer

COBIT 2019

Answer

CIA triad

Answer

ISO/IEC 27001

Question 4

Under the GDPR, a data controller experiences a personal data breach that is likely to result in a risk to the rights and freedoms of individuals. What is the maximum time frame within which the controller must notify the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to rights and freedoms.

Answer

24 hours

Answer

48 hours

Answer

7 days

Question 5

Which type of risk remains after management has implemented controls to mitigate the identified risks?

Accepted Answer

Residual risk. Residual risk is the risk that remains after controls are applied. Inherent risk is the risk before controls.

Answer

Acceptable risk

Answer

Control risk

Answer

Inherent risk

Question 6

A financial institution is required to comply with SOX. Which of the following is a key focus area for IT under SOX?

Accepted Answer

IT general controls for financial systems. SOX requires publicly traded companies to establish and maintain internal controls over financial reporting. IT general controls (ITGC) are critical for ensuring the integrity of financial systems.

Answer

Encryption of data at rest

Answer

Breach notification procedures

Answer

Privacy of customer data

Question 7

During a business impact analysis (BIA), which metric represents the maximum amount of time a business process can be disrupted before causing significant harm to the organization?

Accepted Answer

Maximum Tolerable Period of Disruption (MTPD). Maximum Tolerable Period of Disruption (MTPD) or Maximum Tolerable Downtime (MTD) is the longest time a process can be unavailable before causing severe damage. RTO is the recovery time objective, RPO is recovery point objective, and WRT is work recovery time.

Answer

Work Recovery Time (WRT)

Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Question 8

In qualitative risk analysis, a risk is assessed with a likelihood of 4 (on a scale of 1-5) and an impact of 5. The risk matrix defines scores of 15-25 as high. What is the risk rating?

Accepted Answer

High. Likelihood × Impact = 4 × 5 = 20, which falls in the high range (15-25).

Answer

Low

Answer

Medium

Answer

Critical

Question 9

Which document is mandatory, high-level, and sets the direction for security within an organization?

Accepted Answer

Policy. A security policy is a high-level, mandatory document that establishes the overall security direction and principles. Standards, baselines, guidelines, and procedures are more detailed.

Answer

Standard

Answer

Procedure

Answer

Baseline

Question 10

Under HIPAA, a covered entity must have a Business Associate Agreement (BAA) with which of the following?

Accepted Answer

A cloud service provider hosting ePHI. A BAA is required with a business associate, which is a person or entity that performs certain functions or activities involving the use or disclosure of PHI on behalf of a covered entity. A cloud service provider that stores ePHI is a business associate.

Answer

A janitorial service that cleans the office

Answer

A government regulator conducting an audit

Answer

A patient requesting their medical records

Question 11

An organization wants to avoid a particular risk entirely by not engaging in the activity that creates the risk. Which risk response strategy is being used?

Accepted Answer

Avoid. Risk avoidance involves eliminating the risk by not performing the activity that causes it. Transfer shifts risk to a third party, mitigate reduces impact/likelihood, and accept acknowledges the risk.

Answer

Transfer

Answer

Mitigate

Answer

Accept

Question 12

Which component of the CIA triad ensures that information is not disclosed to unauthorized individuals, entities, or processes?

Accepted Answer

Confidentiality. Confidentiality ensures that information is accessible only to those authorized. Integrity ensures accuracy and completeness, and availability ensures timely access.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 13

A company is designing a disaster recovery plan. They need to recover critical systems within 4 hours and lose no more than 15 minutes of data. Which combination of RTO and RPO should be specified?

Accepted Answer

RTO = 4 hours, RPO = 15 minutes. RTO (Recovery Time Objective) is the maximum acceptable downtime, here 4 hours. RPO (Recovery Point Objective) is the maximum acceptable data loss, here 15 minutes.

Answer

RTO = 15 minutes, RPO = 4 hours

Answer

RTO = 4 hours, RPO = 4 hours

Answer

RTO = 15 minutes, RPO = 15 minutes

Question 14

Which governance framework is specifically designed to help organizations manage and protect their information assets by providing a comprehensive set of controls based on a risk management approach?

Accepted Answer

ISO/IEC 27001. ISO/IEC 27001 is an international standard for information security management systems (ISMS) that provides a risk-based approach to managing information security.

Answer

NIST Cybersecurity Framework

Answer

COBIT 2019

Answer

ITIL

Question 15

A company is implementing a hot site as a disaster recovery option. Which of the following best describes a hot site?

Accepted Answer

A facility that is fully configured and ready to operate within hours. A hot site is a fully equipped backup facility that is ready to take over operations immediately, including hardware, software, and data synchronization.

Answer

A facility with basic infrastructure but no equipment

Answer

A reciprocal agreement with another company to share space

Answer

A facility with some equipment but not fully operational