CISSP Security and Risk Management Practice Test 4 — 15 Questions

Question 1

A company is implementing PCI DSS compliance. Which requirement is related to protecting cardholder data at rest?

Accepted Answer

Protect stored cardholder data. PCI DSS Requirement 3 is 'Protect stored cardholder data,' which specifically addresses data at rest through encryption, truncation, masking, and hashing. This requirement mandates protections for cardholder data wherever it is stored, including databases, files, and backups.

Answer

Restrict physical access to cardholder data

Answer

Encrypt transmission of cardholder data over open networks

Answer

Install and maintain a firewall configuration

Question 2

An organization has identified a risk with a high likelihood and high impact. Management decides to implement controls to reduce the likelihood. After controls, the risk is reassessed as medium likelihood and medium impact. What is the residual risk?

Accepted Answer

Medium likelihood, medium impact. Residual risk is the risk that remains after controls have been implemented. In this scenario, the original risk was high likelihood and high impact; after controls, it is reassessed as medium likelihood and medium impact. Therefore, the residual risk is medium likelihood and medium impact.

Answer

Low likelihood, low impact

Answer

High likelihood, high impact

Answer

Control risk is not a defined term

Question 3

Which TWO of the following are lawful bases for processing personal data under the GDPR? (Select two)

Accepted Answer

Consent of the data subject. Option C (Consent of the data subject) is correct because Article 6(1)(a) of the GDPR expressly lists the data subject's consent as a lawful basis for processing personal data, provided it is freely given, specific, informed, and unambiguous. Option D (Legitimate interests of the controller) is correct because Article 6(1)(f) recognizes the legitimate interests pursued by the controller or a third party as a lawful basis, subject to a balancing test against the data subject's rights and freedoms. Options A (employment status) and B (nationality) are not lawful bases; they are merely categories of personal data, and nationality can even constitute special category data under Article 9. Option E (profit maximization) is not a lawful basis; it is a business objective that must still be grounded in one of the Article 6(1) legal grounds, such as legitimate interests, to be lawful.

Answer

Data subject's employment status

Answer

Data subject's nationality

Answer

Profit maximization

Question 4

Which THREE of the following are key components of a disaster recovery plan for a hot site? (Select three)

Accepted Answer

Pre-installed servers and workstations. A hot site is a fully equipped alternate facility that is ready to operate almost immediately, so pre-installed servers and workstations (A) are essential components because they eliminate procurement and build time during failover. Real-time data replication from the primary site (C) is also required so the hot site holds current, usable data with minimal RPO, typically achieved through synchronous or asynchronous replication. Network connectivity with sufficient bandwidth to support operations (D) is likewise critical, since the hot site must carry production traffic and connect users, systems, and replicated data without performance degradation. Option B describes a cold site, which provides only space, power, and cooling with no pre-installed equipment, and option E describes a cold or warm site characteristic, since a hot site is designed for rapid activation, often within minutes or hours, not weeks.

Answer

Empty space with power and cooling only

Answer

Long lead time to activate (e.g., weeks)

Question 5

Which TWO of the following are examples of non-repudiation controls? (Select two)

Accepted Answer

Audit logs with timestamps. Audit logs with timestamps (C) are a non-repudiation control because they create a tamper-evident, time-stamped record of who did what and when, so a user cannot later credibly deny having performed an action. Digital signatures (D) provide non-repudiation by cryptographically binding a signer's private key to the message, allowing any party to verify origin and integrity and preventing the signer from denying the signature. Firewall rules (A) are a network access control that filters traffic, not a mechanism for proving an action occurred. Encryption of data at rest (B) provides confidentiality, not proof of origin or action. Biometric authentication (E) provides strong authentication (something you are) but by itself does not prevent a user from denying an action after authentication.

Answer

Firewall rules

Answer

Encryption of data at rest

Answer

Biometric authentication

Question 6

A security analyst is evaluating the risk of a data breach in a healthcare organization. The asset value of the patient database is $500,000, and the exposure factor is 0.2. The annual rate of occurrence is estimated at 0.1. What is the annualized loss expectancy (ALE)?

Accepted Answer

$10,000. The Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO). SLE = Asset Value × Exposure Factor = $500,000 × 0.2 = $100,000. ALE = SLE × ARO = $100,000 × 0.1 = $10,000. Therefore, the ALE is $10,000.

Answer

$5,000

Answer

$50,000

Answer

$100,000

Question 7

Which of the following is the correct order of the ISC2 Code of Ethics canons from highest to lowest priority?

Accepted Answer

Protect society, act honorably, provide diligent service, advance the profession. The ISC2 Code of Ethics canons are ordered by priority: (1) Protect society, the common good, necessary public trust and confidence, and the infrastructure; (2) Act honorably, honestly, justly, responsibly, and legally; (3) Provide diligent and competent service to principals; (4) Advance and protect the profession. Option A lists them in this exact order, making it correct. This hierarchy is critical because when canons conflict, the higher one must take precedence.

Answer

Act honorably, protect society, provide diligent service, advance the profession

Answer

Advance the profession, protect society, act honorably, provide diligent service

Answer

Provide diligent service, advance the profession, protect society, act honorably

Question 8

An organization is implementing a new access control system. They want to ensure that users are who they claim to be, that actions can be traced to individuals, and that access rights are managed appropriately. Which framework encompasses all three of these goals?

Accepted Answer

AAA framework. The AAA framework directly addresses the three stated goals: Authentication verifies that users are who they claim to be, Authorization determines what resources they can access and manages their rights, and Accounting (or Auditing) ensures that actions can be traced back to individuals through logging and auditing. This triad of functions is the foundational model for access control in information security, making it the exact match for the question's requirements.

Answer

COBIT 2019

Answer

CIA triad

Answer

ISO/IEC 27001

Question 9

Under the GDPR, a data controller experiences a personal data breach that is likely to result in a risk to the rights and freedoms of individuals. What is the maximum time frame within which the controller must notify the supervisory authority?

Accepted Answer

72 hours. Article 33 of the GDPR requires that a controller notify the competent supervisory authority of a personal data breach likely to result in a risk to the rights and freedoms of natural persons without undue delay and, where feasible, no later than 72 hours after becoming aware of it. This 72-hour window is the regulatory maximum, and failure to meet it must be accompanied by reasons for the delay. The 72-hour clock starts when the controller becomes aware, not when the breach occurred.

Answer

24 hours

Answer

48 hours

Answer

7 days

Question 10

Which type of risk remains after management has implemented controls to mitigate the identified risks?

Accepted Answer

Residual risk. Residual risk is the risk that remains after controls have been implemented to mitigate the identified risks. It is the difference between inherent risk (risk before controls) and the effect of the controls. Management must decide whether the residual risk is within the organization's risk appetite or requires further treatment.

Answer

Acceptable risk

Answer

Control risk

Answer

Inherent risk

Question 11

A financial institution is required to comply with SOX. Which of the following is a key focus area for IT under SOX?

Accepted Answer

IT general controls for financial systems. SOX Section 404 requires management to assess and auditors to attest to the effectiveness of internal controls over financial reporting (ICFR). IT general controls (ITGCs) — change management, access control, IT operations, and SDLC controls — are the primary mechanism by which IT supports that assertion for financial systems. Encryption, breach notification, and privacy are important but are not the defining IT compliance focus of SOX.

Answer

Encryption of data at rest

Answer

Breach notification procedures

Answer

Privacy of customer data

Question 12

During a business impact analysis (BIA), which metric represents the maximum amount of time a business process can be disrupted before causing significant harm to the organization?

Accepted Answer

Maximum Tolerable Period of Disruption (MTPD). The Maximum Tolerable Period of Disruption (MTPD) is the metric defined during a BIA that captures the absolute upper bound of time a business process can be unavailable before the organization suffers unacceptable or significant harm. It is derived from business-side impact analysis (financial, regulatory, reputational) rather than technical recovery capabilities, and it serves as the ceiling from which RTO is derived. Because MTPD represents the business's tolerance limit, it is the correct answer for the maximum disruption time before significant harm.

Answer

Work Recovery Time (WRT)

Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Question 13

In qualitative risk analysis, a risk is assessed with a likelihood of 4 (on a scale of 1-5) and an impact of 5. The risk matrix defines scores of 15-25 as high. What is the risk rating?

Accepted Answer

High. In qualitative risk analysis, the risk score is calculated by multiplying likelihood by impact. Here, likelihood = 4 and impact = 5, so the risk score = 4 × 5 = 20. The risk matrix defines scores of 15–25 as high, so a score of 20 falls into the high category. Therefore, the risk rating is High.

Answer

Low

Answer

Medium

Answer

Critical

Question 14

Which document is mandatory, high-level, and sets the direction for security within an organization?

Accepted Answer

Policy. A security policy is a mandatory, high-level document that defines an organization's security objectives, principles, and management intent. It sets direction and assigns responsibility without prescribing specific technical implementations. Standards, procedures, and baselines all derive from and must comply with the policy, making policy the authoritative top-level document.

Answer

Standard

Answer

Procedure

Answer

Baseline

Question 15

Under HIPAA, a covered entity must have a Business Associate Agreement (BAA) with which of the following?

Accepted Answer

A cloud service provider hosting ePHI. Under HIPAA, a covered entity must have a Business Associate Agreement (BAA) with a cloud service provider that hosts electronic protected health information (ePHI). This is because the cloud provider is a business associate, as it creates, receives, maintains, or transmits ePHI on behalf of the covered entity. The BAA ensures the business associate safeguards the ePHI and complies with HIPAA.

Answer

A janitorial service that cleans the office

Answer

A government regulator conducting an audit

Answer

A patient requesting their medical records