CISSP Security and Risk Management Practice Test 5 — 15 Questions

Question 1

An organization wants to avoid a particular risk entirely by not engaging in the activity that creates the risk. Which risk response strategy is being used?

Accepted Answer

Avoid. Risk avoidance is the strategy of eliminating the risk by not performing the activity that creates it — for example, deciding not to store credit card data at all to avoid PCI DSS exposure. It is the only strategy that reduces risk to zero for that specific activity, though it may forfeit business benefits. The question's phrasing 'not engaging in the activity' is the textbook definition of avoidance.

Answer

Transfer

Answer

Mitigate

Answer

Accept

Question 2

Which component of the CIA triad ensures that information is not disclosed to unauthorized individuals, entities, or processes?

Accepted Answer

Confidentiality. Confidentiality is the core security objective that ensures information is not disclosed to unauthorized individuals, entities, or processes. It is achieved through mechanisms such as encryption, access control lists, and data classification. The CIA triad defines confidentiality as the opposite of disclosure, directly matching the question's wording. Thus, option D is correct.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 3

A company is designing a disaster recovery plan. They need to recover critical systems within 4 hours and lose no more than 15 minutes of data. Which combination of RTO and RPO should be specified?

Accepted Answer

RTO = 4 hours, RPO = 15 minutes. RTO (Recovery Time Objective) defines the maximum acceptable downtime — how long until systems are restored — so 4 hours matches the requirement to recover critical systems within 4 hours. RPO (Recovery Point Objective) defines the maximum acceptable data loss measured in time, so 15 minutes matches the requirement to lose no more than 15 minutes of data. Option C is the only pairing that maps each objective to its correct definition.

Answer

RTO = 15 minutes, RPO = 4 hours

Answer

RTO = 4 hours, RPO = 4 hours

Answer

RTO = 15 minutes, RPO = 15 minutes

Question 4

A company is implementing a hot site as a disaster recovery option. Which of the following best describes a hot site?

Accepted Answer

A facility that is fully configured and ready to operate within hours. A hot site is a fully configured disaster recovery facility that is ready to operate within hours (or immediately). It contains all necessary hardware, software, data, and network connectivity, often with near-real-time replication, allowing the organization to resume operations quickly after a disaster.

Answer

A facility with basic infrastructure but no equipment

Answer

A reciprocal agreement with another company to share space

Answer

A facility with some equipment but not fully operational

Question 5

Under the GDPR, which THREE of the following are rights of data subjects? (Select THREE.)

Accepted Answer

Right to erasure (right to be forgotten). The GDPR explicitly grants data subjects the right to erasure (also called the right to be forgotten) under Article 17, allowing individuals to request deletion of personal data when there is no compelling reason for continued processing, so option A is correct. Option D, the right to data portability under Article 20, is correct because it lets data subjects receive their personal data in a structured, commonly used, machine-readable format and transmit it to another controller. Option E, the right to access under Article 15, is correct because data subjects may obtain confirmation of whether their personal data is being processed and receive a copy along with related information. Option B is not a recognized GDPR right, as there is no 'right to ignore processing'; the closest concept is the right to object under Article 21, which is different. Option C is not a GDPR right either, since the regulation does not grant a right to sell data and instead imposes strict conditions on lawful processing and consent.

Answer

Right to ignore processing

Answer

Right to sell data

Question 6

In the context of business continuity planning, which THREE of the following are typically identified during a business impact analysis (BIA)? (Select THREE.)

Accepted Answer

Critical business processes. A BIA identifies critical business processes (A) because it must determine which functions are essential to the organization's survival and prioritize them for recovery. It also establishes the maximum tolerable downtime (B), the longest time a process can be unavailable before causing unacceptable harm, which drives recovery strategies. The recovery point objective (D) is likewise derived during the BIA, defining the maximum acceptable data loss measured in time and setting backup frequency requirements. Preferred vendor contracts (C) are procurement/legal artifacts addressed during recovery planning or supply-chain review, not core BIA outputs. Employee performance metrics (E) belong to HR performance management and are unrelated to continuity impact analysis.

Answer

Preferred vendor contracts

Answer

Employee performance metrics

Question 7

An organization's security policy requires that all data at rest must be encrypted. Which security principle is primarily being addressed?

Accepted Answer

Confidentiality. Encryption of data at rest protects data from unauthorized disclosure by rendering it unreadable without the decryption key. This directly addresses the confidentiality principle of the CIA triad, ensuring only authorized parties can access the data. Integrity concerns unauthorized modification, availability concerns uptime, and non-repudiation concerns proving an action occurred.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 8

A company is implementing a risk management program. They have identified a critical server with an asset value of $50,000. The exposure factor due to a potential threat is 40%, and the annual rate of occurrence is 2. What is the Annualized Loss Expectancy (ALE)?

Accepted Answer

$40,000. ALE = SLE × ARO, where SLE = Asset Value × Exposure Factor. Here SLE = $50,000 × 0.40 = $20,000, and ARO = 2, so ALE = $20,000 × 2 = $40,000. This quantifies the expected annual monetary loss from the threat, which is used to justify security controls whose cost is less than the ALE.

Answer

$50,000

Answer

$20,000

Answer

$100,000

Question 9

During a Business Impact Analysis (BIA), the maximum amount of time a business process can be unavailable before causing significant harm is determined. Which metric represents this?

Accepted Answer

Maximum Tolerable Period of Disruption (MTPD). The Maximum Tolerable Period of Disruption (MTPD) is the metric that defines the longest time a business process can be unavailable before its disruption causes unacceptable harm to the organization. It is determined during the BIA and sets the upper bound from which RTO and RPO are derived. MTPD is sometimes called Maximum Allowable Downtime (MAD).

Answer

Work Recovery Time (WRT)

Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Question 10

A security manager is evaluating risk responses for a high-likelihood, low-impact risk. The cost of mitigation exceeds the potential loss. Which risk response strategy is most appropriate?

Accepted Answer

Accept. Risk acceptance is the appropriate response when the cost of mitigating a risk exceeds the potential loss and the risk falls within the organization's risk tolerance. For a high-likelihood, low-impact risk where mitigation is not cost-effective, accepting the risk (with documented awareness and monitoring) is the rational business decision.

Answer

Avoid

Answer

Mitigate

Answer

Transfer

Question 11

Under the ISC2 Code of Ethics, which canon has the highest priority?

Accepted Answer

Protect society. The ISC2 Code of Ethics canons are ordered by priority: Protect society, the common good, necessary public trust and confidence, and the infrastructure; Act honorably, honestly, justly, responsibly, and legally; Provide diligent and competent service to principals; and Advance and protect the profession. Therefore, 'Protect society' is the highest priority canon.

Answer

Advance the profession

Answer

Provide diligent service

Answer

Act honorably

Question 12

An organization is required to report a personal data breach to the supervisory authority within 72 hours. Which regulation imposes this requirement?

Accepted Answer

GDPR. The GDPR (General Data Protection Regulation) Article 33 mandates that controllers notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to rights and freedoms. This 72-hour window is a signature GDPR requirement. No other listed regulation imposes this specific timeline for personal data breaches.

Answer

PCI DSS

Answer

SOX

Answer

HIPAA

Question 13

A company's disaster recovery plan includes an agreement with another company to provide backup computing facilities in case of a disaster. The agreement allows the second company to use the facilities for its own operations if needed. This arrangement is best described as:

Accepted Answer

Reciprocal agreement. A reciprocal agreement is a mutual arrangement where two organizations agree to provide backup computing facilities to each other in the event of a disaster. Because the second company can also use the facilities for its own operations, the arrangement is explicitly reciprocal rather than a one-way commercial contract. Hot, warm, and cold sites are unilateral facility types owned or leased by the primary organization, not mutual sharing agreements.

Answer

Hot site

Answer

Warm site

Answer

Cold site

Question 14

Which THREE of the following are valid risk response strategies?

Accepted Answer

Transfer. Common risk responses include Avoid, Transfer, Mitigate, and Accept.

Answer

Eliminate

Answer

Ignore

Question 15

Under GDPR, which TWO of the following are valid lawful bases for processing personal data?

Accepted Answer

Consent. Under GDPR Article 6(1), the six lawful bases for processing personal data include consent (option C), where the data subject has given clear, specific, informed, and unambiguous agreement, and legitimate interest (option D), where processing is necessary for the legitimate interests pursued by the controller or a third party unless overridden by the data subject's rights and interests. These are both explicitly enumerated lawful bases, making C and D correct. Option A (data subject's employment) is not a lawful basis under Article 6; employment status is not one of the six grounds, though employment context may affect consent validity or other bases. Option B (data processor's request) is invalid because a processor acts only on the controller's documented instructions and cannot itself create a lawful basis for processing. Option E (data controller's profit) is not a recognized lawful basis; profit alone does not satisfy any Article 6 condition, though it might be considered under legitimate interest only if the balancing test is met.

Answer

Data subject's employment

Answer

Data processor's request

Answer

Data controller's profit