CISSP Security and Risk Management — Timed 40 Questions

Question 1

An organization is implementing a new access control system. Which of the following represents the correct order of the AAA framework components?

Accepted Answer

Authentication, Authorization, Accounting. The AAA framework stands for Authentication, Authorization, and Accounting, in that order. First, a user's identity is verified, then permissions are checked, and finally activities are logged.

Answer

Authorization, Authentication, Accounting

Answer

Authentication, Accounting, Authorization

Answer

Accounting, Authentication, Authorization

Question 2

A security analyst is evaluating the risk of a data breach. The asset value of the database is $100,000, and the exposure factor is 0.5. If the annual rate of occurrence is 0.2, what is the annualized loss expectancy (ALE)?

Accepted Answer

$10,000. SLE = AV * EF = $100,000 * 0.5 = $50,000. ALE = SLE * ARO = $50,000 * 0.2 = $10,000.

Answer

$100,000

Answer

$50,000

Answer

$20,000

Question 3

Under the ISC2 Code of Ethics, which canon takes precedence over all others?

Accepted Answer

Protect society, the common good, and the infrastructure. The first canon is to protect society, the common good, and the public trust. It is the highest priority.

Answer

Provide diligent and competent service to principals

Answer

Act honorably, honestly, justly, responsibly, and legally

Answer

Advance and protect the profession

Question 4

A company is migrating its critical application to a cloud provider. Which disaster recovery strategy provides the shortest recovery time objective (RTO) and recovery point objective (RPO)?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and real-time data synchronization, minimizing RTO and RPO.

Answer

Warm site

Answer

Cold site

Answer

Reciprocal agreement

Question 5

Which governance framework provides guidance specifically for aligning IT services with business needs and includes a service lifecycle?

Accepted Answer

ITIL. ITIL (Information Technology Infrastructure Library) is a set of practices for IT service management that focuses on aligning IT services with business needs.

Answer

ISO/IEC 27001

Answer

NIST Cybersecurity Framework

Answer

COBIT 2019

Question 6

In a qualitative risk assessment, a risk with a likelihood rating of 'High' and an impact rating of 'Critical' would typically fall into which category?

Accepted Answer

High risk. In a typical 5x5 risk matrix, high likelihood and critical impact place the risk in the 'High' or 'Extreme' risk category, requiring immediate action.

Answer

Medium risk

Answer

Low risk

Answer

De minimis risk

Question 7

Which of the following is an example of a security policy?

Accepted Answer

All employees must use multi-factor authentication. A policy is a high-level mandatory statement that reflects management's intent. 'All employees must use multi-factor authentication' is a mandatory directive.

Answer

Step 1: Log in, Step 2: Enter code, Step 3: Access system

Answer

It is recommended to change passwords every 90 days

Answer

Use passwords of at least 12 characters with mixed case and numbers

Question 8

Under GDPR, which of the following is a valid lawful basis for processing personal data?

Accepted Answer

Vital interests. GDPR Article 6 lists lawful bases including consent, contract, legal obligation, vital interests, public task, and legitimate interests. 'Vital interests' is a valid basis.

Answer

Corporate policy

Answer

Profit motive

Answer

Marketing preference

Question 9

A hospital is subject to HIPAA. Which of the following is required when sharing protected health information (PHI) with a third-party billing company?

Accepted Answer

Business Associate Agreement. Under HIPAA, covered entities must have a Business Associate Agreement (BAA) with business associates that handle PHI.

Answer

Annual audit report

Answer

Patient consent

Answer

Data Protection Impact Assessment

Question 10

In a quantitative risk analysis, if the single loss expectancy (SLE) is $15,000 and the annual rate of occurrence (ARO) is 0.5, what is the annualized loss expectancy (ALE)?

Accepted Answer

$7,500. ALE = SLE * ARO = $15,000 * 0.5 = $7,500.

Answer

$30,000

Answer

$15,000

Answer

$75,000

Question 11

Which of the following is a key objective of a business impact analysis (BIA)?

Accepted Answer

Determine the maximum tolerable downtime for critical processes. BIA identifies critical business processes and their recovery requirements such as RTO, RPO, and maximum tolerable downtime.

Answer

Implement security controls

Answer

Identify vulnerabilities in the network

Answer

Test the disaster recovery plan

Question 12

Under the Sarbanes-Oxley Act (SOX), which of the following is an example of an IT general control that supports financial reporting?

Accepted Answer

Change management process for the financial system. IT general controls (ITGC) include access controls, change management, backup and recovery, and computer operations. Change management ensures that changes to financial systems are authorized and tested.

Answer

Data encryption for customer PII

Answer

Firewall rule to block unauthorized traffic

Answer

Automated calculation of interest on loans

Question 13

A security manager is choosing a risk response for a high-impact, high-likelihood risk. Which TWO responses are most appropriate? (Select TWO)

Accepted Answer

Risk mitigation. For high-impact, high-likelihood risks, avoidance (eliminating the activity) or mitigation (reducing impact/likelihood) are common. Transfer (insurance) may also be used but is less comprehensive. Acceptance is for low risks.

Answer

Risk research

Answer

Risk acceptance

Answer

Risk deferral

Question 14

Which THREE of the following are data subject rights under the GDPR? (Select THREE)

Accepted Answer

Right to object to processing. GDPR grants rights including right to erasure, right to data portability, and right to rectification. Right to remuneration is not a data subject right.

Answer

Right to remuneration

Question 15

A company is implementing PCI DSS compliance. Which THREE requirements are part of the PCI DSS? (Select THREE)

Accepted Answer

Encrypt transmission of cardholder data across open, public networks. PCI DSS has 12 requirements including installing firewalls, encrypting cardholder data, and restricting physical access. Implementing MFA for all users is not a specific requirement (though it may be part of access control).

Answer

Use only approved encryption algorithms for stored data

Answer

Implement multi-factor authentication for all employees

Question 16

Which of the following is the primary purpose of the CIA triad in information security?

Accepted Answer

To define the core objectives of information security. The CIA triad—Confidentiality, Integrity, and Availability—provides a foundational model for developing security policies and ensuring that data is protected from unauthorized access, tampering, and downtime.

Answer

To establish a framework for risk management

Answer

To ensure compliance with regulatory requirements

Answer

To balance security controls with usability

Question 17

An organization is implementing a new access control system. The security team wants to ensure that users cannot deny having performed an action. Which security principle is being addressed?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a party cannot deny the authenticity of their signature or the sending of a message. In access control, this is often achieved through audit logs and digital signatures.

Answer

Availability

Answer

Integrity

Answer

Confidentiality

Question 18

A company uses a qualitative risk analysis matrix where likelihood ranges from 1 to 5 and impact ranges from 1 to 5. A risk with a likelihood of 4 and an impact of 5 would fall into which risk level if the matrix defines high risk as scores above 15, medium as 10-15, and low as below 10?

Accepted Answer

High. In qualitative risk analysis using a 5x5 matrix, the score is typically the product of likelihood and impact. 4 x 5 = 20, which is above 15, indicating high risk.

Answer

Medium

Answer

Critical

Answer

Low

Question 19

During a business impact analysis (BIA), the recovery point objective (RPO) for a critical database is determined to be 2 hours. What does this mean?

Accepted Answer

Data backups must be taken at least every 2 hours. RPO defines the maximum acceptable data loss measured in time. An RPO of 2 hours means that data can be lost up to the last 2 hours before the disruption.

Answer

Data can be recovered from any point within the past 2 hours

Answer

The maximum tolerable downtime is 2 hours

Answer

The database must be fully recovered within 2 hours of a disaster

Question 20

Which of the following is a key requirement under the GDPR regarding personal data breaches?

Accepted Answer

Notify the supervisory authority within 72 hours. GDPR Article 33 requires data controllers to notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to rights and freedoms.

Answer

Conduct a privacy impact assessment within 30 days

Answer

Report the breach to law enforcement immediately

Answer

Notify affected individuals within 24 hours