CISSP Security and Risk Management Practice Test 3 — 15 Questions

Question 1

A company is outsourcing its customer support operations to a third-party vendor. The vendor will have access to sensitive customer data. Which of the following should be the primary security requirement in the contract with the vendor?

Accepted Answer

The vendor must comply with the company's security policies and standards.. Option B is correct because the contract must mandate that the vendor adheres to the company's security policies and standards to ensure consistent protection. Option A is incorrect because while background checks are important, they are not the primary contractual requirement. Option C is incorrect because the company should not rely solely on vendor self-assessment. Option D is incorrect because penetration testing is a specific activity, but the overarching requirement is compliance with policies.

Answer

The vendor must perform annual penetration testing.

Answer

The vendor must conduct background checks on all employees.

Answer

The vendor must provide a list of all subcontractors.

Question 2

During a risk communication session, the security team needs to present risk analysis results to executive management. Which approach is most effective for this audience?

Accepted Answer

A high-level summary highlighting top risks and recommended actions. Option D is correct because executive management prefers high-level summaries that focus on business impact, strategic risk, and resource needs. Option A is incorrect because technical details may overwhelm executives. Option B is incorrect because showing only raw data without analysis requires more effort from the audience. Option C is incorrect because it is too detailed for a high-level audience.

Answer

Raw data from the risk assessment without interpretation

Answer

A comprehensive report with all risk register entries

Answer

Detailed technical explanations of each vulnerability

Question 3

A security manager is conducting a risk assessment for a new cloud application. The manager needs to estimate the potential financial loss from a data breach. Which approach should be used?

Accepted Answer

Quantitative risk analysis using annualized loss expectancy (ALE). Quantitative risk analysis assigns monetary values to assets, threats, and impacts, allowing calculation of SLE, ARO, and ALE. Qualitative analysis uses subjective scales and is not monetary.

Answer

Scenario-based risk analysis with ordinal scales

Answer

Qualitative risk analysis using high/medium/low ratings

Answer

Benchmarking against industry standards

Question 4

A multinational company must comply with the EU General Data Protection Regulation (GDPR) for processing personal data of EU citizens. The company's data protection officer (DPO) has been appointed but reports to the Chief Marketing Officer (CMO). Which compliance issue is most critical?

Accepted Answer

The DPO must report directly to the board of directors or CEO. Under the GDPR, the Data Protection Officer (DPO) must report directly to the highest level of management, typically the board of directors or CEO, to ensure independence and authority. Reporting to the Chief Marketing Officer (CMO) creates a conflict of interest because the CMO oversees marketing activities that often involve extensive personal data processing, compromising the DPO's ability to provide unbiased oversight. This structural subordination is the most critical compliance issue as it directly undermines the DPO's statutory role under Article 38(3) of the GDPR.

Answer

The DPO should not hold any other role within the organization

Answer

The DPO must be a lawyer certified in data protection

Answer

The DPO must be located in the EU

Question 5

During a business impact analysis (BIA), the team identifies that the customer service application must be restored within 4 hours of a disruption. What is the term for this metric?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable time that a business process or application can be unavailable after a disruption. In this scenario, the 4-hour restoration requirement for the customer service application directly matches the RTO metric, which drives the design of recovery strategies and resource allocation.

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Point Objective (RPO)

Answer

Service Level Agreement (SLA)

Question 6

An organization is developing a security governance framework to align with business objectives. Which group should have ultimate authority and responsibility for the cybersecurity program?

Accepted Answer

Board of directors. Security governance is a board-level responsibility. The board of directors ensures that cybersecurity aligns with business strategy and risk appetite.

Answer

IT steering committee

Answer

Chief Information Security Officer (CISO)

Answer

Chief Executive Officer (CEO)

Question 7

A security analyst discovers that an employee shared confidential customer data with an unauthorized third party. The analyst reports this to the CISO, who decides to terminate the employee. Which ethical principle from the (ISC)² Code of Ethics is most directly violated by the employee?

Accepted Answer

Protect society, the common good, necessary public trust and confidence, and the infrastructure. The (ISC)² Code of Ethics Canon 1: Protect society, the common good, necessary public trust and confidence, and the infrastructure. Disclosing confidential data undermines trust and harms society.

Answer

Provide diligent and competent service to principals

Answer

Advance and protect the profession

Answer

Act honorably, honestly, justly, responsibly, and legally

Question 8

A company has implemented data classification labels such as 'Public', 'Internal', 'Confidential', and 'Restricted'. Which control is most appropriate for protecting 'Confidential' data?

Accepted Answer

Encryption at rest and in transit. Confidential data requires encryption both at rest and in transit to prevent unauthorized disclosure.

Answer

Data masking for all users

Answer

Removing all access controls to streamline sharing

Answer

Public posting on the company website

Question 9

A business is evaluating risk treatment options for a high-likelihood, low-impact risk. The cost of mitigation exceeds the potential loss. Which risk treatment strategy is most appropriate?

Accepted Answer

Risk acceptance with documented decision. Risk acceptance is appropriate when the cost of mitigation exceeds the potential loss and the risk is within the organization's risk appetite.

Answer

Risk transfer by purchasing insurance

Answer

Risk mitigation by implementing additional controls

Answer

Risk avoidance by discontinuing the activity

Question 10

A financial institution is required to retain customer transaction records for seven years under regulatory mandates. The institution is facing a lawsuit and must preserve all relevant data. What legal concept applies?

Accepted Answer

Legal hold. A legal hold (or litigation hold) requires organizations to preserve potentially relevant evidence when litigation is anticipated or ongoing.

Answer

E-discovery

Answer

Data retention policy

Answer

Chain of custody

Question 11

A business continuity coordinator is planning a test of the disaster recovery plan. Which type of test involves a walk-through of the plan with key stakeholders without actually invoking the technical recovery?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based session where team members review their roles and actions in a simulated scenario.

Answer

Full interruption test

Answer

Checklist review

Answer

Parallel test

Question 12

Which TWO are examples of administrative controls in an information security program?

Accepted Answer

Background checks. Administrative controls involve policies, procedures, and people. Security awareness training and background checks are administrative. Firewalls, ACLs, and encryption are technical/physical.

Answer

Encryption algorithms

Answer

Firewall rules

Answer

Access control lists (ACLs)

Question 13

Which TWO are essential components of a security policy framework?

Accepted Answer

Roles and responsibilities. A security policy framework includes high-level policies that define scope, responsibilities, and governance. Standards and procedures operationalize policies, but the core policy document includes scope and roles.

Answer

Specific encryption key lengths

Answer

Incident response flowcharts

Answer

Network topology diagrams

Question 14

Which THREE are key components of a business continuity plan (BCP)?

Accepted Answer

Backup strategies. Backup strategies are a core component of a BCP because they ensure that critical data and systems can be restored after a disruption. Without defined backup procedures (e.g., frequency, media rotation, off-site storage), the organization cannot recover its operational state, making this a fundamental technical requirement for continuity.

Answer

Vendor risk assessments

Answer

System hardening standards

Question 15

Refer to the exhibit. The network administrator applies this access control list to the inbound interface of a router connecting to the internet. Which type of access control model is being implemented?

Accepted Answer

Rule-Based Access Control. The access control list (ACL) applied to the inbound interface of a router connecting to the internet enforces traffic filtering based on a set of predefined rules (e.g., permit or deny statements based on source IP, destination IP, port numbers). This is the essence of Rule-Based Access Control (RBAC), where access decisions are governed by a global set of rules applied uniformly to all subjects, independent of user identity or roles. The ACL does not allow individual users to change permissions (eliminating DAC), does not use security labels or clearances (eliminating MAC), and does not map permissions to job roles (eliminating Role-Based Access Control).

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)