CISSP Security and Risk Management Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. A cloud security architect is designing access control for an S3 bucket. This policy is attached to an IAM role. Which access control model does this policy primarily implement?

Accepted Answer

Attribute-Based Access Control (ABAC). The policy uses an attribute (PrincipalTag/department) in the Condition to grant access. This is attribute-based access control (ABAC). It is not purely RBAC because the Role is not the only factor; the tag attribute is evaluated.

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Question 2

Refer to the exhibit. A security analyst reviews this syslog entry from a firewall. The firewall's ACL is configured to deny all traffic by default except what is explicitly permitted. This is an example of which security principle?

Accepted Answer

Least privilege. The principle of least privilege grants only necessary access; default-deny (deny all by default) is an implementation of this principle.

Answer

Separation of duties

Answer

Need to know

Answer

Defense in depth

Question 3

A small business wants to implement a risk management framework. Which approach is best for identifying risks?

Accepted Answer

Qualitative analysis. Qualitative analysis is cost-effective and does not require precise data, making it suitable for small businesses. Quantitative analysis is resource-intensive. Threat modeling is specific to certain scenarios. Penetration testing is a validation technique, not a broad risk identification method.

Answer

Quantitative analysis

Answer

Penetration testing

Answer

Threat modeling

Question 4

A multinational corporation must comply with GDPR and CCPA. Which data protection strategy should they prioritize?

Accepted Answer

Data minimization. Data minimization reduces the amount of personal data collected and stored, thereby limiting exposure and compliance burden. Encryption protects data but does not reduce collection. Data retention policies are secondary. Data masking is useful for specific use cases but not a primary strategy.

Answer

Data masking

Answer

Data retention

Answer

Data encryption

Question 5

During a risk assessment, a critical asset has a vulnerability with a CVSS score of 9.0. Which risk treatment strategy is most appropriate if the cost to mitigate exceeds the asset's value?

Accepted Answer

Transfer. Transferring the risk (e.g., via insurance) is appropriate when mitigation cost exceeds asset value. Acceptance would leave the organization exposed to high risk. Avoidance would mean eliminating the asset or activity, which may not be feasible. Mitigation is too costly.

Answer

Acceptance

Answer

Avoidance

Answer

Mitigation

Question 6

An organization is developing an information security policy. Which of the following should be included?

Accepted Answer

Roles and responsibilities. Security policies establish high-level roles and responsibilities, mandatory requirements, and scope. Detailed technical controls are more appropriate for standards or procedures. Vendor contracts and incident response playbooks are separate documents.

Answer

Incident response playbooks

Answer

Detailed technical controls

Answer

Vendor contracts

Question 7

A company experiences a data breach. Which step should be taken first according to best practices?

Accepted Answer

Contain the breach. Containing the breach is the immediate priority to prevent further damage. Notifying authorities and affected parties comes after containment. Assessing damage can happen concurrently but containment is first.

Answer

Inform affected parties

Answer

Notify law enforcement

Answer

Assess the damage

Question 8

A security manager is evaluating risk treatment options for a high-impact, low-probability risk. Which approach is most appropriate?

Accepted Answer

Transfer. For high-impact, low-probability risks, transferring (e.g., insurance) is often most cost-effective. Accepting may be too risky. Mitigating may not be justified due to low probability. Avoidance may be too disruptive.

Answer

Accept

Answer

Avoid

Answer

Mitigate

Question 9

Which security control is most effective for preventing unauthorized access to a data center?

Accepted Answer

Mantrap. A mantrap provides a physical barrier that prevents tailgating and ensures one person enters at a time. Biometrics and video surveillance are controls but less direct prevention. Access logs are detective.

Answer

Biometric authentication

Answer

Access logs

Answer

Video surveillance

Question 10

An organization is implementing a security awareness program. Which topic should be emphasized most?

Accepted Answer

Phishing recognition. Phishing is one of the most common attack vectors and requires user vigilance. Password policies are important but phishing directly exploits human error. Clean desk and social media are relevant but less critical.

Answer

Social media usage

Answer

Password policy

Answer

Clean desk policy

Question 11

A company is merging with another and must integrate security policies. What is the first step?

Accepted Answer

Conduct a gap analysis. A gap analysis identifies differences and overlaps between the two companies' policies, informing the integration plan. Adopting the stricter policy may cause disruption. Creating a new policy without understanding existing ones is premature. Training comes after integration.

Answer

Train all employees

Answer

Create a new policy

Answer

Adopt the stricter policy

Question 12

A security manager is selecting controls to protect sensitive data. Which TWO are examples of administrative controls?

Accepted Answer

Security awareness training. Administrative controls are policies, procedures, and training. Security awareness training (B) and background checks (D) are administrative. Firewalls (A) and encryption (C) are technical. Access control lists (E) are technical.

Answer

Firewalls

Answer

Access control lists

Answer

Encryption

Question 13

A risk assessment identifies several threats. Which THREE are considered external threats?

Accepted Answer

Hacktivist. External threats originate outside the organization. Hacktivist (B), natural disaster (C), and competitor (E) are external. Disgruntled employee (A) and insider error (D) are internal.

Answer

Insider error

Answer

Disgruntled employee

Question 14

Which TWO documents are considered foundational for an information security program?

Accepted Answer

Security policy. The security policy (A) defines overall governance and direction. The incident response plan (B) is a critical operational plan. Standards (C) and guidelines (D) are supporting, and baselines (E) are technical minimums.

Answer

Baseline

Answer

Guideline

Answer

Standard operating procedure

Question 15

Refer to the exhibit. Which security risk does this policy primarily introduce?

Accepted Answer

Unauthorized write access. The policy allows any principal (anyone) to perform the s3:PutObject action on the bucket, meaning anyone can upload objects. This introduces unauthorized write access risk. Read access is not allowed. Privilege escalation and DoS are not directly introduced.

Answer

Privilege escalation

Answer

Unauthorized read access

Answer

Denial of service

CISSP Security and Risk Management Practice Test 4 — 15 Questions

Exhibit

CISSP Security and Risk Management Practice Test 4 — 15 Questions

Exhibit