CISSP Security and Risk Management Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. A security analyst finds the above in a configuration file stored in a public GitHub repository. What is the most immediate risk?

Accepted Answer

Unauthorized authentication. The private key can be used to authenticate as the key owner, enabling unauthorized access to systems or data. Man-in-the-middle attacks are a risk if keys are compromised but less immediate. Loss of confidentiality is a broad category. Integrity violation is not the primary concern.

Answer

Man-in-the-middle attacks

Answer

Loss of confidentiality

Answer

Integrity violation

Question 2

You are the chief information security officer (CISO) of a large healthcare organization that handles protected health information (PHI). The organization has recently been acquired by a larger conglomerate, and the new parent company mandates that all subsidiaries adopt a single, unified risk management framework based on NIST SP 800-39. Your current framework is ISO 27005-based and has been effective for years. During the transition, you discover that the parent company's framework requires quantitative risk analysis for all critical assets, while your team has been primarily using qualitative analysis due to lack of accurate financial data. Moreover, the parent company expects all risk assessments to be completed within 30 days, a timeframe your team considers unrealistic given the number of assets. Several key stakeholders are concerned about the additional resource burden and potential disruption to operations. You need to propose a course of action that balances compliance with the parent company's mandate while maintaining operational effectiveness and minimizing risk to patient data.

Accepted Answer

Conduct a gap analysis between ISO 27005 and NIST SP 800-39, then develop a phased transition plan with a longer timeline, presenting it to the parent company's board for approval.. A gap analysis between ISO 27005 and NIST SP 800-39 identifies differences and allows a phased transition plan with a realistic timeline, which is then presented to the parent company for approval. This approach respects both frameworks and addresses stakeholder concerns. Option A is too aggressive and unrealistic. Option C is non-compliant and may lead to conflict. Option D neglects the need for a structured transition and may cause operational disruption.

Answer

Continue using ISO 27005 and argue that it is equally valid, citing the principle of risk management flexibility and the disruption that a transition would cause.

Answer

Hire external consultants to perform the quantitative assessments, allowing the internal team to focus on existing operations, and accept the cost as a business necessity.

Answer

Immediately adopt the NIST framework and begin quantitative assessments, using industry-standard cost estimates to expedite the process within 30 days.

Question 3

A small business wants to ensure compliance with GDPR for its customer data. What is the initial action required to comply with GDPR?

Accepted Answer

Map data flows and identify personal data. Before implementing controls or appointing a DPO, the organization must first understand what data it processes and where it flows. Mapping data flows and identifying personal data is the foundational step for all subsequent compliance activities.

Answer

Obtain consent from all data subjects

Answer

Implement pseudonymization techniques

Answer

Conduct a Data Protection Impact Assessment (DPIA)

Question 4

A multinational corporation is evaluating risk treatment options for a identified high-impact, low-probability risk. The risk is below the organization's risk appetite threshold. Which is the most appropriate action?

Accepted Answer

Accept the risk. Since the risk is within the risk appetite, acceptance is the most efficient and appropriate response. Transferring, mitigating, or avoiding would consume resources unnecessarily for a risk that is already tolerated.

Answer

Mitigate the risk

Answer

Transfer the risk via insurance

Answer

Avoid the risk by discontinuing the activity

Question 5

During a merger, the security teams of two companies are integrating their networks. The acquiring company has a high-security classification system (e.g., Top Secret, Secret, Confidential), while the acquired company uses a lower classification (e.g., Internal, Public). Which approach best ensures secure data handling during integration?

Accepted Answer

Create a new classification system for the merged entity. Applying the higher classification to all data prevents inadvertent disclosure by ensuring the most restrictive controls are used. Maintaining separate systems or using the lower classification creates risk of data leakage.

Answer

Maintain separate classification systems for each company

Answer

Apply the lower classification level to all data to simplify integration

Answer

Apply the higher of the two classification levels to all data

Question 6

Which TWO of the following are considered mandatory elements of an organization's security policy framework?

Accepted Answer

Procedures. Standards and procedures are mandatory because they specify required configurations and step-by-step instructions. Guidelines are recommended but not required; baselines are a type of standard; metrics are measurements, not policy documents.

Answer

Guidelines

Answer

Baselines

Answer

Metrics

Question 7

Which THREE of the following are primary objectives of a risk management program?

Accepted Answer

Identify assets. The primary objectives include identifying assets, protecting critical assets, and achieving risk appetite. Eliminating all risks is impossible, and compliance is a secondary benefit, not a primary objective.

Answer

Eliminate all risks

Answer

Ensure compliance

Question 8

An organization has implemented a password policy requiring a minimum of 8 characters, including uppercase, lowercase, numbers, and special characters. Despite annual security awareness training, a recent audit revealed that 60% of employees are using passwords that can be cracked within hours. The organization is also experiencing a high number of account compromises due to credential stuffing attacks. The security team is considering various controls to reduce the risk. Which of the following would be the MOST effective in addressing the identified issues?

Accepted Answer

Implement multifactor authentication for all user accounts. Multifactor authentication (MFA) adds an additional layer of security that significantly reduces the risk of credential compromise, even if passwords are weak. Increasing password length may help but is still vulnerable to cracking if users choose predictable patterns. Password cracking tests are reactive and may not prevent attacks. Frequent password changes often lead to weaker passwords.

Answer

Increase the minimum password length to 15 characters

Answer

Conduct quarterly password cracking attempts and notify users with weak passwords

Answer

Require password changes every 30 days

Question 9

A financial institution is migrating its customer data to a cloud environment. The cloud provider offers encryption at rest and in transit using AES-256 and TLS 1.2+. The compliance team requires that the organization maintain full control of encryption keys to meet regulatory obligations such as PCI DSS and local banking laws. The data is highly sensitive and includes personally identifiable information (PII). Which solution should the security architect recommend?

Accepted Answer

Implement client-side encryption with keys stored on-premises. Client-side encryption with keys stored on-premises ensures the organization retains exclusive control over encryption keys. Relying on cloud provider's encryption with KMS gives key management to the provider, which may not satisfy compliance. Accepting provider encryption without additional controls surrenders control. Tokenization can protect data but removes original format, which may not be acceptable for all uses.

Answer

Use tokenization instead of encryption

Answer

Use the cloud provider's default encryption with their key management service

Answer

Accept the provider's encryption without additional controls

Question 10

A large healthcare organization is subject to both HIPAA and GDPR. They are creating a data retention policy for electronic protected health information (ePHI) concerning European patients. HIPAA requires retention for 6 years from creation or last effective date, while GDPR requires that personal data not be kept longer than necessary for the purpose, with a general guideline of retaining for the duration of the relationship plus a reasonable period. The organization wants to minimize storage costs while ensuring compliance. Which approach should they take?

Accepted Answer

Implement a tiered retention policy based on data classification. A tiered retention policy based on data classification allows the organization to apply different retention periods to different types of data, balancing regulatory requirements and cost. Retaining for the longer of the two requirements may over-retain data that is not subject to both laws. Retaining for the shorter may violate HIPAA. Retaining all data indefinitely is costly and may violate GDPR's storage limitation principle.

Answer

Retain data for the longer of the two regulatory requirements (HIPAA 6 years)

Answer

Retain all data indefinitely

Answer

Retain data for the shorter requirement (GDPR-defined necessity period)

Question 11

An organization's risk assessment identified a vulnerability in a legacy system that cannot be patched because the vendor no longer supports it. The system processes sensitive customer data and is critical for daily operations. The risk is rated as high likelihood and high impact. The organization has a moderate risk appetite. Which risk treatment is most appropriate?

Accepted Answer

Mitigate by implementing compensating controls. Since the system cannot be replaced immediately, implementing compensating controls (e.g., network segmentation, strict access controls, monitoring) reduces the risk to an acceptable level. Accepting a high risk is not advisable when it exceeds appetite. Cyber insurance does not protect against data breach consequences adequately. Decommissioning would disrupt critical operations.

Answer

Transfer the risk through cyber insurance

Answer

Avoid the risk by decommissioning the system

Answer

Accept the risk

Question 12

A company wants to ensure that its security policy is effectively enforced across all departments. Currently, the policy is published on the intranet and included in the employee handbook. However, the security team notices that many employees are not following the policy, leading to security incidents. Which of the following would be the most effective way to improve policy enforcement?

Accepted Answer

Require annual signed acknowledgment of the policy. Requiring annual signed acknowledgment ensures that employees are aware of and agree to comply with the policy. This creates a record of acceptance and can be used in disciplinary actions. Publishing on intranet or handbook alone does not guarantee reading or acceptance. Random audits with penalties may enforce compliance but without awareness, employees may not know what is expected.

Answer

Include the policy in the employee handbook

Answer

Conduct random audits and penalize non-compliance

Answer

Publish the policy on the intranet only

Question 13

An organization is conducting a Business Impact Analysis (BIA) as part of its business continuity planning. Which THREE of the following are essential components of a BIA? (Choose three.)

Accepted Answer

Criticality prioritization. The correct options are A, B, and D. Recovery Time Objective (RTO) defines the target time to resume operations; Maximum Tolerable Downtime (MTD) defines the total allowable downtime; Criticality prioritization ranks processes by importance. Option C (Mean Time Between Failures) is a reliability metric not used in BIA. Option E (Single point of failure identification) is part of vulnerability assessment, not a direct component of BIA.

Answer

Mean Time Between Failures (MTBF)

Answer

Single point of failure identification

Question 14

Refer to the exhibit. The risk manager is reviewing this risk register entry. According to the organization's risk appetite, which states that residual risks must be low or below, what is the most appropriate recommendation?

Accepted Answer

Implement additional controls to reduce the likelihood or impact.. Option B is correct because the residual risk is medium, exceeding the risk appetite. Additional controls should be implemented to reduce likelihood or impact. Option A (accept) is inappropriate as residual risk is not low. Option C (transfer) may be considered but does not address the root cause and is not the primary recommendation. Option D (avoid) is too drastic without exploring controls.

Answer

Accept the residual risk because existing controls are in place.

Answer

Transfer the risk to a third party via cyber insurance.

Answer

Avoid the risk by decommissioning the database server.

Question 15

A large financial institution is finalizing its annual risk treatment plan based on a recent enterprise risk assessment. The risk appetite statement approved by the board specifies that the organization will accept only low residual risks for financial loss, but is willing to accept moderate risks for reputational damage if cost-benefit justifies. The risk register includes the following findings: 1) A critical SQL injection vulnerability in the online banking portal with high likelihood and critical impact; current controls include a web application firewall (WAF) that is not fully tuned. 2) Use of outdated TLS 1.0 encryption on internal communications between data centers; likelihood is medium, impact is low. 3) Lack of background checks for third-party vendors with access to sensitive data; likelihood is low, impact is moderate. 4) A single point of failure in the primary data center's power supply; likelihood is low, impact is critical. 5) An incident response plan that has not been tested in two years; likelihood is medium, impact is moderate. The CISO must prioritize actions for the upcoming quarter. What is the most appropriate first step?

Accepted Answer

Immediately remediate the SQL injection vulnerability by tuning the WAF and applying vendor patches.. Option A is correct. The SQL injection vulnerability has high likelihood and critical impact, resulting in high risk that exceeds the risk appetite for financial loss. Immediate patching or other remediation is necessary to bring the risk to an acceptable level. Option B (accept outdated encryption) is possible but not the highest priority. Option C (transfer single point of failure) is valid but power supply risk is low likelihood; insurance may not be the first step. Option D (outsource incident response) is not the most urgent; testing the plan is less critical than addressing a high-risk vulnerability.

Answer

Transfer the single point of failure risk by purchasing business interruption insurance.

Answer

Outsource incident response to a managed security service provider (MSSP) to compensate for the untested plan.

Answer

Accept the risk of outdated TLS 1.0 encryption because impact is low.

CISSP Security and Risk Management Practice Test 5 — 15 Questions

Exhibit

CISSP Security and Risk Management Practice Test 5 — 15 Questions

Exhibit