Security and Risk Management practice questions

Right to rectification

Why wrong: The right to rectification is a valid GDPR right (Article 16), but it is not one of the three rights that answer this question. The question requires exactly three correct options, and A, B, C are the intended correct answers.

Right to remuneration

Why wrong: The 'Right to Remuneration' is not a recognized data subject right under the General Data Protection Regulation (GDPR). GDPR focuses on granting individuals control over their personal data, ensuring privacy, and providing mechanisms for data access, correction, and deletion. It does not establish a right for individuals to receive financial compensation or payment for an organization's legitimate processing of their personal data.

Medium

Why wrong: While some less stringent risk matrices might categorize a high likelihood and medium impact scenario as medium, standard practice in robust qualitative risk assessments often elevates this. The high probability of an event occurring, even if its individual impact is not extreme, typically warrants a higher classification. This ensures that frequently occurring issues with noticeable consequences receive appropriate attention and resource allocation.

Critical

Why wrong: Critical risk is generally reserved for scenarios where both the likelihood and the impact are assessed as 'High' or 'Very High,' indicating a near-certain catastrophic event. In this case, while the likelihood is high, the impact is only medium, which does not meet the threshold for a critical designation. A critical risk implies an existential threat or severe operational failure that would fundamentally compromise the organization's mission or survival.

Low

Why wrong: Classifying a risk with high likelihood and medium impact as 'Low' would fundamentally misrepresent the potential threat and is inconsistent with standard risk management principles. A high probability of occurrence, regardless of the impact level, inherently means the event is likely to happen, precluding a low-risk rating. Low risk typically applies to events with very low likelihood and minimal impact, requiring minimal mitigation effort.

Auditing

Why wrong: Auditing, while a critical security function, is not considered a distinct, standalone element within the AAA framework itself. Instead, the data collection necessary for auditing, such as user actions, system events, and resource consumption, is primarily handled by the Accounting component. Accounting provides the raw logs and records that security teams later analyze during an audit to detect anomalies, investigate incidents, or ensure compliance.

Availability

Why wrong: Availability is a fundamental principle of information security, representing one-third of the well-known CIA triad (Confidentiality, Integrity, Availability). It ensures that authorized users can reliably access information and resources when needed. However, availability is a broader security goal and system characteristic, distinct from the operational functions of identity verification, access control, and activity logging provided by the AAA framework.

Act honorably

Why wrong: This is the second canon of the ISC2 Code of Ethics, which mandates that professionals "Act honorably, honestly, justly, responsibly, and legally." It requires practitioners to maintain the highest standards of personal and professional conduct, ensuring that all actions are beyond reproach and comply with applicable laws.

Provide diligent service

Why wrong: While "Provide diligent and competent service to principals" is indeed an official ISC2 canon, it is the third canon in the hierarchy, not the first or second. In the event of a conflict, this duty to employers and clients is legally and ethically subordinate to protecting society and acting honorably.

Act honestly

Why wrong: Although acting honestly is a core behavioral expectation embedded within the text of the second canon, "Act honestly" is not a standalone canon itself. Candidates must distinguish between the high-level titles of the four official canons and the specific descriptive adjectives used within their supporting text.

Advance the profession

Why wrong: This option represents the fourth and final canon of the ISC2 Code of Ethics: "Advance and protect the profession." While vital for the long-term growth and integrity of the cybersecurity community, it occupies the lowest priority in the ethical hierarchy and is incorrect for questions targeting the first two canons.

Authorization, Authentication, Accounting

Why wrong: This order is fundamentally flawed because authorization, which grants access permissions, cannot logically occur before authentication. An access control system must first verify the identity of a user or entity ('who you are') through authentication mechanisms. Without a confirmed identity, the system has no basis to determine what specific privileges ('what you can do') should be assigned or denied.

Authentication, Accounting, Authorization

Why wrong: Placing accounting before authorization is incorrect as it attempts to log activities before access rights are even established. The system must first authenticate the user and then authorize their specific permissions to resources. Only after authorization has determined what actions are permissible can accounting accurately record those actions in the context of granted access, ensuring proper audit trails.

Accounting, Authentication, Authorization

Why wrong: Initiating the access control process with accounting is illogical, as there are no actions to log prior to identity verification and permission assignment. Accounting's role is to record events and resource usage, which presupposes that a user has been identified and granted some level of access. Therefore, both authentication and authorization must precede any meaningful accounting activities within the system.

$100,000

Why wrong: This figure represents the Asset Value (AV), which is the total worth of the asset being protected, such as the data itself or the system housing it. While a critical component in risk assessment, the AV alone does not account for the probability or impact of a specific threat event. It is merely the starting point for calculating potential losses, not the Annualized Loss Expectancy (ALE).

$50,000

Why wrong: This amount represents the Single Loss Expectancy (SLE), which quantifies the financial impact of a single occurrence of a specific threat. The SLE is calculated by multiplying the Asset Value (AV) by the Exposure Factor (EF), representing the percentage of asset loss due to the threat. However, SLE does not incorporate the frequency of the event, making it an incomplete measure for the Annualized Loss Expectancy (ALE).

$20,000

Why wrong: This value would be obtained if an incorrect Annualized Rate of Occurrence (ARO) of 0.4 (or 40%) was used in the calculation. If the Single Loss Expectancy (SLE) is $50,000, multiplying it by an ARO of 0.4 yields $20,000. However, for this specific scenario, the correct ARO is 0.2, indicating a lower annual probability of the data breach occurring than assumed in this incorrect calculation.

Provide diligent and competent service to principals

Why wrong: This canon, while crucial for professional conduct, is the third in the (ISC)² Code of Ethics hierarchy, meaning it does not take precedence over the first two. It mandates that CISSPs perform their duties with the highest level of professional care and skill for their employers, clients, or other stakeholders. However, this obligation is subordinate to protecting society and acting honorably, especially when conflicts of interest or duty arise.

Act honorably, honestly, justly, responsibly, and legally

Why wrong: This canon represents the second-highest priority within the (ISC)² Code of Ethics, establishing the foundational ethical conduct expected of all certified professionals. It requires adherence to legal statutes and ethical principles in all professional activities, ensuring integrity and trustworthiness. While fundamental to a CISSP's professional life, this canon is superseded by the paramount duty to protect society, the common good, and the infrastructure.

Advance and protect the profession

Why wrong: This canon is the fourth and lowest in the hierarchical structure of the (ISC)² Code of Ethics, meaning it does not take precedence over the other three. It obligates CISSPs to uphold the reputation of the information security profession, contribute to its knowledge base, and mentor future professionals. While important for the long-term viability and respect of the field, this duty is subordinate to all other canons, particularly the direct protection of society.

Warm site

Why wrong: A warm site provides a facility with pre-installed hardware and network infrastructure, but it typically lacks current data and may require significant configuration and data restoration efforts. While offering a faster recovery than a cold site, its near-real-time or batched data synchronization means it cannot achieve the extremely low Recovery Time Objective (RTO) and Recovery Point Objective (RPO) required for critical applications demanding immediate availability.

Cold site

Why wrong: A cold site is an empty facility equipped only with basic utilities like power and cooling, requiring the organization to procure, transport, install, and configure all necessary hardware, software, and data. This extensive setup process results in the longest Recovery Time Objective (RTO) and Recovery Point Objective (RPO) among all disaster recovery site types. Consequently, a cold site is entirely unsuitable for critical applications that necessitate rapid restoration and minimal downtime.

Reciprocal agreement

Why wrong: A reciprocal agreement involves two organizations agreeing to provide backup facilities to each other in a disaster scenario. However, this approach carries substantial risks, as the host organization's resources may be insufficient, incompatible, or unavailable when needed, especially if both parties are affected simultaneously. Such agreements often lack guaranteed service levels and typically cannot meet the stringent Recovery Time Objective (RTO) and Recovery Point Objective (RPO) demands of critical applications due to potential resource contention or configuration discrepancies.

ISO/IEC 27001

Why wrong: ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). While it ensures secure handling of information assets, its primary focus is on managing information security risks and controls across an organization, not on the lifecycle management of IT services themselves.

NIST Cybersecurity Framework

Why wrong: The NIST Cybersecurity Framework provides a policy framework of computer security guidelines to help organizations manage and reduce cybersecurity risks. It outlines five core functions—Identify, Protect, Detect, Respond, and Recover—to improve an organization's ability to prevent, detect, and respond to cyber incidents, but it does not detail a service delivery lifecycle.

COBIT 2019

Why wrong: COBIT 2019 is a comprehensive framework for enterprise IT governance and management, providing principles, processes, and organizational structures to align IT with business objectives. It focuses on value creation from IT, risk optimization, and resource optimization across the entire enterprise, rather than specifically detailing the lifecycle stages of individual IT services.

Medium risk

Why wrong: "Medium risk" is typically assigned in a qualitative risk assessment when either the likelihood or the impact is moderate, or when one factor is high while the other is low, resulting in an intermediate overall risk level. It represents a situation where the potential harm is not catastrophic, and the event is not highly probable, suggesting that mitigation efforts can be prioritized after higher risks are addressed.

Low risk

Why wrong: "Low risk" is characterized by both a low likelihood of a threat event occurring and a minimal impact if it were to materialize, according to the qualitative assessment criteria. This combination indicates that the potential for adverse effects on organizational assets or operations is negligible, allowing for less urgent or less resource-intensive mitigation strategies, or even risk acceptance.

De minimis risk

Why wrong: "De minimis risk" refers to a level of risk that is so insignificant or trivial that it can be practically ignored, often falling below the threshold for any formal risk management action or resource expenditure. It implies an extremely low likelihood and an almost imperceptible impact, making it economically impractical or unnecessary to expend resources on further analysis or mitigation efforts.

Step 1: Log in, Step 2: Enter code, Step 3: Access system

Why wrong: A procedure provides detailed, step-by-step instructions for performing a specific task or process. This example clearly outlines the sequential actions required to gain system access, making it an operational guide rather than a high-level organizational mandate. Policies state *what* must be done, while procedures explain *how* to do it.

It is recommended to change passwords every 90 days

Why wrong: A guideline offers advice or best practices that are strongly suggested but not strictly mandatory. The use of "recommended" indicates a flexible suggestion rather than a compulsory rule, allowing for discretion based on specific circumstances. Policies, in contrast, establish binding requirements that must be followed without exception.

Use passwords of at least 12 characters with mixed case and numbers

Why wrong: A standard specifies mandatory requirements for hardware, software, or configurations to ensure consistency and interoperability within an organization. This example details specific technical parameters for password construction, providing a precise, enforceable rule for password complexity. While derived from policy, it outlines the *specific technical criteria* that must be met, rather than the overarching security objective.

Corporate policy

Why wrong: Corporate policy, while crucial for internal governance and operational consistency, does not independently serve as a lawful basis for processing personal data under GDPR Article 6. GDPR explicitly requires a specific legal ground, such as consent, contract, legal obligation, vital interests, public task, or legitimate interests, to justify data processing activities. An internal policy merely dictates how an organization operates, not the legal permissibility of its data handling, meaning reliance solely on such a policy would result in non-compliance.

Profit motive

Why wrong: Profit motive, while a primary driver for commercial enterprises, is not recognized as a standalone lawful basis for processing personal data under the GDPR. The desire for financial gain may underpin activities that could potentially be justified under the 'legitimate interests' basis, but only if a strict balancing test is performed. This test must demonstrate that the organization's interests are not overridden by the fundamental rights and freedoms of the data subject, making mere profit a insufficient justification.

Marketing preference

Why wrong: Marketing preference refers to an individual's expressed choice regarding the receipt of marketing communications, or their opt-in/opt-out status. This preference itself is not a lawful basis for processing personal data under GDPR. Instead, the processing of data for marketing purposes must be justified by a specific lawful basis, typically either the data subject's explicit consent or the organization's legitimate interests, provided a robust impact assessment and balancing test are conducted. The preference merely dictates the scope or permissibility of marketing activities under an established basis.

Annual audit report

Why wrong: While HIPAA-covered entities are required to conduct risk analyses and implement security measures, an "annual audit report" is not a specific document mandated by HIPAA that must be shared with a Business Associate (like a billing company) as a prerequisite for data sharing. The primary requirement for establishing a compliant data-sharing relationship with a Business Associate is the execution of a Business Associate Agreement, which outlines responsibilities rather than requiring the sharing of internal audit findings.

Patient consent

Why wrong: HIPAA generally permits the use and disclosure of Protected Health Information (PHI) for treatment, payment, and healthcare operations (TPO) without requiring explicit patient consent or authorization. Sharing PHI with a billing company falls squarely under "payment" operations, which is a permissible disclosure under HIPAA. While patients have the right to receive a Notice of Privacy Practices, this informs them of how their PHI may be used, but does not necessitate their specific consent for TPO activities.

Data Protection Impact Assessment

Why wrong: A Data Protection Impact Assessment (DPIA) is a specific requirement under the European Union's General Data Protection Regulation (GDPR) for processing activities likely to result in a high risk to individuals' rights and freedoms. While a hospital subject to HIPAA must conduct a risk analysis as part of its Security Rule compliance, a DPIA is a distinct regulatory instrument not mandated by HIPAA for sharing PHI with a billing company in the United States.

$30,000

Why wrong: This value is incorrect for the Annualized Loss Expectancy (ALE) and indicates a miscalculation. It appears to be derived by multiplying the Single Loss Expectancy (SLE) of $15,000 by an incorrect Annualized Rate of Occurrence (ARO) of 2, or by simply doubling the SLE. Such an error would imply the threat event occurs twice a year, which contradicts the scenario where $7,500 is the correct ALE, suggesting an ARO of 0.5. This miscalculation significantly overestimates the annual financial impact of the risk, leading to potentially misguided resource allocation.

$15,000

Why wrong: This figure represents the Single Loss Expectancy (SLE), which is the monetary loss expected each time a specific threat event occurs. SLE is calculated as the Asset Value (AV) multiplied by the Exposure Factor (EF), quantifying the impact of a single incident. However, the question asks for a value that is likely the Annualized Loss Expectancy (ALE), which incorporates the frequency of occurrence over a year. Therefore, while $15,000 is a crucial component in the ALE calculation, it is not the final annualized figure that accounts for recurrence.

$75,000

Why wrong: This value is significantly higher than the correct Annualized Loss Expectancy (ALE) and strongly suggests a calculation error, most likely a misplaced decimal point or an incorrect multiplier. If the Single Loss Expectancy (SLE) is $15,000 and the Annualized Rate of Occurrence (ARO) is 0.5, then multiplying $15,000 by 5 instead of 0.5, or by 0.05 and then by 10, would lead to this erroneous result. Such a substantial overestimation would lead to misinformed risk management decisions, potentially causing an organization to overspend on controls for a less impactful risk.

Implement security controls

Why wrong: Implementation follows risk assessment and BIA.

Identify vulnerabilities in the network

Why wrong: Vulnerability identification is part of risk assessment, not BIA.

Test the disaster recovery plan

Why wrong: Testing is a separate exercise after BCP/DRP development.

Data encryption for customer PII

Why wrong: While data encryption is a vital technical control for protecting the confidentiality of customer Personally Identifiable Information (PII), its primary focus is data privacy and security, not the integrity of financial reporting as mandated by SOX. SOX IT General Controls (ITGCs) are concerned with the overall reliability of the IT environment supporting financial data, whereas encryption is a specific technical mechanism primarily addressing data confidentiality and integrity at rest or in transit, rather than the foundational processes governing system operations.

Firewall rule to block unauthorized traffic

Why wrong: A firewall rule designed to block unauthorized network traffic is a crucial network security control that protects system perimeters from external threats. However, it is not typically classified as an IT General Control (ITGC) in the context of SOX. ITGCs focus on the overall integrity of the IT environment, including system development, program changes, computer operations, and logical access, rather than specific network traffic filtering mechanisms. While important for overall security, firewalls do not directly govern the processes that ensure the accuracy and reliability of financial data within the applications themselves.

Automated calculation of interest on loans

Why wrong: An automated calculation of interest on loans represents an application control, which is embedded within the specific functionality of a financial application to ensure the accuracy and completeness of transactions. This differs from an IT General Control (ITGC), which governs the overall IT environment and infrastructure supporting all applications, such as system development, access management, and operational processes. While critical for the accuracy of loan interest, this control's scope is limited to a specific business process within an application, rather than the foundational IT governance that SOX ITGCs address.

Risk research

Why wrong: Risk research is an analytical phase of risk management, focused on identifying, assessing, and understanding the characteristics of threats, vulnerabilities, and potential impacts. While essential for informed decision-making, it is a preparatory step that precedes the selection of a risk response. Research itself does not constitute an action taken to alter the risk's likelihood or impact, which is the defining characteristic of a risk response.

Risk acceptance

Why wrong: Risk acceptance involves consciously deciding to take no action to reduce the likelihood or impact of a risk, typically because the cost of mitigation outweighs the potential loss, or the risk is deemed very low. For a high-impact risk, however, simply accepting it without implementing controls is generally irresponsible and contrary to sound security management principles, as it leaves the organization vulnerable to significant harm.

Risk deferral

Why wrong: Risk deferral is not a recognized or advisable risk response strategy within formal cybersecurity frameworks like NIST or ISO 27005. While an organization might operationally delay a response due to resource constraints, this is an operational decision, not a strategic risk treatment. For a high-impact risk, deferring action would leave the organization exposed to severe consequences without a planned countermeasure, which is unacceptable in robust risk management.

Use only approved encryption algorithms for stored data

Why wrong: While using approved encryption algorithms is a critical control, it is a specific detail within PCI DSS Requirement 3, which broadly mandates protecting stored cardholder data. Requirement 3.4 specifies rendering the Primary Account Number (PAN) unreadable, and 3.5 covers cryptographic key management. This option describes a component of a requirement, not one of the 12 high-level requirements themselves.

Implement multi-factor authentication for all employees

Why wrong: PCI DSS Requirement 8 focuses on identifying and authenticating access to system components. While Requirement 8.3 mandates multi-factor authentication (MFA) for all non-console administrative access to the Cardholder Data Environment (CDE) and all remote network access to the CDE, it does not broadly mandate MFA for *all employees* for *all access*. This option overstates the scope and is a specific control within Requirement 8, rather than a standalone high-level requirement.

To establish a framework for risk management

Why wrong: The CIA triad articulates the fundamental properties of secure information, which are then addressed by risk management processes. Risk management encompasses identifying threats, vulnerabilities, and impacts, and then selecting controls to protect confidentiality, integrity, and availability, making the triad a critical input rather than the overarching framework itself.

To ensure compliance with regulatory requirements

Why wrong: While regulatory requirements frequently mandate the implementation of controls designed to uphold confidentiality, integrity, and availability, the CIA triad's inherent purpose is not to ensure compliance. Instead, it serves as the conceptual foundation for what security aims to achieve, with compliance being an external driver for why certain security measures are adopted.

To balance security controls with usability

Why wrong: Balancing security controls with usability is a crucial design and implementation challenge within information security, often requiring trade-offs. However, this practical consideration is a consequence of applying security principles, not the primary definitional purpose of the CIA triad itself. The triad defines the core security objectives, not the operational complexities of achieving them.

Availability

Why wrong: Availability ensures that authorized users can access information and resources when needed, preventing service disruptions and ensuring system uptime. While crucial for any operational system, it does not provide mechanisms to prove that a specific user performed a particular action, nor does it prevent a user from denying their involvement in an event. Its focus is on continuous operation and accessibility, not accountability for past deeds.

Integrity

Why wrong: Integrity focuses on safeguarding the accuracy, completeness, and consistency of data throughout its entire lifecycle. It prevents unauthorized modification or destruction of information, ensuring its trustworthiness and reliability. However, maintaining data integrity does not inherently provide irrefutable proof of who initiated a specific action, which is essential to counter a user's denial of having performed that action.

Confidentiality

Why wrong: Confidentiality is the principle of protecting sensitive information from unauthorized disclosure or access, ensuring that only authorized individuals can view specific data. It is vital for privacy and preventing data leaks, safeguarding information from being read by unintended parties. However, confidentiality does not address the issue of proving that a particular user executed a specific operation; its primary concern is secrecy, not the attribution of actions.