Question 90
After a prior contract controls finding, a payment-services company reports that the approved safeguard is implemented: “Add security terms specifying incident notice, audit rights, data handling, exit and responsibilities.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Review contract terms against tracked supplier risks and test notification contacts
- Use the completion of this alternative as proof: Rely only on a marketing privacy page
- Run this adjacent but different test as the sole proof: Review independent assurance, scope and open exceptions against contractual requirements
- Accept a signed change ticket saying: Add security terms specifying incident notice, audit rights, data handling, exit and responsibilities
Explanation
Correct Answer
A:Contract-to-control mapping reduces unowned obligations.
Incorrect Answers
B:Marketing content may lack binding commitments. Review contract terms against tracked supplier risks and test notification contacts.
C:Evidence-based supplier review supports accountable selection. It tests supplier assessments, while this case requires evidence about contract controls.
D:Review contract terms against tracked supplier risks and test notification contacts. Contract-to-control mapping reduces unowned obligations.
Question 91
Database administrators face elevated risk from privilege and destructive command errors. Which response best addresses the central security requirement with a defensible, risk-based design?
- Send identical introductory slides to every role
- Measure attendance alone as competence
- Use ethical simulations and feedback to improve recognition and reporting behavior
- Provide role-specific exercises for actual privileged tasks in addition to general awareness
Explanation
Correct Answer
D:Generic reminders cannot teach specialized security operating decisions.
Incorrect Answers
A:Uniform material misses privileged technical risks.
B:Attendance does not prove safe behavior.
C:Training should encourage timely reporting, not only punish clicks. Provide role-specific exercises for actual privileged tasks in addition to general awareness.
Question 92
Employees click simulated phishing links but reported malicious email rates are low. Which response best addresses the central security requirement with a defensible, risk-based design?
- Count only simulation click rates
- Use ethical simulations and feedback to improve recognition and reporting behavior
- Publicly shame individuals who fail tests
- Provide role-specific exercises for actual privileged tasks in addition to general awareness
Explanation
Correct Answer
B:Training should encourage timely reporting, not only punish clicks.
Incorrect Answers
A:Clicks alone miss desirable reporting behavior.
C:Punishment can suppress reporting and create distrust.
D:Generic reminders cannot teach specialized security operating decisions. Use ethical simulations and feedback to improve recognition and reporting behavior.
Question 93
The awareness program reports 100 percent course attendance yet social engineering incidents rise. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use ethical simulations and feedback to improve recognition and reporting behavior
- Remove outcome metrics when results are poor
- Track outcomes such as reporting quality, unsafe behaviors and role-specific proficiency
- Claim the attendance figure proves risk elimination
Explanation
Correct Answer
C:Completion measures participation but not security effectiveness.
Incorrect Answers
A:Training should encourage timely reporting, not only punish clicks. Track outcomes such as reporting quality, unsafe behaviors and role-specific proficiency.
B:Suppressing adverse measurements hides gaps.
D:Participation is not direct evidence of correct behavior.
Question 94
The organization changed to passwordless login but its awareness content still warns only about password reuse. Which response best addresses the central security requirement with a defensible, risk-based design?
- Refresh learning materials when technology, threats and incident lessons change
- Track outcomes such as reporting quality, unsafe behaviors and role-specific proficiency
- Let staff invent security guidance individually
- Keep material unchanged for several years
Explanation
Correct Answer
A:An awareness program must evolve with changing attacker paths and user tasks.
Incorrect Answers
B:Completion measures participation but not security effectiveness. Refresh learning materials when technology, threats and incident lessons change.
C:Unreviewed advice becomes inconsistent.
D:Stale instruction may give wrong advice.
Question 95
After a prior role-specific training finding, a regulated financial institution reports that the approved safeguard is implemented: “Provide role-specific exercises for actual privileged tasks in addition to general awareness.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Send identical introductory slides to every role
- Accept a signed change ticket saying: Provide role-specific exercises for actual privileged tasks in addition to general awareness
- Use task-based demonstrations that show correct privileged change decisions
- Run this adjacent but different test as the sole proof: Compare safe reporting latency and phishing response over repeated exercises
Explanation
Correct Answer
C:Performance evidence validates relevant skill.
Incorrect Answers
A:Uniform material misses privileged technical risks. Use task-based demonstrations that show correct privileged change decisions.
B:Use task-based demonstrations that show correct privileged change decisions. Performance evidence validates relevant skill.
D:Behavioral trends are more meaningful than completion counts. It tests phishing simulation, while this case requires evidence about role-specific training.
Question 96
After a prior phishing simulation finding, a global logistics firm reports that the approved safeguard is implemented: “Use ethical simulations and feedback to improve recognition and reporting behavior.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Use ethical simulations and feedback to improve recognition and reporting behavior
- Use the completion of this alternative as proof: Publicly shame individuals who fail tests
- Run this adjacent but different test as the sole proof: Use task-based demonstrations that show correct privileged change decisions
- Compare safe reporting latency and phishing response over repeated exercises
Explanation
Correct Answer
D:Behavioral trends are more meaningful than completion counts.
Incorrect Answers
A:Compare safe reporting latency and phishing response over repeated exercises. Behavioral trends are more meaningful than completion counts.
B:Punishment can suppress reporting and create distrust. Compare safe reporting latency and phishing response over repeated exercises.
C:Performance evidence validates relevant skill. It tests role-specific training, while this case requires evidence about phishing simulation.
Question 97
A file share mixes public brochures and unpublished acquisition figures without classification. Which response best addresses the central security requirement with a defensible, risk-based design?
- Classify every item only by extension
- Use storage cost as the confidentiality grade
- Require the authorized data owner to establish and approve classification rules
- Have the accountable owner classify data by disclosure impact and apply proportional controls
Explanation
Correct Answer
D:Sensitivity reflects expected harm from unauthorized disclosure rather than file size.
Incorrect Answers
A:A spreadsheet can be public or highly sensitive.
B:Price does not measure disclosure harm.
C:Ownership and authority for classification should not default to the most convenient user. Have the accountable owner classify data by disclosure impact and apply proportional controls.
Question 98
A minor lab server and the primary customer authorization database appear equally important in inventory. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rate asset criticality using process dependency, availability tolerance and business impact
- Have the accountable owner classify data by disclosure impact and apply proportional controls
- Assign identical recovery priorities to every asset
- Sort asset importance by original invoice value
Explanation
Correct Answer
A:Criticality depends on loss to mission, not replacement purchase price.
Incorrect Answers
B:Sensitivity reflects expected harm from unauthorized disclosure rather than file size. Rate asset criticality using process dependency, availability tolerance and business impact.
C:Uniform treatment wastes resources or misses critical paths.
D:Low-cost infrastructure can support essential processes.
Question 99
Developers label regulated records as public to avoid approval delays. Which response best addresses the central security requirement with a defensible, risk-based design?
- Build governed metadata and asset inventories linking owners, sensitivity, location and lifecycle
- Require the authorized data owner to establish and approve classification rules
- Let anyone with read access downgrade sensitivity
- Allow the backup custodian to invent legal sensitivity labels
Explanation
Correct Answer
B:Ownership and authority for classification should not default to the most convenient user.
Incorrect Answers
A:A searchable inventory enables targeted controls and lawful retention. Require the authorized data owner to establish and approve classification rules.
C:Reader convenience is not a classification authority.
D:Technical handling does not confer business classification ownership.
Question 100
A data lake has petabytes of objects but no map of which datasets contain restricted customer data. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rely only on aggregate storage utilization charts
- Have the accountable owner classify data by disclosure impact and apply proportional controls
- Store classification in unsearchable personal notes
- Build governed metadata and asset inventories linking owners, sensitivity, location and lifecycle
Explanation
Correct Answer
D:A searchable inventory enables targeted controls and lawful retention.
Incorrect Answers
A:Capacity metrics reveal no data owner or sensitivity.
B:Sensitivity reflects expected harm from unauthorized disclosure rather than file size. Build governed metadata and asset inventories linking owners, sensitivity, location and lifecycle.
C:Local notes do not sustain an enterprise inventory.
Certified Information Systems Security Professional (CISSP) Practice Tests