Question 110
A project engineer requests all HR salary data to troubleshoot one employee ID mapping. Which response best addresses the central security requirement with a defensible, risk-based design?
- Publish the dataset to a shared troubleshooting channel
- Grant the engineer unrestricted HR access because they are internal
- Apply data-at-rest encryption with key governance and least-privilege storage access
- Grant access only to the minimum records necessary for the authorized purpose
Explanation
Correct Answer
D:Clearance does not automatically imply need-to-know for unrelated data.
Incorrect Answers
A:Broad disclosure far exceeds the purpose.
B:Employment is not an entitlement to all sensitive data.
C:Storage controls protect sensitive contents and key custody across media and backups. Grant access only to the minimum records necessary for the authorized purpose.
Question 111
A production engineer needs temporary access to a classified dataset in an incident. Which response best addresses the central security requirement with a defensible, risk-based design?
- Make the temporary right permanent for convenience
- Use a time-limited documented exception with owner approval and compensating controls
- Use authenticated encrypted transport and recipient validation appropriate to classification
- Skip approval and delete audit logs afterward
Explanation
Correct Answer
B:Exceptional access should be accountable, scoped and revoked.
Incorrect Answers
A:A short emergency does not justify indefinite privilege.
C:Transmission protection must address both interception and wrong-recipient risk. Use a time-limited documented exception with owner approval and compensating controls.
D:Concealment prevents investigation and governance.
Question 112
After a prior labeling finding, a global logistics firm reports that the approved safeguard is implemented: “Apply consistent visible or machine-readable labels that drive approved handling controls.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Verify expiry, use logs and post-event exception closure
- Accept a signed change ticket saying: Apply consistent visible or machine-readable labels that drive approved handling controls
- Use the completion of this alternative as proof: Change the filename to a random string
- Inspect representative transfers to ensure labels persist and are respected
Explanation
Correct Answer
D:Persistence tests show labels work across workflows.
Incorrect Answers
A:Time-bounded evidence detects privilege persistence. It tests handling exceptions, while this case requires evidence about labeling.
B:Inspect representative transfers to ensure labels persist and are respected. Persistence tests show labels work across workflows.
C:An opaque name does not encode handling requirements. Inspect representative transfers to ensure labels persist and are respected.
Question 113
After a prior transmission finding, a regional hospital network reports that the approved safeguard is implemented: “Use authenticated encrypted transport and recipient validation appropriate to classification.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Review access against task approvals and actual records retrieved
- Use the completion of this alternative as proof: Rely on a private-looking URL without TLS
- Accept a signed change ticket saying: Use authenticated encrypted transport and recipient validation appropriate to classification
- Inspect protocol configuration and execute a wrong-recipient access test
Explanation
Correct Answer
D:Encryption and destination authorization both need evidence.
Incorrect Answers
A:Purpose-aligned review detects overbroad rights. It tests need to know, while this case requires evidence about transmission.
B:URL appearance does not prove channel confidentiality. Inspect protocol configuration and execute a wrong-recipient access test.
C:Inspect protocol configuration and execute a wrong-recipient access test. Encryption and destination authorization both need evidence.
Question 114
After a prior storage finding, a payment-services company reports that the approved safeguard is implemented: “Apply data-at-rest encryption with key governance and least-privilege storage access.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Test unauthorized disk access and authorized recovery of encrypted copies
- Run this adjacent but different test as the sole proof: Verify expiry, use logs and post-event exception closure
- Accept a signed change ticket saying: Apply data-at-rest encryption with key governance and least-privilege storage access
- Use the completion of this alternative as proof: Enable only HTTP transport TLS
Explanation
Correct Answer
A:Both confidentiality and recoverability must hold.
Incorrect Answers
B:Time-bounded evidence detects privilege persistence. It tests handling exceptions, while this case requires evidence about storage.
C:Test unauthorized disk access and authorized recovery of encrypted copies. Both confidentiality and recoverability must hold.
D:Transport TLS does not protect disk contents. Test unauthorized disk access and authorized recovery of encrypted copies.
Question 115
After a prior need to know finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Grant access only to the minimum records necessary for the authorized purpose.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Test unauthorized disk access and authorized recovery of encrypted copies
- Review access against task approvals and actual records retrieved
- Use the completion of this alternative as proof: Grant the engineer unrestricted HR access because they are internal
- Accept a signed change ticket saying: Grant access only to the minimum records necessary for the authorized purpose
Explanation
Correct Answer
B:Purpose-aligned review detects overbroad rights.
Incorrect Answers
A:Both confidentiality and recoverability must hold. It tests storage, while this case requires evidence about need to know.
C:Employment is not an entitlement to all sensitive data. Review access against task approvals and actual records retrieved.
D:Review access against task approvals and actual records retrieved. Purpose-aligned review detects overbroad rights.
Question 116
After a prior handling exceptions finding, an international retailer reports that the approved safeguard is implemented: “Use a time-limited documented exception with owner approval and compensating controls.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Inspect representative transfers to ensure labels persist and are respected
- Verify expiry, use logs and post-event exception closure
- Use the completion of this alternative as proof: Make the temporary right permanent for convenience
- Accept a signed change ticket saying: Use a time-limited documented exception with owner approval and compensating controls
Explanation
Correct Answer
B:Time-bounded evidence detects privilege persistence.
Incorrect Answers
A:Persistence tests show labels work across workflows. It tests labeling, while this case requires evidence about handling exceptions.
C:A short emergency does not justify indefinite privilege. Verify expiry, use logs and post-event exception closure.
D:Verify expiry, use logs and post-event exception closure. Time-bounded evidence detects privilege persistence.
Question 117
A storage administrator is asked to approve the business classification and retention period of finance data. Which response best addresses the central security requirement with a defensible, risk-based design?
- Have the business data owner decide classification and retention while the custodian implements approved safeguards
- Allow storage staff to set business retention unilaterally
- Remove the data owner's signoff from the process
- Use versioned secure configuration baselines with drift review and controlled changes
Explanation
Correct Answer
A:Owner accountability is distinct from operational custody.
Incorrect Answers
B:Technical access does not establish statutory or business authority.
C:That obscures risk accountability.
D:Reproducible baselines reduce inconsistent exposure and aid audit. Have the business data owner decide classification and retention while the custodian implements approved safeguards.
Question 118
Decommissioned laptops still appear active and cloud test resources are absent from the register. Which response best addresses the central security requirement with a defensible, risk-based design?
- Maintain reconciled asset discovery and ownership records through acquisition, change and disposal
- Use network IP addresses as the sole asset identifier
- Only count newly purchased equipment
- Use versioned secure configuration baselines with drift review and controlled changes
Explanation
Correct Answer
A:Inventories lose value when they do not reflect actual assets and status.
Incorrect Answers
B:Addresses change and cannot represent all assets reliably.
C:Existing and virtual resources remain unmanaged.
D:Reproducible baselines reduce inconsistent exposure and aid audit. Maintain reconciled asset discovery and ownership records through acquisition, change and disposal.
Question 119
A new storage appliance is connected to production before security hardening or owner assignment. Which response best addresses the central security requirement with a defensible, risk-based design?
- Require asset registration, accountable owner, baseline hardening and vulnerability review before operation
- Use versioned secure configuration baselines with drift review and controlled changes
- Ship vendor defaults directly into the trusted zone
- Assign an inventory ID only after an incident
Explanation
Correct Answer
A:Secure provisioning controls the first exposure window.
Incorrect Answers
B:Reproducible baselines reduce inconsistent exposure and aid audit. Require asset registration, accountable owner, baseline hardening and vulnerability review before operation.
C:Default credentials and services expand attack surface.
D:Delayed registration leaves early risk unmanaged.
Question 120
Engineers deploy new database servers using mutable undocumented images. Which response best addresses the central security requirement with a defensible, risk-based design?
- Require asset registration, accountable owner, baseline hardening and vulnerability review before operation
- Rely on the vendor's original default settings
- Let every team pick unrelated settings
- Use versioned secure configuration baselines with drift review and controlled changes
Explanation
Correct Answer
D:Reproducible baselines reduce inconsistent exposure and aid audit.
Incorrect Answers
A:Secure provisioning controls the first exposure window. Use versioned secure configuration baselines with drift review and controlled changes.
B:Defaults may include unnecessary services and weak controls.
C:Uncontrolled variation complicates remediation.
Certified Information Systems Security Professional (CISSP) Practice Tests