Question 120
Engineers deploy new database servers using mutable undocumented images. Which response best addresses the central security requirement with a defensible, risk-based design?
- Require asset registration, accountable owner, baseline hardening and vulnerability review before operation
- Rely on the vendor's original default settings
- Let every team pick unrelated settings
- Use versioned secure configuration baselines with drift review and controlled changes
Explanation
Correct Answer
D:Reproducible baselines reduce inconsistent exposure and aid audit.
Incorrect Answers
A:Secure provisioning controls the first exposure window. Use versioned secure configuration baselines with drift review and controlled changes.
B:Defaults may include unnecessary services and weak controls.
C:Uncontrolled variation complicates remediation.
Question 121
After a prior asset owner vs custodian finding, a regional hospital network reports that the approved safeguard is implemented: “Have the business data owner decide classification and retention while the custodian implements approved safeguards.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Allow storage staff to set business retention unilaterally
- Compare documented owner decisions with custodian configuration
- Accept a signed change ticket saying: Have the business data owner decide classification and retention while the custodian implements approved safeguards
- Run this adjacent but different test as the sole proof: Compare observed builds to the approved hardened template and exceptions
Explanation
Correct Answer
B:A role separation audit validates governance.
Incorrect Answers
A:Technical access does not establish statutory or business authority. Compare documented owner decisions with custodian configuration.
C:Compare documented owner decisions with custodian configuration. A role separation audit validates governance.
D:Drift evidence shows actual conformance. It tests configuration baseline, while this case requires evidence about asset owner vs custodian.
Question 122
After a prior inventory finding, a payment-services company reports that the approved safeguard is implemented: “Maintain reconciled asset discovery and ownership records through acquisition, change and disposal.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Reconcile discovery, procurement, cloud APIs and disposal receipts
- Accept a signed change ticket saying: Maintain reconciled asset discovery and ownership records through acquisition, change and disposal
- Use the completion of this alternative as proof: Only count newly purchased equipment
- Run this adjacent but different test as the sole proof: Compare documented owner decisions with custodian configuration
Explanation
Correct Answer
A:Multiple sources reveal blind spots.
Incorrect Answers
B:Reconcile discovery, procurement, cloud APIs and disposal receipts. Multiple sources reveal blind spots.
C:Existing and virtual resources remain unmanaged. Reconcile discovery, procurement, cloud APIs and disposal receipts.
D:A role separation audit validates governance. It tests asset owner vs custodian, while this case requires evidence about inventory.
Question 123
New industrial IoT gateways join production networks without being entered into the asset inventory or assigned support owners. Which response best addresses the central security requirement with a defensible, risk-based design?
- Require secure enrollment with owner, purpose, baseline and lifecycle records before network access
- Trust factory admin passwords until the first incident
- Assign a device IP as proof the asset is approved
- Have the business data owner decide classification and retention while the custodian implements approved safeguards
Explanation
Correct Answer
A:Unowned newly provisioned assets evade updates and detection.
Incorrect Answers
B:Default credentials enable easy compromise.
C:Addressing does not establish ownership.
D:Owner accountability is distinct from operational custody. Require secure enrollment with owner, purpose, baseline and lifecycle records before network access.
Question 124
After a prior configuration baseline finding, an international retailer reports that the approved safeguard is implemented: “Use versioned secure configuration baselines with drift review and controlled changes.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Compare observed builds to the approved hardened template and exceptions
- Use the completion of this alternative as proof: Rely on the vendor's original default settings
- Run this adjacent but different test as the sole proof: Reconcile discovery, procurement, cloud APIs and disposal receipts
- Accept a signed change ticket saying: Use versioned secure configuration baselines with drift review and controlled changes
Explanation
Correct Answer
A:Drift evidence shows actual conformance.
Incorrect Answers
B:Defaults may include unnecessary services and weak controls. Compare observed builds to the approved hardened template and exceptions.
C:Multiple sources reveal blind spots. It tests inventory, while this case requires evidence about configuration baseline.
D:Compare observed builds to the approved hardened template and exceptions. Drift evidence shows actual conformance.
Question 125
An incident review documented this asset owner vs custodian exposure: A storage administrator is asked to approve the business classification and retention period of finance data. The response team proposed only “Allow storage staff to set business retention unilaterally” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Delayed registration leaves early risk unmanaged.
- That obscures risk accountability.
- Technical access does not establish statutory or business authority.
- Uncontrolled variation complicates remediation.
Explanation
Correct Answer
C:Technical access does not establish statutory or business authority. The missing change involves technical access does not establish statutory or business authority.
Incorrect Answers
A:Delayed registration leaves early risk unmanaged. That does not establish technical access does not establish statutory or business authority.
B:This describes the limitation of a different proposed action (Remove the data owner's signoff from the process); it does not identify the main defect in Allow storage staff to set business retention unilaterally.
D:This describes the unrelated configuration baseline decision rather than the named faulty measure Allow storage staff to set business retention unilaterally.
Question 126
An app asks customers for birth date, passport copy and home address though only age eligibility is needed. Which response best addresses the central security requirement with a defensible, risk-based design?
- Minimize collection to data necessary for the documented purpose
- Encrypt unnecessary fields and treat that as permission to collect them
- Collect every possible attribute for future analytics
- Use approved physical destruction with witnessed custody and destruction certificates
Explanation
Correct Answer
A:Uncollected personal data cannot be exposed and avoids needless retention obligations.
Incorrect Answers
B:Encryption does not eliminate purpose limitation.
C:Undefined future value does not justify unlimited collection.
D:When sanitization is infeasible, documented destruction protects confidentiality. Minimize collection to data necessary for the documented purpose.
Question 127
An analytics group repurposes customer support transcripts to train a public model. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use approved physical destruction with witnessed custody and destruction certificates
- Remove direct identifiers while retaining uniquely identifying combinations without review
- Review the intended secondary use against approved purpose, consent or other lawful basis and controls
- Assume internal employees can use data for anything
Explanation
Correct Answer
C:Possessing data does not authorize all secondary processing.
Incorrect Answers
A:When sanitization is infeasible, documented destruction protects confidentiality. Review the intended secondary use against approved purpose, consent or other lawful basis and controls.
B:Weak deidentification can remain personal data.
D:Internal access does not remove purpose constraints.
Question 128
An archive retains customer identifiers indefinitely because storage is inexpensive. Which response best addresses the central security requirement with a defensible, risk-based design?
- Delete every record immediately after collection
- Minimize collection to data necessary for the documented purpose
- Keep everything forever to avoid deletion mistakes
- Set a justified retention schedule, legal exceptions and enforceable disposal triggers
Explanation
Correct Answer
D:Retention should follow business/legal need instead of cost alone.
Incorrect Answers
A:Premature deletion can violate legal and operational needs.
B:Uncollected personal data cannot be exposed and avoids needless retention obligations. Set a justified retention schedule, legal exceptions and enforceable disposal triggers.
C:Over-retention creates liability and breaches minimization.
Question 129
A public cloud backup unexpectedly replicates regulated records to a prohibited region. Which response best addresses the central security requirement with a defensible, risk-based design?
- Change the region label in documentation
- Apply approved geographic placement and replication restrictions across primary, backup and support paths
- Encrypt the cross-region replica and ignore the legal boundary
- Set a justified retention schedule, legal exceptions and enforceable disposal triggers
Explanation
Correct Answer
B:Data residency applies to actual copies and access flows, not only the primary database.
Incorrect Answers
A:Documentation cannot alter physical location.
C:Confidentiality alone does not satisfy localization duties.
D:Retention should follow business/legal need instead of cost alone. Apply approved geographic placement and replication restrictions across primary, backup and support paths.
Question 130
A leased SSD with sensitive data is being returned to the supplier after simple file deletion. Which response best addresses the central security requirement with a defensible, risk-based design?
- Overwrite selected visible files and ignore hidden media regions
- Rely solely on quick format
- Identify controller and processor responsibilities contractually and legally by actual decision authority
- Use media-appropriate sanitization, cryptographic erase where suitable and verified disposition
Explanation
Correct Answer
D:Deleted directory entries can leave recoverable data or remapped flash blocks.
Incorrect Answers
A:Partial erasure does not guarantee complete sanitization.
B:Quick formatting may not remove residual content.
C:A processor executes processing on behalf of the controller under documented instructions. Use media-appropriate sanitization, cryptographic erase where suitable and verified disposition.
Certified Information Systems Security Professional (CISSP) Practice Tests