Question 140
An aging router is past its vendor end-of-life date but still carries sensitive traffic. Which response best addresses the central security requirement with a defensible, risk-based design?
- Create an owner- and legal-approved enterprise records schedule mapped to data categories
- Assess exposure and plan a supported replacement or controlled isolation
- Assume physical uptime means patch support continues
- Disable all monitoring to reduce maintenance
Explanation
Correct Answer
B:Equipment lifecycle affects available fixes and operational support.
Incorrect Answers
A:A records schedule normalizes retention and disposal obligations. Assess exposure and plan a supported replacement or controlled isolation.
C:Working hardware can be insecure and unsupported.
D:Less visibility increases residual risk.
Question 141
A critical identity server's operating system no longer receives security patches. Which response best addresses the central security requirement with a defensible, risk-based design?
- Suspend normal deletion for in-scope material under an authorized legal hold
- Leave the system reachable from all internal zones
- Rely on last month's clean scan as a permanent guarantee
- Migrate to a supported platform or obtain documented risk-authorized containment until replacement
Explanation
Correct Answer
D:Unsupported software carries unfixable exposure after support ends.
Incorrect Answers
A:Preservation duties override ordinary expiry for specified evidence. Migrate to a supported platform or obtain documented risk-authorized containment until replacement.
B:Broad reachability amplifies unsupported risk.
C:New threats arise without vendor fixes.
Question 142
Departments keep different retention periods for identical regulated transaction records. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use only the cloud default object expiration
- Let each employee invent their own retention interval
- Create an owner- and legal-approved enterprise records schedule mapped to data categories
- Migrate to a supported platform or obtain documented risk-authorized containment until replacement
Explanation
Correct Answer
C:A records schedule normalizes retention and disposal obligations.
Incorrect Answers
A:Generic technical defaults may conflict with law.
B:Individual choices create noncompliance and inconsistency.
D:Unsupported software carries unfixable exposure after support ends. Create an owner- and legal-approved enterprise records schedule mapped to data categories.
Question 143
A vendor claims to have recycled storage devices but supplies no asset-level evidence. Which response best addresses the central security requirement with a defensible, risk-based design?
- Require asset-serial-matched certificates, controlled chain of custody and sanitization assurance
- Assume shipping a box proves every item was destroyed
- Accept a generic annual recycling brochure
- Create an owner- and legal-approved enterprise records schedule mapped to data categories
Explanation
Correct Answer
A:Disposal proof must show which assets were irreversibly sanitized or destroyed.
Incorrect Answers
B:Transfer does not equal destruction.
C:A brochure does not prove disposition of specific drives.
D:A records schedule normalizes retention and disposal obligations. Require asset-serial-matched certificates, controlled chain of custody and sanitization assurance.
Question 144
After a prior legal hold finding, a global logistics firm reports that the approved safeguard is implemented: “Suspend normal deletion for in-scope material under an authorized legal hold.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Sample categories against retention rules and record-level evidence
- Accept a signed change ticket saying: Suspend normal deletion for in-scope material under an authorized legal hold
- Verify hold scope, custodians, acknowledgments and release approval
- Use the completion of this alternative as proof: Continue automatic deletion because the schedule predates litigation
Explanation
Correct Answer
C:Controlled lifecycle prevents both spoliation and over-holding.
Incorrect Answers
A:Sampling verifies policy implementation. It tests records schedule, while this case requires evidence about legal hold.
B:Verify hold scope, custodians, acknowledgments and release approval. Controlled lifecycle prevents both spoliation and over-holding.
D:Routine retention does not defeat preservation duty. Verify hold scope, custodians, acknowledgments and release approval.
Question 145
After a prior eol finding, a regional hospital network reports that the approved safeguard is implemented: “Assess exposure and plan a supported replacement or controlled isolation.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Assume physical uptime means patch support continues
- Compare installed products and dates with vendor lifecycle advisories and compensating controls
- Run this adjacent but different test as the sole proof: Reconcile shipment manifests to certificates and asset inventory statuses
- Accept a signed change ticket saying: Assess exposure and plan a supported replacement or controlled isolation
Explanation
Correct Answer
B:Lifecycle evidence supports replacement priority.
Incorrect Answers
A:Working hardware can be insecure and unsupported. Compare installed products and dates with vendor lifecycle advisories and compensating controls.
C:A complete paper trail detects missing media. It tests disposal proof, while this case requires evidence about eol.
D:Compare installed products and dates with vendor lifecycle advisories and compensating controls. Lifecycle evidence supports replacement priority.
Question 146
A security design encrypts files on disk but ignores sensitive values in application memory and network transit. Which response best addresses the central security requirement with a defensible, risk-based design?
- Protect data at rest, in transit and in use using controls appropriate to each state
- Only add a network firewall to defend stored keys
- Use context-appropriate masking or tokenization with protected access to originals
- Enable encryption at rest and call every state protected
Explanation
Correct Answer
A:Data changes exposure as it moves between storage, networks and processing.
Incorrect Answers
B:Packet filtering cannot replace cryptographic key protection.
C:Masking limits displayed sensitive values while preserving authorized utility. Protect data at rest, in transit and in use using controls appropriate to each state.
D:Disk encryption does not protect packets or process memory.
Question 147
A compliance audit for cardholder data ignores backups and shared logging infrastructure. Which response best addresses the central security requirement with a defensible, risk-based design?
- Exclude shared identity systems simply because another team owns them
- Include every system that stores, processes, transmits or can materially affect protected data
- Exclude backup copies because they are not primary databases
- Protect data at rest, in transit and in use using controls appropriate to each state
Explanation
Correct Answer
B:Scope follows actual data paths and dependencies, not department charts.
Incorrect Answers
A:Shared services can affect in-scope security.
C:Backups still hold sensitive records.
D:Data changes exposure as it moves between storage, networks and processing. Include every system that stores, processes, transmits or can materially affect protected data.
Question 148
A standard security baseline blocks a vital industrial control function. Which response best addresses the central security requirement with a defensible, risk-based design?
- Tailor controls through documented risk analysis and compensating safeguards approved by owners
- Use context-appropriate masking or tokenization with protected access to originals
- Claim a product cannot be used and stop risk evaluation
- Disable every control in the industrial zone
Explanation
Correct Answer
A:Tailoring adapts control implementation while preserving required outcomes.
Incorrect Answers
B:Masking limits displayed sensitive values while preserving authorized utility. Tailor controls through documented risk analysis and compensating safeguards approved by owners.
C:Unsuitable implementation still requires alternative controls.
D:Blanket exception removes necessary protection.
Question 149
An insider repeatedly uploads confidential spreadsheets to personal cloud storage. Which response best addresses the central security requirement with a defensible, risk-based design?
- Protect data at rest, in transit and in use using controls appropriate to each state
- Block only one known personal cloud IP address
- Turn on disk encryption only
- Deploy content-aware DLP policies with approved egress enforcement and tuned exceptions
Explanation
Correct Answer
D:DLP evaluates sensitive data movement beyond IP connectivity.
Incorrect Answers
A:Data changes exposure as it moves between storage, networks and processing. Deploy content-aware DLP policies with approved egress enforcement and tuned exceptions.
B:Alternative destinations can carry the same data.
C:At-rest encryption does not govern user-authorized export.
Question 150
Staff use many unsanctioned SaaS apps and security lacks visibility into tenant configurations and sharing. Which response best addresses the central security requirement with a defensible, risk-based design?
- Tailor controls through documented risk analysis and compensating safeguards approved by owners
- Assume traditional endpoint antivirus inventories every SaaS tenant permission
- Evaluate cloud access security broker capabilities for SaaS discovery, policy and governance
- Disable proxy logs and rely on purchase invoices
Explanation
Correct Answer
C:CASB addresses cloud-service usage and policy visibility rather than one on-prem port.
Incorrect Answers
A:Tailoring adapts control implementation while preserving required outcomes. Evaluate cloud access security broker capabilities for SaaS discovery, policy and governance.
B:Endpoint malware controls do not inspect SaaS sharing policies.
D:Unbilled shadow IT may still expose records.
Certified Information Systems Security Professional (CISSP) Practice Tests