Question 150
Staff use many unsanctioned SaaS apps and security lacks visibility into tenant configurations and sharing. Which response best addresses the central security requirement with a defensible, risk-based design?
- Tailor controls through documented risk analysis and compensating safeguards approved by owners
- Assume traditional endpoint antivirus inventories every SaaS tenant permission
- Evaluate cloud access security broker capabilities for SaaS discovery, policy and governance
- Disable proxy logs and rely on purchase invoices
Explanation
Correct Answer
C:CASB addresses cloud-service usage and policy visibility rather than one on-prem port.
Incorrect Answers
A:Tailoring adapts control implementation while preserving required outcomes. Evaluate cloud access security broker capabilities for SaaS discovery, policy and governance.
B:Endpoint malware controls do not inspect SaaS sharing policies.
D:Unbilled shadow IT may still expose records.
Question 151
A confidential report must remain restricted after an authorized recipient downloads it. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use context-appropriate masking or tokenization with protected access to originals
- Use only a database backup policy
- Rely on the original file-share ACL after a local copy is made
- Apply supported digital rights management or usage controls with identity-bound access where appropriate
Explanation
Correct Answer
D:DRM can constrain use beyond initial storage authorization.
Incorrect Answers
A:Masking limits displayed sensitive values while preserving authorized utility. Apply supported digital rights management or usage controls with identity-bound access where appropriate.
B:Backups do not control downstream document use.
C:The copied file may no longer depend on the share ACL.
Question 152
A call center needs to display the last four card digits without revealing the full identifier. Which response best addresses the central security requirement with a defensible, risk-based design?
- Apply supported digital rights management or usage controls with identity-bound access where appropriate
- Hash the complete card number and show it as the last four digits
- Use context-appropriate masking or tokenization with protected access to originals
- Give every agent full database decrypt rights
Explanation
Correct Answer
C:Masking limits displayed sensitive values while preserving authorized utility.
Incorrect Answers
A:DRM can constrain use beyond initial storage authorization. Use context-appropriate masking or tokenization with protected access to originals.
B:A hash does not preserve the requested legitimate suffix.
D:Broad access defeats the display minimization requirement.
Question 153
After a prior data states finding, a regional hospital network reports that the approved safeguard is implemented: “Protect data at rest, in transit and in use using controls appropriate to each state.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Test access revocation and restrictions on an exported copy
- Test representative data flows and runtime exposure for all states
- Accept a signed change ticket saying: Protect data at rest, in transit and in use using controls appropriate to each state
- Use the completion of this alternative as proof: Enable encryption at rest and call every state protected
Explanation
Correct Answer
B:Coverage by state reveals missing safeguards.
Incorrect Answers
A:Post-download testing differentiates DRM from repository ACLs. It tests drm, while this case requires evidence about data states.
C:Test representative data flows and runtime exposure for all states. Coverage by state reveals missing safeguards.
D:Disk encryption does not protect packets or process memory. Test representative data flows and runtime exposure for all states.
Question 154
After a prior scoping finding, a payment-services company reports that the approved safeguard is implemented: “Include every system that stores, processes, transmits or can materially affect protected data.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Trace data flow and segmentation to validate in-scope components
- Accept a signed change ticket saying: Include every system that stores, processes, transmits or can materially affect protected data
- Use the completion of this alternative as proof: Exclude backup copies because they are not primary databases
- Run this adjacent but different test as the sole proof: Test blocked sensitive uploads and allowed legitimate collaboration
Explanation
Correct Answer
A:Evidence-based scoping prevents false exclusions.
Incorrect Answers
B:Trace data flow and segmentation to validate in-scope components. Evidence-based scoping prevents false exclusions.
C:Backups still hold sensitive records. Trace data flow and segmentation to validate in-scope components.
D:A tuned control must prevent leaks without indiscriminate blockage. It tests dlp, while this case requires evidence about scoping.
Question 155
After a prior tailoring finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Tailor controls through documented risk analysis and compensating safeguards approved by owners.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Demonstrate compensating outcome and formally approve residual risk
- Accept a signed change ticket saying: Tailor controls through documented risk analysis and compensating safeguards approved by owners
- Use the completion of this alternative as proof: Disable every control in the industrial zone
- Run this adjacent but different test as the sole proof: Trace data flow and segmentation to validate in-scope components
Explanation
Correct Answer
A:Risk-based validation supports justified deviations.
Incorrect Answers
B:Demonstrate compensating outcome and formally approve residual risk. Risk-based validation supports justified deviations.
C:Blanket exception removes necessary protection. Demonstrate compensating outcome and formally approve residual risk.
D:Evidence-based scoping prevents false exclusions. It tests scoping, while this case requires evidence about tailoring.
Question 156
After a prior dlp finding, an international retailer reports that the approved safeguard is implemented: “Deploy content-aware DLP policies with approved egress enforcement and tuned exceptions.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Block only one known personal cloud IP address
- Accept a signed change ticket saying: Deploy content-aware DLP policies with approved egress enforcement and tuned exceptions
- Test blocked sensitive uploads and allowed legitimate collaboration
- Run this adjacent but different test as the sole proof: Validate that unprivileged displays expose only approved fields
Explanation
Correct Answer
C:A tuned control must prevent leaks without indiscriminate blockage.
Incorrect Answers
A:Alternative destinations can carry the same data. Test blocked sensitive uploads and allowed legitimate collaboration.
B:Test blocked sensitive uploads and allowed legitimate collaboration. A tuned control must prevent leaks without indiscriminate blockage.
D:Output inspection proves masking operates at use time. It tests encryption/masking, while this case requires evidence about dlp.
Question 157
A batch application role can delete every production database though it only needs read access to one reporting view. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rely on the application team's promise not to delete records
- Grant administrator rights for operational convenience
- Restrict effective permissions to required operations and resources and review escalation paths
- Separate incompatible initiation and approval functions or enforce compensating oversight
Explanation
Correct Answer
C:Least privilege limits accidental damage and misuse from an exposed identity.
Incorrect Answers
A:Voluntary conduct does not constrain effective authority.
B:Excess permissions enlarge the blast radius.
D:No single actor should control an entire high-fraud transaction. Restrict effective permissions to required operations and resources and review escalation paths.
Question 158
A public portal relies solely on a perimeter firewall while authenticated sessions can directly reach sensitive records. Which response best addresses the central security requirement with a defensible, risk-based design?
- Increase firewall throughput without application authorization
- Design minimization, purpose limitations and privacy defaults before the system is built
- Apply complementary network, identity, application and data-layer controls
- Use only data center door locks
Explanation
Correct Answer
C:Layered independent controls reduce reliance on one failure-prone barrier.
Incorrect Answers
A:Throughput cannot repair a missing authorization check.
B:Embedding privacy early avoids costly downstream retrofits. Apply complementary network, identity, application and data-layer controls.
D:Physical protection does not govern internet sessions.
Question 159
A payment gateway loses its authorization service and currently lets all purchases through. Which response best addresses the central security requirement with a defensible, risk-based design?
- Cache an allow-all response forever
- Bypass verification during every outage
- Design access decisions to deny or hold sensitive actions safely when required authorization is unavailable
- Continuously evaluate user, device and resource context at each appropriate access decision
Explanation
Correct Answer
C:Failure should not automatically grant privileges.
Incorrect Answers
A:An unrestricted cache is not a safe fallback.
B:Open access converts unavailability into integrity and fraud exposure.
D:Zero trust avoids permanent implicit trust solely from network location. Design access decisions to deny or hold sensitive actions safely when required authorization is unavailable.
Question 160
The same employee can create suppliers and approve their invoices without independent review. Which response best addresses the central security requirement with a defensible, risk-based design?
- Log the transactions but never restrict self-approval
- Add a second password to the same employee's account
- Design minimization, purpose limitations and privacy defaults before the system is built
- Separate incompatible initiation and approval functions or enforce compensating oversight
Explanation
Correct Answer
D:No single actor should control an entire high-fraud transaction.
Incorrect Answers
A:Detective logging alone may not prevent fraudulent processing.
B:Extra authentication does not create independent approval.
C:Embedding privacy early avoids costly downstream retrofits. Separate incompatible initiation and approval functions or enforce compensating oversight.
Certified Information Systems Security Professional (CISSP) Practice Tests