Question 160
The same employee can create suppliers and approve their invoices without independent review. Which response best addresses the central security requirement with a defensible, risk-based design?
- Log the transactions but never restrict self-approval
- Add a second password to the same employee's account
- Design minimization, purpose limitations and privacy defaults before the system is built
- Separate incompatible initiation and approval functions or enforce compensating oversight
Explanation
Correct Answer
D:No single actor should control an entire high-fraud transaction.
Incorrect Answers
A:Detective logging alone may not prevent fraudulent processing.
B:Extra authentication does not create independent approval.
C:Embedding privacy early avoids costly downstream retrofits. Separate incompatible initiation and approval functions or enforce compensating oversight.
Question 161
A remote worker is trusted for all services after one VPN login even when device health degrades. Which response best addresses the central security requirement with a defensible, risk-based design?
- Continuously evaluate user, device and resource context at each appropriate access decision
- Treat VPN membership as blanket authorization
- Separate incompatible initiation and approval functions or enforce compensating oversight
- Make the internal VLAN open to every employee
Explanation
Correct Answer
A:Zero trust avoids permanent implicit trust solely from network location.
Incorrect Answers
B:Network position does not prove ongoing entitlement.
C:No single actor should control an entire high-fraud transaction. Continuously evaluate user, device and resource context at each appropriate access decision.
D:Implicit lateral reach contradicts resource-level control.
Question 162
A new mobile product collects precise location and full identity before documenting a real need. Which response best addresses the central security requirement with a defensible, risk-based design?
- Add a privacy notice after collecting everything
- Let analytics keep all raw events indefinitely
- Design minimization, purpose limitations and privacy defaults before the system is built
- Design access decisions to deny or hold sensitive actions safely when required authorization is unavailable
Explanation
Correct Answer
C:Embedding privacy early avoids costly downstream retrofits.
Incorrect Answers
A:Notice alone does not justify needless collection.
B:Unlimited retention expands exposure.
D:Failure should not automatically grant privileges. Design minimization, purpose limitations and privacy defaults before the system is built.
Question 163
A SaaS buyer assumes its provider will configure every user role and data-retention setting. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assume provider certifications remove all tenant configuration risk
- Require the customer to patch the provider's physical hypervisors
- Restrict effective permissions to required operations and resources and review escalation paths
- Document the customer/provider responsibility matrix for identity, data and service configurations
Explanation
Correct Answer
D:Managed hosting does not automatically transfer customer governance duties.
Incorrect Answers
A:Provider controls cannot guarantee customer-side permissions.
B:Those duties ordinarily belong to the cloud service provider.
C:Least privilege limits accidental damage and misuse from an exposed identity. Document the customer/provider responsibility matrix for identity, data and service configurations.
Question 164
After a prior least privilege finding, an international retailer reports that the approved safeguard is implemented: “Restrict effective permissions to required operations and resources and review escalation paths.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Restrict effective permissions to required operations and resources and review escalation paths
- Run this adjacent but different test as the sole proof: Simulate one control failure and verify other independent layers still constrain access
- Use the completion of this alternative as proof: Rely on the application team's promise not to delete records
- Attempt an unauthorized destructive operation in a safe test and verify denial
Explanation
Correct Answer
D:Negative tests demonstrate the privilege ceiling.
Incorrect Answers
A:Attempt an unauthorized destructive operation in a safe test and verify denial. Negative tests demonstrate the privilege ceiling.
B:Independence is the core value of defense in depth. It tests defense in depth, while this case requires evidence about least privilege.
C:Voluntary conduct does not constrain effective authority. Attempt an unauthorized destructive operation in a safe test and verify denial.
Question 165
After a prior defense in depth finding, a university consortium reports that the approved safeguard is implemented: “Apply complementary network, identity, application and data-layer controls.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Simulate one control failure and verify other independent layers still constrain access
- Use the completion of this alternative as proof: Increase firewall throughput without application authorization
- Run this adjacent but different test as the sole proof: Attempt an unauthorized destructive operation in a safe test and verify denial
- Accept a signed change ticket saying: Apply complementary network, identity, application and data-layer controls
Explanation
Correct Answer
A:Independence is the core value of defense in depth.
Incorrect Answers
B:Throughput cannot repair a missing authorization check. Simulate one control failure and verify other independent layers still constrain access.
C:Negative tests demonstrate the privilege ceiling. It tests least privilege, while this case requires evidence about defense in depth.
D:Simulate one control failure and verify other independent layers still constrain access. Independence is the core value of defense in depth.
Question 166
After a prior fail secure finding, a cloud service provider reports that the approved safeguard is implemented: “Design access decisions to deny or hold sensitive actions safely when required authorization is unavailable.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Bypass verification during every outage
- Accept a signed change ticket saying: Design access decisions to deny or hold sensitive actions safely when required authorization is unavailable
- Run this adjacent but different test as the sole proof: Attempt a self-approved transaction and verify a second authorized actor is required
- Disable authorization in a test and confirm transactions are rejected or appropriately queued
Explanation
Correct Answer
D:Failure injection proves secure defaults.
Incorrect Answers
A:Open access converts unavailability into integrity and fraud exposure. Disable authorization in a test and confirm transactions are rejected or appropriately queued.
B:Disable authorization in a test and confirm transactions are rejected or appropriately queued. Failure injection proves secure defaults.
C:A control test exercises independence of authority. It tests separation of duties, while this case requires evidence about fail secure.
Question 167
After a prior separation of duties finding, a regulated financial institution reports that the approved safeguard is implemented: “Separate incompatible initiation and approval functions or enforce compensating oversight.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Test actual tenant settings against the agreed responsibility split
- Accept a signed change ticket saying: Separate incompatible initiation and approval functions or enforce compensating oversight
- Use the completion of this alternative as proof: Add a second password to the same employee's account
- Attempt a self-approved transaction and verify a second authorized actor is required
Explanation
Correct Answer
D:A control test exercises independence of authority.
Incorrect Answers
A:Responsibility mapping matters only when linked to operational evidence. It tests shared responsibility, while this case requires evidence about separation of duties.
B:Attempt a self-approved transaction and verify a second authorized actor is required. A control test exercises independence of authority.
C:Extra authentication does not create independent approval. Attempt a self-approved transaction and verify a second authorized actor is required.
Question 168
A classified intelligence system must prevent lower-cleared subjects from reading higher-classified material. Which response best addresses the central security requirement with a defensible, risk-based design?
- Let ordinary document owners downgrade mandatory classification freely
- Use Biba's no-write-up rule as the confidentiality specification
- Use well-formed transformation procedures and separation of duties over constrained data items
- Apply mandatory confidentiality labels with Bell-LaPadula no-read-up and no-write-down controls
Explanation
Correct Answer
D:The model prioritizes confidentiality flows across clearances.
Incorrect Answers
A:Discretionary changes break mandatory labels.
B:Biba addresses integrity, not secrecy flow.
C:Clark-Wilson protects commercial integrity through controlled operations. Apply mandatory confidentiality labels with Bell-LaPadula no-read-up and no-write-down controls.
Question 169
A laboratory needs to prevent untrusted low-integrity data from contaminating high-integrity assay results. Which response best addresses the central security requirement with a defensible, risk-based design?
- Allow untrusted measurements to overwrite verified results
- Apply Bell-LaPadula no-read-up as the only constraint
- Apply mandatory confidentiality labels with Bell-LaPadula no-read-up and no-write-down controls
- Apply Biba-style integrity controls preventing inappropriate read-down and write-up
Explanation
Correct Answer
D:The integrity model limits contamination across trust levels.
Incorrect Answers
A:Low-integrity writes violate integrity protection.
B:Confidentiality rules do not guarantee integrity.
C:The model prioritizes confidentiality flows across clearances. Apply Biba-style integrity controls preventing inappropriate read-down and write-up.
Question 170
A financial ledger must allow updates only through approved, auditable business transactions. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use well-formed transformation procedures and separation of duties over constrained data items
- Give accountants direct unrestricted table writes
- Apply mandatory confidentiality labels with Bell-LaPadula no-read-up and no-write-down controls
- Replace transaction controls with data confidentiality labels alone
Explanation
Correct Answer
A:Clark-Wilson protects commercial integrity through controlled operations.
Incorrect Answers
B:Bypassing certified procedures defeats data integrity.
C:The model prioritizes confidentiality flows across clearances. Use well-formed transformation procedures and separation of duties over constrained data items.
D:Secrecy labels do not validate ledger transformations.
Certified Information Systems Security Professional (CISSP) Practice Tests