Question 170
A financial ledger must allow updates only through approved, auditable business transactions. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use well-formed transformation procedures and separation of duties over constrained data items
- Give accountants direct unrestricted table writes
- Apply mandatory confidentiality labels with Bell-LaPadula no-read-up and no-write-down controls
- Replace transaction controls with data confidentiality labels alone
Explanation
Correct Answer
A:Clark-Wilson protects commercial integrity through controlled operations.
Incorrect Answers
B:Bypassing certified procedures defeats data integrity.
C:The model prioritizes confidentiality flows across clearances. Use well-formed transformation procedures and separation of duties over constrained data items.
D:Secrecy labels do not validate ledger transformations.
Question 171
A consultant has accessed confidential strategy files for one client and later requests a competing client's files. Which response best addresses the central security requirement with a defensible, risk-based design?
- Apply dynamic conflict-of-interest restrictions based on access history
- Use well-formed transformation procedures and separation of duties over constrained data items
- Make past access history invisible to authorization
- Use static read-only permissions for every customer
Explanation
Correct Answer
A:Brewer-Nash/Chinese Wall prevents conflicting client-data exposure over time.
Incorrect Answers
B:Clark-Wilson protects commercial integrity through controlled operations. Apply dynamic conflict-of-interest restrictions based on access history.
C:Conflict status depends on historical access.
D:Read-only access can still reveal competitor secrets.
Question 172
After a prior bell-lapadula finding, an international retailer reports that the approved safeguard is implemented: “Apply mandatory confidentiality labels with Bell-LaPadula no-read-up and no-write-down controls.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Apply mandatory confidentiality labels with Bell-LaPadula no-read-up and no-write-down controls
- Run this adjacent but different test as the sole proof: Test access to competing datasets after a first-client access
- Use the completion of this alternative as proof: Use Biba's no-write-up rule as the confidentiality specification
- Simulate read-up and write-down attempts for subjects at different clearances
Explanation
Correct Answer
D:Boundary tests validate confidentiality flow.
Incorrect Answers
A:Simulate read-up and write-down attempts for subjects at different clearances. Boundary tests validate confidentiality flow.
B:Stateful access history distinguishes this model. It tests brewer-nash, while this case requires evidence about bell-lapadula.
C:Biba addresses integrity, not secrecy flow. Simulate read-up and write-down attempts for subjects at different clearances.
Question 173
A procurement team selects endpoint products before defining the threats and assurance outcomes required. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assume every control solves every risk equally
- Select controls that directly address the assessed threat mechanism and required outcome
- Translate business security needs into testable requirements before comparing designs
- Use a vendor feature-count contest as the only decision
Explanation
Correct Answer
C:Explicit requirements make candidate-control selection defensible.
Incorrect Answers
A:Different controls address different threat paths.
B:Controls must fit the specific attack or failure path. Translate business security needs into testable requirements before comparing designs.
D:Feature count does not establish requirement fit.
Question 174
A medical device system can gain stronger authentication but its emergency workflow has strict availability needs. Which response best addresses the central security requirement with a defensible, risk-based design?
- Disable authentication to eliminate friction
- Balance safety, usability and security with documented risk-based design decisions
- Mandate blocking all emergency use regardless of clinical consequence
- Translate business security needs into testable requirements before comparing designs
Explanation
Correct Answer
B:Security design must meet mission constraints rather than optimize one property blindly.
Incorrect Answers
A:Removing identity control creates unauthorized access risk.
C:Security that breaks life-safety workflow may increase overall harm.
D:Explicit requirements make candidate-control selection defensible. Balance safety, usability and security with documented risk-based design decisions.
Question 175
A supplier reports its software has no known CVEs and calls the system verified secure. Which response best addresses the central security requirement with a defensible, risk-based design?
- Treat a passing vulnerability scan as a complete formal proof
- Select controls that directly address the assessed threat mechanism and required outcome
- Require evidence of design, implementation and independent testing appropriate to risk
- Accept self-declared perfection without evidence
Explanation
Correct Answer
C:Absence of known defects is not positive assurance of security.
Incorrect Answers
A:Scanners cover only selected classes of known flaws.
B:Controls must fit the specific attack or failure path. Require evidence of design, implementation and independent testing appropriate to risk.
D:Unchallenged claims provide weak confidence.
Question 176
A hospital chooses an expensive DLP tool to prevent unauthorized physical access to a server room. Which response best addresses the central security requirement with a defensible, risk-based design?
- Install badge access but omit incident logging when audits require it
- Purchase DLP solely because it has a high industry rating
- Balance safety, usability and security with documented risk-based design decisions
- Select controls that directly address the assessed threat mechanism and required outcome
Explanation
Correct Answer
D:Controls must fit the specific attack or failure path.
Incorrect Answers
A:A partial control may leave evidence obligations unmet.
B:Data-loss tooling does not control a physical door.
C:Security design must meet mission constraints rather than optimize one property blindly. Select controls that directly address the assessed threat mechanism and required outcome.
Question 177
After a prior security requirement mapping finding, a regional hospital network reports that the approved safeguard is implemented: “Translate business security needs into testable requirements before comparing designs.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Trace each selected feature to an approved requirement and acceptance test
- Run this adjacent but different test as the sole proof: Threat-test the chosen control and confirm the intended outcome
- Use the completion of this alternative as proof: Use a vendor feature-count contest as the only decision
- Accept a signed change ticket saying: Translate business security needs into testable requirements before comparing designs
Explanation
Correct Answer
A:Bidirectional traceability prevents omissions.
Incorrect Answers
B:Effective selection is demonstrated by matching behavior. It tests control selection, while this case requires evidence about security requirement mapping.
C:Feature count does not establish requirement fit. Trace each selected feature to an approved requirement and acceptance test.
D:Trace each selected feature to an approved requirement and acceptance test. Bidirectional traceability prevents omissions.
Question 178
After a prior design tradeoffs finding, a payment-services company reports that the approved safeguard is implemented: “Balance safety, usability and security with documented risk-based design decisions.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Exercise both emergency and normal paths under realistic fault conditions
- Run this adjacent but different test as the sole proof: Evaluate assurance reports, scope, limitations and remediation closure
- Accept a signed change ticket saying: Balance safety, usability and security with documented risk-based design decisions
- Use the completion of this alternative as proof: Mandate blocking all emergency use regardless of clinical consequence
Explanation
Correct Answer
A:Balanced tests expose safety/security tradeoffs.
Incorrect Answers
B:Assurance requires justified confidence, not one status label. It tests assurance, while this case requires evidence about design tradeoffs.
C:Exercise both emergency and normal paths under realistic fault conditions. Balanced tests expose safety/security tradeoffs.
D:Security that breaks life-safety workflow may increase overall harm. Exercise both emergency and normal paths under realistic fault conditions.
Question 179
A fleet needs hardware-bound boot measurements and protection of device cryptographic material. Which response best addresses the central security requirement with a defensible, risk-based design?
- Store measured-boot secrets in plain configuration files
- Treat a BIOS password as a cryptographic attestation service
- Keep private signing keys within approved isolated cryptographic boundary and limit operations by role
- Use a trusted platform module with measured boot and protected key operations where supported
Explanation
Correct Answer
D:TPM capabilities can bind trust evidence and keys to a hardware root.
Incorrect Answers
A:Software-only files lack hardware binding.
B:A password is not a TPM quote.
C:Isolation reduces key extraction risk and separates use from raw key access. Use a trusted platform module with measured boot and protected key operations where supported.
Question 180
A process exploit attempts to execute attacker bytes from a data-only memory page. Which response best addresses the central security requirement with a defensible, risk-based design?
- Enforce execute permissions such as NX/DEP with complementary memory-safety mitigations
- Use full disk encryption as the only runtime defense
- Use verified boot/UEFI Secure Boot with controlled signing trust and recovery
- Disable address randomization to simplify debugging
Explanation
Correct Answer
A:Non-executable data pages impede certain injected code execution.
Incorrect Answers
B:Disk encryption does not govern in-memory execution.
C:Secure Boot helps detect unauthorized boot components before operating-system load. Enforce execute permissions such as NX/DEP with complementary memory-safety mitigations.
D:Predictable memory layouts help attackers.
Certified Information Systems Security Professional (CISSP) Practice Tests