Question 10
An API accepts messages claiming to come from a trusted supplier, but sender identity can be spoofed. Which response best addresses the central security requirement with a defensible, risk-based design?
- Add message compression to reduce bandwidth
- Use verified identity and cryptographic sender authentication before trusting supplier-origin messages
- Rely on source IP alone as proof of supplier identity
- Use authenticated integrity protection such as a digital signature or suitable message authentication code
Explanation
Correct Answer
B:Authenticity establishes the claimed origin or identity, distinct from merely transmitting over an encrypted channel.
Incorrect Answers
A:Compression has no role in proving origin.
C:Network addresses can be shared or spoofed and lack strong sender authentication.
D:Integrity controls detect unauthorized changes and bind protected message content to verification. Use verified identity and cryptographic sender authentication before trusting supplier-origin messages.
Question 11
A company must resolve disputes about who approved a high-value electronic contract. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use verified identity and cryptographic sender authentication before trusting supplier-origin messages
- Use a shared team password as the sole approval record
- Use approved digital signatures backed by protected private keys and attributable audit evidence
- Rely only on symmetric encryption of the contract
Explanation
Correct Answer
C:Strong signing and key custody can support evidence that a particular signer approved content.
Incorrect Answers
A:Authenticity establishes the claimed origin or identity, distinct from merely transmitting over an encrypted channel. Use approved digital signatures backed by protected private keys and attributable audit evidence.
B:Shared secrets cannot reliably attribute an act to one person.
D:Encryption may hide content but does not inherently establish individual signatory accountability.
Question 12
After a prior confidentiality finding, an international retailer reports that the approved safeguard is implemented: “Restrict file access by need to know and encrypt sensitive storage and transfer paths.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Test that an unauthorized payroll role cannot read plaintext while an approved role still can
- Accept a signed change ticket saying: Restrict file access by need to know and encrypt sensitive storage and transfer paths
- Run this adjacent but different test as the sole proof: Verify signatures, signatory certificate status, protected key ownership and retained audit context
- Use the completion of this alternative as proof: Add only transaction hashes to payroll exports
Explanation
Correct Answer
A:A denied unauthorized read with authorized functionality directly tests confidentiality.
Incorrect Answers
B:Test that an unauthorized payroll role cannot read plaintext while an approved role still can. A denied unauthorized read with authorized functionality directly tests confidentiality.
C:Nonrepudiation depends on attributable evidence and validation, not an unverified signature icon. It tests nonrepudiation, while this case requires evidence about confidentiality.
D:Hashes may detect modifications but do not hide salary values. Test that an unauthorized payroll role cannot read plaintext while an approved role still can.
Question 13
The security team proposes expensive controls without identifying which business service they protect. Which response best addresses the central security requirement with a defensible, risk-based design?
- Buy the highest-rated tool without consulting process owners
- Exercise due care by implementing reasonable protective measures promptly
- Prioritize whichever vulnerability has the most media coverage
- Map security objectives to business outcomes, process criticality and approved risk appetite before prioritizing spending
Explanation
Correct Answer
D:Security governance directs investment toward business-relevant risk reduction.
Incorrect Answers
A:A tool score is not a substitute for identifying business impact.
B:Due care refers to the conduct of reasonable protection, not simply learning about a risk. Map security objectives to business outcomes, process criticality and approved risk appetite before prioritizing spending.
C:Public attention does not establish local business exposure or value.
Question 14
An operations engineer asks who has authority to accept residual risk from a critical application. Which response best addresses the central security requirement with a defensible, risk-based design?
- Route the decision to the accountable business risk owner under the established risk governance framework
- Allow a junior analyst to approve risk silently
- Let the scanner vendor approve the business risk
- Perform regular risk assessments, control reviews and evidence-based follow-up
Explanation
Correct Answer
A:Operational staff implement controls but cannot unilaterally accept enterprise exposure on behalf of owners.
Incorrect Answers
B:Risk acceptance requires explicit delegated authority and recordkeeping.
C:A tool supplier lacks ownership of organizational consequences.
D:Due diligence is sustained investigation and verification of reasonable protections. Route the decision to the accountable business risk owner under the established risk governance framework.
Question 15
A director receives repeated credible reports of exposed customer records but does not act. Which response best addresses the central security requirement with a defensible, risk-based design?
- Store the reports as meeting notes without mitigation
- Delegate legal responsibility to the external scanner
- Exercise due care by implementing reasonable protective measures promptly
- Perform regular risk assessments, control reviews and evidence-based follow-up
Explanation
Correct Answer
C:Due care refers to the conduct of reasonable protection, not simply learning about a risk.
Incorrect Answers
A:Awareness without reasonable action is insufficient care.
B:Outsourcing analysis does not transfer senior management duty.
D:Due diligence is sustained investigation and verification of reasonable protections. Exercise due care by implementing reasonable protective measures promptly.
Question 16
A board wants evidence that management continuously evaluates whether security controls still work. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rely solely on policy approval without checking implementation
- Perform regular risk assessments, control reviews and evidence-based follow-up
- Assume last year's assessment remains indefinitely valid
- Exercise due care by implementing reasonable protective measures promptly
Explanation
Correct Answer
B:Due diligence is sustained investigation and verification of reasonable protections.
Incorrect Answers
A:A written policy does not prove security performance.
C:Threats and business context change over time.
D:Due care refers to the conduct of reasonable protection, not simply learning about a risk. Perform regular risk assessments, control reviews and evidence-based follow-up.
Question 17
A global manufacturer wants to structure control coverage and communicate maturity across its units. Which response best addresses the central security requirement with a defensible, risk-based design?
- Implement every possible control regardless of applicability
- Map security objectives to business outcomes, process criticality and approved risk appetite before prioritizing spending
- Select a recognized framework such as NIST CSF 2.0 and map outcomes to business risks and owned controls
- Treat the framework title as a certification of all controls
Explanation
Correct Answer
C:A framework organizes governance and outcomes but does not prescribe identical implementations everywhere.
Incorrect Answers
A:Unscoped maximal controls can be wasteful and fail business alignment.
B:Security governance directs investment toward business-relevant risk reduction. Select a recognized framework such as NIST CSF 2.0 and map outcomes to business risks and owned controls.
D:Mapping a framework is not proof that controls operate effectively.
Question 18
After a prior business alignment finding, a payment-services company reports that the approved safeguard is implemented: “Map security objectives to business outcomes, process criticality and approved risk appetite before prioritizing spending.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Map security objectives to business outcomes, process criticality and approved risk appetite before prioritizing spending
- Trace funded security initiatives to business objectives and measurable risk outcomes
- Use the completion of this alternative as proof: Buy the highest-rated tool without consulting process owners
- Run this adjacent but different test as the sole proof: Inspect current risk reviews, control-testing evidence and resolved findings
Explanation
Correct Answer
B:Strategy traceability shows security investments serve organizational priorities.
Incorrect Answers
A:Trace funded security initiatives to business objectives and measurable risk outcomes. Strategy traceability shows security investments serve organizational priorities.
C:A tool score is not a substitute for identifying business impact. Trace funded security initiatives to business objectives and measurable risk outcomes.
D:Ongoing scrutiny distinguishes due diligence from a one-time control deployment. It tests due diligence, while this case requires evidence about business alignment.
Question 19
After a prior governance responsibility finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Route the decision to the accountable business risk owner under the established risk governance framework.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Review gap mapping, accountable owners and objective evidence for selected control outcomes
- Accept a signed change ticket saying: Route the decision to the accountable business risk owner under the established risk governance framework
- Confirm approval was given by an authorized risk owner against documented appetite and treatment options
- Use the completion of this alternative as proof: Let the scanner vendor approve the business risk
Explanation
Correct Answer
C:Proper signature and context establish accountability for residual risk.
Incorrect Answers
A:A traceable control profile demonstrates implementation against the chosen framework. It tests security control frameworks, while this case requires evidence about governance responsibility.
B:Confirm approval was given by an authorized risk owner against documented appetite and treatment options. Proper signature and context establish accountability for residual risk.
D:A tool supplier lacks ownership of organizational consequences. Confirm approval was given by an authorized risk owner against documented appetite and treatment options.
Question 20
After a prior due care finding, an international retailer reports that the approved safeguard is implemented: “Exercise due care by implementing reasonable protective measures promptly.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Exercise due care by implementing reasonable protective measures promptly
- Verify the mitigation plan has accountable owners, milestones and completed protective actions
- Use the completion of this alternative as proof: Store the reports as meeting notes without mitigation
- Run this adjacent but different test as the sole proof: Trace funded security initiatives to business objectives and measurable risk outcomes
Explanation
Correct Answer
B:Evidence of actual controls supports exercise of due care.
Incorrect Answers
A:Verify the mitigation plan has accountable owners, milestones and completed protective actions. Evidence of actual controls supports exercise of due care.
C:Awareness without reasonable action is insufficient care. Verify the mitigation plan has accountable owners, milestones and completed protective actions.
D:Strategy traceability shows security investments serve organizational priorities. It tests business alignment, while this case requires evidence about due care.
Certified Information Systems Security Professional (CISSP) Practice Tests