Question 190
A function processes untrusted input and shares a wildcard cloud role with unrelated workflows. Which response best addresses the central security requirement with a defensible, risk-based design?
- Choose consistency and conflict-handling semantics that match business requirements
- Assign scoped function identity, validate input and limit event-source/secret permissions
- Use one all-powerful role for every function
- Assume the platform automatically validates all business input
Explanation
Correct Answer
B:Serverless shifts host management but leaves customer code and permissions in scope.
Incorrect Answers
A:Replication and availability do not automatically provide serializable writes. Assign scoped function identity, validate input and limit event-source/secret permissions.
C:Wildcard roles magnify compromise.
D:Managed execution does not supply application validation.
Question 191
A virtualization cluster allows guests to access the hypervisor management interface. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assume each VM has dedicated immutable hardware
- Map patching, runtime hardening and access duties to the IaaS shared-responsibility model
- Isolate management planes and harden hypervisors against guest-to-host escape
- Expose the hypervisor console to every guest VLAN
Explanation
Correct Answer
C:The virtualization boundary must protect host control from workloads.
Incorrect Answers
A:Shared hypervisors create common dependencies.
B:IaaS customers normally retain substantial guest workload responsibilities. Isolate management planes and harden hypervisors against guest-to-host escape.
D:Guest compromise could reach the management plane.
Question 192
Smart sensors retain factory passwords and receive no authenticated firmware updates. Which response best addresses the central security requirement with a defensible, risk-based design?
- Isolate management planes and harden hypervisors against guest-to-host escape
- Keep one hard-coded password across all devices
- Provision unique identities, secure update validation and controlled device network segmentation
- Use public unsigned update packages
Explanation
Correct Answer
C:IoT security must address constrained lifecycle and remote physical exposure.
Incorrect Answers
A:The virtualization boundary must protect host control from workloads. Provision unique identities, secure update validation and controlled device network segmentation.
B:Shared credentials make fleet-wide compromise easy.
D:Unsigned firmware permits malicious replacement.
Question 193
After a prior cloud models finding, a regional hospital network reports that the approved safeguard is implemented: “Map patching, runtime hardening and access duties to the IaaS shared-responsibility model.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Map patching, runtime hardening and access duties to the IaaS shared-responsibility model
- Review guest patch state and tenant IAM configuration against the model
- Run this adjacent but different test as the sole proof: Validate segmentation and maintenance-window tests with OT engineers
- Use the completion of this alternative as proof: Rely only on provider physical security audits
Explanation
Correct Answer
B:Responsibility clarity must survive real deployments.
Incorrect Answers
A:Review guest patch state and tenant IAM configuration against the model. Responsibility clarity must survive real deployments.
C:Safety-aware testing proves protection without unsafe disruption. It tests ics, while this case requires evidence about cloud models.
D:Physical assurance does not patch a guest OS. Review guest patch state and tenant IAM configuration against the model.
Question 194
After a prior distributed systems finding, a payment-services company reports that the approved safeguard is implemented: “Choose consistency and conflict-handling semantics that match business requirements.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Assume multi-site replication guarantees one global write order
- Run this adjacent but different test as the sole proof: Attempt a tampered update and default-password login and verify rejection
- Accept a signed change ticket saying: Choose consistency and conflict-handling semantics that match business requirements
- Inject concurrent writes and verify deterministic resolution/consistency limits
Explanation
Correct Answer
D:Conflict tests show the system's actual guarantees.
Incorrect Answers
A:Asynchronous replication can conflict. Inject concurrent writes and verify deterministic resolution/consistency limits.
B:A fleet test confirms both update authenticity and credential controls. It tests iot, while this case requires evidence about distributed systems.
C:Inject concurrent writes and verify deterministic resolution/consistency limits. Conflict tests show the system's actual guarantees.
Question 195
After a prior ics finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Segment OT from IT and use safety-aware assessment and change controls.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Run aggressive authenticated scans during peak manufacturing
- Run this adjacent but different test as the sole proof: Review guest patch state and tenant IAM configuration against the model
- Validate segmentation and maintenance-window tests with OT engineers
- Accept a signed change ticket saying: Segment OT from IT and use safety-aware assessment and change controls
Explanation
Correct Answer
C:Safety-aware testing proves protection without unsafe disruption.
Incorrect Answers
A:Scanning may disrupt fragile controllers. Validate segmentation and maintenance-window tests with OT engineers.
B:Responsibility clarity must survive real deployments. It tests cloud models, while this case requires evidence about ics.
D:Validate segmentation and maintenance-window tests with OT engineers. Safety-aware testing proves protection without unsafe disruption.
Question 196
After a prior containers finding, an international retailer reports that the approved safeguard is implemented: “Run as unprivileged principals with minimal capabilities, controlled mounts and signed images.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Attempt forbidden host filesystem access from the workload and verify denial
- Accept a signed change ticket saying: Run as unprivileged principals with minimal capabilities, controlled mounts and signed images
- Use the completion of this alternative as proof: Treat containers as fully independent hardware machines
- Run this adjacent but different test as the sole proof: Attempt cross-service calls with an unauthorized identity and confirm rejection
Explanation
Correct Answer
A:A boundary test shows actual privilege containment.
Incorrect Answers
B:Attempt forbidden host filesystem access from the workload and verify denial. A boundary test shows actual privilege containment.
C:Containers typically share host-kernel attack surface. Attempt forbidden host filesystem access from the workload and verify denial.
D:Identity-level negative tests validate service controls. It tests microservices, while this case requires evidence about containers.
Question 197
After a prior microservices finding, a university consortium reports that the approved safeguard is implemented: “Apply service identity, mutual authentication and per-service authorization at communication boundaries.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Review guest patch state and tenant IAM configuration against the model
- Accept a signed change ticket saying: Apply service identity, mutual authentication and per-service authorization at communication boundaries
- Attempt cross-service calls with an unauthorized identity and confirm rejection
- Use the completion of this alternative as proof: Allow every internal source to invoke every service
Explanation
Correct Answer
C:Identity-level negative tests validate service controls.
Incorrect Answers
A:Responsibility clarity must survive real deployments. It tests cloud models, while this case requires evidence about microservices.
B:Attempt cross-service calls with an unauthorized identity and confirm rejection. Identity-level negative tests validate service controls.
D:Broad lateral access amplifies compromise. Attempt cross-service calls with an unauthorized identity and confirm rejection.
Question 198
After a prior serverless finding, a cloud service provider reports that the approved safeguard is implemented: “Assign scoped function identity, validate input and limit event-source/secret permissions.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Assume the platform automatically validates all business input
- Invoke with malformed input and unauthorized resource access and observe rejection
- Accept a signed change ticket saying: Assign scoped function identity, validate input and limit event-source/secret permissions
- Run this adjacent but different test as the sole proof: Review guest patch state and tenant IAM configuration against the model
Explanation
Correct Answer
B:Service-specific tests reveal the customer control plane.
Incorrect Answers
A:Managed execution does not supply application validation. Invoke with malformed input and unauthorized resource access and observe rejection.
C:Invoke with malformed input and unauthorized resource access and observe rejection. Service-specific tests reveal the customer control plane.
D:Responsibility clarity must survive real deployments. It tests cloud models, while this case requires evidence about serverless.
Question 199
After a prior virtualization finding, a regulated financial institution reports that the approved safeguard is implemented: “Isolate management planes and harden hypervisors against guest-to-host escape.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Review guest patch state and tenant IAM configuration against the model
- Use the completion of this alternative as proof: Expose the hypervisor console to every guest VLAN
- Test segmentation of guest versus management networks and privileged APIs
- Accept a signed change ticket saying: Isolate management planes and harden hypervisors against guest-to-host escape
Explanation
Correct Answer
C:Boundary testing reduces hypervisor exposure.
Incorrect Answers
A:Responsibility clarity must survive real deployments. It tests cloud models, while this case requires evidence about virtualization.
B:Guest compromise could reach the management plane. Test segmentation of guest versus management networks and privileged APIs.
D:Test segmentation of guest versus management networks and privileged APIs. Boundary testing reduces hypervisor exposure.
Question 200
A backup platform needs fast bulk encryption of multi-terabyte datasets. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use asymmetric encryption on every data block without a hybrid design
- Reuse a nonce under a mode that forbids reuse
- Plan key creation, rotation, escrow/recovery and retirement with old-ciphertext dependency mapping
- Use approved authenticated symmetric encryption with protected key generation and handling
Explanation
Correct Answer
D:Symmetric ciphers are efficient for bulk confidentiality/integrity with shared-secret governance.
Incorrect Answers
A:Public-key operations are inefficient for bulk data.
B:Nonce misuse can destroy confidentiality or authenticity.
C:Deleting needed keys can make retained ciphertext unrecoverable. Use approved authenticated symmetric encryption with protected key generation and handling.
Certified Information Systems Security Professional (CISSP) Practice Tests