Question 220
Visitors can walk directly from a public lobby into the server hall. Which response best addresses the central security requirement with a defensible, risk-based design?
- Layer physical zones and enforce authorized transitions using badges, locks and monitoring
- Use only a sign saying Authorized Personnel
- Provide resilient HVAC, environmental monitoring and controlled shutdown procedures
- Give all visitors unrestricted temporary badges
Explanation
Correct Answer
A:Physical defense in depth separates public, controlled and restricted areas.
Incorrect Answers
B:Signs do not prevent entry.
C:Environmental resilience needs capacity and response, not alerts alone. Layer physical zones and enforce authorized transitions using badges, locks and monitoring.
D:Unscoped access defeats zoning.
Question 221
Temperature sensors exist but no cooling fallback is available for critical racks. Which response best addresses the central security requirement with a defensible, risk-based design?
- Provide resilient HVAC, environmental monitoring and controlled shutdown procedures
- Evaluate environmental, utility, logistics and geographic threats before site selection
- Silence alarms to avoid staff fatigue
- Raise CPU cooling thresholds arbitrarily
Explanation
Correct Answer
A:Environmental resilience needs capacity and response, not alerts alone.
Incorrect Answers
B:Physical location can create correlated outages and recovery obstacles. Provide resilient HVAC, environmental monitoring and controlled shutdown procedures.
C:Lost detection increases thermal damage risk.
D:Threshold changes cannot add cooling capacity.
Question 222
After a prior site selection finding, a cloud service provider reports that the approved safeguard is implemented: “Evaluate environmental, utility, logistics and geographic threats before site selection.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Choose solely by rent price
- Cross-check hazard maps, utilities and alternative transport routes
- Run this adjacent but different test as the sole proof: Test cooling failure response and thermal margins
- Accept a signed change ticket saying: Evaluate environmental, utility, logistics and geographic threats before site selection
Explanation
Correct Answer
B:Independent evidence informs siting.
Incorrect Answers
A:Cost does not capture flood or isolation risk. Cross-check hazard maps, utilities and alternative transport routes.
C:Exercises prove resilience beyond normal-state metrics. It tests environmental resilience, while this case requires evidence about site selection.
D:Cross-check hazard maps, utilities and alternative transport routes. Independent evidence informs siting.
Question 223
A server room uses water-sensitive equipment and must minimize both fire spread and equipment damage. Which response best addresses the central security requirement with a defensible, risk-based design?
- Deploy UPS capacity sized for critical load and generator transfer interval
- Design code-compliant detection and appropriate suppression suited to occupancy and equipment
- Disable suppression to protect hardware
- Choose an agent without assessing occupant safety or local code
Explanation
Correct Answer
B:Life safety, early detection and appropriate agent selection must be balanced.
Incorrect Answers
A:UPS bridges short interruptions and conditions power but is not indefinite generation. Design code-compliant detection and appropriate suppression suited to occupancy and equipment.
C:Uncontrolled fire threatens people and operations.
D:Suppression decisions require life-safety compliance.
Question 224
A hospital network closet loses power before its standby generator starts. Which response best addresses the central security requirement with a defensible, risk-based design?
- Deploy UPS capacity sized for critical load and generator transfer interval
- Treat a surge protector as full backup power
- Design code-compliant detection and appropriate suppression suited to occupancy and equipment
- Assume generator startup has zero transfer time
Explanation
Correct Answer
A:UPS bridges short interruptions and conditions power but is not indefinite generation.
Incorrect Answers
B:Surge protection does not provide energy during outage.
C:Life safety, early detection and appropriate agent selection must be balanced. Deploy UPS capacity sized for critical load and generator transfer interval.
D:The gap can interrupt equipment.
Question 225
One cooling unit failure overheats a payment-processing room. Which response best addresses the central security requirement with a defensible, risk-based design?
- Increase network throughput
- Use monitored cooling capacity with N+1 or appropriate redundancy to the required heat load
- Place all chillers on a single fragile power circuit
- Design code-compliant detection and appropriate suppression suited to occupancy and equipment
Explanation
Correct Answer
B:Cooling is an availability dependency even when computing hardware is redundant.
Incorrect Answers
A:Packets are not the cause of overheating.
C:Correlated power loss defeats multiple units.
D:Life safety, early detection and appropriate agent selection must be balanced. Use monitored cooling capacity with N+1 or appropriate redundancy to the required heat load.
Question 226
A critical data hall has two PDUs but both connect to the same single upstream breaker. Which response best addresses the central security requirement with a defensible, risk-based design?
- Add another PDU to the same upstream circuit
- Deploy UPS capacity sized for critical load and generator transfer interval
- Design independent power paths without shared hidden single points of failure
- Count dual power cords as proof of independent utility feed
Explanation
Correct Answer
C:Redundancy requires independence across the whole chain.
Incorrect Answers
A:More devices cannot remove shared upstream failure.
B:UPS bridges short interruptions and conditions power but is not indefinite generation. Design independent power paths without shared hidden single points of failure.
D:Cords may terminate at the same breaker.
Question 227
An archive holds sealed recovery tapes in an unlocked office near the primary server room. Which response best addresses the central security requirement with a defensible, risk-based design?
- Label tapes confidential without controlling physical access
- Deploy UPS capacity sized for critical load and generator transfer interval
- Store the only copies beside the systems they protect
- Use controlled off-site or isolated media storage with logged access and environmental protection
Explanation
Correct Answer
D:Backup media must survive site incidents and unauthorized handling.
Incorrect Answers
A:Labels do not enforce protection.
B:UPS bridges short interruptions and conditions power but is not indefinite generation. Use controlled off-site or isolated media storage with logged access and environmental protection.
C:One incident can destroy both.
Question 228
A maintenance contractor can enter a high-security communications room without escort or log. Which response best addresses the central security requirement with a defensible, risk-based design?
- Treat possession of an employee badge as universal access
- Deploy UPS capacity sized for critical load and generator transfer interval
- Give every vendor a shared untracked key
- Require controlled authorization, escort where appropriate and recorded entry to sensitive zones
Explanation
Correct Answer
D:Physical privileges should correspond to approved task and identity.
Incorrect Answers
A:Area permissions are not all-or-nothing.
B:UPS bridges short interruptions and conditions power but is not indefinite generation. Require controlled authorization, escort where appropriate and recorded entry to sensitive zones.
C:Shared credentials defeat attribution.
Question 229
After a prior fire suppression finding, a university consortium reports that the approved safeguard is implemented: “Design code-compliant detection and appropriate suppression suited to occupancy and equipment.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Design code-compliant detection and appropriate suppression suited to occupancy and equipment
- Run this adjacent but different test as the sole proof: Review access logs and challenge an unauthorized maintenance request
- Test detectors, evacuation pathways and suppression maintenance records
- Use the completion of this alternative as proof: Disable suppression to protect hardware
Explanation
Correct Answer
C:Integrated testing validates fire readiness.
Incorrect Answers
A:Test detectors, evacuation pathways and suppression maintenance records. Integrated testing validates fire readiness.
B:Access testing checks zoning rules. It tests restricted areas, while this case requires evidence about fire suppression.
D:Uncontrolled fire threatens people and operations. Test detectors, evacuation pathways and suppression maintenance records.
Question 230
A team begins building a secure service without documenting confidentiality or audit requirements. Which response best addresses the central security requirement with a defensible, risk-based design?
- Capture testable security requirements at initiation and link them to business risks
- Treat a vulnerability scanner as the requirement specification
- Plan secure data disposition, access revocation and dependency removal during retirement
- Write requirements only after production incidents
Explanation
Correct Answer
A:Late requirements cause expensive redesign and omitted controls.
Incorrect Answers
B:Tools do not encode full business needs.
C:End of service does not mean residual data or privileges disappear. Capture testable security requirements at initiation and link them to business risks.
D:Reactive discovery is costly.
Certified Information Systems Security Professional (CISSP) Practice Tests