Question 20
After a prior due care finding, an international retailer reports that the approved safeguard is implemented: “Exercise due care by implementing reasonable protective measures promptly.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Exercise due care by implementing reasonable protective measures promptly
- Verify the mitigation plan has accountable owners, milestones and completed protective actions
- Use the completion of this alternative as proof: Store the reports as meeting notes without mitigation
- Run this adjacent but different test as the sole proof: Trace funded security initiatives to business objectives and measurable risk outcomes
Explanation
Correct Answer
B:Evidence of actual controls supports exercise of due care.
Incorrect Answers
A:Verify the mitigation plan has accountable owners, milestones and completed protective actions. Evidence of actual controls supports exercise of due care.
C:Awareness without reasonable action is insufficient care. Verify the mitigation plan has accountable owners, milestones and completed protective actions.
D:Strategy traceability shows security investments serve organizational priorities. It tests business alignment, while this case requires evidence about due care.
Question 21
After a prior due diligence finding, a university consortium reports that the approved safeguard is implemented: “Perform regular risk assessments, control reviews and evidence-based follow-up.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Inspect current risk reviews, control-testing evidence and resolved findings
- Use the completion of this alternative as proof: Assume last year's assessment remains indefinitely valid
- Run this adjacent but different test as the sole proof: Verify the mitigation plan has accountable owners, milestones and completed protective actions
- Accept a signed change ticket saying: Perform regular risk assessments, control reviews and evidence-based follow-up
Explanation
Correct Answer
A:Ongoing scrutiny distinguishes due diligence from a one-time control deployment.
Incorrect Answers
B:Threats and business context change over time. Inspect current risk reviews, control-testing evidence and resolved findings.
C:Evidence of actual controls supports exercise of due care. It tests due care, while this case requires evidence about due diligence.
D:Inspect current risk reviews, control-testing evidence and resolved findings. Ongoing scrutiny distinguishes due diligence from a one-time control deployment.
Question 22
After a prior security control frameworks finding, a cloud service provider reports that the approved safeguard is implemented: “Select a recognized framework such as NIST CSF 2.0 and map outcomes to business risks and owned controls.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Select a recognized framework such as NIST CSF 2.0 and map outcomes to business risks and owned controls
- Run this adjacent but different test as the sole proof: Verify the mitigation plan has accountable owners, milestones and completed protective actions
- Review gap mapping, accountable owners and objective evidence for selected control outcomes
- Use the completion of this alternative as proof: Treat the framework title as a certification of all controls
Explanation
Correct Answer
C:A traceable control profile demonstrates implementation against the chosen framework.
Incorrect Answers
A:Review gap mapping, accountable owners and objective evidence for selected control outcomes. A traceable control profile demonstrates implementation against the chosen framework.
B:Evidence of actual controls supports exercise of due care. It tests due care, while this case requires evidence about security control frameworks.
D:Mapping a framework is not proof that controls operate effectively. Review gap mapping, accountable owners and objective evidence for selected control outcomes.
Question 23
A team plans to reuse collected employee health data for marketing in another jurisdiction. Which response best addresses the central security requirement with a defensible, risk-based design?
- Review license terms, obligations and allowed distribution before release
- Assume employment consent is valid for all future uses
- Obtain privacy/legal review of purpose, lawful basis, notices and local rights before secondary processing
- Anonymize only the destination filename
Explanation
Correct Answer
C:A new processing purpose may be restricted even if the company already possesses the data.
Incorrect Answers
A:Technical ability to copy software does not authorize redistribution or ignore attribution obligations. Obtain privacy/legal review of purpose, lawful basis, notices and local rights before secondary processing.
B:Initial collection does not create unlimited lawful grounds for later purposes.
D:Renaming a file does not remove personal-data identifiability.
Question 24
A developer bundles a third-party library into a commercial security product without checking its license. Which response best addresses the central security requirement with a defensible, risk-based design?
- Treat every freely downloadable package as public domain
- Review license terms, obligations and allowed distribution before release
- Remove author comments while keeping copied code
- Assess applicable transfer restrictions, recipient protections, contracts and security measures before migration
Explanation
Correct Answer
B:Technical ability to copy software does not authorize redistribution or ignore attribution obligations.
Incorrect Answers
A:Free access does not eliminate copyright or license conditions.
C:Stripping attribution may worsen rather than resolve license compliance.
D:Cross-border transfers can trigger separate legal and contractual obligations. Review license terms, obligations and allowed distribution before release.
Question 25
An EU client dataset will be moved to a support provider in a foreign jurisdiction. Which response best addresses the central security requirement with a defensible, risk-based design?
- Change the cloud region name in documentation while moving data
- Have qualified legal/compliance owners map binding obligations into security controls and reporting triggers
- Assume encryption alone establishes a lawful transfer basis
- Assess applicable transfer restrictions, recipient protections, contracts and security measures before migration
Explanation
Correct Answer
D:Cross-border transfers can trigger separate legal and contractual obligations.
Incorrect Answers
A:Mislabeling storage location cannot cure an unlawful transfer.
B:Different laws and contracts can impose different deadlines, scopes and responsibilities. Assess applicable transfer restrictions, recipient protections, contracts and security measures before migration.
C:Encryption supports security but does not replace transfer legality.
Question 26
A regulated organization has overlapping contractual, statutory and sector reporting requirements. Which response best addresses the central security requirement with a defensible, risk-based design?
- Ask a tool vendor to decide legal applicability without counsel
- Review license terms, obligations and allowed distribution before release
- Apply one generic privacy policy to all jurisdictions without review
- Have qualified legal/compliance owners map binding obligations into security controls and reporting triggers
Explanation
Correct Answer
D:Different laws and contracts can impose different deadlines, scopes and responsibilities.
Incorrect Answers
A:Technical vendors cannot determine all legal duties for the organization.
B:Technical ability to copy software does not authorize redistribution or ignore attribution obligations. Have qualified legal/compliance owners map binding obligations into security controls and reporting triggers.
C:A generic policy may omit binding local obligations.
Question 27
After a prior privacy law finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Obtain privacy/legal review of purpose, lawful basis, notices and local rights before secondary processing.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Document the lawful purpose assessment, applicable rights and approved processing controls
- Use the completion of this alternative as proof: Assume employment consent is valid for all future uses
- Accept a signed change ticket saying: Obtain privacy/legal review of purpose, lawful basis, notices and local rights before secondary processing
- Run this adjacent but different test as the sole proof: Reconcile obligation registers, owners and evidence of required filings or notifications
Explanation
Correct Answer
A:Evidence of lawful basis and purpose limitation supports privacy compliance.
Incorrect Answers
B:Initial collection does not create unlimited lawful grounds for later purposes. Document the lawful purpose assessment, applicable rights and approved processing controls.
C:Document the lawful purpose assessment, applicable rights and approved processing controls. Evidence of lawful basis and purpose limitation supports privacy compliance.
D:A mapped obligation register prevents important statutory or contract requirements being silently missed. It tests legal/regulatory obligations, while this case requires evidence about privacy law.
Question 28
A development team intends to ship a commercial product using a library whose license requires source disclosure for covered distributions. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assess applicable transfer restrictions, recipient protections, contracts and security measures before migration
- Consult qualified legal counsel to assess license compatibility and redesign the distribution if needed
- Assume a free download permits any proprietary redistribution
- Strip copyright notices from the distributed package
Explanation
Correct Answer
B:Open-source obligations depend on license terms and actual distribution patterns.
Incorrect Answers
A:Cross-border transfers can trigger separate legal and contractual obligations. Consult qualified legal counsel to assess license compatibility and redesign the distribution if needed.
C:Cost and license obligations are unrelated.
D:Removing notices can deepen noncompliance.
Question 29
After a prior transborder data flows finding, a university consortium reports that the approved safeguard is implemented: “Assess applicable transfer restrictions, recipient protections, contracts and security measures before migration.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Verify the data-flow map and documented approved transfer mechanism for each destination
- Run this adjacent but different test as the sole proof: Document the lawful purpose assessment, applicable rights and approved processing controls
- Accept a signed change ticket saying: Assess applicable transfer restrictions, recipient protections, contracts and security measures before migration
- Use the completion of this alternative as proof: Assume encryption alone establishes a lawful transfer basis
Explanation
Correct Answer
A:Actual flow evidence is needed to validate residency and transfer constraints.
Incorrect Answers
B:Evidence of lawful basis and purpose limitation supports privacy compliance. It tests privacy law, while this case requires evidence about transborder data flows.
C:Verify the data-flow map and documented approved transfer mechanism for each destination. Actual flow evidence is needed to validate residency and transfer constraints.
D:Encryption supports security but does not replace transfer legality. Verify the data-flow map and documented approved transfer mechanism for each destination.
Question 30
After a prior legal/regulatory obligations finding, a cloud service provider reports that the approved safeguard is implemented: “Have qualified legal/compliance owners map binding obligations into security controls and reporting triggers.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Apply one generic privacy policy to all jurisdictions without review
- Run this adjacent but different test as the sole proof: Verify the data-flow map and documented approved transfer mechanism for each destination
- Reconcile obligation registers, owners and evidence of required filings or notifications
- Accept a signed change ticket saying: Have qualified legal/compliance owners map binding obligations into security controls and reporting triggers
Explanation
Correct Answer
C:A mapped obligation register prevents important statutory or contract requirements being silently missed.
Incorrect Answers
A:A generic policy may omit binding local obligations. Reconcile obligation registers, owners and evidence of required filings or notifications.
B:Actual flow evidence is needed to validate residency and transfer constraints. It tests transborder data flows, while this case requires evidence about legal/regulatory obligations.
D:Reconcile obligation registers, owners and evidence of required filings or notifications. A mapped obligation register prevents important statutory or contract requirements being silently missed.
Certified Information Systems Security Professional (CISSP) Practice Tests