Question 30
After a prior legal/regulatory obligations finding, a cloud service provider reports that the approved safeguard is implemented: “Have qualified legal/compliance owners map binding obligations into security controls and reporting triggers.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Apply one generic privacy policy to all jurisdictions without review
- Run this adjacent but different test as the sole proof: Verify the data-flow map and documented approved transfer mechanism for each destination
- Reconcile obligation registers, owners and evidence of required filings or notifications
- Accept a signed change ticket saying: Have qualified legal/compliance owners map binding obligations into security controls and reporting triggers
Explanation
Correct Answer
C:A mapped obligation register prevents important statutory or contract requirements being silently missed.
Incorrect Answers
A:A generic policy may omit binding local obligations. Reconcile obligation registers, owners and evidence of required filings or notifications.
B:Actual flow evidence is needed to validate residency and transfer constraints. It tests transborder data flows, while this case requires evidence about legal/regulatory obligations.
D:Reconcile obligation registers, owners and evidence of required filings or notifications. A mapped obligation register prevents important statutory or contract requirements being silently missed.
Question 31
An incident review documented this privacy law exposure: A team plans to reuse collected employee health data for marketing in another jurisdiction. The response team proposed only “Assume employment consent is valid for all future uses” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- A generic policy may omit binding local obligations.
- Stripping attribution may worsen rather than resolve license compliance.
- Initial collection does not create unlimited lawful grounds for later purposes.
- Renaming a file does not remove personal-data identifiability.
Explanation
Correct Answer
C:Initial collection does not create unlimited lawful grounds for later purposes. The missing change involves initial collection does not create unlimited lawful grounds for later purposes.
Incorrect Answers
A:A generic policy may omit binding local obligations. That does not establish initial collection does not create unlimited lawful grounds for later purposes.
B:Stripping attribution may worsen rather than resolve license compliance. The actual criticized measure is initial collection does not create unlimited lawful grounds for later purposes.
D:Renaming a file does not remove personal-data identifiability. The actual criticized measure is initial collection does not create unlimited lawful grounds for later purposes.
Question 32
An employee misconduct inquiry may lead to criminal prosecution and internal disciplinary action. Which response best addresses the central security requirement with a defensible, risk-based design?
- Have HR search personal devices without assessing legal authority
- Separate civil litigation preservation from regulator notification and evidence obligations with legal guidance
- Coordinate with legal and preserve evidence under the applicable distinct investigative standards
- Delete the original logs once an internal interview ends
Explanation
Correct Answer
C:Internal HR fact finding and criminal investigations differ in authority and evidentiary requirements.
Incorrect Answers
A:Improper collection can violate privacy and jeopardize admissibility.
B:Different proceeding types have different standards, timelines and recipients. Coordinate with legal and preserve evidence under the applicable distinct investigative standards.
D:Destruction can prejudice later legal proceedings.
Question 33
A data breach may produce civil claims and a regulator inquiry with different disclosure duties. Which response best addresses the central security requirement with a defensible, risk-based design?
- Separate civil litigation preservation from regulator notification and evidence obligations with legal guidance
- Assume a single insurance claim satisfies every statutory notification
- Publicly assert a verdict before investigating facts
- Coordinate with legal and preserve evidence under the applicable distinct investigative standards
Explanation
Correct Answer
A:Different proceeding types have different standards, timelines and recipients.
Incorrect Answers
B:Insurance processes do not replace regulator deadlines.
C:Speculation can cause legal and reputational harm.
D:Internal HR fact finding and criminal investigations differ in authority and evidentiary requirements. Separate civil litigation preservation from regulator notification and evidence obligations with legal guidance.
Question 34
Security operations wants to preserve a disk image likely to be used in legal proceedings. Which response best addresses the central security requirement with a defensible, risk-based design?
- Record a filename without collector or transfer history
- Run cleanup utilities on the only original disk before imaging
- Separate civil litigation preservation from regulator notification and evidence obligations with legal guidance
- Collect and hash a forensic image under approved chain-of-custody procedures
Explanation
Correct Answer
D:Documented acquisition and tamper-evident integrity support evidence reliability.
Incorrect Answers
A:An unauthenticated name does not establish custody.
B:Modification can destroy relevant evidence.
C:Different proceeding types have different standards, timelines and recipients. Collect and hash a forensic image under approved chain-of-custody procedures.
Question 35
After a prior administrative versus criminal finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Coordinate with legal and preserve evidence under the applicable distinct investigative standards.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Verify investigator authority, lawful collection and a chain-of-custody record for each evidence item
- Run this adjacent but different test as the sole proof: Maintain separate deadlines and evidence-handling records for civil and regulatory tracks
- Accept a signed change ticket saying: Coordinate with legal and preserve evidence under the applicable distinct investigative standards
- Use the completion of this alternative as proof: Have HR search personal devices without assessing legal authority
Explanation
Correct Answer
A:Documented legal scope protects both the inquiry and potential downstream proceedings.
Incorrect Answers
B:Independent tracking catches obligations not covered by another process. It tests civil versus regulatory, while this case requires evidence about administrative versus criminal.
C:Verify investigator authority, lawful collection and a chain-of-custody record for each evidence item. Documented legal scope protects both the inquiry and potential downstream proceedings.
D:Improper collection can violate privacy and jeopardize admissibility. Verify investigator authority, lawful collection and a chain-of-custody record for each evidence item.
Question 36
After a prior civil versus regulatory finding, an international retailer reports that the approved safeguard is implemented: “Separate civil litigation preservation from regulator notification and evidence obligations with legal guidance.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Assume a single insurance claim satisfies every statutory notification
- Run this adjacent but different test as the sole proof: Verify acquisition timestamps, hashes, transfers and storage access history
- Accept a signed change ticket saying: Separate civil litigation preservation from regulator notification and evidence obligations with legal guidance
- Maintain separate deadlines and evidence-handling records for civil and regulatory tracks
Explanation
Correct Answer
D:Independent tracking catches obligations not covered by another process.
Incorrect Answers
A:Insurance processes do not replace regulator deadlines. Maintain separate deadlines and evidence-handling records for civil and regulatory tracks.
B:Complete provenance makes evidence defensible across investigators. It tests evidence obligations, while this case requires evidence about civil versus regulatory.
C:Maintain separate deadlines and evidence-handling records for civil and regulatory tracks. Independent tracking catches obligations not covered by another process.
Question 37
An enterprise wants all business units to observe a binding security rule despite conflicting team preferences. Which response best addresses the central security requirement with a defensible, risk-based design?
- Publish a recommended guideline while keeping mandatory minimum controls in policy and standards
- Publish the rule as an optional guideline
- Let every engineer set their own exceptions
- Have authorized leadership approve a policy defining mandatory security intent and accountability
Explanation
Correct Answer
D:Policy expresses governing expectations and must have legitimate executive authority.
Incorrect Answers
A:Guidelines offer flexible advice without pretending every recommendation is binding. Have authorized leadership approve a policy defining mandatory security intent and accountability.
B:Guidance alone may not create enforceable organization requirements.
C:Uncontrolled local exceptions defeat consistent policy.
Question 38
A policy requires strong encryption but teams deploy inconsistent algorithms and configurations. Which response best addresses the central security requirement with a defensible, risk-based design?
- Replace the standard with individual preferences
- Write only a high-level policy that says use appropriate encryption
- Publish enforceable technical standards specifying allowed algorithms, key sizes and configurations
- Publish a step-by-step offboarding procedure with role responsibilities and timing
Explanation
Correct Answer
C:Standards translate broad policy intent into measurable mandatory rules.
Incorrect Answers
A:Local preferences may violate the intended minimum.
B:Ambiguous language cannot enforce configuration consistency.
D:Procedures specify repeatable execution of mandatory tasks rather than general intent. Publish enforceable technical standards specifying allowed algorithms, key sizes and configurations.
Question 39
A help desk must reliably revoke access when a contractor leaves at midnight. Which response best addresses the central security requirement with a defensible, risk-based design?
- Depend on each clerk remembering the steps
- Publish a step-by-step offboarding procedure with role responsibilities and timing
- Publish enforceable technical standards specifying allowed algorithms, key sizes and configurations
- State only that access should be secure
Explanation
Correct Answer
B:Procedures specify repeatable execution of mandatory tasks rather than general intent.
Incorrect Answers
A:Unwritten practice creates inconsistent outcomes.
C:Standards translate broad policy intent into measurable mandatory rules. Publish a step-by-step offboarding procedure with role responsibilities and timing.
D:A vague statement does not guide immediate revocation.
Question 40
A development group needs advice on secure patterns but several equally safe implementation approaches exist. Which response best addresses the central security requirement with a defensible, risk-based design?
- Make all optional suggestions equal to legal obligations
- Present recommendations as an unapproved emergency waiver
- Publish a recommended guideline while keeping mandatory minimum controls in policy and standards
- Have authorized leadership approve a policy defining mandatory security intent and accountability
Explanation
Correct Answer
C:Guidelines offer flexible advice without pretending every recommendation is binding.
Incorrect Answers
A:Mislabeling optional practices confuses enforcement and compliance.
B:A guideline cannot waive mandatory requirements.
D:Policy expresses governing expectations and must have legitimate executive authority. Publish a recommended guideline while keeping mandatory minimum controls in policy and standards.
Certified Information Systems Security Professional (CISSP) Practice Tests