Question 390
A privileged remote-access gateway trusts any client certificate including one issued by an unknown CA. Which response best addresses the central security requirement with a defensible, risk-based design?
- Validate client certificate chain, identity mapping, key usage and revocation
- Ignore revocation after a laptop is stolen
- Use appropriate RADIUS-based AAA between network devices and an identity service
- Accept self-signed certificates without trust enrollment
Explanation
Correct Answer
A:Possessing an arbitrary certificate is not proof of approved identity.
Incorrect Answers
B:Compromised certificates can stay usable.
C:RADIUS commonly serves network access authentication and accounting. Validate client certificate chain, identity mapping, key usage and revocation.
D:Untrusted issuers can claim arbitrary identities.
Question 391
A board asks whether an internal team can independently attest to its own controls while an external auditor has different obligations. Which response best addresses the central security requirement with a defensible, risk-based design?
- Obtain written authorization, scope, timing, methods, safety limits and escalation contacts
- Call every internal checklist an independent external audit
- Replace all ongoing internal tests with a yearly outside visit
- Define objective assessment scope, independence needs and appropriate internal versus external roles
Explanation
Correct Answer
D:Internal review supports continuous improvement while independent assurance has distinct credibility and requirements.
Incorrect Answers
A:Rules of engagement prevent unauthorized or unsafe testing. Define objective assessment scope, independence needs and appropriate internal versus external roles.
B:The assessment team may lack separation from control owners.
C:Periodic independent testing cannot provide daily control ownership.
Question 392
A control designer is assigned to approve its own system's compliance. Which response best addresses the central security requirement with a defensible, risk-based design?
- Let the control developer sign the independent assurance letter
- Define objective assessment scope, independence needs and appropriate internal versus external roles
- Hide known weaknesses from the audit scope
- Use an auditor sufficiently independent from implementation and operational ownership
Explanation
Correct Answer
D:Auditor objectivity is weakened by self-review conflicts.
Incorrect Answers
A:Self-attestation is not independent evaluation.
B:Internal review supports continuous improvement while independent assurance has distinct credibility and requirements. Use an auditor sufficiently independent from implementation and operational ownership.
C:Concealment misrepresents assurance.
Question 393
An assessment excludes a shared identity provider although it authenticates every in-scope application. Which response best addresses the central security requirement with a defensible, risk-based design?
- Define scope from assets, data flows, dependencies and documented exclusions
- Exclude all externally hosted systems automatically
- Use an auditor sufficiently independent from implementation and operational ownership
- Limit testing to visible application screens
Explanation
Correct Answer
A:Shared controls materially affect security even when owned by another unit.
Incorrect Answers
B:Service location does not eliminate relevant dependency.
C:Auditor objectivity is weakened by self-review conflicts. Define scope from assets, data flows, dependencies and documented exclusions.
D:Back-end and identities may hold key risks.
Question 394
A penetration testing company plans a scan of production without agreed downtime limits. Which response best addresses the central security requirement with a defensible, risk-based design?
- Continue exploitation whenever a system is reachable
- Define scope from assets, data flows, dependencies and documented exclusions
- Obtain written authorization, scope, timing, methods, safety limits and escalation contacts
- Rely on a verbal informal invitation
Explanation
Correct Answer
C:Rules of engagement prevent unauthorized or unsafe testing.
Incorrect Answers
A:Reachability is not permission to test.
B:Shared controls materially affect security even when owned by another unit. Obtain written authorization, scope, timing, methods, safety limits and escalation contacts.
D:Unclear authority can cause legal and business harm.
Question 395
After a prior internal/external assessment finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Define objective assessment scope, independence needs and appropriate internal versus external roles.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Define objective assessment scope, independence needs and appropriate internal versus external roles
- Compare assessor independence and scope against the requested assurance purpose
- Use the completion of this alternative as proof: Call every internal checklist an independent external audit
- Run this adjacent but different test as the sole proof: Verify signed scope and test stoppage/escalation procedures before launch
Explanation
Correct Answer
B:Independence must match the claim being made.
Incorrect Answers
A:Compare assessor independence and scope against the requested assurance purpose. Independence must match the claim being made.
C:The assessment team may lack separation from control owners. Compare assessor independence and scope against the requested assurance purpose.
D:Written authorization is a core gate. It tests rules of engagement, while this case requires evidence about internal/external assessment.
Question 396
After a prior independent audit finding, an international retailer reports that the approved safeguard is implemented: “Use an auditor sufficiently independent from implementation and operational ownership.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Use an auditor sufficiently independent from implementation and operational ownership
- Review team reporting lines, conflicts and evidence of independent challenge
- Use the completion of this alternative as proof: Let the control developer sign the independent assurance letter
- Run this adjacent but different test as the sole proof: Verify signed scope and test stoppage/escalation procedures before launch
Explanation
Correct Answer
B:Independence is a verifiable governance property.
Incorrect Answers
A:Review team reporting lines, conflicts and evidence of independent challenge. Independence is a verifiable governance property.
C:Self-attestation is not independent evaluation. Review team reporting lines, conflicts and evidence of independent challenge.
D:Written authorization is a core gate. It tests rules of engagement, while this case requires evidence about independent audit.
Question 397
A security evaluation tests the public website but excludes its shared cloud key-management service without documenting the omission. Which response best addresses the central security requirement with a defensible, risk-based design?
- Identify material trust dependencies and explicitly justify in-scope or inherited controls
- Use an auditor sufficiently independent from implementation and operational ownership
- Assume hosted services have no shared responsibility
- Define scope only by the marketing product name
Explanation
Correct Answer
A:The control boundary should match the actual system architecture.
Incorrect Answers
B:Auditor objectivity is weakened by self-review conflicts. Identify material trust dependencies and explicitly justify in-scope or inherited controls.
C:Vendor services can carry customer control obligations.
D:Product names do not capture dependencies.
Question 398
An authorized red-team assessment accidentally reaches a partner subnet not listed in its agreement. Which response best addresses the central security requirement with a defensible, risk-based design?
- Delete test logs to avoid raising concerns
- Pause out-of-scope activity and obtain explicit authorization before extending methods or targets
- Define objective assessment scope, independence needs and appropriate internal versus external roles
- Continue because the subnet uses the same network carrier
Explanation
Correct Answer
B:Technical reachability does not expand legal or operational permission.
Incorrect Answers
A:Concealment breaks the authorized assessment record.
C:Internal review supports continuous improvement while independent assurance has distinct credibility and requirements. Pause out-of-scope activity and obtain explicit authorization before extending methods or targets.
D:Carrier membership is not authorization.
Question 399
An incident review documented this internal/external assessment exposure: A board asks whether an internal team can independently attest to its own controls while an external auditor has different obligations. The response team proposed only “Call every internal checklist an independent external audit” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- The assessment team may lack separation from control owners.
- Back-end and identities may hold key risks.
- Periodic independent testing cannot provide daily control ownership.
- Self-attestation is not independent evaluation.
Explanation
Correct Answer
A:The assessment team may lack separation from control owners. The missing change involves the assessment team may lack separation from control owners.
Incorrect Answers
B:Back-end and identities may hold key risks. The actual criticized measure is the assessment team may lack separation from control owners.
C:Periodic independent testing cannot provide daily control ownership. The actual criticized measure is the assessment team may lack separation from control owners.
D:A control developer signing their own assurance letter lacks independence. Calling an internal checklist an external audit does not provide independent assessment either.
Question 400
An incident review documented this independent audit exposure: A control designer is assigned to approve its own system's compliance. The response team proposed only “Let the control developer sign the independent assurance letter” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Self-attestation is not independent evaluation.
- Back-end and identities may hold key risks.
- The assessment team may lack separation from control owners.
- Concealment misrepresents assurance.
Explanation
Correct Answer
A:Self-attestation is not independent evaluation. The relevant alternative is self-attestation is not independent evaluation.
Incorrect Answers
B:Back-end and identities may hold key risks. The actual criticized measure is self-attestation is not independent evaluation.
C:The assessment team may lack separation from control owners. That does not establish self-attestation is not independent evaluation.
D:This describes the limitation of a different proposed action (Hide known weaknesses from the audit scope); it does not identify the main defect in Let the control developer sign the independent assurance letter.
Certified Information Systems Security Professional (CISSP) Practice Tests