Question 400
An incident review documented this independent audit exposure: A control designer is assigned to approve its own system's compliance. The response team proposed only “Let the control developer sign the independent assurance letter” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Self-attestation is not independent evaluation.
- Back-end and identities may hold key risks.
- The assessment team may lack separation from control owners.
- Concealment misrepresents assurance.
Explanation
Correct Answer
A:Self-attestation is not independent evaluation. The relevant alternative is self-attestation is not independent evaluation.
Incorrect Answers
B:Back-end and identities may hold key risks. The actual criticized measure is self-attestation is not independent evaluation.
C:The assessment team may lack separation from control owners. That does not establish self-attestation is not independent evaluation.
D:This describes the limitation of a different proposed action (Hide known weaknesses from the audit scope); it does not identify the main defect in Let the control developer sign the independent assurance letter.
Question 401
After a prior scope finding, a regional hospital network reports that the approved safeguard is implemented: “Define scope from assets, data flows, dependencies and documented exclusions.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Exclude all externally hosted systems automatically
- Trace assessed assets to actual trust boundaries and business processes
- Accept a signed change ticket saying: Define scope from assets, data flows, dependencies and documented exclusions
- Run this adjacent but different test as the sole proof: Verify signed scope and test stoppage/escalation procedures before launch
Explanation
Correct Answer
B:Scope evidence finds omitted components.
Incorrect Answers
A:Service location does not eliminate relevant dependency. Trace assessed assets to actual trust boundaries and business processes.
C:Trace assessed assets to actual trust boundaries and business processes. Scope evidence finds omitted components.
D:Written authorization is a core gate. It tests rules of engagement, while this case requires evidence about scope.
Question 402
After a prior rules of engagement finding, a payment-services company reports that the approved safeguard is implemented: “Obtain written authorization, scope, timing, methods, safety limits and escalation contacts.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Rely on a verbal informal invitation
- Verify signed scope and test stoppage/escalation procedures before launch
- Run this adjacent but different test as the sole proof: Review team reporting lines, conflicts and evidence of independent challenge
- Accept a signed change ticket saying: Obtain written authorization, scope, timing, methods, safety limits and escalation contacts
Explanation
Correct Answer
B:Written authorization is a core gate.
Incorrect Answers
A:Unclear authority can cause legal and business harm. Verify signed scope and test stoppage/escalation procedures before launch.
C:Independence is a verifiable governance property. It tests independent audit, while this case requires evidence about rules of engagement.
D:Verify signed scope and test stoppage/escalation procedures before launch. Written authorization is a core gate.
Question 403
Automated tooling reports an outdated library on a server but has not established exploitation. Which response best addresses the central security requirement with a defensible, risk-based design?
- Ignore all unexploited findings forever
- Run synthetic end-to-end transactions from representative locations
- Treat scan findings as candidates and validate applicability, exposure and remediation urgency
- Call every finding a confirmed breach
Explanation
Correct Answer
C:Scanners detect possible weakness; they do not always prove an exploitable path.
Incorrect Answers
A:Potential risk still warrants triage.
B:Synthetic tests exercise user journeys and external dependencies proactively. Treat scan findings as candidates and validate applicability, exposure and remediation urgency.
D:A vulnerability is not evidence of successful exploitation.
Question 404
A web app has passed vulnerability scanning but management wants proof attackers cannot chain several flaws to steal data. Which response best addresses the central security requirement with a defensible, risk-based design?
- Run authorized penetration testing with realistic objectives and bounded exploit paths
- Treat a clean scan as proof no attack path exists
- Treat scan findings as candidates and validate applicability, exposure and remediation urgency
- Allow unsanctioned destructive exploitation
Explanation
Correct Answer
A:Pen tests assess exploitability and attack chains beyond inventory-based scanning.
Incorrect Answers
B:Unknown and chained vulnerabilities can evade scanners.
C:Scanners detect possible weakness; they do not always prove an exploitable path. Run authorized penetration testing with realistic objectives and bounded exploit paths.
D:Uncontrolled testing may harm production.
Question 405
An exercise finds that attackers reached the objective but SOC sensors produced no relevant alert. Which response best addresses the central security requirement with a defensible, risk-based design?
- Celebrate only that red team achieved access
- Disable the blue team during all exercises
- Run synthetic end-to-end transactions from representative locations
- Conduct coordinated purple-team testing to improve detection against exercised adversary techniques
Explanation
Correct Answer
D:Purple teaming joins offensive emulation and defensive feedback.
Incorrect Answers
A:The security value includes defensive detection lessons.
B:Unshared telemetry prevents improvement.
C:Synthetic tests exercise user journeys and external dependencies proactively. Conduct coordinated purple-team testing to improve detection against exercised adversary techniques.
Question 406
Source code scanning reports no SQL injection, but deployed runtime request handling has not been exercised. Which response best addresses the central security requirement with a defensible, risk-based design?
- Conduct coordinated purple-team testing to improve detection against exercised adversary techniques
- Assume a SAST pass proves every runtime configuration is safe
- Run only black-box dynamic tests and never inspect code paths
- Combine static analysis with dynamic testing of live behavior as appropriate
Explanation
Correct Answer
D:Static code review and runtime DAST cover different evidence surfaces.
Incorrect Answers
A:Purple teaming joins offensive emulation and defensive feedback. Combine static analysis with dynamic testing of live behavior as appropriate.
B:Deployment dependencies can alter behavior.
C:Unreachable or rare branches may be missed.
Question 407
A microservice API contract changed but downstream callers still send the old payload schema. Which response best addresses the central security requirement with a defensible, risk-based design?
- Run synthetic end-to-end transactions from representative locations
- Test interface input, output, authorization and error contracts between integrated components
- Test only each component's internal helper functions
- Check only overall host CPU usage
Explanation
Correct Answer
B:Interface testing finds integration mistakes not visible in isolated unit tests.
Incorrect Answers
A:Synthetic tests exercise user journeys and external dependencies proactively. Test interface input, output, authorization and error contracts between integrated components.
C:Unit passing does not prove inter-service compatibility.
D:Performance metrics cannot show schema mismatch.
Question 408
A customer portal appears healthy from server metrics but overseas users cannot complete a payment. Which response best addresses the central security requirement with a defensible, risk-based design?
- Conduct coordinated purple-team testing to improve detection against exercised adversary techniques
- Run synthetic end-to-end transactions from representative locations
- Monitor only server ping
- Wait for real customers to complain
Explanation
Correct Answer
B:Synthetic tests exercise user journeys and external dependencies proactively.
Incorrect Answers
A:Purple teaming joins offensive emulation and defensive feedback. Run synthetic end-to-end transactions from representative locations.
C:Reachability does not prove transaction completion.
D:Reactive feedback delays incident detection.
Question 409
A security team has a new EDR rule but has never tested whether it catches the intended attacker technique. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use unrestricted real malware on production
- Perform authorized breach-and-attack simulation with safe technique emulation and defender telemetry verification
- Combine static analysis with dynamic testing of live behavior as appropriate
- Assume installing the rule proves effectiveness
Explanation
Correct Answer
B:Controlled emulation measures detection coverage without requiring real compromise.
Incorrect Answers
A:Unsafe testing can cause harm.
C:Static code review and runtime DAST cover different evidence surfaces. Perform authorized breach-and-attack simulation with safe technique emulation and defender telemetry verification.
D:Unexecuted policy does not show detector response.
Question 410
A scanner finds a critical package version on a host but the vulnerable feature is disabled and the host is isolated. Which response best addresses the central security requirement with a defensible, risk-based design?
- Validate affected component configuration, compensating controls and exploit path before setting treatment priority
- Automatically mark every version match exploited
- Run authorized penetration testing with realistic objectives and bounded exploit paths
- Mark the finding false forever without review
Explanation
Correct Answer
A:Version detection is a starting point; real exposure changes risk.
Incorrect Answers
B:Presence does not prove exploitation.
C:Pen tests assess exploitability and attack chains beyond inventory-based scanning. Validate affected component configuration, compensating controls and exploit path before setting treatment priority.
D:Future configuration changes may make it exploitable.
Certified Information Systems Security Professional (CISSP) Practice Tests