Question 420
After a prior static/dynamic tests finding, an international retailer reports that the approved safeguard is implemented: “Combine static analysis with dynamic testing of live behavior as appropriate.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Combine static analysis with dynamic testing of live behavior as appropriate
- Run this adjacent but different test as the sole proof: Demonstrate the attack path in a safe scope and retest controls after fixes
- Compare a controlled vulnerability seeded in code to both static and runtime detection
- Use the completion of this alternative as proof: Assume a SAST pass proves every runtime configuration is safe
Explanation
Correct Answer
C:Complementary testing demonstrates coverage.
Incorrect Answers
A:Compare a controlled vulnerability seeded in code to both static and runtime detection. Complementary testing demonstrates coverage.
B:Evidence of exploitability and remediation matters. It tests pen test, while this case requires evidence about static/dynamic tests.
D:Deployment dependencies can alter behavior. Compare a controlled vulnerability seeded in code to both static and runtime detection.
Question 421
After a prior interface finding, a university consortium reports that the approved safeguard is implemented: “Test interface input, output, authorization and error contracts between integrated components.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Send contract-conformant and malformed requests across the real interface
- Run this adjacent but different test as the sole proof: Replay the technique and confirm the defender now detects and responds
- Use the completion of this alternative as proof: Test only each component's internal helper functions
- Accept a signed change ticket saying: Test interface input, output, authorization and error contracts between integrated components
Explanation
Correct Answer
A:Boundary testing validates integration.
Incorrect Answers
B:The feedback loop is the intended outcome. It tests red/blue/purple, while this case requires evidence about interface.
C:Unit passing does not prove inter-service compatibility. Send contract-conformant and malformed requests across the real interface.
D:Send contract-conformant and malformed requests across the real interface. Boundary testing validates integration.
Question 422
After a prior synthetic finding, a cloud service provider reports that the approved safeguard is implemented: “Run synthetic end-to-end transactions from representative locations.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Rehearse a transaction and verify all dependent steps under expected latency
- Accept a signed change ticket saying: Run synthetic end-to-end transactions from representative locations
- Use the completion of this alternative as proof: Monitor only server ping
- Run this adjacent but different test as the sole proof: Compare a controlled vulnerability seeded in code to both static and runtime detection
Explanation
Correct Answer
A:End-to-end synthetic results show availability from user perspective.
Incorrect Answers
B:Rehearse a transaction and verify all dependent steps under expected latency. End-to-end synthetic results show availability from user perspective.
C:Reachability does not prove transaction completion. Rehearse a transaction and verify all dependent steps under expected latency.
D:Complementary testing demonstrates coverage. It tests static/dynamic tests, while this case requires evidence about synthetic.
Question 423
An incident review documented this breach simulation exposure: A security team has a new EDR rule but has never tested whether it catches the intended attacker technique. The response team proposed only “Assume installing the rule proves effectiveness” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Unsafe testing can cause harm.
- Performance metrics cannot show schema mismatch.
- Unexecuted policy does not show detector response.
- Reachability does not prove transaction completion.
Explanation
Correct Answer
C:Unexecuted policy does not show detector response. The missing change involves unexecuted policy does not show detector response.
Incorrect Answers
A:Unsafe testing can cause harm. The actual criticized measure is unexecuted policy does not show detector response.
B:Performance metrics cannot show schema mismatch. The actual criticized measure is unexecuted policy does not show detector response.
D:Reachability does not prove transaction completion. That does not establish unexecuted policy does not show detector response.
Question 424
An incident review documented this vulnerability scan exposure: A scanner finds a critical package version on a host but the vulnerable feature is disabled and the host is isolated. The response team proposed only “Automatically mark every version match exploited” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Reachability does not prove transaction completion.
- Unsafe testing can cause harm.
- Future configuration changes may make it exploitable.
- Presence does not prove exploitation.
Explanation
Correct Answer
D:Presence does not prove exploitation. The relevant alternative is presence does not prove exploitation.
Incorrect Answers
A:Reachability does not prove transaction completion. That does not establish presence does not prove exploitation.
B:Unsafe testing can cause harm. The actual criticized measure is presence does not prove exploitation.
C:Future configuration changes may make it exploitable. The actual criticized measure is presence does not prove exploitation.
Question 425
An incident review documented this pen test exposure: External testers can run exploits in a sandbox but the product owner wants no customer data in test outputs. The response team proposed only “Copy all live customer accounts into the sandbox” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- A vulnerability is not evidence of successful exploitation.
- Uncontrolled sensitive copies create new risk.
- Excessive evidence collection can violate obligations.
- Unshared telemetry prevents improvement.
Explanation
Correct Answer
B:Uncontrolled sensitive copies create new risk. The relevant alternative is uncontrolled sensitive copies create new risk.
Incorrect Answers
A:A vulnerability is not evidence of successful exploitation. That does not establish uncontrolled sensitive copies create new risk.
C:Excessive evidence collection can violate obligations. The actual criticized measure is uncontrolled sensitive copies create new risk.
D:This describes the unrelated red/blue/purple decision rather than the named faulty measure Copy all live customer accounts into the sandbox.
Question 426
An incident review documented this red/blue/purple exposure: A red team repeatedly gets domain-administrator access but the blue team learns nothing because exercises remain secret after completion. The response team proposed only “Measure success only by whether red team won” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- A win/loss score does not show detection improvement.
- Unexecuted policy does not show detector response.
- Defenders cannot improve unknown gaps.
- Potential risk still warrants triage.
Explanation
Correct Answer
A:A win/loss score does not show detection improvement. The missing change involves a win/loss score does not show detection improvement.
Incorrect Answers
B:Unexecuted policy does not show detector response. That does not establish a win/loss score does not show detection improvement.
C:Defenders cannot improve unknown gaps. The actual criticized measure is a win/loss score does not show detection improvement.
D:Potential risk still warrants triage. The actual criticized measure is a win/loss score does not show detection improvement.
Question 427
An incident review documented this static/dynamic tests exposure: A release includes dynamic code paths constructed through reflection that the static analyzer does not see clearly. The response team proposed only “Declare static analysis complete security proof” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Multiple methods cover different weaknesses.
- Unknown and chained vulnerabilities can evade scanners.
- Unshared telemetry prevents improvement.
- Static scans have blind spots.
Explanation
Correct Answer
D:Static scans have blind spots. The relevant alternative is static scans have blind spots.
Incorrect Answers
A:Multiple methods cover different weaknesses. The actual criticized measure is static scans have blind spots.
B:Unknown and chained vulnerabilities can evade scanners. That does not establish static scans have blind spots.
C:This describes the unrelated red/blue/purple decision rather than the named faulty measure Declare static analysis complete security proof.
Question 428
A dashboard shows fewer security tickets while the organization has doubled public exposure. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use risk indicators linked to attack surface, control failures and business impact
- Report only patch completion counts
- Treat fewer alerts as proof all threats declined
- Evaluate control design and operational coverage against tested bypass paths
Explanation
Correct Answer
A:Lower ticket volume alone can indicate reduced detection rather than reduced risk.
Incorrect Answers
B:Activity counts may not reflect residual exposure.
C:Suppressed sensors can also reduce alerts.
D:A control is effective only where it covers actual traffic and usage. Use risk indicators linked to attack surface, control failures and business impact.
Question 429
Backups are reported successful every night but no one has restored them in twelve months. Which response best addresses the central security requirement with a defensible, risk-based design?
- Accept the backup job green badge alone
- Correlate workflow approval timestamps with actual IAM grants
- Perform representative restore tests and retain measured success and recovery time
- Increase storage retention without performing a test
Explanation
Correct Answer
C:Backup completion is not proof that recovery can meet RTO or integrity needs.
Incorrect Answers
A:Creation can succeed while restore fails.
B:Approval integrity depends on the right decision before elevation. Perform representative restore tests and retain measured success and recovery time.
D:More copies may remain unusable.
Question 430
Access-request tickets are marked approved, but privileged grants appear before the risk owner signs. Which response best addresses the central security requirement with a defensible, risk-based design?
- Perform representative restore tests and retain measured success and recovery time
- Correlate workflow approval timestamps with actual IAM grants
- Accept a completed ticket even if it postdates the grant
- Treat an engineer's informal chat as formal authorization
Explanation
Correct Answer
B:Approval integrity depends on the right decision before elevation.
Incorrect Answers
A:Backup completion is not proof that recovery can meet RTO or integrity needs. Correlate workflow approval timestamps with actual IAM grants.
C:After-the-fact approval can hide an unauthorized window.
D:Unstructured communications lack required decision evidence.
Certified Information Systems Security Professional (CISSP) Practice Tests