Question 430
Access-request tickets are marked approved, but privileged grants appear before the risk owner signs. Which response best addresses the central security requirement with a defensible, risk-based design?
- Perform representative restore tests and retain measured success and recovery time
- Correlate workflow approval timestamps with actual IAM grants
- Accept a completed ticket even if it postdates the grant
- Treat an engineer's informal chat as formal authorization
Explanation
Correct Answer
B:Approval integrity depends on the right decision before elevation.
Incorrect Answers
A:Backup completion is not proof that recovery can meet RTO or integrity needs. Correlate workflow approval timestamps with actual IAM grants.
C:After-the-fact approval can hide an unauthorized window.
D:Unstructured communications lack required decision evidence.
Question 431
A DLP tool is installed but confidential files still leave through a secondary API. Which response best addresses the central security requirement with a defensible, risk-based design?
- Disable alerts to make the dashboard green
- Evaluate control design and operational coverage against tested bypass paths
- Perform representative restore tests and retain measured success and recovery time
- Count deployed licenses as proof
Explanation
Correct Answer
B:A control is effective only where it covers actual traffic and usage.
Incorrect Answers
A:Suppression hides failure.
C:Backup completion is not proof that recovery can meet RTO or integrity needs. Evaluate control design and operational coverage against tested bypass paths.
D:Deployment coverage differs from enforcement.
Question 432
A board dashboard reports 100 percent patch-ticket closure while actively exploited assets remain exposed. Which response best addresses the central security requirement with a defensible, risk-based design?
- Perform representative restore tests and retain measured success and recovery time
- Use risk-weighted indicators based on live exposure, control success and business impact
- Treat time spent in meetings as a risk reduction measure
- Report only the total number of tickets closed
Explanation
Correct Answer
B:Activity completion metrics can be decoupled from current risk.
Incorrect Answers
A:Backup completion is not proof that recovery can meet RTO or integrity needs. Use risk-weighted indicators based on live exposure, control success and business impact.
C:Effort does not guarantee protection.
D:Counts can hide severe exceptions.
Question 433
The backup job reports success each day but restores cannot decrypt archived databases because recovery keys were retired. Which response best addresses the central security requirement with a defensible, risk-based design?
- Count stored backup gigabytes without checking key custody
- Correlate workflow approval timestamps with actual IAM grants
- Review green backup-job indicators alone
- Perform recovery tests that include required keys, access, application consistency and elapsed time
Explanation
Correct Answer
D:Backup creation does not prove actual recoverability.
Incorrect Answers
A:Storage quantity does not indicate decryptability.
B:Approval integrity depends on the right decision before elevation. Perform recovery tests that include required keys, access, application consistency and elapsed time.
C:Successful backups may still be unusable.
Question 434
After a prior account approvals finding, a payment-services company reports that the approved safeguard is implemented: “Correlate workflow approval timestamps with actual IAM grants.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Correlate workflow approval timestamps with actual IAM grants
- Sample grants and verify prior authorized approvals and expiry
- Use the completion of this alternative as proof: Accept a completed ticket even if it postdates the grant
- Run this adjacent but different test as the sole proof: Correlate risk indicators with incident trends, business assets and validated controls
Explanation
Correct Answer
B:Timing ties action to authority.
Incorrect Answers
A:Sample grants and verify prior authorized approvals and expiry. Timing ties action to authority.
C:After-the-fact approval can hide an unauthorized window. Sample grants and verify prior authorized approvals and expiry.
D:Context makes metrics decision-useful. It tests risk indicators, while this case requires evidence about account approvals.
Question 435
After a prior control effectiveness finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Evaluate control design and operational coverage against tested bypass paths.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Count deployed licenses as proof
- Run this adjacent but different test as the sole proof: Sample grants and verify prior authorized approvals and expiry
- Accept a signed change ticket saying: Evaluate control design and operational coverage against tested bypass paths
- Attempt transfers on primary and alternate routes and verify required policy results
Explanation
Correct Answer
D:Bypass-oriented tests measure coverage.
Incorrect Answers
A:Deployment coverage differs from enforcement. Attempt transfers on primary and alternate routes and verify required policy results.
B:Timing ties action to authority. It tests account approvals, while this case requires evidence about control effectiveness.
C:Attempt transfers on primary and alternate routes and verify required policy results. Bypass-oriented tests measure coverage.
Question 436
After a prior risk indicators finding, an international retailer reports that the approved safeguard is implemented: “Use risk indicators linked to attack surface, control failures and business impact.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Use risk indicators linked to attack surface, control failures and business impact
- Use the completion of this alternative as proof: Treat fewer alerts as proof all threats declined
- Correlate risk indicators with incident trends, business assets and validated controls
- Run this adjacent but different test as the sole proof: Attempt transfers on primary and alternate routes and verify required policy results
Explanation
Correct Answer
C:Context makes metrics decision-useful.
Incorrect Answers
A:Correlate risk indicators with incident trends, business assets and validated controls. Context makes metrics decision-useful.
B:Suppressed sensors can also reduce alerts. Correlate risk indicators with incident trends, business assets and validated controls.
D:Bypass-oriented tests measure coverage. It tests control effectiveness, while this case requires evidence about risk indicators.
Question 437
After a prior backup restore evidence finding, a university consortium reports that the approved safeguard is implemented: “Perform representative restore tests and retain measured success and recovery time.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Restore selected data and application dependencies from the actual protected vault
- Accept a signed change ticket saying: Perform representative restore tests and retain measured success and recovery time
- Run this adjacent but different test as the sole proof: Correlate risk indicators with incident trends, business assets and validated controls
- Use the completion of this alternative as proof: Accept the backup job green badge alone
Explanation
Correct Answer
A:Recovery evidence measures use, not storage.
Incorrect Answers
B:Restore selected data and application dependencies from the actual protected vault. Recovery evidence measures use, not storage.
C:Context makes metrics decision-useful. It tests risk indicators, while this case requires evidence about backup restore evidence.
D:Creation can succeed while restore fails. Restore selected data and application dependencies from the actual protected vault.
Question 438
An incident review documented this account approvals exposure: Access-request tickets are marked approved, but privileged grants appear before the risk owner signs. The response team proposed only “Accept a completed ticket even if it postdates the grant” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Creation can succeed while restore fails.
- Activity counts may not reflect residual exposure.
- After-the-fact approval can hide an unauthorized window.
- Unstructured communications lack required decision evidence.
Explanation
Correct Answer
C:After-the-fact approval can hide an unauthorized window. The missing change involves after-the-fact approval can hide an unauthorized window.
Incorrect Answers
A:Creation can succeed while restore fails. That does not establish after-the-fact approval can hide an unauthorized window.
B:Activity counts may not reflect residual exposure. The actual criticized measure is after-the-fact approval can hide an unauthorized window.
D:Unstructured communications lack required decision evidence. The actual criticized measure is after-the-fact approval can hide an unauthorized window.
Question 439
An incident review documented this control effectiveness exposure: A DLP tool is installed but confidential files still leave through a secondary API. The response team proposed only “Count deployed licenses as proof” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Deployment coverage differs from enforcement.
- Activity counts may not reflect residual exposure.
- Suppression hides failure.
- Creation can succeed while restore fails.
Explanation
Correct Answer
A:Deployment coverage differs from enforcement. The relevant alternative is deployment coverage differs from enforcement.
Incorrect Answers
B:Activity counts may not reflect residual exposure. The actual criticized measure is deployment coverage differs from enforcement.
C:This describes the limitation of a different proposed action (Disable alerts to make the dashboard green); it does not identify the main defect in Count deployed licenses as proof.
D:Creation can succeed while restore fails. That does not establish deployment coverage differs from enforcement.
Question 440
A CVSS-high weakness affects an isolated test device while a medium flaw exposes payroll data externally. Which response best addresses the central security requirement with a defensible, risk-based design?
- Ignore externally exposed flaws without vendor exploits
- Always fix the numerically highest CVSS first regardless of context
- Stop unauthorized testing and follow responsible disclosure and agreed escalation channels
- Prioritize findings by exploitability, exposure, asset criticality and business impact rather than score alone
Explanation
Correct Answer
D:Technical severity is an input, not the full enterprise risk ranking.
Incorrect Answers
A:Practical abuse can precede public exploitation.
B:Scores do not encode all local impact factors.
C:The discovery does not expand testing authorization automatically. Prioritize findings by exploitability, exposure, asset criticality and business impact rather than score alone.
Certified Information Systems Security Professional (CISSP) Practice Tests