Question 460
After a prior audit independence finding, an international retailer reports that the approved safeguard is implemented: “Assess self-review threats and assign independent evaluators where needed.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Compare report scope and carve-outs to the customer's actual processing path
- Accept a signed change ticket saying: Assess self-review threats and assign independent evaluators where needed
- Inspect disclosed conflicts and reviewer independence in the engagement
- Use the completion of this alternative as proof: Allow the architect to approve every own exception
Explanation
Correct Answer
C:Challenge documentation supports impartiality.
Incorrect Answers
A:Reliance requires scope matching. It tests external audit, while this case requires evidence about audit independence.
B:Inspect disclosed conflicts and reviewer independence in the engagement. Challenge documentation supports impartiality.
D:Self-approval defeats independent assurance. Inspect disclosed conflicts and reviewer independence in the engagement.
Question 461
An audit of a managed SaaS application omits customer-owned federation, private network links and external backup dependencies. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assume one provider SOC report covers every customer connection
- Commission an independent assessment with defined criteria, period and scope
- Extend control mapping to customer-responsible and inherited controls across the actual service boundary
- Exclude on-premises identity because the data is in cloud storage
Explanation
Correct Answer
C:Cloud vendor assurance does not certify every integrated customer control.
Incorrect Answers
A:Vendor reports have limited scope.
B:An external opinion has meaning only for the evaluated controls and time frame. Extend control mapping to customer-responsible and inherited controls across the actual service boundary.
D:Identity remains part of the trust path.
Question 462
An incident review documented this internal audit exposure: Internal audit must examine production security but currently reports through the same operations manager who owns the controls. The response team proposed only “Make the operations manager the sole approver of its own audit” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Report scope may exclude critical environments.
- A billing boundary is not a technical dependency map.
- Biased evidence undermines results.
- Self-review creates conflict.
Explanation
Correct Answer
D:Self-review creates conflict. The relevant alternative is self-review creates conflict.
Incorrect Answers
A:Report scope may exclude critical environments. The actual criticized measure is self-review creates conflict.
B:A billing boundary is not a technical dependency map. That does not establish self-review creates conflict.
C:This describes the limitation of a different proposed action (Give audit access only to selected favorable records); it does not identify the main defect in Make the operations manager the sole approver of its own audit.
Question 463
A laptop from a fraud investigation must be examined without altering original file timestamps. Which response best addresses the central security requirement with a defensible, risk-based design?
- Run cleanup software directly on the seized laptop
- Create a forensically sound image with a documented acquisition method and retain the source securely
- Follow legal direction on scope, preservation, documentation and authorized evidence collection
- Analyze the only original disk without recording changes
Explanation
Correct Answer
B:Preserving original evidence supports later reproducible examination.
Incorrect Answers
A:Cleanup changes possible evidence.
C:Admissibility depends on jurisdictional procedures and trustworthy evidence handling. Create a forensically sound image with a documented acquisition method and retain the source securely.
D:Untracked original-disk changes damage reliability.
Question 464
Two incident responders exchange a removable drive containing potential evidence during a weekend shift. Which response best addresses the central security requirement with a defensible, risk-based design?
- Follow legal direction on scope, preservation, documentation and authorized evidence collection
- Record each transfer, custodian, time, reason and tamper-evident seal status
- Track only the first collection without later transfers
- Leave the drive in a shared unlocked cupboard
Explanation
Correct Answer
B:Continuity of custody supports evidence authenticity and accountability.
Incorrect Answers
A:Admissibility depends on jurisdictional procedures and trustworthy evidence handling. Record each transfer, custodian, time, reason and tamper-evident seal status.
C:Missing intermediate handlers creates unexplained custody gaps.
D:Uncontrolled storage breaks custody assurance.
Question 465
Investigators must distinguish an actual compromise timeline from a system clock drifting by several minutes. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rewrite all original logs to local time without preserving originals
- Assume every timestamp uses the analyst's laptop time zone
- Preserve source time zones, record clock offsets and correlate independent timestamped events
- Create a forensically sound image with a documented acquisition method and retain the source securely
Explanation
Correct Answer
C:Clock normalization is needed before attributing activity across heterogeneous devices.
Incorrect Answers
A:Rewriting destroys forensic provenance.
B:Different sources can encode different zones.
D:Preserving original evidence supports later reproducible examination. Preserve source time zones, record clock offsets and correlate independent timestamped events.
Question 466
Counsel warns that an internal intrusion investigation may become evidence in court. Which response best addresses the central security requirement with a defensible, risk-based design?
- Preserve source time zones, record clock offsets and correlate independent timestamped events
- Follow legal direction on scope, preservation, documentation and authorized evidence collection
- Assume technical accuracy eliminates legal collection constraints
- Release all personal records to every investigator without proportional safeguards
Explanation
Correct Answer
B:Admissibility depends on jurisdictional procedures and trustworthy evidence handling.
Incorrect Answers
A:Clock normalization is needed before attributing activity across heterogeneous devices. Follow legal direction on scope, preservation, documentation and authorized evidence collection.
C:A correct technical finding can still have evidence defects.
D:Uncontrolled access undermines privacy and provenance.
Question 467
After a prior evidence handling finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Create a forensically sound image with a documented acquisition method and retain the source securely.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Compare cryptographic hashes of the acquisition and its verified copy before analysis
- Run this adjacent but different test as the sole proof: Reconstruct one known cross-system event and verify its normalized timestamp ordering
- Accept a signed change ticket saying: Create a forensically sound image with a documented acquisition method and retain the source securely
- Use the completion of this alternative as proof: Run cleanup software directly on the seized laptop
Explanation
Correct Answer
A:Hash verification provides integrity evidence for the forensic copy.
Incorrect Answers
B:A known event tests chronology and clock-skew treatment. It tests forensics, while this case requires evidence about evidence handling.
C:Compare cryptographic hashes of the acquisition and its verified copy before analysis. Hash verification provides integrity evidence for the forensic copy.
D:Cleanup changes possible evidence. Compare cryptographic hashes of the acquisition and its verified copy before analysis.
Question 468
After a prior chain of custody finding, an international retailer reports that the approved safeguard is implemented: “Record each transfer, custodian, time, reason and tamper-evident seal status.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Record each transfer, custodian, time, reason and tamper-evident seal status
- Use the completion of this alternative as proof: Leave the drive in a shared unlocked cupboard
- Audit the custody ledger against physical seal identifiers and access records
- Run this adjacent but different test as the sole proof: Compare cryptographic hashes of the acquisition and its verified copy before analysis
Explanation
Correct Answer
C:Reconciliation can reveal a missing transfer or unauthorized handling.
Incorrect Answers
A:Audit the custody ledger against physical seal identifiers and access records. Reconciliation can reveal a missing transfer or unauthorized handling.
B:Uncontrolled storage breaks custody assurance. Audit the custody ledger against physical seal identifiers and access records.
D:Hash verification provides integrity evidence for the forensic copy. It tests evidence handling, while this case requires evidence about chain of custody.
Question 469
A retail SOC receives endpoint, firewall and authentication logs that cannot be tied to one attack sequence. Which response best addresses the central security requirement with a defensible, risk-based design?
- Suppress every alert from privileged accounts
- Monitor network flows, DNS, TLS metadata and behavioral indicators at appropriate capture points
- Increase only firewall storage without correlating identity events
- Normalize and correlate events using synchronized timestamps and relevant entity identifiers
Explanation
Correct Answer
D:A SIEM can connect otherwise fragmented events when ingestion quality is controlled.
Incorrect Answers
A:Privilege is a high-impact signal rather than an exemption.
B:Network detection can identify anomalous communications without decrypting every payload. Normalize and correlate events using synchronized timestamps and relevant entity identifiers.
C:More isolated logs do not supply attack context.
Question 470
A privileged service account starts downloading records at unusual times from new devices. Which response best addresses the central security requirement with a defensible, risk-based design?
- Investigate behavioral deviation with context and confirm whether the activity is authorized
- Treat a single anomaly score as conclusive guilt
- Ignore deviations whenever credentials authenticate successfully
- Monitor network flows, DNS, TLS metadata and behavioral indicators at appropriate capture points
Explanation
Correct Answer
A:Behavior analytics provides anomaly indications, not automatic proof of compromise.
Incorrect Answers
B:Legitimate change can create anomalies.
C:Valid credentials may be stolen.
D:Network detection can identify anomalous communications without decrypting every payload. Investigate behavioral deviation with context and confirm whether the activity is authorized.
Certified Information Systems Security Professional (CISSP) Practice Tests