Question 40
A development group needs advice on secure patterns but several equally safe implementation approaches exist. Which response best addresses the central security requirement with a defensible, risk-based design?
- Make all optional suggestions equal to legal obligations
- Present recommendations as an unapproved emergency waiver
- Publish a recommended guideline while keeping mandatory minimum controls in policy and standards
- Have authorized leadership approve a policy defining mandatory security intent and accountability
Explanation
Correct Answer
C:Guidelines offer flexible advice without pretending every recommendation is binding.
Incorrect Answers
A:Mislabeling optional practices confuses enforcement and compliance.
B:A guideline cannot waive mandatory requirements.
D:Policy expresses governing expectations and must have legitimate executive authority. Publish a recommended guideline while keeping mandatory minimum controls in policy and standards.
Question 41
After a prior policy authority finding, a regional hospital network reports that the approved safeguard is implemented: “Have authorized leadership approve a policy defining mandatory security intent and accountability.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Rehearse the procedure and check timestamps from departure trigger through revocation
- Check formal approval, communication and delegated exception workflow
- Accept a signed change ticket saying: Have authorized leadership approve a policy defining mandatory security intent and accountability
- Use the completion of this alternative as proof: Publish the rule as an optional guideline
Explanation
Correct Answer
B:Authority and exception governance demonstrate the policy is operational.
Incorrect Answers
A:Execution evidence verifies the task can be performed on time. It tests procedure operation, while this case requires evidence about policy authority.
C:Check formal approval, communication and delegated exception workflow. Authority and exception governance demonstrate the policy is operational.
D:Guidance alone may not create enforceable organization requirements. Check formal approval, communication and delegated exception workflow.
Question 42
After a prior standard enforceability finding, a payment-services company reports that the approved safeguard is implemented: “Publish enforceable technical standards specifying allowed algorithms, key sizes and configurations.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Scan deployed cryptographic configurations against the approved baseline standard
- Use the completion of this alternative as proof: Write only a high-level policy that says use appropriate encryption
- Accept a signed change ticket saying: Publish enforceable technical standards specifying allowed algorithms, key sizes and configurations
- Run this adjacent but different test as the sole proof: Check formal approval, communication and delegated exception workflow
Explanation
Correct Answer
A:A measurable conformance test shows the standard was enforced.
Incorrect Answers
B:Ambiguous language cannot enforce configuration consistency. Scan deployed cryptographic configurations against the approved baseline standard.
C:Scan deployed cryptographic configurations against the approved baseline standard. A measurable conformance test shows the standard was enforced.
D:Authority and exception governance demonstrate the policy is operational. It tests policy authority, while this case requires evidence about standard enforceability.
Question 43
After a prior procedure operation finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Publish a step-by-step offboarding procedure with role responsibilities and timing.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Check formal approval, communication and delegated exception workflow
- Rehearse the procedure and check timestamps from departure trigger through revocation
- Accept a signed change ticket saying: Publish a step-by-step offboarding procedure with role responsibilities and timing
- Use the completion of this alternative as proof: State only that access should be secure
Explanation
Correct Answer
B:Execution evidence verifies the task can be performed on time.
Incorrect Answers
A:Authority and exception governance demonstrate the policy is operational. It tests policy authority, while this case requires evidence about procedure operation.
C:Rehearse the procedure and check timestamps from departure trigger through revocation. Execution evidence verifies the task can be performed on time.
D:A vague statement does not guide immediate revocation. Rehearse the procedure and check timestamps from departure trigger through revocation.
Question 44
After a merger, IT asks which business functions should receive the shortest recovery targets. Which response best addresses the central security requirement with a defensible, risk-based design?
- Conduct a business impact analysis with process owners before selecting recovery technologies
- Map and include upstream service, supplier and infrastructure dependencies in recovery planning
- Copy each server equally without measuring process impact
- Pick recovery priorities by server purchase price
Explanation
Correct Answer
A:A BIA identifies criticality and losses over time to prioritize recovery.
Incorrect Answers
B:A business process can fail even when its primary application is restored. Conduct a business impact analysis with process owners before selecting recovery technologies.
C:Uniform recovery ignores critical process differences.
D:Hardware cost does not measure business disruption.
Question 45
A payment recovery exercise restores the database but cannot resume transactions because an identity service is missing. Which response best addresses the central security requirement with a defensible, risk-based design?
- Restore only the main application binary
- Conduct a business impact analysis with process owners before selecting recovery technologies
- Map and include upstream service, supplier and infrastructure dependencies in recovery planning
- Decrease database RPO without fixing the dependency
Explanation
Correct Answer
C:A business process can fail even when its primary application is restored.
Incorrect Answers
A:Software restoration omits dependent identity, network and data services.
B:A BIA identifies criticality and losses over time to prioritize recovery. Map and include upstream service, supplier and infrastructure dependencies in recovery planning.
D:Data freshness does not restore missing authentication.
Question 46
A core trading service must resume within 45 minutes after a declared disaster. Which response best addresses the central security requirement with a defensible, risk-based design?
- Design replication and recovery points to meet a five-minute recovery point objective
- Define a 45-minute recovery time objective and test full application restoration against it
- Treat 45 minutes as the allowable data-loss window
- Choose a backup interval of 45 minutes without recovery rehearsal
Explanation
Correct Answer
B:RTO is the maximum targeted duration to restore service, not the age of recovered data.
Incorrect Answers
A:RPO limits acceptable data loss measured in time, not rebuild duration. Define a 45-minute recovery time objective and test full application restoration against it.
C:That is RPO, which measures data recency.
D:Backup frequency does not prove service restoration time.
Question 47
A medical records system can tolerate no more than five minutes of committed-record loss after failure. Which response best addresses the central security requirement with a defensible, risk-based design?
- Promise to restart servers within five minutes without data replication
- Set the maximum allowable outage from business impact and choose RTO shorter than that tolerance
- Treat daily full backups as sufficient for a five-minute RPO
- Design replication and recovery points to meet a five-minute recovery point objective
Explanation
Correct Answer
D:RPO limits acceptable data loss measured in time, not rebuild duration.
Incorrect Answers
A:Fast restart can still lose hours of data.
B:Maximum allowable outage expresses business tolerance, which recovery targets must respect. Design replication and recovery points to meet a five-minute recovery point objective.
C:A daily interval has a much wider data-loss exposure.
Question 48
A hospital business process can survive interruption for only four hours before impact becomes unacceptable. Which response best addresses the central security requirement with a defensible, risk-based design?
- Define a 45-minute recovery time objective and test full application restoration against it
- Use backup retention days as the outage tolerance
- Set the maximum allowable outage from business impact and choose RTO shorter than that tolerance
- Set technical RTO longer than the business's tolerated outage
Explanation
Correct Answer
C:Maximum allowable outage expresses business tolerance, which recovery targets must respect.
Incorrect Answers
A:RTO is the maximum targeted duration to restore service, not the age of recovered data. Set the maximum allowable outage from business impact and choose RTO shorter than that tolerance.
B:Retention age is not maximum process downtime.
D:Restoration after intolerable loss fails the business requirement.
Question 49
After a prior bia finding, a regional hospital network reports that the approved safeguard is implemented: “Conduct a business impact analysis with process owners before selecting recovery technologies.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Validate BIA outputs against process dependencies, disruption costs and approved thresholds
- Accept a signed change ticket saying: Conduct a business impact analysis with process owners before selecting recovery technologies
- Run this adjacent but different test as the sole proof: Run an end-to-end business transaction test under simulated dependency failure
- Use the completion of this alternative as proof: Pick recovery priorities by server purchase price
Explanation
Correct Answer
A:Owner-confirmed impacts justify recovery objectives.
Incorrect Answers
B:Validate BIA outputs against process dependencies, disruption costs and approved thresholds. Owner-confirmed impacts justify recovery objectives.
C:Transaction success proves the process chain is viable. It tests critical process dependencies, while this case requires evidence about bia.
D:Hardware cost does not measure business disruption. Validate BIA outputs against process dependencies, disruption costs and approved thresholds.
Question 50
After a prior critical process dependencies finding, a payment-services company reports that the approved safeguard is implemented: “Map and include upstream service, supplier and infrastructure dependencies in recovery planning.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run an end-to-end business transaction test under simulated dependency failure
- Accept a signed change ticket saying: Map and include upstream service, supplier and infrastructure dependencies in recovery planning
- Run this adjacent but different test as the sole proof: Check the BIA's maximum tolerable outage against tested RTO and dependent process recovery
- Use the completion of this alternative as proof: Restore only the main application binary
Explanation
Correct Answer
A:Transaction success proves the process chain is viable.
Incorrect Answers
B:Run an end-to-end business transaction test under simulated dependency failure. Transaction success proves the process chain is viable.
C:A valid plan maintains recovery before intolerable impact. It tests mao, while this case requires evidence about critical process dependencies.
D:Software restoration omits dependent identity, network and data services. Run an end-to-end business transaction test under simulated dependency failure.
Certified Information Systems Security Professional (CISSP) Practice Tests