Question 490
A laptop fleet has secure VPN but stolen disks can still be mounted on another system. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use only screen lock and rely on device casing
- Apply approved end-to-end transport encryption and authenticate the partner endpoint
- Enable strong full-disk encryption with protected keys and enforced recovery handling
- Keep all recovery keys in a plaintext shared folder
Explanation
Correct Answer
C:Network encryption does not defend data stored on a stolen drive.
Incorrect Answers
A:Offline disk access can bypass the login screen.
B:Dedicated physical transport is not equivalent to cryptographic confidentiality. Enable strong full-disk encryption with protected keys and enforced recovery handling.
D:Poor key custody undermines encryption.
Question 491
A laboratory allows staff to copy patient records onto unmanaged USB drives. Which response best addresses the central security requirement with a defensible, risk-based design?
- Encrypt the media, register chain of custody and approve secure shipment procedures
- Post a warning sign but leave all USB ports unrestricted
- Disable drive auditing because USB devices are temporary
- Restrict removable media with endpoint controls and approved encrypted exception workflows
Explanation
Correct Answer
D:Uncontrolled portable copies evade custody and revocation.
Incorrect Answers
A:Physical transport can expose durable sensitive copies. Restrict removable media with endpoint controls and approved encrypted exception workflows.
B:Awareness alone does not enforce policy.
C:Lack of evidence hides policy bypasses.
Question 492
After a prior media finding, an international retailer reports that the approved safeguard is implemented: “Encrypt the media, register chain of custody and approve secure shipment procedures.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Rely on a plain shipping label as access control
- Reconcile shipped serial numbers, recipient signatures and encryption records
- Run this adjacent but different test as the sole proof: Test unauthorized USB write denial and approved encrypted transfer with full audit
- Accept a signed change ticket saying: Encrypt the media, register chain of custody and approve secure shipment procedures
Explanation
Correct Answer
B:Matching custody and encryption logs substantiate protection.
Incorrect Answers
A:Labels do not protect data confidentiality. Reconcile shipped serial numbers, recipient signatures and encryption records.
C:Both paths show enforceable exceptions and control coverage. It tests removable storage, while this case requires evidence about media.
D:Reconcile shipped serial numbers, recipient signatures and encryption records. Matching custody and encryption logs substantiate protection.
Question 493
An alert queue contains thousands of low-confidence detections while a possible ransomware lateral-movement event is unfolding. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use business impact, confidence and threat progression to prioritize investigation and escalate the high-risk event
- Investigate solely in order of oldest alert
- Engage legal/privacy response owners to evaluate facts, jurisdictions, deadlines and authorized notice content
- Suppress all alerts after any false positive
Explanation
Correct Answer
A:Triage allocates limited response resources to consequential incidents.
Incorrect Answers
B:Chronology may delay urgent containment.
C:Notification duties depend on applicable law and verified incident circumstances. Use business impact, confidence and threat progression to prioritize investigation and escalate the high-risk event.
D:Noise cannot justify ignoring high-impact evidence.
Question 494
A compromised workstation is sending data to an attacker but holds volatile forensic evidence. Which response best addresses the central security requirement with a defensible, risk-based design?
- Remove persistence, remediate exploited weaknesses and rotate affected credentials before declaring eradication
- Wait until a full root-cause report is written before stopping exfiltration
- Wipe all hosts before preserving context
- Isolate its network path with authorized containment while preserving evidence where practical
Explanation
Correct Answer
D:Rapid containment can limit harm without unnecessary destruction of investigative material.
Incorrect Answers
A:Restoration without threat removal allows reinfection. Isolate its network path with authorized containment while preserving evidence where practical.
B:Delay permits continuing loss.
C:Destruction may remove evidence and break operations.
Question 495
A ransomware victim restored one server but left malicious scheduled tasks and compromised credentials active. Which response best addresses the central security requirement with a defensible, risk-based design?
- Reboot the server and mark the incident closed
- Remove persistence, remediate exploited weaknesses and rotate affected credentials before declaring eradication
- Perform a blameless root-cause review with owners, deadlines and tracked corrective actions
- Disable monitoring to reduce recovery overhead
Explanation
Correct Answer
B:Restoration without threat removal allows reinfection.
Incorrect Answers
A:Persistence can survive restart.
C:Learning only matters when control improvements are implemented. Remove persistence, remediate exploited weaknesses and rotate affected credentials before declaring eradication.
D:Lack of detection conceals recurring infection.
Question 496
A clean backup is available after compromise but the restored application has not been safely reconnected. Which response best addresses the central security requirement with a defensible, risk-based design?
- Reconnect all systems before testing their security state
- Declare recovery complete when a backup job succeeds
- Restore in a controlled environment, validate service and security, then monitor a staged return to production
- Use business impact, confidence and threat progression to prioritize investigation and escalate the high-risk event
Explanation
Correct Answer
C:Recovery should avoid reintroducing compromise and meet business objectives.
Incorrect Answers
A:Premature reconnection can reinfect the environment.
B:Backup existence is not functional recovery.
D:Triage allocates limited response resources to consequential incidents. Restore in a controlled environment, validate service and security, then monitor a staged return to production.
Question 497
An incident may involve regulated customer information but the response team has no confirmed notification obligations. Which response best addresses the central security requirement with a defensible, risk-based design?
- Perform a blameless root-cause review with owners, deadlines and tracked corrective actions
- Engage legal/privacy response owners to evaluate facts, jurisdictions, deadlines and authorized notice content
- Assume security operations can ignore legal notification deadlines
- Send every customer a breach declaration immediately without fact review
Explanation
Correct Answer
B:Notification duties depend on applicable law and verified incident circumstances.
Incorrect Answers
A:Learning only matters when control improvements are implemented. Engage legal/privacy response owners to evaluate facts, jurisdictions, deadlines and authorized notice content.
C:Response teams must coordinate compliance.
D:Unsubstantiated notice may be misleading.
Question 498
Two similar phishing incidents recur because postincident actions were never assigned. Which response best addresses the central security requirement with a defensible, risk-based design?
- Engage legal/privacy response owners to evaluate facts, jurisdictions, deadlines and authorized notice content
- Perform a blameless root-cause review with owners, deadlines and tracked corrective actions
- Judge effectiveness only by how quickly the meeting ends
- Archive the incident ticket and make no changes
Explanation
Correct Answer
B:Learning only matters when control improvements are implemented.
Incorrect Answers
A:Notification duties depend on applicable law and verified incident circumstances. Perform a blameless root-cause review with owners, deadlines and tracked corrective actions.
C:Meeting duration does not show risk reduction.
D:Unaddressed causes can recur.
Question 499
After a prior triage finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Use business impact, confidence and threat progression to prioritize investigation and escalate the high-risk event.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Use business impact, confidence and threat progression to prioritize investigation and escalate the high-risk event
- Run this adjacent but different test as the sole proof: Validate application transactions, integrity and monitoring after phased restoration
- Replay a mixed alert queue and inspect whether escalation meets agreed priorities
- Use the completion of this alternative as proof: Investigate solely in order of oldest alert
Explanation
Correct Answer
C:Exercises expose triage thresholds and delay.
Incorrect Answers
A:Replay a mixed alert queue and inspect whether escalation meets agreed priorities. Exercises expose triage thresholds and delay.
B:Business and security tests establish operational recovery. It tests recovery, while this case requires evidence about triage.
D:Chronology may delay urgent containment. Replay a mixed alert queue and inspect whether escalation meets agreed priorities.
Question 500
After a prior containment finding, an international retailer reports that the approved safeguard is implemented: “Isolate its network path with authorized containment while preserving evidence where practical.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- In a safe exercise verify isolation blocks exfiltration while incident artifacts remain accessible
- Accept a signed change ticket saying: Isolate its network path with authorized containment while preserving evidence where practical
- Run this adjacent but different test as the sole proof: Review a notification decision log with applicable criteria, approval and timestamps
- Use the completion of this alternative as proof: Wipe all hosts before preserving context
Explanation
Correct Answer
A:Containment tests need both security and evidence outcomes.
Incorrect Answers
B:In a safe exercise verify isolation blocks exfiltration while incident artifacts remain accessible. Containment tests need both security and evidence outcomes.
C:Documented legal decisions make deadline handling reviewable. It tests notifications, while this case requires evidence about containment.
D:Destruction may remove evidence and break operations. In a safe exercise verify isolation blocks exfiltration while incident artifacts remain accessible.
Certified Information Systems Security Professional (CISSP) Practice Tests