Question 500
After a prior containment finding, an international retailer reports that the approved safeguard is implemented: “Isolate its network path with authorized containment while preserving evidence where practical.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- In a safe exercise verify isolation blocks exfiltration while incident artifacts remain accessible
- Accept a signed change ticket saying: Isolate its network path with authorized containment while preserving evidence where practical
- Run this adjacent but different test as the sole proof: Review a notification decision log with applicable criteria, approval and timestamps
- Use the completion of this alternative as proof: Wipe all hosts before preserving context
Explanation
Correct Answer
A:Containment tests need both security and evidence outcomes.
Incorrect Answers
B:In a safe exercise verify isolation blocks exfiltration while incident artifacts remain accessible. Containment tests need both security and evidence outcomes.
C:Documented legal decisions make deadline handling reviewable. It tests notifications, while this case requires evidence about containment.
D:Destruction may remove evidence and break operations. In a safe exercise verify isolation blocks exfiltration while incident artifacts remain accessible.
Question 501
After a prior eradication finding, a university consortium reports that the approved safeguard is implemented: “Remove persistence, remediate exploited weaknesses and rotate affected credentials before declaring eradication.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Reboot the server and mark the incident closed
- Run approved scans and attempted persistence execution after cleanup to confirm absence
- Accept a signed change ticket saying: Remove persistence, remediate exploited weaknesses and rotate affected credentials before declaring eradication
- Run this adjacent but different test as the sole proof: Review a notification decision log with applicable criteria, approval and timestamps
Explanation
Correct Answer
B:Verification must challenge the actual reinfection mechanisms.
Incorrect Answers
A:Persistence can survive restart. Run approved scans and attempted persistence execution after cleanup to confirm absence.
C:Run approved scans and attempted persistence execution after cleanup to confirm absence. Verification must challenge the actual reinfection mechanisms.
D:Documented legal decisions make deadline handling reviewable. It tests notifications, while this case requires evidence about eradication.
Question 502
After a prior recovery finding, a cloud service provider reports that the approved safeguard is implemented: “Restore in a controlled environment, validate service and security, then monitor a staged return to production.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Validate application transactions, integrity and monitoring after phased restoration
- Accept a signed change ticket saying: Restore in a controlled environment, validate service and security, then monitor a staged return to production
- Run this adjacent but different test as the sole proof: Replay a mixed alert queue and inspect whether escalation meets agreed priorities
- Use the completion of this alternative as proof: Reconnect all systems before testing their security state
Explanation
Correct Answer
A:Business and security tests establish operational recovery.
Incorrect Answers
B:Validate application transactions, integrity and monitoring after phased restoration. Business and security tests establish operational recovery.
C:Exercises expose triage thresholds and delay. It tests triage, while this case requires evidence about recovery.
D:Premature reconnection can reinfect the environment. Validate application transactions, integrity and monitoring after phased restoration.
Question 503
A database accepts traffic from any internal subnet even though only one service tier needs its port. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rely only on a network diagram with no enforcement
- Keep all internal inbound ports open for convenience
- Implement maintainable application allowlisting with controlled exception approvals
- Restrict stateful traffic policy to approved service identities or sources and necessary ports
Explanation
Correct Answer
D:A flat inside-trust rule allows avoidable lateral connections.
Incorrect Answers
A:Diagrams do not filter packets.
B:Broad access increases exposure.
C:A positive execution policy blocks unapproved binaries, including unseen malware. Restrict stateful traffic policy to approved service identities or sources and necessary ports.
Question 504
Network intrusion sensors alert on a known exploit but do not stop packets by design. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use appropriately placed inline IPS enforcement where prevention is required and tune it safely
- Enable every signature without testing legitimate workload impact
- Assume IDS alerting automatically drops exploit traffic
- Restrict stateful traffic policy to approved service identities or sources and necessary ports
Explanation
Correct Answer
A:Detection-only IDS and inline IPS have different traffic roles.
Incorrect Answers
B:False positives may disrupt critical applications.
C:Alerts do not imply prevention.
D:A flat inside-trust rule allows avoidable lateral connections. Use appropriately placed inline IPS enforcement where prevention is required and tune it safely.
Question 505
Analysts receive a suspicious attachment containing unknown macro behavior. Which response best addresses the central security requirement with a defensible, risk-based design?
- Isolate the decoy, use synthetic information and monitor activity without giving it reach to production
- Open the attachment directly on a production administrator laptop
- Email the file to all employees for parallel inspection
- Detonate a safe copy in an isolated monitored analysis sandbox
Explanation
Correct Answer
D:Isolation helps observe potential malware without executing on enterprise endpoints.
Incorrect Answers
A:Deception tools should not become attack pivot points or store actual sensitive data. Detonate a safe copy in an isolated monitored analysis sandbox.
B:Direct execution endangers a privileged endpoint.
C:Broad distribution increases exposure.
Question 506
A hospital workstation needs only signed approved clinical applications but users can launch arbitrary scripts. Which response best addresses the central security requirement with a defensible, risk-based design?
- Give all users local administrators so updates are easy
- Detonate a safe copy in an isolated monitored analysis sandbox
- Implement maintainable application allowlisting with controlled exception approvals
- Rely only on antivirus signatures
Explanation
Correct Answer
C:A positive execution policy blocks unapproved binaries, including unseen malware.
Incorrect Answers
A:Privilege broadening bypasses application safeguards.
B:Isolation helps observe potential malware without executing on enterprise endpoints. Implement maintainable application allowlisting with controlled exception approvals.
D:Signatures may miss new or modified executables.
Question 507
A company deploys a decoy database to learn about internal scans without exposing real records. Which response best addresses the central security requirement with a defensible, risk-based design?
- Restrict stateful traffic policy to approved service identities or sources and necessary ports
- Populate the decoy with live customer data for realism
- Isolate the decoy, use synthetic information and monitor activity without giving it reach to production
- Allow the decoy unrestricted production network access
Explanation
Correct Answer
C:Deception tools should not become attack pivot points or store actual sensitive data.
Incorrect Answers
A:A flat inside-trust rule allows avoidable lateral connections. Isolate the decoy, use synthetic information and monitor activity without giving it reach to production.
B:Real data increases loss if accessed.
D:The decoy can become a stepping stone.
Question 508
A user downloads a trojan that bypasses one endpoint signature but shows suspicious execution behavior. Which response best addresses the central security requirement with a defensible, risk-based design?
- Isolate the decoy, use synthetic information and monitor activity without giving it reach to production
- Trust a single signature database as complete prevention
- Combine endpoint behavioral detection, isolation and managed response with traditional malware controls
- Turn off endpoint logging to improve speed
Explanation
Correct Answer
C:Layering detection and response addresses unknown or modified threats.
Incorrect Answers
A:Deception tools should not become attack pivot points or store actual sensitive data. Combine endpoint behavioral detection, isolation and managed response with traditional malware controls.
B:Novel malware may not match known signatures.
D:Loss of telemetry impedes containment.
Question 509
After a prior firewall finding, a university consortium reports that the approved safeguard is implemented: “Restrict stateful traffic policy to approved service identities or sources and necessary ports.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Run a benign attack simulation and confirm telemetry and isolation actions operate as approved
- Attempt blocked lateral access and valid application traffic and confirm respective outcomes
- Accept a signed change ticket saying: Restrict stateful traffic policy to approved service identities or sources and necessary ports
- Use the completion of this alternative as proof: Keep all internal inbound ports open for convenience
Explanation
Correct Answer
B:Paired negative/positive tests verify segmentation.
Incorrect Answers
A:Behavior-driven detection must be exercised with safe test cases. It tests malware, while this case requires evidence about firewall.
C:Attempt blocked lateral access and valid application traffic and confirm respective outcomes. Paired negative/positive tests verify segmentation.
D:Broad access increases exposure. Attempt blocked lateral access and valid application traffic and confirm respective outcomes.
Question 510
An actively exploited internet-facing remote-access vulnerability competes with numerous medium-severity internal findings. Which response best addresses the central security requirement with a defensible, risk-based design?
- Wait for annual patch windows regardless of exploitation
- Patch in alphabetical asset order
- Prioritize based on exploitation evidence, exposure, asset impact and workable mitigation deadlines
- Plan controlled maintenance with vendor compatibility validation, rollback and compensating defenses until the window
Explanation
Correct Answer
C:CVSS alone does not capture active threats to critical services.
Incorrect Answers
A:Long delays prolong reachable exposure.
B:Alphabetical ordering ignores risk.
D:Availability and safety must be balanced with remediation urgency. Prioritize based on exploitation evidence, exposure, asset impact and workable mitigation deadlines.
Certified Information Systems Security Professional (CISSP) Practice Tests