Question 510
An actively exploited internet-facing remote-access vulnerability competes with numerous medium-severity internal findings. Which response best addresses the central security requirement with a defensible, risk-based design?
- Wait for annual patch windows regardless of exploitation
- Patch in alphabetical asset order
- Prioritize based on exploitation evidence, exposure, asset impact and workable mitigation deadlines
- Plan controlled maintenance with vendor compatibility validation, rollback and compensating defenses until the window
Explanation
Correct Answer
C:CVSS alone does not capture active threats to critical services.
Incorrect Answers
A:Long delays prolong reachable exposure.
B:Alphabetical ordering ignores risk.
D:Availability and safety must be balanced with remediation urgency. Prioritize based on exploitation evidence, exposure, asset impact and workable mitigation deadlines.
Question 511
An inventory lists an old vulnerability on an isolated lab host and a lower-scored flaw on an internet-facing identity gateway. Which response best addresses the central security requirement with a defensible, risk-based design?
- Plan controlled maintenance with vendor compatibility validation, rollback and compensating defenses until the window
- Ignore the external identity gateway because its score is lower
- Assess real attack-path reachability and business criticality before ranking treatment
- Always fix higher CVSS first without context
Explanation
Correct Answer
C:Exploitability and mission impact can outweigh severity score differences.
Incorrect Answers
A:Availability and safety must be balanced with remediation urgency. Assess real attack-path reachability and business criticality before ranking treatment.
B:Exposure can make the lower score urgent.
D:CVSS is only one risk factor.
Question 512
A critical factory controller can only be patched during a weekly production stop. Which response best addresses the central security requirement with a defensible, risk-based design?
- Suspend all security controls until the next patch date
- Plan controlled maintenance with vendor compatibility validation, rollback and compensating defenses until the window
- Document a time-limited risk exception approved by an accountable owner with compensating controls
- Force an untested firmware upgrade while the line is running
Explanation
Correct Answer
B:Availability and safety must be balanced with remediation urgency.
Incorrect Answers
A:Deferral needs documented compensating risk reduction.
C:A real technical constraint still requires ownership and expiration. Plan controlled maintenance with vendor compatibility validation, rollback and compensating defenses until the window.
D:Unexpected controller failure can endanger operations.
Question 513
A legacy medical device cannot accept the required security agent for six months. Which response best addresses the central security requirement with a defensible, risk-based design?
- Grant an indefinite silent waiver to avoid reporting
- Mark the device compliant without safeguards
- Plan controlled maintenance with vendor compatibility validation, rollback and compensating defenses until the window
- Document a time-limited risk exception approved by an accountable owner with compensating controls
Explanation
Correct Answer
D:A real technical constraint still requires ownership and expiration.
Incorrect Answers
A:Unbounded exceptions conceal accumulating exposure.
B:Relabeling does not reduce risk.
C:Availability and safety must be balanced with remediation urgency. Document a time-limited risk exception approved by an accountable owner with compensating controls.
Question 514
After a prior patch priority finding, a payment-services company reports that the approved safeguard is implemented: “Prioritize based on exploitation evidence, exposure, asset impact and workable mitigation deadlines.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Confirm the exposed vulnerable service is remediated or mitigated and rescanned within target
- Accept a signed change ticket saying: Prioritize based on exploitation evidence, exposure, asset impact and workable mitigation deadlines
- Use the completion of this alternative as proof: Patch in alphabetical asset order
- Run this adjacent but different test as the sole proof: Confirm tested firmware version, backup and recovery plan during maintenance rehearsal
Explanation
Correct Answer
A:Evidence of actual exposure closure matters more than ticket counts.
Incorrect Answers
B:Confirm the exposed vulnerable service is remediated or mitigated and rescanned within target. Evidence of actual exposure closure matters more than ticket counts.
C:Alphabetical ordering ignores risk. Confirm the exposed vulnerable service is remediated or mitigated and rescanned within target.
D:Practical readiness reduces patch-caused outage. It tests maintenance, while this case requires evidence about patch priority.
Question 515
After a prior exposure finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Assess real attack-path reachability and business criticality before ranking treatment.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Always fix higher CVSS first without context
- Accept a signed change ticket saying: Assess real attack-path reachability and business criticality before ranking treatment
- Validate reachability from relevant threat positions and confirm mitigations
- Run this adjacent but different test as the sole proof: Confirm tested firmware version, backup and recovery plan during maintenance rehearsal
Explanation
Correct Answer
C:Attack-path checks substantiate actual exposure.
Incorrect Answers
A:CVSS is only one risk factor. Validate reachability from relevant threat positions and confirm mitigations.
B:Validate reachability from relevant threat positions and confirm mitigations. Attack-path checks substantiate actual exposure.
D:Practical readiness reduces patch-caused outage. It tests maintenance, while this case requires evidence about exposure.
Question 516
A deployment team wants to ship a firewall change without review because it is technically simple. Which response best addresses the central security requirement with a defensible, risk-based design?
- Require risk-appropriate documented authorization and independent review before planned production changes
- Use an approved emergency-change path with narrow authorization, logging and timely retrospective review
- Let its author be the sole approver for all risky changes
- Treat a chat emoji as complete change impact evidence
Explanation
Correct Answer
A:A change's size does not eliminate accountability.
Incorrect Answers
B:Urgency alters process timing but does not remove accountability. Require risk-appropriate documented authorization and independent review before planned production changes.
C:Self-approval can hide unintended impact.
D:Informal acknowledgments may not prove scope.
Question 517
A zero-day exploit requires immediate blocking while the normal weekly change board is unavailable. Which response best addresses the central security requirement with a defensible, risk-based design?
- Bypass all logging and documentation permanently
- Wait a week without emergency mitigation despite active exploitation
- Use an approved emergency-change path with narrow authorization, logging and timely retrospective review
- Require risk-appropriate documented authorization and independent review before planned production changes
Explanation
Correct Answer
C:Urgency alters process timing but does not remove accountability.
Incorrect Answers
A:Emergency action still requires evidence.
B:Avoidable exposure remains.
D:A change's size does not eliminate accountability. Use an approved emergency-change path with narrow authorization, logging and timely retrospective review.
Question 518
A newly deployed authentication policy blocks legitimate operators and needs safe reversal. Which response best addresses the central security requirement with a defensible, risk-based design?
- Maintain tested rollback artifacts and authorized reversal triggers before rollout
- Separate request, approval and implementation or enforce monitored compensating reviews
- Delete all identity logs to restore performance
- Improvise the previous state from memory after failure
Explanation
Correct Answer
A:A change with no recovery path can prolong outage.
Incorrect Answers
B:Independent oversight reduces unilateral privilege escalation. Maintain tested rollback artifacts and authorized reversal triggers before rollout.
C:Logging is not the authorization failure.
D:Unknown configurations are unreliable.
Question 519
The same operator requests, approves and applies production database permission changes. Which response best addresses the central security requirement with a defensible, risk-based design?
- Allow self-approval as long as no one notices
- Require risk-appropriate documented authorization and independent review before planned production changes
- Use two browser tabs under the same identity
- Separate request, approval and implementation or enforce monitored compensating reviews
Explanation
Correct Answer
D:Independent oversight reduces unilateral privilege escalation.
Incorrect Answers
A:Hidden conflicts contradict change governance.
B:A change's size does not eliminate accountability. Separate request, approval and implementation or enforce monitored compensating reviews.
C:Multiple interfaces do not create separate authority.
Question 520
A ransomware actor with domain-admin access can delete connected production backups. Which response best addresses the central security requirement with a defensible, risk-based design?
- Create protected offline/immutable or separately administered backups with controlled restore credentials
- Depend only on storage replication of deletions
- Keep backups only as writable shares under the same account
- Use appropriate active redundancy and fault-tolerant state handling for the critical component
Explanation
Correct Answer
A:Backup isolation prevents compromise of production administration from destroying recovery points.
Incorrect Answers
B:Replication can copy attacker deletions.
C:Common administration enables destructive propagation.
D:Simple periodic backup cannot deliver continuous operation. Create protected offline/immutable or separately administered backups with controlled restore credentials.
Certified Information Systems Security Professional (CISSP) Practice Tests