Question 540
An earthquake triggers fire alarms while staff focus on keeping servers online. Which response best addresses the central security requirement with a defensible, risk-based design?
- Prioritize evacuation, life safety, emergency roles and safe shutdown when feasible
- Keep locked exits secure against evacuation
- Provide a protected duress alert path and practiced escalation procedures
- Require staff to finish backups before evacuation
Explanation
Correct Answer
A:Human safety outranks asset availability during an imminent hazard.
Incorrect Answers
B:Access controls must support safe egress.
C:Personnel safety controls must work without escalating danger. Prioritize evacuation, life safety, emergency roles and safe shutdown when feasible.
D:Delaying evacuation puts personnel at immediate physical risk.
Question 541
An API team plans to add authorization only after its new customer portal is deployed. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use code obfuscation instead of access design
- Wait for a production incident before defining roles
- Perform only a late penetration test after deployment, leaving early authorization requirements undefined
- Define abuse cases, trust boundaries and enforceable security requirements during design
Explanation
Correct Answer
D:Early security requirements avoid insecure default behavior becoming embedded.
Incorrect Answers
A:Obfuscation cannot establish authorization.
B:Retroactive authorization is costly and risky.
C:A late penetration test can find implemented weaknesses, but it does not establish required authorization and trust boundaries before the software design is locked.
Question 542
Two-week sprints deliver features but security testing happens only once at the annual audit. Which response best addresses the central security requirement with a defensible, risk-based design?
- Disable continuous integration until the yearly assessment
- Ask one auditor to review all code only after publication
- Integrate threat review, automated tests and risk-based security acceptance into each sprint
- Use controlled build provenance, reviewed releases and authorized deployment identities
Explanation
Correct Answer
C:Continuous security validation catches defects near their introduction.
Incorrect Answers
A:Stopping automation delays useful feedback.
B:Late reviews may miss release-blocking issues.
D:Release integrity depends on knowing what was built, reviewed and deployed. Integrate threat review, automated tests and risk-based security acceptance into each sprint.
Question 543
A product adds a new third-party payment callback after the threat model was approved. Which response best addresses the central security requirement with a defensible, risk-based design?
- Treat the old diagram as permanently valid
- Apply only infrastructure patching without considering callback trust
- Update the threat model for new entry points, trust boundaries and abuse cases
- Integrate threat review, automated tests and risk-based security acceptance into each sprint
Explanation
Correct Answer
C:Architecture changes can introduce new threats not covered by the prior model.
Incorrect Answers
A:New interfaces alter attack surface.
B:Patching cannot resolve logical authorization flaws.
D:Continuous security validation catches defects near their introduction. Update the threat model for new entry points, trust boundaries and abuse cases.
Question 544
Developers can deploy critical vulnerabilities because the pipeline reports findings but never enforces release rules. Which response best addresses the central security requirement with a defensible, risk-based design?
- Introduce risk-based mandatory release gates with ownership and controlled exception paths
- Use controlled build provenance, reviewed releases and authorized deployment identities
- Block all releases forever regardless of risk and remediation
- Suppress critical scanner alerts on release day
Explanation
Correct Answer
A:Alerts without an enforceable decision allow unacceptable releases.
Incorrect Answers
B:Release integrity depends on knowing what was built, reviewed and deployed. Introduce risk-based mandatory release gates with ownership and controlled exception paths.
C:Absolute bans can prevent even safe fixes.
D:Hiding evidence weakens governance.
Question 545
A production release can be deployed from any developer laptop without approval or artifact signing. Which response best addresses the central security requirement with a defensible, risk-based design?
- Copy code by email directly to production
- Use controlled build provenance, reviewed releases and authorized deployment identities
- Grant all engineers permanent production root
- Integrate threat review, automated tests and risk-based security acceptance into each sprint
Explanation
Correct Answer
B:Release integrity depends on knowing what was built, reviewed and deployed.
Incorrect Answers
A:Untracked artifacts can be altered.
C:Broad access makes unauthorized releases easier.
D:Continuous security validation catches defects near their introduction. Use controlled build provenance, reviewed releases and authorized deployment identities.
Question 546
A financial microservice handles account updates but its business requirements omit concurrency conflicts and replay threats. Which response best addresses the central security requirement with a defensible, risk-based design?
- Define idempotency, authentication and transaction integrity requirements before coding
- Introduce risk-based mandatory release gates with ownership and controlled exception paths
- Add only a firewall on the service subnet
- Rely on client retries to fix duplicate transfers
Explanation
Correct Answer
A:Secure design includes business-logic correctness as well as technical hardening.
Incorrect Answers
B:Alerts without an enforceable decision allow unacceptable releases. Define idempotency, authentication and transaction integrity requirements before coding.
C:Network filtering cannot prevent authorized transaction replay.
D:Retries can magnify non-idempotent operations.
Question 547
After a prior agile/devsecops finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Integrate threat review, automated tests and risk-based security acceptance into each sprint.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Review recent sprint evidence for executed checks, findings and accountable exceptions
- Use the completion of this alternative as proof: Disable continuous integration until the yearly assessment
- Accept a signed change ticket saying: Integrate threat review, automated tests and risk-based security acceptance into each sprint
- Run this adjacent but different test as the sole proof: Submit a deliberately vulnerable test build and verify its disposition and recorded exception behavior
Explanation
Correct Answer
A:Actual build histories show whether the process is continuous.
Incorrect Answers
B:Stopping automation delays useful feedback. Review recent sprint evidence for executed checks, findings and accountable exceptions.
C:Review recent sprint evidence for executed checks, findings and accountable exceptions. Actual build histories show whether the process is continuous.
D:Negative build testing proves the gate is operative. It tests security gates, while this case requires evidence about agile/devsecops.
Question 548
After a prior threat model finding, an international retailer reports that the approved safeguard is implemented: “Update the threat model for new entry points, trust boundaries and abuse cases.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Review recent sprint evidence for executed checks, findings and accountable exceptions
- Simulate a spoofed callback and check design controls and validation results
- Use the completion of this alternative as proof: Treat the old diagram as permanently valid
- Accept a signed change ticket saying: Update the threat model for new entry points, trust boundaries and abuse cases
Explanation
Correct Answer
B:Testing an abuse case confirms that the new boundary is protected.
Incorrect Answers
A:Actual build histories show whether the process is continuous. It tests agile/devsecops, while this case requires evidence about threat model.
C:New interfaces alter attack surface. Simulate a spoofed callback and check design controls and validation results.
D:Simulate a spoofed callback and check design controls and validation results. Testing an abuse case confirms that the new boundary is protected.
Question 549
A security build gate blocks every low-severity code style warning but permits unreviewed externally exploitable authorization flaws. Which response best addresses the central security requirement with a defensible, risk-based design?
- Set all findings to the same priority
- Calibrate release gates to risk severity, exploitability and accountable exception authority
- Let feature developers silently waive critical risks
- Use controlled build provenance, reviewed releases and authorized deployment identities
Explanation
Correct Answer
B:Risk-based thresholds prevent inconsequential noise from masking real danger.
Incorrect Answers
A:Equal severity ignores actual business impact.
C:Unowned exceptions undermine governance.
D:Release integrity depends on knowing what was built, reviewed and deployed. Calibrate release gates to risk severity, exploitability and accountable exception authority.
Question 550
After a prior release controls finding, a cloud service provider reports that the approved safeguard is implemented: “Use controlled build provenance, reviewed releases and authorized deployment identities.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Copy code by email directly to production
- Run this adjacent but different test as the sole proof: Submit a deliberately vulnerable test build and verify its disposition and recorded exception behavior
- Accept a signed change ticket saying: Use controlled build provenance, reviewed releases and authorized deployment identities
- Compare the deployed artifact digest with the approved signed build and deployment log
Explanation
Correct Answer
D:Digest and identity matching verify provenance end to end.
Incorrect Answers
A:Untracked artifacts can be altered. Compare the deployed artifact digest with the approved signed build and deployment log.
B:Negative build testing proves the gate is operative. It tests security gates, while this case requires evidence about release controls.
C:Compare the deployed artifact digest with the approved signed build and deployment log. Digest and identity matching verify provenance end to end.
Certified Information Systems Security Professional (CISSP) Practice Tests