Question 570
After a prior secret scanning finding, a payment-services company reports that the approved safeguard is implemented: “Revoke or rotate the compromised token and scan code history and build artifacts.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Attempt use of the revoked test token and verify rejection plus clean history review
- Run this adjacent but different test as the sole proof: Run instrumented tests through a seeded unsafe route and verify actionable finding context
- Accept a signed change ticket saying: Revoke or rotate the compromised token and scan code history and build artifacts
- Use the completion of this alternative as proof: Assume git deletion makes the secret unusable
Explanation
Correct Answer
A:Revocation validation proves the credential is no longer usable.
Incorrect Answers
B:Instrumented execution shows whether the vulnerable path was exercised. It tests iast, while this case requires evidence about secret scanning.
C:Attempt use of the revoked test token and verify rejection plus clean history review. Revocation validation proves the credential is no longer usable.
D:Copies can survive in history and logs. Attempt use of the revoked test token and verify rejection plus clean history review.
Question 571
After a prior repositories finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Enforce protected branches, signed or attributable changes and separation of approval from deployment.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Attempt a test direct force-push without reviewer approval and confirm rejection
- Accept a signed change ticket saying: Enforce protected branches, signed or attributable changes and separation of approval from deployment
- Use the completion of this alternative as proof: Rely on a verbal agreement not to bypass reviews
- Run this adjacent but different test as the sole proof: Test a known vulnerable staging endpoint and verify dynamic detection and safe cleanup
Explanation
Correct Answer
A:A negative workflow test demonstrates branch protection.
Incorrect Answers
B:Attempt a test direct force-push without reviewer approval and confirm rejection. A negative workflow test demonstrates branch protection.
C:Informal trust does not enforce policy. Attempt a test direct force-push without reviewer approval and confirm rejection.
D:Observed runtime findings validate the deployed-path scanner. It tests dast, while this case requires evidence about repositories.
Question 572
After a prior ci/cd finding, an international retailer reports that the approved safeguard is implemented: “Use ephemeral workload identity, protected branches and narrowly scoped deployment permissions.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Attempt a test direct force-push without reviewer approval and confirm rejection
- Accept a signed change ticket saying: Use ephemeral workload identity, protected branches and narrowly scoped deployment permissions
- Execute a test from an untrusted branch and confirm it cannot obtain deployment credentials
- Use the completion of this alternative as proof: Store root API keys in repository variables
Explanation
Correct Answer
C:Negative credential access validates branch and workload boundaries.
Incorrect Answers
A:A negative workflow test demonstrates branch protection. It tests repositories, while this case requires evidence about ci/cd.
B:Execute a test from an untrusted branch and confirm it cannot obtain deployment credentials. Negative credential access validates branch and workload boundaries.
D:Encrypted-at-rest storage does not eliminate overly privileged use. Execute a test from an untrusted branch and confirm it cannot obtain deployment credentials.
Question 573
After a prior dependencies finding, a university consortium reports that the approved safeguard is implemented: “Maintain a version inventory or SBOM and a risk-based vulnerable-dependency remediation workflow.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Maintain a version inventory or SBOM and a risk-based vulnerable-dependency remediation workflow
- Run this adjacent but different test as the sole proof: Attempt a test direct force-push without reviewer approval and confirm rejection
- Use the completion of this alternative as proof: Assume compile success proves all dependencies safe
- Introduce a known vulnerable test component and confirm inventory detection and patch workflow
Explanation
Correct Answer
D:A seeded dependency test exercises the supply-chain control.
Incorrect Answers
A:Introduce a known vulnerable test component and confirm inventory detection and patch workflow. A seeded dependency test exercises the supply-chain control.
B:A negative workflow test demonstrates branch protection. It tests repositories, while this case requires evidence about dependencies.
C:A working build may contain vulnerable libraries. Introduce a known vulnerable test component and confirm inventory detection and patch workflow.
Question 574
After a prior sast finding, a cloud service provider reports that the approved safeguard is implemented: “Run static application security analysis on source or build artifacts and review findings.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Run static application security analysis on source or build artifacts and review findings
- Run this adjacent but different test as the sole proof: Introduce a known vulnerable test component and confirm inventory detection and patch workflow
- Use the completion of this alternative as proof: Use only an external uptime monitor
- Seed a test unsafe data flow and confirm scanner detection plus triage
Explanation
Correct Answer
D:A known test defect checks SAST effectiveness.
Incorrect Answers
A:Seed a test unsafe data flow and confirm scanner detection plus triage. A known test defect checks SAST effectiveness.
B:A seeded dependency test exercises the supply-chain control. It tests dependencies, while this case requires evidence about sast.
C:Availability probes do not find insecure data flow. Seed a test unsafe data flow and confirm scanner detection plus triage.
Question 575
A software security program counts scanner alerts but has no measure of whether vulnerabilities reach production. Which response best addresses the central security requirement with a defensible, risk-based design?
- Measure relevant outcomes such as escaping critical defects, fix time and validated recurrence
- Treat alert count alone as a measure of protection
- Have a qualified assessor retest the original exploit path and potential variants
- Stop measuring to avoid negative trends
Explanation
Correct Answer
A:Operational outcomes better express effectiveness than raw tool volume.
Incorrect Answers
B:More scanning can increase counts even as risk falls.
C:Ticket closure alone does not prove that access control works. Measure relevant outcomes such as escaping critical defects, fix time and validated recurrence.
D:Without evidence progress is unknowable.
Question 576
A penetration test found an authorization bypass and developers marked the ticket fixed without independent retest. Which response best addresses the central security requirement with a defensible, risk-based design?
- Trace the change through source commits, build provenance, approvals and runtime configuration
- Remove the finding from the report without evidence
- Have a qualified assessor retest the original exploit path and potential variants
- Accept the developer's message as final independent assurance
Explanation
Correct Answer
C:Ticket closure alone does not prove that access control works.
Incorrect Answers
A:A trustworthy release audit ties effective behavior to an authorized change. Have a qualified assessor retest the original exploit path and potential variants.
B:Unsubstantiated closure misleads stakeholders.
D:Self-report may overlook incomplete fixes.
Question 577
A product owner asks developers to ship an unresolved critical vulnerability to meet a market date. Which response best addresses the central security requirement with a defensible, risk-based design?
- Route residual risk to a properly empowered business owner with documented consequences and conditions
- Let the developer silently accept the risk
- Have a qualified assessor retest the original exploit path and potential variants
- Record approval from anyone willing to sign
Explanation
Correct Answer
A:Security testers identify risk; accountable owners decide tolerance within governance.
Incorrect Answers
B:Implementation responsibility is not risk ownership.
C:Ticket closure alone does not prove that access control works. Route residual risk to a properly empowered business owner with documented consequences and conditions.
D:Decision authority matters.
Question 578
A deployed application suddenly permits a privilege not present in its approved release notes. Which response best addresses the central security requirement with a defensible, risk-based design?
- Have a qualified assessor retest the original exploit path and potential variants
- Assume all production changes were approved because CI completed
- Trace the change through source commits, build provenance, approvals and runtime configuration
- Delete deployment logs to reduce storage
Explanation
Correct Answer
C:A trustworthy release audit ties effective behavior to an authorized change.
Incorrect Answers
A:Ticket closure alone does not prove that access control works. Trace the change through source commits, build provenance, approvals and runtime configuration.
B:CI can run on unapproved changes.
D:Missing evidence impedes attribution.
Question 579
After a prior security metrics finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Measure relevant outcomes such as escaping critical defects, fix time and validated recurrence.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Inspect written acceptance authority, expiry, mitigation and stakeholder notification
- Use the completion of this alternative as proof: Treat alert count alone as a measure of protection
- Accept a signed change ticket saying: Measure relevant outcomes such as escaping critical defects, fix time and validated recurrence
- Correlate release findings with production incidents and time-to-fix over several releases
Explanation
Correct Answer
D:Longitudinal data tests whether security posture improves.
Incorrect Answers
A:Governed evidence distinguishes accepted residual risk from neglect. It tests risk acceptance, while this case requires evidence about security metrics.
B:More scanning can increase counts even as risk falls. Correlate release findings with production incidents and time-to-fix over several releases.
C:Correlate release findings with production incidents and time-to-fix over several releases. Longitudinal data tests whether security posture improves.
Question 580
After a prior pen test results finding, an international retailer reports that the approved safeguard is implemented: “Have a qualified assessor retest the original exploit path and potential variants.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Re-run the proof-of-concept safely and confirm blocked unauthorized access
- Run this adjacent but different test as the sole proof: Inspect written acceptance authority, expiry, mitigation and stakeholder notification
- Use the completion of this alternative as proof: Accept the developer's message as final independent assurance
- Accept a signed change ticket saying: Have a qualified assessor retest the original exploit path and potential variants
Explanation
Correct Answer
A:Direct negative testing proves the remedied boundary.
Incorrect Answers
B:Governed evidence distinguishes accepted residual risk from neglect. It tests risk acceptance, while this case requires evidence about pen test results.
C:Self-report may overlook incomplete fixes. Re-run the proof-of-concept safely and confirm blocked unauthorized access.
D:Re-run the proof-of-concept safely and confirm blocked unauthorized access. Direct negative testing proves the remedied boundary.
Certified Information Systems Security Professional (CISSP) Practice Tests