Question 580
After a prior pen test results finding, an international retailer reports that the approved safeguard is implemented: “Have a qualified assessor retest the original exploit path and potential variants.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Re-run the proof-of-concept safely and confirm blocked unauthorized access
- Run this adjacent but different test as the sole proof: Inspect written acceptance authority, expiry, mitigation and stakeholder notification
- Use the completion of this alternative as proof: Accept the developer's message as final independent assurance
- Accept a signed change ticket saying: Have a qualified assessor retest the original exploit path and potential variants
Explanation
Correct Answer
A:Direct negative testing proves the remedied boundary.
Incorrect Answers
B:Governed evidence distinguishes accepted residual risk from neglect. It tests risk acceptance, while this case requires evidence about pen test results.
C:Self-report may overlook incomplete fixes. Re-run the proof-of-concept safely and confirm blocked unauthorized access.
D:Re-run the proof-of-concept safely and confirm blocked unauthorized access. Direct negative testing proves the remedied boundary.
Question 581
After a prior risk acceptance finding, a university consortium reports that the approved safeguard is implemented: “Route residual risk to a properly empowered business owner with documented consequences and conditions.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Inspect written acceptance authority, expiry, mitigation and stakeholder notification
- Run this adjacent but different test as the sole proof: Re-run the proof-of-concept safely and confirm blocked unauthorized access
- Accept a signed change ticket saying: Route residual risk to a properly empowered business owner with documented consequences and conditions
- Use the completion of this alternative as proof: Let the developer silently accept the risk
Explanation
Correct Answer
A:Governed evidence distinguishes accepted residual risk from neglect.
Incorrect Answers
B:Direct negative testing proves the remedied boundary. It tests pen test results, while this case requires evidence about risk acceptance.
C:Inspect written acceptance authority, expiry, mitigation and stakeholder notification. Governed evidence distinguishes accepted residual risk from neglect.
D:Implementation responsibility is not risk ownership. Inspect written acceptance authority, expiry, mitigation and stakeholder notification.
Question 582
After a prior change audit finding, a cloud service provider reports that the approved safeguard is implemented: “Trace the change through source commits, build provenance, approvals and runtime configuration.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Assume all production changes were approved because CI completed
- Reconcile one production privilege with its signed change and reviewer record
- Run this adjacent but different test as the sole proof: Re-run the proof-of-concept safely and confirm blocked unauthorized access
- Accept a signed change ticket saying: Trace the change through source commits, build provenance, approvals and runtime configuration
Explanation
Correct Answer
B:Traceability reveals unauthorized drift.
Incorrect Answers
A:CI can run on unapproved changes. Reconcile one production privilege with its signed change and reviewer record.
C:Direct negative testing proves the remedied boundary. It tests pen test results, while this case requires evidence about change audit.
D:Reconcile one production privilege with its signed change and reviewer record. Traceability reveals unauthorized drift.
Question 583
A vendor packages a closed-source security tool but refuses to disclose patch support and vulnerability reporting channels. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assume closed source is automatically secure
- Include supplier maintenance, incident notification and assurance requirements in the procurement decision
- Ignore vendor support end dates until failure
- Assess license obligations and distribution model before approving the dependency
Explanation
Correct Answer
B:Security of purchased software depends on ongoing vendor obligations.
Incorrect Answers
A:Opacity is not evidence of assurance.
C:Unsupported components accumulate exposure.
D:Software licenses can impose duties independent of runtime security. Include supplier maintenance, incident notification and assurance requirements in the procurement decision.
Question 584
A SaaS platform stores customer data but the buyer assumes the provider controls every identity and data-export risk. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assume the provider's uptime promise covers customer authorization
- Obtain appropriately scoped assurance and evaluate material findings, residual risk and contract obligations
- Omit data-export planning because the service is hosted
- Document shared security responsibilities, data flows, identity integrations and contractual exit needs
Explanation
Correct Answer
D:Buying SaaS does not transfer all customer governance duties.
Incorrect Answers
A:Availability and access management differ.
B:A claim without reviewed evidence is weak assurance. Document shared security responsibilities, data flows, identity integrations and contractual exit needs.
C:Vendor lock-in affects confidentiality and continuity.
Question 585
A software supplier uses subcontractors with privileged access to customer support data. Which response best addresses the central security requirement with a defensible, risk-based design?
- Allow indefinite shared access to all support contractors
- Require subprocessor visibility, bounded access and flow-down security contract obligations
- Trust the original supplier NDA as complete subcontractor control
- Assess license obligations and distribution model before approving the dependency
Explanation
Correct Answer
B:Third-party chains can extend exposure beyond the primary provider.
Incorrect Answers
A:Persistent broad credentials exceed need.
C:NDA alone does not restrict every subcontractor.
D:Software licenses can impose duties independent of runtime security. Require subprocessor visibility, bounded access and flow-down security contract obligations.
Question 586
A product accepts an unmaintained cryptographic library from a public repository because its license is permissive. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use only the license name to approve cryptographic strength
- Treat a popular star count as technical assurance
- Assess license obligations and distribution model before approving the dependency
- Assess maintainership, provenance, vulnerability exposure and replacement options before adoption
Explanation
Correct Answer
D:Legal permission to use code does not establish ongoing security fitness.
Incorrect Answers
A:Licensing does not validate algorithms.
B:Popularity can coexist with vulnerabilities.
C:Software licenses can impose duties independent of runtime security. Assess maintainership, provenance, vulnerability exposure and replacement options before adoption.
Question 587
A developer copies a strong-copyleft library into a proprietary binary without legal review. Which response best addresses the central security requirement with a defensible, risk-based design?
- Hide the library in a minified bundle
- Assume open source means no obligations
- Assess license obligations and distribution model before approving the dependency
- Require subprocessor visibility, bounded access and flow-down security contract obligations
Explanation
Correct Answer
C:Software licenses can impose duties independent of runtime security.
Incorrect Answers
A:Concealment does not remove license obligations.
B:Open-source licenses set conditions.
D:Third-party chains can extend exposure beyond the primary provider. Assess license obligations and distribution model before approving the dependency.
Question 588
A commercial application provider claims annual penetration tests but supplies no scope or remediation evidence. Which response best addresses the central security requirement with a defensible, risk-based design?
- Require only a vendor sales promise of security
- Obtain appropriately scoped assurance and evaluate material findings, residual risk and contract obligations
- Assess maintainership, provenance, vulnerability exposure and replacement options before adoption
- Treat a marketing badge as sufficient assurance
Explanation
Correct Answer
B:A claim without reviewed evidence is weak assurance.
Incorrect Answers
A:Promises do not prove control operation.
C:Legal permission to use code does not establish ongoing security fitness. Obtain appropriately scoped assurance and evaluate material findings, residual risk and contract obligations.
D:Badges can omit critical scope.
Question 589
A proprietary desktop client cannot be patched quickly because the supplier offers only major annual releases. Which response best addresses the central security requirement with a defensible, risk-based design?
- Disable endpoint monitoring to preserve compatibility
- Evaluate compensating isolation, vendor update commitments and exit strategy before deploying widely
- Obtain appropriately scoped assurance and evaluate material findings, residual risk and contract obligations
- Assume proprietary license fees guarantee timely patches
Explanation
Correct Answer
B:Long vulnerability windows may exceed the organization's tolerance.
Incorrect Answers
A:Reduced monitoring increases risk.
C:A claim without reviewed evidence is weak assurance. Evaluate compensating isolation, vendor update commitments and exit strategy before deploying widely.
D:Payment does not define patch obligations.
Question 590
A team enables external sharing by default on a newly purchased document SaaS without identity governance review. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assess maintainership, provenance, vulnerability exposure and replacement options before adoption
- Configure secure defaults, centralized identity lifecycle, audit retention and approved sharing scope
- Turn off all auditing because the vendor logs elsewhere
- Assume vendor network security prevents public link sharing
Explanation
Correct Answer
B:SaaS baseline configuration is a customer responsibility in many service models.
Incorrect Answers
A:Legal permission to use code does not establish ongoing security fitness. Configure secure defaults, centralized identity lifecycle, audit retention and approved sharing scope.
C:Loss of customer evidence harms response.
D:Transport security does not authorize document recipients.
Certified Information Systems Security Professional (CISSP) Practice Tests