Question 50
After a prior critical process dependencies finding, a payment-services company reports that the approved safeguard is implemented: “Map and include upstream service, supplier and infrastructure dependencies in recovery planning.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run an end-to-end business transaction test under simulated dependency failure
- Accept a signed change ticket saying: Map and include upstream service, supplier and infrastructure dependencies in recovery planning
- Run this adjacent but different test as the sole proof: Check the BIA's maximum tolerable outage against tested RTO and dependent process recovery
- Use the completion of this alternative as proof: Restore only the main application binary
Explanation
Correct Answer
A:Transaction success proves the process chain is viable.
Incorrect Answers
B:Run an end-to-end business transaction test under simulated dependency failure. Transaction success proves the process chain is viable.
C:A valid plan maintains recovery before intolerable impact. It tests mao, while this case requires evidence about critical process dependencies.
D:Software restoration omits dependent identity, network and data services. Run an end-to-end business transaction test under simulated dependency failure.
Question 51
After a prior rto finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Define a 45-minute recovery time objective and test full application restoration against it.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Time a full failover from outage declaration to usable service
- Use the completion of this alternative as proof: Treat 45 minutes as the allowable data-loss window
- Accept a signed change ticket saying: Define a 45-minute recovery time objective and test full application restoration against it
- Run this adjacent but different test as the sole proof: Run an end-to-end business transaction test under simulated dependency failure
Explanation
Correct Answer
A:Measured restoration duration tests RTO directly.
Incorrect Answers
B:That is RPO, which measures data recency. Time a full failover from outage declaration to usable service.
C:Time a full failover from outage declaration to usable service. Measured restoration duration tests RTO directly.
D:Transaction success proves the process chain is viable. It tests critical process dependencies, while this case requires evidence about rto.
Question 52
After a prior rpo finding, an international retailer reports that the approved safeguard is implemented: “Design replication and recovery points to meet a five-minute recovery point objective.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Promise to restart servers within five minutes without data replication
- Accept a signed change ticket saying: Design replication and recovery points to meet a five-minute recovery point objective
- Compare the latest recoverable committed state with the failure moment during a test
- Run this adjacent but different test as the sole proof: Time a full failover from outage declaration to usable service
Explanation
Correct Answer
C:Measured recoverable-data age validates RPO.
Incorrect Answers
A:Fast restart can still lose hours of data. Compare the latest recoverable committed state with the failure moment during a test.
B:Compare the latest recoverable committed state with the failure moment during a test. Measured recoverable-data age validates RPO.
D:Measured restoration duration tests RTO directly. It tests rto, while this case requires evidence about rpo.
Question 53
A vendor technician will receive privileged access to payment systems before the employer verifies identity and qualifications. Which response best addresses the central security requirement with a defensible, risk-based design?
- Apply intrusive checks without lawful basis to every applicant
- Grant administrator access and investigate credentials later
- Provide time-limited, sponsor-approved contractor access with periodic review and rapid expiry
- Apply lawful role-based background screening and verification before granting privileged access
Explanation
Correct Answer
D:Personnel screening should be proportional to role sensitivity and applicable privacy law.
Incorrect Answers
A:Screening must be lawful and risk-proportionate.
B:Delayed vetting leaves an immediate exposure window.
C:Nonemployee privileges should track a sponsor, scope and contract lifecycle. Apply lawful role-based background screening and verification before granting privileged access.
Question 54
A contractor joins a team handling proprietary product plans. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assume verbal onboarding supersedes all contractual duties
- Require signed confidentiality and acceptable-use commitments as part of onboarding
- Give repository access without stating information responsibilities
- Revoke obsolete entitlements and grant only new-role access during the mover workflow
Explanation
Correct Answer
B:Documented employee/contractor duties clarify permitted information handling.
Incorrect Answers
A:Unrecorded promises are unreliable and insufficient governance.
C:Access grants alone do not establish enforceable expectations.
D:Role changes must remove prior access, not merely add new grants. Require signed confidentiality and acceptable-use commitments as part of onboarding.
Question 55
A new privileged operator receives production access before completing training and approval. Which response best addresses the central security requirement with a defensible, risk-based design?
- Leave temporary onboarding access with no expiration
- Revoke obsolete entitlements and grant only new-role access during the mover workflow
- Clone an existing administrator's full privileges
- Require identity validation, role owner approval and role-specific security induction before access
Explanation
Correct Answer
D:Joiner controls should authorize necessary privileges only after prerequisites.
Incorrect Answers
A:Unbounded interim rights create lingering privilege.
B:Role changes must remove prior access, not merely add new grants. Require identity validation, role owner approval and role-specific security induction before access.
C:Role copying can import unrelated permissions.
Question 56
An engineer moves from payroll administration into network operations but retains salary database rights. Which response best addresses the central security requirement with a defensible, risk-based design?
- Require signed confidentiality and acceptable-use commitments as part of onboarding
- Add network rights while retaining payroll access indefinitely
- Delay removal until annual audit
- Revoke obsolete entitlements and grant only new-role access during the mover workflow
Explanation
Correct Answer
D:Role changes must remove prior access, not merely add new grants.
Incorrect Answers
A:Documented employee/contractor duties clarify permitted information handling. Revoke obsolete entitlements and grant only new-role access during the mover workflow.
B:Privilege accumulation violates least privilege.
C:A long review gap permits unnecessary access.
Question 57
A terminated employee retains VPN sessions and API tokens after directory account disablement. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rotate only the employee's desk PIN
- Coordinate prompt account disablement with token/session revocation and asset recovery
- Revoke obsolete entitlements and grant only new-role access during the mover workflow
- Disable only email while leaving VPN and APIs active
Explanation
Correct Answer
B:Offboarding must remove independent active sessions and credentials, not only one directory entry.
Incorrect Answers
A:Physical access change does not revoke remote tokens.
C:Role changes must remove prior access, not merely add new grants. Coordinate prompt account disablement with token/session revocation and asset recovery.
D:Email access is not the only authentication path.
Question 58
A temporary consultant's privileged role has no end date and survives project completion. Which response best addresses the central security requirement with a defensible, risk-based design?
- Grant permanent shared admin credentials to the consultant
- Provide time-limited, sponsor-approved contractor access with periodic review and rapid expiry
- Require identity validation, role owner approval and role-specific security induction before access
- Treat the vendor master agreement as ongoing individual authorization
Explanation
Correct Answer
B:Nonemployee privileges should track a sponsor, scope and contract lifecycle.
Incorrect Answers
A:Shared permanent rights prevent reliable ownership and revocation.
C:Joiner controls should authorize necessary privileges only after prerequisites. Provide time-limited, sponsor-approved contractor access with periodic review and rapid expiry.
D:A contract does not prove current project need for each user.
Question 59
After a prior screening finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Apply lawful role-based background screening and verification before granting privileged access.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Review screening completion and approved access prerequisite evidence
- Use the completion of this alternative as proof: Grant administrator access and investigate credentials later
- Run this adjacent but different test as the sole proof: Confirm expiry, sponsor recertification and prompt removal at contract end
- Accept a signed change ticket saying: Apply lawful role-based background screening and verification before granting privileged access
Explanation
Correct Answer
A:Pre-access verification protects sensitive roles while respecting legal limits.
Incorrect Answers
B:Delayed vetting leaves an immediate exposure window. Review screening completion and approved access prerequisite evidence.
C:Lifecycle tests reduce stale third-party privileges. It tests contractors, while this case requires evidence about screening.
D:Review screening completion and approved access prerequisite evidence. Pre-access verification protects sensitive roles while respecting legal limits.
Question 60
After a prior employment agreement finding, an international retailer reports that the approved safeguard is implemented: “Require signed confidentiality and acceptable-use commitments as part of onboarding.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Inspect signed agreements and evidence of required security briefing
- Use the completion of this alternative as proof: Assume verbal onboarding supersedes all contractual duties
- Accept a signed change ticket saying: Require signed confidentiality and acceptable-use commitments as part of onboarding
- Run this adjacent but different test as the sole proof: Review screening completion and approved access prerequisite evidence
Explanation
Correct Answer
A:Acknowledgments tie role privileges to known obligations.
Incorrect Answers
B:Unrecorded promises are unreliable and insufficient governance. Inspect signed agreements and evidence of required security briefing.
C:Inspect signed agreements and evidence of required security briefing. Acknowledgments tie role privileges to known obligations.
D:Pre-access verification protects sensitive roles while respecting legal limits. It tests screening, while this case requires evidence about employment agreement.
Certified Information Systems Security Professional (CISSP) Practice Tests