Question 60
After a prior employment agreement finding, an international retailer reports that the approved safeguard is implemented: “Require signed confidentiality and acceptable-use commitments as part of onboarding.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Inspect signed agreements and evidence of required security briefing
- Use the completion of this alternative as proof: Assume verbal onboarding supersedes all contractual duties
- Accept a signed change ticket saying: Require signed confidentiality and acceptable-use commitments as part of onboarding
- Run this adjacent but different test as the sole proof: Review screening completion and approved access prerequisite evidence
Explanation
Correct Answer
A:Acknowledgments tie role privileges to known obligations.
Incorrect Answers
B:Unrecorded promises are unreliable and insufficient governance. Inspect signed agreements and evidence of required security briefing.
C:Inspect signed agreements and evidence of required security briefing. Acknowledgments tie role privileges to known obligations.
D:Pre-access verification protects sensitive roles while respecting legal limits. It tests screening, while this case requires evidence about employment agreement.
Question 61
A public API has a known exploitable flaw but the review reports only that a threat actor exists. Which response best addresses the central security requirement with a defensible, risk-based design?
- Model risk as an adversarial threat exploiting a specific vulnerability in a valuable asset
- Count every threat feed entry as a confirmed vulnerability
- Classify all unpatched software as confirmed active compromise
- Transfer eligible financial impact while separately treating or accepting remaining operational risk
Explanation
Correct Answer
A:Threat, weakness and business impact are distinct parts of a risk scenario.
Incorrect Answers
B:Threat intelligence does not prove local exploitable weakness.
C:Exposure and an observed incident are different facts.
D:Insurance does not transfer accountability or remove all cyber exposures. Model risk as an adversarial threat exploiting a specific vulnerability in a valuable asset.
Question 62
A board is comparing a rare catastrophic outage with frequent minor service errors. Which response best addresses the central security requirement with a defensible, risk-based design?
- Transfer eligible financial impact while separately treating or accepting remaining operational risk
- Rank risks by headline severity only
- Rank risks by event count only
- Evaluate both estimated likelihood and business impact against defined appetite
Explanation
Correct Answer
D:A high frequency does not automatically create the highest risk without consequence.
Incorrect Answers
A:Insurance does not transfer accountability or remove all cyber exposures. Evaluate both estimated likelihood and business impact against defined appetite.
B:Impact without plausible likelihood can distort priorities.
C:Frequency ignores the size of potential loss.
Question 63
A business wants monetary annual loss estimates for a repeatable equipment incident. Which response best addresses the central security requirement with a defensible, risk-based design?
- Test design suitability and operational effectiveness against actual risk scenarios
- Multiply equipment purchase price by employee headcount
- Call a color-coded heatmap a precise monetary loss model
- Use credible single-loss and annual-occurrence inputs to estimate annualized loss exposure
Explanation
Correct Answer
D:Quantitative assessment depends on supportable loss and frequency assumptions.
Incorrect Answers
A:Control purchase or deployment alone is not proof of risk reduction. Use credible single-loss and annual-occurrence inputs to estimate annualized loss exposure.
B:An arbitrary multiplier is not estimated impact times frequency.
C:Qualitative categories do not produce defensible dollar values.
Question 64
An insurer will cover a portion of cyber losses but a residual operational outage remains. Which response best addresses the central security requirement with a defensible, risk-based design?
- Transfer eligible financial impact while separately treating or accepting remaining operational risk
- Report business impact, trend, appetite exceptions and recommended actions at executive level
- Declare the entire technical risk eliminated by insurance
- Avoid risk by doing nothing to a critical process
Explanation
Correct Answer
A:Insurance does not transfer accountability or remove all cyber exposures.
Incorrect Answers
B:Risk reporting translates technical findings into actionable business decisions. Transfer eligible financial impact while separately treating or accepting remaining operational risk.
C:Coverage cannot prevent service disruption or uninsurable harm.
D:Avoidance means discontinuing the exposure-generating activity, not neglect.
Question 65
A security control was purchased but no one has verified its intended threat is blocked. Which response best addresses the central security requirement with a defensible, risk-based design?
- Report business impact, trend, appetite exceptions and recommended actions at executive level
- Accept a vendor product brochure as operational evidence
- Count license seats instead of prevented attack paths
- Test design suitability and operational effectiveness against actual risk scenarios
Explanation
Correct Answer
D:Control purchase or deployment alone is not proof of risk reduction.
Incorrect Answers
A:Risk reporting translates technical findings into actionable business decisions. Test design suitability and operational effectiveness against actual risk scenarios.
B:Marketing claims are not actual local control tests.
C:Adoption metrics may not measure effectiveness.
Question 66
A board asks for a decision on cyber exposure rather than a 90-page vulnerability list. Which response best addresses the central security requirement with a defensible, risk-based design?
- Hide all uncertainty and residual risks
- Report business impact, trend, appetite exceptions and recommended actions at executive level
- Evaluate both estimated likelihood and business impact against defined appetite
- Send only raw CVE identifiers
Explanation
Correct Answer
B:Risk reporting translates technical findings into actionable business decisions.
Incorrect Answers
A:False certainty prevents informed ownership.
C:A high frequency does not automatically create the highest risk without consequence. Report business impact, trend, appetite exceptions and recommended actions at executive level.
D:Technical labels alone cannot support executive prioritization.
Question 67
After a prior threat and vulnerability finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Model risk as an adversarial threat exploiting a specific vulnerability in a valuable asset.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Validate asset exposure, vulnerability, threat capability and possible impact together
- Accept a signed change ticket saying: Model risk as an adversarial threat exploiting a specific vulnerability in a valuable asset
- Use the completion of this alternative as proof: Count every threat feed entry as a confirmed vulnerability
- Run this adjacent but different test as the sole proof: Execute safe positive and negative tests under the deployed configuration
Explanation
Correct Answer
A:A complete scenario supports meaningful prioritization.
Incorrect Answers
B:Validate asset exposure, vulnerability, threat capability and possible impact together. A complete scenario supports meaningful prioritization.
C:Threat intelligence does not prove local exploitable weakness. Validate asset exposure, vulnerability, threat capability and possible impact together.
D:Observed control behavior establishes effectiveness. It tests control assessment, while this case requires evidence about threat and vulnerability.
Question 68
After a prior risk likelihood impact finding, an international retailer reports that the approved safeguard is implemented: “Evaluate both estimated likelihood and business impact against defined appetite.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Check policy exclusions and authorized residual-risk acceptance after transfer
- Accept a signed change ticket saying: Evaluate both estimated likelihood and business impact against defined appetite
- Show assumptions, loss ranges and relative risk ranking to the accountable owner
- Use the completion of this alternative as proof: Rank risks by event count only
Explanation
Correct Answer
C:Explicit uncertainty allows business decisions.
Incorrect Answers
A:Documented residual exposure prevents false zero-risk claims. It tests risk treatment, while this case requires evidence about risk likelihood impact.
B:Show assumptions, loss ranges and relative risk ranking to the accountable owner. Explicit uncertainty allows business decisions.
D:Frequency ignores the size of potential loss. Show assumptions, loss ranges and relative risk ranking to the accountable owner.
Question 69
After a prior qualitative/quantitative finding, a university consortium reports that the approved safeguard is implemented: “Use credible single-loss and annual-occurrence inputs to estimate annualized loss exposure.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Call a color-coded heatmap a precise monetary loss model
- Accept a signed change ticket saying: Use credible single-loss and annual-occurrence inputs to estimate annualized loss exposure
- Recalculate annualized loss from documented SLE and ARO inputs
- Run this adjacent but different test as the sole proof: Obtain an explicit decision with documented assumptions and risk owner
Explanation
Correct Answer
C:Reproducible numbers allow challenge of quantitative assumptions.
Incorrect Answers
A:Qualitative categories do not produce defensible dollar values. Recalculate annualized loss from documented SLE and ARO inputs.
B:Recalculate annualized loss from documented SLE and ARO inputs. Reproducible numbers allow challenge of quantitative assumptions.
D:A defensible decision is the purpose of board reporting. It tests reporting, while this case requires evidence about qualitative/quantitative.
Question 70
A regional bank faces rare but catastrophic cyber losses and proposes treating the quantified expected loss as permission to ignore safety laws. Which response best addresses the central security requirement with a defensible, risk-based design?
- Accept risk automatically because its annualized expected loss is small
- Evaluate both estimated likelihood and business impact against defined appetite
- Transfer all accountability to an insurer by buying a policy
- Evaluate legal hard constraints, tail impact and risk appetite before approving any acceptance decision
Explanation
Correct Answer
D:Expected-value calculations do not override non-negotiable compliance or intolerable consequences.
Incorrect Answers
A:Average loss can hide extreme outcomes and regulatory obligations.
B:A high frequency does not automatically create the highest risk without consequence. Evaluate legal hard constraints, tail impact and risk appetite before approving any acceptance decision.
C:Insurance cannot remove regulatory duty or prevent human harm.
Certified Information Systems Security Professional (CISSP) Practice Tests