Question 70
A regional bank faces rare but catastrophic cyber losses and proposes treating the quantified expected loss as permission to ignore safety laws. Which response best addresses the central security requirement with a defensible, risk-based design?
- Accept risk automatically because its annualized expected loss is small
- Evaluate both estimated likelihood and business impact against defined appetite
- Transfer all accountability to an insurer by buying a policy
- Evaluate legal hard constraints, tail impact and risk appetite before approving any acceptance decision
Explanation
Correct Answer
D:Expected-value calculations do not override non-negotiable compliance or intolerable consequences.
Incorrect Answers
A:Average loss can hide extreme outcomes and regulatory obligations.
B:A high frequency does not automatically create the highest risk without consequence. Evaluate legal hard constraints, tail impact and risk appetite before approving any acceptance decision.
C:Insurance cannot remove regulatory duty or prevent human harm.
Question 71
After a prior control assessment finding, a regulated financial institution reports that the approved safeguard is implemented: “Test design suitability and operational effectiveness against actual risk scenarios.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Execute safe positive and negative tests under the deployed configuration
- Accept a signed change ticket saying: Test design suitability and operational effectiveness against actual risk scenarios
- Use the completion of this alternative as proof: Accept a vendor product brochure as operational evidence
- Run this adjacent but different test as the sole proof: Validate asset exposure, vulnerability, threat capability and possible impact together
Explanation
Correct Answer
A:Observed control behavior establishes effectiveness.
Incorrect Answers
B:Execute safe positive and negative tests under the deployed configuration. Observed control behavior establishes effectiveness.
C:Marketing claims are not actual local control tests. Execute safe positive and negative tests under the deployed configuration.
D:A complete scenario supports meaningful prioritization. It tests threat and vulnerability, while this case requires evidence about control assessment.
Question 72
After a prior reporting finding, a global logistics firm reports that the approved safeguard is implemented: “Report business impact, trend, appetite exceptions and recommended actions at executive level.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Send only raw CVE identifiers
- Accept a signed change ticket saying: Report business impact, trend, appetite exceptions and recommended actions at executive level
- Run this adjacent but different test as the sole proof: Validate asset exposure, vulnerability, threat capability and possible impact together
- Obtain an explicit decision with documented assumptions and risk owner
Explanation
Correct Answer
D:A defensible decision is the purpose of board reporting.
Incorrect Answers
A:Technical labels alone cannot support executive prioritization. Obtain an explicit decision with documented assumptions and risk owner.
B:Obtain an explicit decision with documented assumptions and risk owner. A defensible decision is the purpose of board reporting.
C:A complete scenario supports meaningful prioritization. It tests threat and vulnerability, while this case requires evidence about reporting.
Question 73
An incident review documented this threat and vulnerability exposure: A public API has a known exploitable flaw but the review reports only that a threat actor exists. The response team proposed only “Count every threat feed entry as a confirmed vulnerability” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Avoidance means discontinuing the exposure-generating activity, not neglect.
- Qualitative categories do not produce defensible dollar values.
- Threat intelligence does not prove local exploitable weakness.
- Exposure and an observed incident are different facts.
Explanation
Correct Answer
C:Threat intelligence does not prove local exploitable weakness. The missing change involves threat intelligence does not prove local exploitable weakness.
Incorrect Answers
A:Avoidance means discontinuing the exposure-generating activity, not neglect. The actual criticized measure is threat intelligence does not prove local exploitable weakness.
B:Qualitative categories do not produce defensible dollar values. That does not establish threat intelligence does not prove local exploitable weakness.
D:Exposure and an observed incident are different facts. The actual criticized measure is threat intelligence does not prove local exploitable weakness.
Question 74
An incident review documented this risk likelihood impact exposure: A board is comparing a rare catastrophic outage with frequent minor service errors. The response team proposed only “Rank risks by event count only” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Frequency ignores the size of potential loss.
- Impact without plausible likelihood can distort priorities.
- Exposure and an observed incident are different facts.
- Technical labels alone cannot support executive prioritization.
Explanation
Correct Answer
A:Frequency ignores the size of potential loss. The missing change involves frequency ignores the size of potential loss.
Incorrect Answers
B:Impact without plausible likelihood can distort priorities. The actual criticized measure is frequency ignores the size of potential loss.
C:Exposure and an observed incident are different facts. The actual criticized measure is frequency ignores the size of potential loss.
D:Technical labels alone cannot support executive prioritization. That does not establish frequency ignores the size of potential loss.
Question 75
An incident review documented this qualitative/quantitative exposure: A business wants monetary annual loss estimates for a repeatable equipment incident. The response team proposed only “Call a color-coded heatmap a precise monetary loss model” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Avoidance means discontinuing the exposure-generating activity, not neglect.
- Frequency ignores the size of potential loss.
- Qualitative categories do not produce defensible dollar values.
- An arbitrary multiplier is not estimated impact times frequency.
Explanation
Correct Answer
C:Qualitative categories do not produce defensible dollar values. The missing change involves qualitative categories do not produce defensible dollar values.
Incorrect Answers
A:Avoidance means discontinuing the exposure-generating activity, not neglect. The actual criticized measure is qualitative categories do not produce defensible dollar values.
B:Frequency ignores the size of potential loss. That does not establish qualitative categories do not produce defensible dollar values.
D:An arbitrary multiplier is not estimated impact times frequency. The actual criticized measure is qualitative categories do not produce defensible dollar values.
Question 76
A design team wants a systematic way to brainstorm identity spoofing and data tampering against a new API. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use only an asset depreciation report
- Treat STRIDE as a penetration tool that exploits vulnerabilities automatically
- Apply STRIDE categories to data flows and trust boundaries during threat modeling
- Write concrete attacker scenarios with entry points, trust boundaries and business consequences
Explanation
Correct Answer
C:STRIDE helps organize spoofing, tampering, repudiation, disclosure, denial and elevation threats.
Incorrect Answers
A:Financial inventory does not model adversarial behavior.
B:A threat taxonomy is not an automated exploit scanner.
D:Realistic threat scenarios connect exploit behavior with impact and defenses. Apply STRIDE categories to data flows and trust boundaries during threat modeling.
Question 77
A security analyst needs to decompose several ways to compromise a payment authorization process. Which response best addresses the central security requirement with a defensible, risk-based design?
- Draw a network topology without attacker conditions
- Inventory only installed software versions
- Apply STRIDE categories to data flows and trust boundaries during threat modeling
- Create an attack tree with explicit attacker goal and branching attack prerequisites
Explanation
Correct Answer
D:Attack trees expose alternate paths and dependency chains toward one adversary objective.
Incorrect Answers
A:Topology alone lacks goal and precondition logic.
B:Inventory does not show attack path combinations.
C:STRIDE helps organize spoofing, tampering, repudiation, disclosure, denial and elevation threats. Create an attack tree with explicit attacker goal and branching attack prerequisites.
Question 78
A new business workflow will permit third-party API callbacks into financial systems. Which response best addresses the central security requirement with a defensible, risk-based design?
- Apply STRIDE categories to data flows and trust boundaries during threat modeling
- Write concrete attacker scenarios with entry points, trust boundaries and business consequences
- Assume every internet packet is a successful breach
- Copy an unrelated list of generic malware names
Explanation
Correct Answer
B:Realistic threat scenarios connect exploit behavior with impact and defenses.
Incorrect Answers
A:STRIDE helps organize spoofing, tampering, repudiation, disclosure, denial and elevation threats. Write concrete attacker scenarios with entry points, trust boundaries and business consequences.
C:Unbounded assumptions prevent useful prioritization.
D:Names without local attack paths do not guide decisions.
Question 79
A company adds dozens of unused public endpoints during a rapid migration. Which response best addresses the central security requirement with a defensible, risk-based design?
- Enable logging but leave unnecessary listeners open
- Count patched laptops as the only surface metric
- Refresh the threat model when architecture, data flows or dependencies materially change
- Enumerate externally reachable interfaces and remove or restrict unnecessary exposure
Explanation
Correct Answer
D:Attack surface includes reachable entry points rather than only known CVEs.
Incorrect Answers
A:Detection cannot erase an exploitable endpoint.
B:Public APIs and service connections can remain exposed.
C:An outdated model omits new attack paths even if previous findings were resolved. Enumerate externally reachable interfaces and remove or restrict unnecessary exposure.
Question 80
A payment system was redesigned after threat modeling but its trust-boundary diagram is unchanged. Which response best addresses the central security requirement with a defensible, risk-based design?
- Run only a new vulnerability scan and omit design review
- Write concrete attacker scenarios with entry points, trust boundaries and business consequences
- Refresh the threat model when architecture, data flows or dependencies materially change
- Keep the initial model indefinitely
Explanation
Correct Answer
C:An outdated model omits new attack paths even if previous findings were resolved.
Incorrect Answers
A:Vulnerability scans may miss architectural trust changes.
B:Realistic threat scenarios connect exploit behavior with impact and defenses. Refresh the threat model when architecture, data flows or dependencies materially change.
D:System design and threats evolve.
Certified Information Systems Security Professional (CISSP) Practice Tests