Question 80
A payment system was redesigned after threat modeling but its trust-boundary diagram is unchanged. Which response best addresses the central security requirement with a defensible, risk-based design?
- Run only a new vulnerability scan and omit design review
- Write concrete attacker scenarios with entry points, trust boundaries and business consequences
- Refresh the threat model when architecture, data flows or dependencies materially change
- Keep the initial model indefinitely
Explanation
Correct Answer
C:An outdated model omits new attack paths even if previous findings were resolved.
Incorrect Answers
A:Vulnerability scans may miss architectural trust changes.
B:Realistic threat scenarios connect exploit behavior with impact and defenses. Refresh the threat model when architecture, data flows or dependencies materially change.
D:System design and threats evolve.
Question 81
After a prior stride finding, a regional hospital network reports that the approved safeguard is implemented: “Apply STRIDE categories to data flows and trust boundaries during threat modeling.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Apply STRIDE categories to data flows and trust boundaries during threat modeling
- Use the completion of this alternative as proof: Treat STRIDE as a penetration tool that exploits vulnerabilities automatically
- Run this adjacent but different test as the sole proof: Compare approved service entry points against observed exposure scans
- Review threats mapped to each trust boundary and corresponding mitigations
Explanation
Correct Answer
D:Coverage evidence checks the model against its intended flows.
Incorrect Answers
A:Review threats mapped to each trust boundary and corresponding mitigations. Coverage evidence checks the model against its intended flows.
B:A threat taxonomy is not an automated exploit scanner. Review threats mapped to each trust boundary and corresponding mitigations.
C:An exposure inventory validates surface reduction. It tests attack surface, while this case requires evidence about stride.
Question 82
After a prior attack trees finding, a payment-services company reports that the approved safeguard is implemented: “Create an attack tree with explicit attacker goal and branching attack prerequisites.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Challenge each scenario with feasible preconditions and affected asset owners
- Accept a signed change ticket saying: Create an attack tree with explicit attacker goal and branching attack prerequisites
- Use the completion of this alternative as proof: Inventory only installed software versions
- Walk each branch and validate mitigation coverage for plausible paths
Explanation
Correct Answer
D:Goal-oriented review exposes bypass routes.
Incorrect Answers
A:Feasibility review differentiates likely threats from abstract fears. It tests threat scenarios, while this case requires evidence about attack trees.
B:Walk each branch and validate mitigation coverage for plausible paths. Goal-oriented review exposes bypass routes.
C:Inventory does not show attack path combinations. Walk each branch and validate mitigation coverage for plausible paths.
Question 83
After a prior threat scenarios finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Write concrete attacker scenarios with entry points, trust boundaries and business consequences.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Challenge each scenario with feasible preconditions and affected asset owners
- Run this adjacent but different test as the sole proof: Verify that new services and trust boundaries appear in the revised threat model
- Accept a signed change ticket saying: Write concrete attacker scenarios with entry points, trust boundaries and business consequences
- Use the completion of this alternative as proof: Copy an unrelated list of generic malware names
Explanation
Correct Answer
A:Feasibility review differentiates likely threats from abstract fears.
Incorrect Answers
B:Traceability shows the model tracks the deployed system. It tests model maintenance, while this case requires evidence about threat scenarios.
C:Challenge each scenario with feasible preconditions and affected asset owners. Feasibility review differentiates likely threats from abstract fears.
D:Names without local attack paths do not guide decisions. Challenge each scenario with feasible preconditions and affected asset owners.
Question 84
A cloud subcontractor will host regulated customer data but provides no evidence of control maturity. Which response best addresses the central security requirement with a defensible, risk-based design?
- Accept self-asserted security claims with no supporting evidence
- Use purchase price as the sole supplier risk factor
- Conduct a risk-tiered supplier security assessment before contract award
- Require an accurate software bill of materials and link component versions to deployed artifacts
Explanation
Correct Answer
C:Third-party inherited risks require due diligence proportional to data and service criticality.
Incorrect Answers
A:Unverified assurances cannot establish actual control design.
B:Cost is not a substitute for exposure and dependency.
D:A component inventory supports exposure analysis when a dependency vulnerability appears. Conduct a risk-tiered supplier security assessment before contract award.
Question 85
A software-as-a-service provider handles sensitive data but the contract omits incident notification and data return. Which response best addresses the central security requirement with a defensible, risk-based design?
- Add security terms specifying incident notice, audit rights, data handling, exit and responsibilities
- Omit audit and termination terms because uptime is high
- Establish tested exit, escrow or alternative sourcing and transferable operational knowledge
- Rely only on a marketing privacy page
Explanation
Correct Answer
A:Contractual controls make operational obligations enforceable between parties.
Incorrect Answers
B:Availability does not cover breach, data rights or exit risk.
C:Supplier continuity risk includes loss of people, artifacts and the ability to switch providers. Add security terms specifying incident notice, audit rights, data handling, exit and responsibilities.
D:Marketing content may lack binding commitments.
Question 86
A vendor cannot identify which released binaries contain a vulnerable third-party component. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use only the vendor's product brand list
- Require an accurate software bill of materials and link component versions to deployed artifacts
- Treat code signing as a complete dependency inventory
- Verify provenance, digests and trusted signatures of dependencies before promotion
Explanation
Correct Answer
B:A component inventory supports exposure analysis when a dependency vulnerability appears.
Incorrect Answers
A:Brands do not identify embedded dependency versions.
C:A signature proves origin/integrity, not component composition.
D:Artifact integrity controls detect unauthorized substitutions in the software supply chain. Require an accurate software bill of materials and link component versions to deployed artifacts.
Question 87
A CI pipeline downloads dependency packages from an untrusted mirror before packaging an approved app. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use antivirus only after public release
- Trust file names to prove publisher identity
- Verify provenance, digests and trusted signatures of dependencies before promotion
- Conduct a risk-tiered supplier security assessment before contract award
Explanation
Correct Answer
C:Artifact integrity controls detect unauthorized substitutions in the software supply chain.
Incorrect Answers
A:Late scanning cannot replace trusted build provenance.
B:Names can be duplicated by an attacker.
D:Third-party inherited risks require due diligence proportional to data and service criticality. Verify provenance, digests and trusted signatures of dependencies before promotion.
Question 88
A sole specialist supplier holds proprietary recovery scripts and might cease operations. Which response best addresses the central security requirement with a defensible, risk-based design?
- Add security terms specifying incident notice, audit rights, data handling, exit and responsibilities
- Buy a second license from the same failing supplier
- Wait until the vendor fails to collect documentation
- Establish tested exit, escrow or alternative sourcing and transferable operational knowledge
Explanation
Correct Answer
D:Supplier continuity risk includes loss of people, artifacts and the ability to switch providers.
Incorrect Answers
A:Contractual controls make operational obligations enforceable between parties. Establish tested exit, escrow or alternative sourcing and transferable operational knowledge.
B:A license does not restore unavailable expertise or tooling.
C:Exit activities may then be impossible.
Question 89
After a prior supplier assessments finding, a regional hospital network reports that the approved safeguard is implemented: “Conduct a risk-tiered supplier security assessment before contract award.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Review independent assurance, scope and open exceptions against contractual requirements
- Use the completion of this alternative as proof: Accept self-asserted security claims with no supporting evidence
- Accept a signed change ticket saying: Conduct a risk-tiered supplier security assessment before contract award
- Run this adjacent but different test as the sole proof: Review contract terms against tracked supplier risks and test notification contacts
Explanation
Correct Answer
A:Evidence-based supplier review supports accountable selection.
Incorrect Answers
B:Unverified assurances cannot establish actual control design. Review independent assurance, scope and open exceptions against contractual requirements.
C:Review independent assurance, scope and open exceptions against contractual requirements. Evidence-based supplier review supports accountable selection.
D:Contract-to-control mapping reduces unowned obligations. It tests contract controls, while this case requires evidence about supplier assessments.
Question 90
After a prior contract controls finding, a payment-services company reports that the approved safeguard is implemented: “Add security terms specifying incident notice, audit rights, data handling, exit and responsibilities.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Review contract terms against tracked supplier risks and test notification contacts
- Use the completion of this alternative as proof: Rely only on a marketing privacy page
- Run this adjacent but different test as the sole proof: Review independent assurance, scope and open exceptions against contractual requirements
- Accept a signed change ticket saying: Add security terms specifying incident notice, audit rights, data handling, exit and responsibilities
Explanation
Correct Answer
A:Contract-to-control mapping reduces unowned obligations.
Incorrect Answers
B:Marketing content may lack binding commitments. Review contract terms against tracked supplier risks and test notification contacts.
C:Evidence-based supplier review supports accountable selection. It tests supplier assessments, while this case requires evidence about contract controls.
D:Review contract terms against tracked supplier risks and test notification contacts. Contract-to-control mapping reduces unowned obligations.
Certified Information Systems Security Professional (CISSP) Practice Tests