CISSP Security and Risk Management: 192 practice questions

12 of the 192 Security and Risk Management questions in the Certsqill CISSP bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISSP? Take the free 5-min readiness check →

1. Keep collection within the approved employee: Exhibit: Approved scope = named employee; systems A and B; prior

1. Expand collection to every employee using the same network segment.

   This broadens collection beyond the named subject and systems without documented authorization or an established factual basis.
2. Image all bank servers first, then request authorization after reviewing findings.

   Collecting before authorization exceeds the stated boundary and risks compromising legal and evidentiary protections.
3. Keep collection within the approved employee, systems, and date boundaries. ✓

   This preserves relevant evidence while respecting the explicitly limited subject, systems, timeframe, and legal authorization.
4. Ask the employee’s manager to conduct unrestricted interviews and select evidence.

   A manager may provide information, but unrestricted collection violates the approved scope and investigative governance.

Use the authorized scope as the investigation boundary while preserving evidence relevant to confirmed facts.

2. Apply the mandatory standard: No emergency exception or compensating control has been approved.

1. Apply the mandatory standard; use compatible guideline recommendations. ✓

   The mandatory standard governs, while the guideline may supplement it only when compatible.
2. Use plaintext because the guideline is newer.

   Recency does not allow an optional recommendation to override a mandatory standard.
3. Treat both documents as equal and let engineers decide for each cache.

   Case-by-case choice would undermine the mandatory encryption requirement and create inconsistent implementation.
4. Wait for an operations procedure before deciding whether encryption applies.

   A future procedure cannot suspend an already applicable mandatory requirement.

The mandatory standard governs; the guideline applies only where it does not conflict.

3. Complete identity proofing and required screening before: Authentication strength after onboarding is already

1. Complete identity proofing and required screening before granting workforce access. ✓

   Pre-employment safeguards address the demonstrated failure by validating identity and eligibility before account provisioning.
2. Use single sign-on so analysts receive consistent access through the corporate identity provider.

   Single sign-on simplifies authentication but does not establish identity or enforce prerequisite screening before provisioning.
3. Require multifactor authentication before the first application login.

   Multifactor authentication verifies possession and another factor, not whether the claimed employee identity was properly proofed.
4. Require managers to review quarterly access reports after onboarding.

   Periodic review can detect excessive access later but does not prevent unverified joiners from receiving initial accounts.

Identity proofing and screening must precede provisioning because the failure occurred during initial joiner onboarding.

4. Encrypt caches and enforce local authenticated: The approved design must preserve warehouse availability and p

1. Delete cached shipment data whenever connectivity fails, even though scanners must remain operational.

   Deletion protects confidentiality but prevents the scanners from supporting the required warehouse operations.
2. Encrypt caches and enforce local authenticated authorization. ✓

   Encryption protects cached confidentiality, while local authentication and authorization preserve controlled offline availability.
3. Require network connectivity before displaying any shipment details, regardless of the four-hour outage requirement.

   Network dependence contradicts the explicit offline operating requirement.
4. Permit unrestricted local access to all cached shipment details until network service returns.

   This preserves availability but exposes confidential information without authorization.

Encrypt cached data and retain authenticated, authorized offline access.

5. The designated owner: Which conclusion correctly addresses accountability and the decision record?

1. The tool operator may accept residual risk because the net benefit is positive.

   A favorable economic result does not transfer risk acceptance authority to the person operating the calculation tool.
2. The designated owner, not the operator, decides whether to accept residual risk. ✓

   Risk calculations inform decisions, but the designated accountable owner accepts or rejects residual risk.
3. The control has a negative net benefit because its annual cost exceeds post-control ALE.

   Post-control ALE is $50,000, but benefit compares before and after exposure before subtracting control cost.
4. The control eliminates risk because post-control ALE is only $50,000.

   A reduced ALE represents expected residual exposure, not elimination of risk or uncertainty.

The designated risk owner remains accountable for accepting residual risk after reviewing the calculated improvement.

6. Enforce authorization at the service boundary for every: The architecture team proposes several controls, but

1. Use TPM attestation on the analytics host before releasing all records.

   Attestation can support platform integrity evidence but does not authorize every individual record request.
2. Enforce authorization at the service boundary for every record request. ✓

   Boundary authorization with repeated mediation applies least privilege and checks every access attempt across the trust boundary.
3. Place both services on the same network segment to reduce routing complexity.

   Network proximity does not enforce least privilege or complete mediation for application-level record requests.
4. Encrypt records while they travel between the two services.

   Encryption protects confidentiality in transit but does not determine whether each requesting service may access records.

Every cross-boundary request needs authorization enforcement so least privilege and complete mediation remain effective.

7. Map jurisdictions and roles: No specific jurisdiction or statutory deadline is supplied.

1. Ask the provider to confirm that its standard contract satisfies every applicable obligation.

   Provider assurances may inform due diligence but cannot replace the organization’s authorized jurisdiction and obligation review.
2. Rely on encryption because it protects records during international processing.

   Encryption reduces exposure but does not determine jurisdictional duties, processing roles, or authorized transfer conditions.
3. Map jurisdictions and roles, then obtain authorized review before transferring records. ✓

   This addresses cross-border scope by identifying applicable obligations and securing accountable approval before processing changes.
4. Keep all records in the originating country regardless of business requirements.

   Residency may reduce transfer complexity, but an unconditional location decision is unsupported without applicable obligations and authorization.

Cross-border processing requires jurisdiction and role analysis followed by authorized review before transfer.

8. The calibration supplier: Which dependency should receive priority attention in recovery planning?

1. The identity service, because authentication controls production access.

   Identity service recovery matters, yet its 30-minute restoration fits comfortably within the process recovery target.
2. The calibration supplier, because its six-hour delivery exceeds the four-hour recovery target. ✓

   The supplier dependency can prevent process recovery within the stated RTO and therefore requires priority planning.
3. The network, because every production system uses it.

   The network is important, but its stated recovery time remains well within the four-hour production target.
4. The calibration supplier, network, and identity service equally, because all dependencies must recover before production resumes.

   All dependencies matter, but the BIA timing identifies the supplier as the constraint threatening the recovery objective.

The six-hour supplier dependency exceeds the four-hour RTO and can delay production recovery beyond its target.

9. Select it: net benefit is $30,000: Which result should be used for this decision?

1. The expected annual loss after control is $70,000 after combining the residual loss and cost.

   The post-control ALE is $40,000; combining it with cost does not produce the stated decision metric.
2. Select it: net benefit is $30,000. ✓

   SLE is $200,000; baseline ALE is $100,000 and post-control ALE is $40,000. The $60,000 reduction minus $30,000 cost yields a $30,000 net benefit.
3. The control provides a $40,000 annual benefit before cost.

   $40,000 is the post-control ALE, not the loss reduction. The expected benefit is $60,000.
4. The expected annual loss before control is $100,000.

   $100,000 is the baseline ALE, not the net benefit used for the investment decision.

The control produces a positive $30,000 expected annual net benefit.

10. Resolve the evidence and contract gaps before onboarding: What is the best action?

1. Rely on service levels because measurable availability creates sufficient supplier accountability.

   Service levels measure performance but do not provide audit rights, security testing boundaries, or data-return protections.
2. Resolve the evidence and contract gaps before onboarding the supplier. ✓

   Due diligence must address scope, verification, testing authority, and exit protections before processing donor records begins.
3. Accept the questionnaire and certification because both demonstrate supplier compliance.

   Self-reported answers and certifications do not establish security for the nonprofit’s excluded subprocessor scope.
4. Onboard now and negotiate audit and deletion terms after the grant deadline.

   Deferring material safeguards exposes donor records before verification and exit responsibilities are contractually established.

Resolve excluded-scope evidence and essential contract protections before permitting donor-record processing.

11. Train developers on validation and reporting: Management asks for one corrective control focused on this demon

1. Train developers on validation and reporting. ✓

   Recurring, role-specific education directly addresses the coding failure and teaches the approved reporting behavior.
2. Add a generic secure-coding module to the annual workforce course.

   A generic module may not address the specific validation defect or the reporting channel.
3. Require every employee to repeat annual security awareness training.

   General repetition does not remediate the developers’ demonstrated technical and reporting deficiencies.
4. Require quarterly acknowledgment of the existing acceptable-use policy.

   Acknowledgment confirms receipt but does not build input-validation skills or reporting competence.

Provide recurring, role-specific training on validation and reporting.

12. Escalate honestly through authorized channels: What approach best satisfies the stated constraint?

1. Publish the weakness immediately without authorization or validation.

   Immediate publication could expose sensitive information and bypass authorized reporting despite the potential danger.
2. Escalate honestly through authorized channels. ✓

   This reports the material danger accurately through the approved process while protecting public welfare without unsupported public disclosure.
3. Follow the internal process without expressly correcting the client report.

   Using the process without ensuring honest reporting could leave the material weakness concealed.
4. Accept the manager’s instruction because employer loyalty controls professional judgment.

   Loyalty does not justify concealing a material danger or presenting a knowingly incomplete professional report.

Escalate honestly through authorized channels.

Other CISSP domains

• Security Architecture and Engineering — 156 questions →
• Communication and Network Security — 156 questions →
• Identity and Access Management (IAM) — 156 questions →
• Security Operations — 156 questions →
• Security Assessment and Testing — 144 questions →
• All 1200 CISSP questions →
• CISSP certification: requirements, cost and exam format →