CISSP Security and Risk Management: 89 practice questions

12 of the 89 Security and Risk Management questions in the Certsqill CISSP bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISSP? Take the free 5-min readiness check →

1. $40,000: What is the Annual Loss Expectancy (ALE)?

1. $40,000 ✓

   Correct. SLE = AV × EF = $200,000 × 0.40 = $80,000. ARO = 0.5 (once every 2 years). ALE = SLE × ARO = $80,000 × 0.5 = $40,000.
2. $100,000

   Incorrect. This applies the wrong formula. ALE = SLE (AV × EF) × ARO = $200,000 × 0.40 × 0.5 = $40,000.
3. $160,000

   Incorrect. This would be the ALE if ARO = 2.0 (twice per year). The attack occurs once every two years, so ARO = 0.5.
4. $80,000

   Incorrect. $80,000 is the SLE (Single Loss Expectancy), not the ALE. The ALE adjusts for frequency: ALE = SLE × ARO = $80,000 × 0.5 = $40,000.

ALE = SLE × ARO = (AV × EF) × ARO = ($200,000 × 0.40) × 0.5 = $80,000 × 0.5 = $40,000.

2. Risk acceptance: Which risk treatment strategy does this represent?

1. Risk avoidance

   Incorrect. Risk avoidance means eliminating the risk by not engaging in the risky activity (e.g., shutting down the legacy system). The system continues to operate.
2. Risk acceptance ✓

   Correct. Risk acceptance (also called risk tolerance or risk retention) means acknowledging the risk and consciously deciding not to act on it. Often appropriate when control costs exceed expected loss.
3. Risk mitigation

   Incorrect. Risk mitigation means implementing controls to reduce the likelihood or impact. No controls are being implemented here.
4. Risk transference

   Incorrect. Risk transference shifts financial impact to a third party (e.g., insurance, outsourcing). No such transfer is described.

Risk acceptance = knowingly retaining risk without control action, typically when control costs exceed expected loss.

3. Availability: Which component of the CIA triad is PRIMARILY violated?

1. Integrity

   Incorrect. Integrity violations involve unauthorized modification of data. While ransomware modifies files (encrypts them), the PRIMARY violation and business impact is the inability to access files (availability).
2. Confidentiality

   Incorrect. Confidentiality would be violated if unauthorized parties could read the data. Ransomware encrypts data to deny access — availability is the primary concern, though confidentiality may also be compromised in exfiltration scenarios.
3. Availability ✓

   Correct. Ransomware prevents authorized users from accessing data — this is a direct attack on availability. The data may still be confidential (encrypted) and the original data intact on disk, but access is denied.
4. Non-repudiation

   Incorrect. Non-repudiation ensures parties cannot deny actions. Ransomware does not affect non-repudiation directly.

Ransomware denies access to data — this primarily violates Availability (authorized users cannot access data when needed).

4. Senior management / executive leadership: Which party bears ULTIMATE responsibility for the organization's sec

1. The CISO

   Incorrect. The CISO has operational responsibility for implementing the security program, but ultimate accountability rests with senior management who approved the program and risk posture.
2. The security team that failed to prevent the breach

   Incorrect. The security team executes security operations. Blame is not the CISSP focus — ultimate responsibility rests with senior management's decision-making about risk.
3. The data owner of the breached information

   Incorrect. Data owners are responsible for classifying data and approving access, but the ultimate responsibility for the entire security program is senior management's.
4. Senior management / executive leadership ✓

   Correct. In the CISSP framework, senior management is ultimately and finally responsible for the security program. They set the risk tolerance, allocate budget, and are accountable to stakeholders and regulators.

Senior management bears ultimate responsibility for the organization's security program — they set risk tolerance and are accountable to stakeholders.

5. BCP focuses on keeping critical business functions: Which statement correctly differentiates what each plan ad

1. BCP focuses on keeping critical business functions operational during the disaster (people and processes), while DRP focuses on restoring IT systems and infrastructure after the disaster ✓

   Correct. BCP is about business continuity — keeping critical processes running with or without IT systems. DRP is IT-focused — recovering systems, data, and infrastructure.
2. BCP is activated strictly before a disaster as a preventive plan, while DRP is triggered only after the disaster ends to guide the technical recovery of the IT systems and data

   Incorrect. Both can be activated during or after a disaster. BCP focuses on ongoing business operations; DRP focuses on IT system recovery — the distinction is scope, not timing.
3. BCP is responsible for recovering physical hardware and facilities, while DRP is limited to reinstalling software applications and restoring the operating system configurations of the affected servers

   Incorrect. BCP is about business processes and people, not hardware. DRP covers both hardware and software recovery.
4. BCP and DRP are interchangeable names for a single combined document, because both describe the same recovery steps and are maintained by the same team using one identical set of objectives and scope

   Incorrect. BCP and DRP are distinct documents with different scopes, owners, and objectives, though they are related and must be coordinated.

BCP = business functions and people during disruption; DRP = IT systems recovery after disruption. Different scopes, complementary plans.

6. Spoofing: Which STRIDE threat category does this attack represent?

1. Tampering

   Incorrect. Tampering involves modifying data without authorization. The attacker is replaying captured credentials, not modifying them.
2. Spoofing ✓

   Correct. Spoofing in STRIDE involves pretending to be someone else. Replaying valid authentication tokens impersonates the legitimate user — this is spoofing via a replay attack.
3. Repudiation

   Incorrect. Repudiation involves denying that an action was performed. The attacker is impersonating a user to gain access, not denying an action.
4. Elevation of Privilege

   Incorrect. Elevation of Privilege involves gaining higher permissions than authorized. Replaying a token gains the victim's existing permissions, not elevated ones — unless the victim had high privileges.

Replay attacks use captured credentials to impersonate another user — this is Spoofing in the STRIDE threat model.

7. The European company is the Data Controller: Under GDPR, which roles do the European company and US cloud prov

1. The US cloud provider is exempt from GDPR because it is headquartered in the United States

   Incorrect. GDPR applies to any organization processing EU citizens' personal data, regardless of where the organization is located. The US provider processing EU data is subject to GDPR obligations.
2. The European company is the Data Processor and the US cloud provider is the Data Controller here

   Incorrect. The Controller determines processing purposes. The company that owns the business relationship with EU citizens and directs the data processing is the Controller.
3. The European company is the Data Controller; the US cloud provider is the Data Processor ✓

   Correct. Under GDPR, the Data Controller determines why and how personal data is processed. The Data Processor processes data on behalf of the Controller. The cloud provider processes data per the controller's instructions.
4. Both firms are joint Data Controllers, since each handles the personal data involved

   Incorrect. A cloud provider that only processes data per client instructions is a Processor, not a Controller. They don't determine the purpose of processing independently.

GDPR: Data Controller (determines purpose/means of processing) = European company; Data Processor (processes on controller's behalf) = US cloud provider.

8. Separation of duties: Which security principle does this enforce?

1. Job rotation — periodically reassigning staff between different roles to expose hidden fraud over an extended period of time

   Incorrect. Job rotation periodically moves employees between roles (detects fraud over time). Requiring different people for initiation and approval is separation of duties.
2. Least privilege — granting each user only the minimum access rights that their specific job function requires

   Incorrect. Least privilege limits access rights to the minimum needed for a job function. The wire transfer policy divides the transaction into multiple roles — this is separation of duties.
3. Need-to-know — restricting access to a piece of information to only those whose duties genuinely require it

   Incorrect. Need-to-know restricts access to information based on job requirements. Dividing transaction steps among different roles is separation of duties.
4. Separation of duties — splitting a sensitive transaction so that two different people are required to complete it ✓

   Correct. Separation of duties requires that no single individual can complete a sensitive transaction end-to-end without involvement from another person. This prevents fraud and errors.

Requiring different people for initiation and approval of a transaction enforces Separation of Duties — no single person controls the entire process.

9. Due diligence: Which concept does this activity represent?

1. Due diligence ✓

   Correct. Due diligence is the act of researching, investigating, and understanding risks and security requirements. It is the knowledge-gathering and assessment phase.
2. Negligence

   Incorrect. Negligence is failure to exercise due care. Researching best practices is the opposite of negligence.
3. Due care

   Incorrect. Due care is taking action based on what is known — actually implementing security controls. Researching what controls are needed is due diligence.
4. Risk acceptance

   Incorrect. Risk acceptance is a conscious decision not to implement a control after assessing risk. Research is the precursor to that decision.

Due diligence = researching and understanding risks and requirements. Due care = taking action to implement appropriate controls based on that understanding.

10. Security policy: Which type of security document is typically broad, high-level, management-approved, and does

1. Security procedure — a detailed, step-by-step set of written instructions for carrying out one specific operational task

   Incorrect. Procedures are step-by-step instructions for performing a task. They are the most specific and detailed documents in the hierarchy.
2. Security policy — a broad, management-approved statement of intent that deliberately omits technical detail ✓

   Correct. A security policy is a high-level statement of management's intent and organizational security objectives. It is technology-neutral and sets direction without specifying how to achieve it.
3. Security standard — a mandatory, specific requirement that is derived directly from a governing security policy

   Incorrect. Standards are mandatory specific requirements derived from policies (e.g., 'Passwords must be at least 12 characters'). They are more specific than policies.
4. Security baseline — a minimum secure configuration defined for a given system or class of device

   Incorrect. Baselines define minimum security configurations for specific systems/platforms. They are specific and often technical.

Security policy = high-level, management-approved, technology-neutral direction. Standards (specific requirements) and Procedures (step-by-step) are lower in the hierarchy.

11. The system can be down at most 4 hours before unacceptable: Which statement correctly describes these values?

1. MTD, RTO, and RPO must all be set to one identical value so that the business continuity plan stays internally consistent and every team is required to recover on exactly the same timeline

   Incorrect. These values are independent measurements that serve different purposes. They rarely are equal and don't need to be.
2. The RTO of 2 hours must be defined as greater than the MTD of 4 hours, so that the recovery team is granted enough additional working time to fully restore the payment system after it goes down

   Incorrect. RTO must be LESS THAN OR EQUAL TO MTD. RTO is the target for IT recovery; MTD is the maximum tolerable outage. Recovery must happen before MTD is reached.
3. The system can be down at most 4 hours (MTD) before unacceptable business impact; recovery must be achieved within 2 hours (RTO); and at most 30 minutes of transaction data can be lost (RPO) ✓

   Correct. MTD (Maximum Tolerable Downtime) = longest acceptable outage. RTO (Recovery Time Objective) = target restore time, must be ≤ MTD. RPO (Recovery Point Objective) = maximum acceptable data loss in time.
4. The RPO of 30 minutes is by definition always required to be longer than the RTO of 2 hours, because a tolerated data-loss window must exceed the corresponding system recovery window in any plan

   Incorrect. RPO and RTO are independent. RPO (30 min) can be shorter than RTO (2 hours) — the system needs recovery within 2 hours and data loss must not exceed 30 minutes.

MTD = max tolerable downtime (4h); RTO = target recovery time (2h, must be ≤ MTD); RPO = max acceptable data loss in time (30 min).

12. Residual risk: What term describes this remaining risk, and who must formally accept it?

1. Residual risk; it is automatically transferred to the organization's insurer

   Incorrect. Risk transference is a deliberate choice, not automatic. Residual risk must be formally accepted by management or actively treated (transferred, reduced further, avoided).
2. Total risk; it must be accepted by the security team

   Incorrect. Total risk is risk BEFORE any controls. After controls, what remains is residual risk. The security team does not own risk acceptance — senior management does.
3. Inherent risk; it should be eliminated before the system goes live

   Incorrect. Inherent risk is another term for total/initial risk before controls. Residual risk cannot always be fully eliminated — senior management accepts what remains.
4. Residual risk; it must be formally accepted by senior management ✓

   Correct. Residual risk is the risk remaining after controls are implemented. It cannot be fully eliminated; senior management must formally accept it as part of their governance responsibility.

Residual risk = risk after controls applied. Cannot be fully eliminated. Senior management must formally accept it — this is a governance responsibility.

Other CISSP domains

• Security Architecture and Engineering — 87 questions →
• Communication and Network Security — 63 questions →
• Identity and Access Management (IAM) — 63 questions →
• Software Development Security — 59 questions →
• Security Operations — 48 questions →
• All 497 CISSP questions →