Security and Risk Management — CISSP practice questions

A manufacturer signs sensor telemetry so a plant operator can prove a reading came from the specific device that produced it and was not altered. Beyond integrity, which of the five pillars does this MOST directly support?

1. Availability, because signed readings can be replayed after an outage
2. Confidentiality, because the act of signing conceals the reading from intermediaries
3. Non-repudiation, because the originating device cannot credibly disown the reading
4. Authenticity alone, because the signature only proves the sender's identity

Answer: C — Non-repudiation, because the originating device cannot credibly disown the reading

C) Correct — the five pillars extend CIA with authenticity and non-repudiation; a device-bound signature makes disowning the reading untenable, which is the defining property of non-repudiation. A) tempts because signing supports safe replay, but availability concerns access to the data, not proof of origin. B) is a common misconception — signing binds origin and integrity, it does not encrypt or hide content. D) is half right: authenticity is served too, but the question asks what is MOST directly added beyond integrity, and non-repudiation is the stronger, distinctly named pillar here.

During design review of a web service, a team catalogues threats such as spoofed identities, altered messages, denied actions, leaked data, service exhaustion and privilege escalation. Which model are they applying?

1. STRIDE, which enumerates threat categories against system components
2. DREAD, which ranks discovered threats by severity attributes
3. PASTA, which centres the analysis on business objectives and attacker simulation
4. The cyber kill chain, which sequences an intrusion into ordered stages

Answer: A — STRIDE, which enumerates threat categories against system components

A) Correct — the six categories listed map directly to spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. B) is the adjacent concept: DREAD scores threats after they are identified rather than enumerating them. C) is a genuine threat-modelling method but risk-centric and staged, not a six-category enumeration. D) describes attacker phases during an intrusion, not design-time threat categories.

A newly hired continuity coordinator wants to begin a business continuity programme. What should be done FIRST?

1. Obtain senior management commitment and an agreed programme scope
2. Perform a business impact analysis across every operating unit
3. Select an alternate processing site that meets the expected recovery window
4. Draft continuity plans for the systems the coordinator judges most critical

Answer: A — Obtain senior management commitment and an agreed programme scope

A) Correct — continuity is a management obligation; without sponsorship, scope and authority the analysis has no mandate and its results cannot be funded or enforced. B) is the classic off-by-one — the BIA is essential but comes after the programme is chartered and scoped. C) presumes an answer the BIA has not yet produced. D) substitutes one person's judgement for the impact analysis that is supposed to determine criticality.

Under GDPR, a data controller is which party?

1. The natural person whose personal data is being processed
2. The party processing data on another entity instructions
3. The entity deciding the purposes and means of processing
4. The data center facility where the records are hosted
5. The end user who submits data through the application

Answer: C — The entity deciding the purposes and means of processing

C is the definition: the controller decides why and how personal data is processed and carries primary accountability for lawfulness, transparency, and data subject rights. A and E both describe the data subject, whose rights the controller must honor. B is the processor, which acts only on documented instructions and holds narrower but real obligations. D confuses a hosting location with a legal role. Determining purpose and means, not possession of the data, is what makes an organization a controller.

Which legal concept holds an organization responsible for failing to implement the reasonable security controls expected of a prudent person?

1. Strict liability, which imposes responsibility for the harm caused without any regard to fault or intent
2. Vicarious liability, which makes an employer answerable for the acts committed by its employees
3. Mens rea, the culpable mental state that must be established by the prosecution in a criminal case
4. Negligence, arising from failure to exercise the due care a prudent organization would exercise

Answer: D — Negligence, arising from failure to exercise the due care a prudent organization would exercise

D) Correct: negligence is the failure to act as a reasonable, prudent organization would in the circumstances, and the prudent-person rule is the yardstick courts apply to security decisions. A) Strict liability attaches without fault and is confined to particular categories of activity, not general security practice. B) Vicarious liability concerns an employer answering for employee acts, a different doctrine entirely. C) Mens rea is criminal intent and has no role in the civil due-care standard.

A company has a manufacturing process it believes gives it a durable advantage. It is willing to invest in strict internal controls and does not want the method disclosed at any point. Which intellectual property protection is MOST appropriate?

1. Patent, because it grants an enforceable exclusive right for a fixed term
2. Copyright, because it protects the recorded expression of the process
3. Trade secret, because protection persists as long as secrecy is maintained
4. Trademark, because it protects the identity attached to the resulting goods

Answer: C — Trade secret, because protection persists as long as secrecy is maintained

C) Correct — trade secret is the only regime whose protection depends on, and rewards, never disclosing the method, and it has no expiry while secrecy holds. A) is the near-twin answer: a patent gives strong rights but requires public disclosure and expires, which contradicts the stated constraint. B) fails because copyright protects expression, not a functional process. D) is off-topic: trademarks protect brand identifiers, not methods.

A CISO discovers a critical vulnerability in a system whose business owner refuses to patch it, citing operational concerns. What is the BEST course of action?

1. Apply the patch over the owner's objection, on the basis that security requirements override operations
2. Escalate straight to the board of directors without involving the accountable business owner at all
3. Take the affected system out of service until a maintenance window allows the patch to be applied
4. Document the risk, present it to the owner and obtain written acceptance from an authorized executive

Answer: D — Document the risk, present it to the owner and obtain written acceptance from an authorized executive

D) Correct: the CISO advises on risk; the business owner accepts it. Formal written acceptance by an authorized executive preserves accountability and leaves an audit trail. A) Security does not unilaterally override a business decision — that inverts governance. B) Bypassing the chain of command is poor governance unless the owner refuses to sign and the exposure is severe. C) Removing a production system from service without authorisation is the same unilateral act in a different form.

Which describes the CIA triad?

1. Cryptography, integrity, and authentication of users
2. Centralization, identity, and authorization of access
3. Cost, importance, and access level of the data asset
4. Compliance, investigation, and audit of the systems
5. Confidentiality, integrity, and availability of data

Answer: E — Confidentiality, integrity, and availability of data

E states the three security objectives every control ultimately serves: no unauthorized disclosure, no unauthorized modification, and access for authorized users when needed. A tempts because cryptography and authentication are real controls, but they are mechanisms, not the objectives. B substitutes identity-management terms. C is an asset-valuation vocabulary, not a security model. D lists assurance activities. The inverse of the triad is the DAD model: disclosure, alteration, destruction.

A risk assessment is being started for a business unit that has never been assessed. Which activity should come FIRST?

1. Identify and value the assets and processes within the assessment scope
2. Estimate the annualised loss expectancy for the unit's main applications
3. Select controls from the organisation's existing control catalogue
4. Survey staff on which threats they believe are most likely to occur

Answer: A — Identify and value the assets and processes within the assessment scope

A) Correct — risk cannot be measured against nothing; identifying assets, processes and their value to the business is the input everything else depends on. B) is an off-by-one in sequence: ALE requires asset value and exposure factors that identification has not yet produced. C) reverses the process by choosing treatment before risk is known. D) is a legitimate technique for threat identification but it is a later step and is not the foundation.

A certified professional discovers that disclosing a client's insecure product design publicly would protect the public but would breach a signed confidentiality agreement. Under the ISC2 Code of Ethics canons, what governs the decision?

1. The canons are ordered, and protecting society and the common good comes first
2. The canons carry equal weight, so the professional must use personal judgement
3. Duty to principals always prevails because it rests on a binding legal contract
4. The professional must resign the engagement before considering any disclosure

Answer: A — The canons are ordered, and protecting society and the common good comes first

A) Correct — the canons are applied in order, and the first canon, protecting society, the common good and the infrastructure, takes precedence over the later duty to principals. B) is the frequent misreading: the canons are explicitly ordered, not equally weighted. C) inverts the ordering by treating a private contract as superior to public safety. D) is a plausible-sounding but incomplete action — withdrawing may follow, but it does not itself resolve which duty controls.

What are the three pillars of the CIA triad?

Confidentiality, Integrity, Availability. Foundation of information security objectives. CISSP exam: Disclosure (vs. C), Alteration (vs. I), Destruction (vs. A) — the DAD model.

What is the breach notification requirement under GDPR?

72 hours to supervisory authority after becoming aware of a breach (unless unlikely to result in risk). Affected individuals notified if high risk.

What are the categories of security controls (function)?

Preventive, Detective, Corrective, Deterrent, Recovery, Compensating, Directive. Often grouped as preventive/detective/corrective for simplicity.

What is the kill chain (Lockheed Martin)?

Recon → Weaponization → Delivery → Exploit → Install → C2 → Actions on Objectives. Defenders disrupt at any stage.