Scenario based application questions covering all eight CISSP domains for final exam review.
37 cards · mixed cards · AI-written, checked twice. Edit anything.
- A company discovers a data breach affecting customer PII. The financial impact is assessed at $500k, but remediation costs are $2M. What risk response strategy is most appropriate?
Show answer
Accept the risk; the financial loss already occurred. Invest the remediation budget in strengthening detection and incident response capabilities for future incidents.- You are conducting a risk assessment for a new cloud migration project. A critical system has a 40% probability of a 2-week outage if security controls fail. What term describes this threat?
Show answer
Residual risk; the remaining risk after implementing controls, calculated as (threat likelihood x vulnerability severity) minus control effectiveness.- A regulatory requirement mandates encryption of sensitive data, but the organization finds encryption cost-prohibitive. What is the correct response in a compliance audit?
Show answer
Document the risk acceptance decision with business justification and executive sign-off; non-compliance cannot be avoided through cost arguments alone.- Your organization's risk matrix rates threats on probability (1-5) and impact (1-5). A scenario scores 2 probability and 4 impact. Should this be prioritized above a 4 probability, 2 impact threat?
Show answer
No; the 4x2 threat (8) ranks equally to the 2x4 threat (8) by numerical score, but context and business impact should break ties, not the matrix formula alone.- An insider threat assessment identifies that a disgruntled employee has administrative access to financial systems and no job prospects. Which risk response is most appropriate?
Show answer
Mitigate immediately by removing or restricting administrative access, implementing enhanced monitoring, and reviewing separation-of-duties controls.- A legacy system stores customer encryption keys in plaintext within the database. The system will be retired in 18 months. What asset protection measure is most critical immediately?
Show answer
Implement database-level encryption and restrict key access through role-based access controls; do not delay until retirement.- You discover that personally identifiable information (PII) is logged in application debug files stored indefinitely on a file server accessible to developers. What is the first remediation step?
Show answer
Immediately remove debug logs containing PII, disable debug logging for sensitive operations, and implement log retention and purge policies.- An organization's backup files are stored on the same network segment as production systems with no encryption or access controls. What classification should this receive in a vulnerability assessment?
Show answer
Critical; unencrypted backups accessible to the same attacker surface as production data represents a direct path to complete data recovery.- A company acquires a competitor's customer database but discovers inadequate security controls. The data remains sensitive and regulated. What is the legal obligation?
Show answer
Apply the same protection standards as your own data; the acquisition does not change regulatory or contractual data protection obligations.- During a data classification project, developers argue that internal-only tools do not require classification or protection. How should security respond?
Show answer
All data requires classification; internal tools may store or process sensitive data and must follow the protection level of the data, not the tool's access scope.- A security architect is designing a system that must provide both strong authentication and high availability. Implementing HSM-backed certificate storage causes single points of failure. What approach balances security and availability?
Show answer
Deploy HSMs in active-active redundancy across geographic regions with real-time key replication and failover mechanisms.- A system architect proposes an air-gapped network for classified processing. Network traffic cannot reach the internet. However, administrators occasionally need to patch systems. What security control is essential?
Show answer
Implement a strictly controlled, monitored import process for patches with integrity verification and change management approval; never allow bidirectional access.- An organization uses a single encryption key for encrypting all customer data across multiple applications and regions. What architectural flaw creates risk?
Show answer
Key sprawl and blast radius; compromise of one key decrypts all data across all systems. Implement key rotation, domain-specific keys, and segregation by sensitivity level.- A cloud migration architecture separates storage and compute into different security zones but uses an unencrypted REST API between them. What threat model is ignored?
Show answer
Network-based eavesdropping and man-in-the-middle attacks; encrypted transport (TLS) is required even in internal network segments.- A security design requires mutual authentication between microservices but current infrastructure does not support certificate management at scale. What is a viable interim measure without removing authentication?
Show answer
Implement API key-based authentication with short-lived tokens, strict key rotation, and cryptographic verification; transition to certificate infrastructure as capability matures.
FlashKeepers