Scenario based application questions covering all eight CISSP domains for final exam review.
37 cards · basic cards · AI-written, checked twice. Edit anything.
- A company discovers a data breach affecting customer PII. The financial impact is assessed at $500k, but remediation costs are $2M. What risk response strategy is most appropriate?
- Accept the risk; the financial loss already occurred. Invest the remediation budget in strengthening detection and incident response capabilities for future incidents.
- You are conducting a risk assessment for a new cloud migration project. A critical system has a 40% probability of a 2-week outage if security controls fail. What term describes this threat?
- Residual risk; the remaining risk after implementing controls, calculated as (threat likelihood x vulnerability severity) minus control effectiveness.
- A regulatory requirement mandates encryption of sensitive data, but the organization finds encryption cost-prohibitive. What is the correct response in a compliance audit?
- Document the risk acceptance decision with business justification and executive sign-off; non-compliance cannot be avoided through cost arguments alone.
- Your organization's risk matrix rates threats on probability (1-5) and impact (1-5). A scenario scores 2 probability and 4 impact. Should this be prioritized above a 4 probability, 2 impact threat?
- No; the 4x2 threat (8) ranks equally to the 2x4 threat (8) by numerical score, but context and business impact should break ties, not the matrix formula alone.
- An insider threat assessment identifies that a disgruntled employee has administrative access to financial systems and no job prospects. Which risk response is most appropriate?
- Mitigate immediately by removing or restricting administrative access, implementing enhanced monitoring, and reviewing separation-of-duties controls.
- A legacy system stores customer encryption keys in plaintext within the database. The system will be retired in 18 months. What asset protection measure is most critical immediately?
- Implement database-level encryption and restrict key access through role-based access controls; do not delay until retirement.
- You discover that personally identifiable information (PII) is logged in application debug files stored indefinitely on a file server accessible to developers. What is the first remediation step?
- Immediately remove debug logs containing PII, disable debug logging for sensitive operations, and implement log retention and purge policies.
- An organization's backup files are stored on the same network segment as production systems with no encryption or access controls. What classification should this receive in a vulnerability assessment?
- Critical; unencrypted backups accessible to the same attacker surface as production data represents a direct path to complete data recovery.
- A company acquires a competitor's customer database but discovers inadequate security controls. The data remains sensitive and regulated. What is the legal obligation?
- Apply the same protection standards as your own data; the acquisition does not change regulatory or contractual data protection obligations.
- During a data classification project, developers argue that internal-only tools do not require classification or protection. How should security respond?
- All data requires classification; internal tools may store or process sensitive data and must follow the protection level of the data, not the tool's access scope.
- A security architect is designing a system that must provide both strong authentication and high availability. Implementing HSM-backed certificate storage causes single points of failure. What approach balances security and availability?
- Deploy HSMs in active-active redundancy across geographic regions with real-time key replication and failover mechanisms.
- A system architect proposes an air-gapped network for classified processing. Network traffic cannot reach the internet. However, administrators occasionally need to patch systems. What security control is essential?
- Implement a strictly controlled, monitored import process for patches with integrity verification and change management approval; never allow bidirectional access.
- An organization uses a single encryption key for encrypting all customer data across multiple applications and regions. What architectural flaw creates risk?
- Key sprawl and blast radius; compromise of one key decrypts all data across all systems. Implement key rotation, domain-specific keys, and segregation by sensitivity level.
- A cloud migration architecture separates storage and compute into different security zones but uses an unencrypted REST API between them. What threat model is ignored?
- Network-based eavesdropping and man-in-the-middle attacks; encrypted transport (TLS) is required even in internal network segments.
- A security design requires mutual authentication between microservices but current infrastructure does not support certificate management at scale. What is a viable interim measure without removing authentication?
- Implement API key-based authentication with short-lived tokens, strict key rotation, and cryptographic verification; transition to certificate infrastructure as capability matures.