Security and Risk Management

The continuity coordinator at a regional hospital has finished interviewing department heads for the business impact analysis. Which result should MOST directly set the order in which systems are recovered?

A BIA sets the maximum tolerable downtime for a claims system at 48 hours, with negligible work recovery time. A hot site would restore it in 2 hours at high cost. A warm site would restore it in 24 hours at much lower cost. Which option should the planner recommend?

A BIA finds that order fulfillment has a maximum tolerable downtime of 4 hours. Fulfillment depends on a warehouse system, which in turn depends on a central authentication service with a planned recovery time of 24 hours. What should the planner do?

During a BIA at a university, department heads say that losing the admissions portal in the application season would badly harm the university's reputation and student trust, but they cannot put a dollar figure on it. How should the planner record this impact?

An order database gets a full backup each night, and transaction logs are copied offsite every 4 hours. The sales director states that the business can lose no more than 1 hour of orders. What should the continuity planner conclude?

A trading firm states that it can tolerate losing at most 5 minutes of executed transactions after a failure. Which metric does this define, and which approach meets it?

A BIA sets the maximum tolerable downtime for online ordering at 8 hours. The IT recovery plan restores the ordering platform at a warm site in 12 hours. What should the continuity team conclude?

Finance staff at a distribution company receive emailed invoices that claim to come from a long-standing supplier. After a fraud attempt, the controller wants assurance that each invoice genuinely came from that supplier. Which security property is the controller asking for?

A courier service that moves an insurer's backup tapes offsite loses a box of tapes holding policyholder records. The insurer's managers worry most that someone could read the records. Which control would BEST have addressed the property at risk?

A network security engineer is asked by his manager to lead a forensic examination of a compromised server for possible legal action. He has never done forensic work and has no training in evidence handling. What is the MOST appropriate response?

A security consultant has one free day before a deadline. She can finish remediation work she owes a client under contract, or she can prepare a conference talk that would help raise standards across the profession. Applying the order of the ISC2 Code of Ethics canons, which should she put first?

A security manager learns that a certified colleague at another company has been selling customer data he obtained during audits. The colleague holds the same ISC2 certification she does. What should she do?

A manufacturer is selling one of its divisions, and the division's staff will move to the buyer next month. Which action is MOST important for the seller's security team as the sale closes?

A software company's enterprise customers ask for proof that it runs an information security management system certified by an accredited third party. Which standard should the company implement and be certified against?

After a breach of customer data at a mid-sized lender, the board asks who is ultimately accountable for how well the company protects that data. Which answer is correct under standard governance practice?

A manufacturing firm's security program keeps stalling because business unit leaders ignore requirements issued by the IT security team. Which change would MOST improve adoption of the program?

A hospital's chief nursing officer says the worst outcome for its medication ordering system would be a dose silently changed between the prescriber and the pharmacy. Which security property is the PRIMARY concern?

The security team publishes tips on building memorable passphrases, such as combining unrelated words. Staff may use the tips or not, as long as their passwords meet the mandatory password standard. What kind of document are the tips?

Help desk staff need step-by-step instructions for verifying a caller's identity and then resetting the caller's multifactor authentication token. Which type of document should hold these instructions?

An insurer's security policy, written five years ago, names a specific firewall model and must be rewritten whenever network equipment changes. What is the BEST improvement?

A senior security analyst at a utility wants a deep understanding of why cryptographic protocols and security models work, so that she can design new controls rather than only operate existing ones. Which kind of learning fits BEST?

In a phishing simulation program, one employee has opened the simulated malicious link in four campaigns in a row. What is the MOST appropriate response?

Developers at a fintech company need hands-on skills for avoiding injection flaws in the code they write each day. Which part of a security learning program does this need?

A company sues a former sales manager for damages, claiming he took its customer list to a competitor. What standard of proof will the company normally need to meet in this civil case?

A company refers an intruder who stole its source code to prosecutors, who file criminal charges. Which standard of proof must the prosecution meet to convict?

A state insurance regulator opens an inquiry into whether an insurer met the state's data security rules and requests records of the insurer's controls. Which description of the situation and response is MOST accurate?

A developer at a small software firm writes original source code for a scheduling application. Which protection applies to the code automatically when it is written, without any application or registration?

A sales representative's laptop holding customer records is stolen from a car. The disk was protected by strong full-disk encryption, and the key was never stored on or with the laptop. Under most US state breach notification laws, what is the likely result?

A US company plans to ship network appliances with strong built-in encryption to customers in several other countries. Which legal issue is MOST relevant for the security manager to raise with counsel before shipment?

A US email marketing firm sends campaigns to the customer list of a German retailer. The firm uses the list only as the retailer instructs and for no purpose of its own. Under GDPR, what is the US firm's role?

The founder of an e-commerce startup believes PCI DSS is a federal law and asks the security lead what happens if the company does not comply. Which description of PCI DSS is MOST accurate?

External auditors at a publicly traded US manufacturer spend much of their review on access controls and change management for the systems that produce the company's financial statements. Which law MOST directly drives this focus?

A beverage startup's competitive edge is a drink formula that it never wants published and wants to protect for as long as the company exists. Which form of intellectual property protection fits BEST?

A company plans to monitor employee email for leaks of confidential data. Which step BEST reduces the legal and privacy risk of the monitoring program?

An audit at a distributor finds that one accounts payable clerk can create new vendors in the system and also approve payments to them. Which principle should be applied to fix this?

An employee moved from the finance team to marketing two years ago and still has her full finance system access in addition to her new marketing access. What is the BEST control to prevent this from happening again?

A product manager resigns on good terms to join another company. Apart from removing his access on his last day, which step BEST protects the company's confidential information as he leaves?

A network team finds core switches offered by an unknown online seller at 60% below the usual price. The team lead is tempted by the savings. What should the security manager recommend?

An online retailer is outsourcing its customer contact center, which will handle customers' payment card details. Which contract provision BEST supports ongoing assurance about the provider's security?

A government contractor is worried that servers could be tampered with while being shipped from the manufacturer. Which practice BEST addresses this risk when the servers arrive?

The owner of a low-value internal wiki decides to accept the risk of a minor flaw because fixing it would cost more than any expected loss. What should happen next?

A bank's board approves a statement that the bank will take moderate risk to launch new digital products but very little risk of breaching regulations. What does this statement BEST describe?

Over the past 10 years a hospital group has suffered 3 ransomware incidents, each costing about $200,000 to recover from. Assuming the pattern continues, what is the annualized loss expectancy for ransomware?

A marketing team wants to store customers' full card numbers so returning shoppers can reorder in one step. The analysis shows that protecting stored card data would cost far more than the feature is worth, so leadership decides not to build the feature. Which risk response is this?

In a risk workshop at an engineering firm, junior staff keep agreeing with whatever the chief architect says, so the ratings mostly reflect one opinion. Which technique BEST addresses this?

Each morning a security analyst at a credit union reviews the previous day's failed login reports for the core banking system and investigates unusual patterns. Which type of control is this review?

A logistics company posts signs at its yard saying that trespassers will be prosecuted and that the area is under surveillance. What is the PRIMARY function of the signs?

A consulting firm loses about 25 laptops a year. Each loss costs $8,000 on average, mostly in breach response. Full$${}-disk encryption would cut the average cost of a loss to$1,500 and costs $60,000 a year across the firm. What is the annual value of encryption?

A company's leadership wants to know how developed its risk management practices are today and to track progress over the next three years, from informal practices toward optimized, continuously improving ones. Which tool fits BEST?

The ALE for outages of a ticketing site caused by denial-of-service attacks is $80,000. A mitigation service would reduce the ALE to$20,000. What is the highest annual cost the company could pay for the service and still break even?

A company deployed data loss prevention six months ago to reduce the risk of customer data leaving by email. The CISO wants to show whether the risk is actually falling. What is the BEST approach?

Executives at a payroll processor are told about a significant flaw in their tax filing system. They decide to take no action, record nothing and tell no one. Which response does this describe?

A security team wants to map every way an attacker could reach the goal of reading the payroll database, with that goal at the top and the alternative paths and sub-steps branching below it. Which technique is this?

A threat model for a file server notes that a user with a standard account could exploit a flaw in a service running with system rights to gain full administrative control. Which STRIDE category is this?

A threat model for a brokerage app notes that a customer could place a large trade and later claim she never did, and the app keeps no reliable record of who submitted each order. Which STRIDE category is this?

A threat modeling team considers an attacker who signs in to a support portal with an agent's stolen password and then acts as that agent. Which STRIDE category does this threat represent?