7.15 - Address Personnel Safety and Security Concerns CISSP Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   A security analyst notices that a long-tenured employee with access to sensitive customer data has been printing large volumes of documents late at night, despite a paperless initiative. The employee has also been seen taking photos of the server room. Which action should the analyst take first?

   • APlace the employee under continuous video surveillance without informing anyone.
   • BConfront the employee directly to ask for an explanation.
   • CReport the observations to the security manager or incident response team through the established reporting channel.
   • DRevoke the employee's access to the server room immediately.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company uses push-based 2FA for all employees. An attacker has been sending a high volume of authentication requests to a specific user, hoping the user will approve one to stop the notifications. Which additional control would best mitigate this attack?

   • AIncrease the timeout for authentication requests so users have more time to decide.
   • BRequire users to enter a number displayed on the login screen into the authenticator app.
   • CAllow users to set a personal identification number (PIN) to approve push requests.
   • DSend authentication requests via SMS instead of push notifications.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A journalist is assigned to cover a story in a country where the government is known to detain foreign journalists. The journalist will carry a laptop with sensitive sources. The security team must balance the need for the journalist to communicate with the newsroom and the risk of device seizure at the border. Which approach best addresses this trade-off?

   • AProvide a laptop with full-disk encryption and instruct the journalist to not power it on until reaching the destination.
   • BProvide a burner phone and a pre-configured laptop with no sensitive data, and use encrypted cloud storage accessed via a secure connection.
   • CAdvise the journalist to refuse to hand over devices at the border, citing press freedom.
   • DAllow the journalist to use personal devices and rely on a strong password to protect the data.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Why is it important for employees to report suspicious behavior that may indicate an insider threat?

   • ATo satisfy regulatory requirements for incident reporting
   • BTo enable early detection and mitigation before a security incident occurs
   • CTo document the behavior for potential legal action against the employee
   • DTo ensure the employee is removed from the organization immediately
   Reveal Solution Discussion Select an answer first