6.3 - Collect Security Process Data (e.g., Technical and Administrative) CISSP Practice Questions (Page 2)

Questions 6–10

1. 6expert · medium

   A security manager is designing a dashboard to present security metrics to the board. The board wants to see both the effectiveness of security controls and the level of risk exposure. Which combination of metrics would BEST serve this purpose?

   • AKPIs such as number of security incidents and KRIs such as number of security incidents
   • BKPIs such as backup success rate and KRIs such as backup success rate
   • CKPIs such as training completion rate and KRIs such as training completion rate
   • DKPIs such as patch compliance percentage and KRIs such as number of critical vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which type of data is most directly associated with Account Management Data Collection for security monitoring?

   • AFirewall rule change approval forms
   • BLogs of user account creation, modification, and deletion events
   • CAntivirus signature update logs
   • DData loss prevention incident reports
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A system administrator is asked to grant a contractor temporary access to a sensitive project repository. The organization's policy requires management approval for such access. What evidence should the administrator collect and retain to demonstrate compliance with this policy?

   • AAn email from the project manager approving the access request
   • BA copy of the access request form signed by the contractor
   • CA formal approval record from the change management system, including the approver's name and date
   • DA verbal confirmation from the department head
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A multinational company's security team is implementing a new identity governance tool. The compliance officer requires evidence that access reviews are conducted regularly and that any discrepancies are resolved. The team wants to automate the collection of this evidence. Which data source should be the PRIMARY input for this automation?

   • AFirewall and proxy logs showing user activity patterns
   • BUser account lifecycle and access certification records from the identity management system
   • CHelp desk tickets related to password resets
   • DVulnerability scan reports from the latest quarterly assessment
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization's backup policy requires that all backups be verified for recoverability on a quarterly basis. The backup administrator has been performing test restores, but the security team wants to automate the collection of this verification data. Which approach would BEST automate this process?

   • AConfigure the backup software to send an email notification when a backup job completes
   • BReview the backup logs for 'success' status messages
   • CUse a script that performs a test restore, validates the data, and logs the results to a central monitoring system
   • DManually document the results of each test restore in a spreadsheet
   Reveal Solution Discussion Select an answer first