1.8 - Contribute to and Enforce Personnel Security Policies and Procedures CISSP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company has a long-term contract with a managed security services provider (MSSP). The MSSP's performance has been declining, and a recent audit found that the MSSP failed to patch a critical vulnerability in a timely manner. The company's security team wants to terminate the contract, but the legal team warns that termination may be costly and could leave the company without security monitoring. What should the company do?

   • AIssue a formal notice of non-compliance, require a corrective action plan, and increase audit frequency.
   • BReduce the MSSP's scope and hire a second provider to cover the gaps.
   • CContinue with the MSSP and hope the performance improves.
   • DTerminate the contract immediately and bring security monitoring in-house.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   During the onboarding process, what is the primary security reason for provisioning new employees with access rights based on the principle of least privilege?

   • ATo simplify the IT department's user administration tasks
   • BTo minimize the potential damage from accidental or malicious misuse of excessive permissions
   • CTo comply with legal requirements for data retention
   • DTo ensure employees can access all systems they might need in the future
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Why is it necessary to re-evaluate an employee's security clearance when they transfer to a different role?

   • ABecause the new role may require a different level of clearance or access to more sensitive information
   • BBecause the employee must be re-investigated by law enforcement for every transfer
   • CBecause the employee's personal background may have changed since hiring
   • DBecause the employee's clearance automatically expires upon any role change
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary security action that must be taken immediately upon an employee's termination?

   • ANotifying all employees of the termination
   • BRevoking all access rights and credentials
   • CConducting an exit interview to gather feedback
   • DCollecting company assets such as laptops and badges
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   When an employee transfers to a new role within the organization, what is the most important security consideration regarding their access rights?

   • AThe employee's existing access rights should remain unchanged to avoid disruption
   • BThe employee should be given administrative access to all systems to facilitate the transition
   • CAccess rights must be updated to match the new role, removing access no longer needed and granting access required for the new position
   • DThe employee must be terminated and rehired to reset all access
   Reveal Solution Discussion Select an answer first