3.3 - Select Controls Based Upon Systems Security Requirements CISSP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When evaluating candidate security controls, which factor is most important to consider alongside cost?

   • AThe effectiveness of the control in mitigating the identified risk
   • BThe color of the control's user interface
   • CThe popularity of the control among other organizations
   • DThe number of features the control offers
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A government agency is required to comply with FISMA and is using NIST SP 800-53 as its control framework. The agency has a system with a moderate impact level. The security team is selecting controls and must balance compliance with budget constraints. Which approach is most appropriate?

   • AApply the high baseline controls to ensure maximum security, regardless of cost.
   • BSelect controls from ISO/IEC 27001 instead, as it is more cost-effective.
   • CApply the moderate baseline controls from NIST SP 800-53 and tailor them based on the system's specific risk assessment.
   • DUse the low baseline controls to save money, since the system is not high impact.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team has implemented a new data classification policy and associated controls. To validate that the controls are effective, they plan to conduct a review. Which validation activity would provide the most reliable evidence that the controls meet the intended security requirements?

   • ACheck the audit logs for any unauthorized access attempts.
   • BPerform a vulnerability scan of the systems that store classified data.
   • CReview the data classification labels and access permissions on a sample of files.
   • DInterview the data owners to ask if they believe the controls are working.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the difference between verification and validation of security controls?

   • AVerification is a one-time activity; validation is continuous
   • BVerification is done by external auditors; validation is done by internal staff
   • CVerification tests the control's performance; validation tests its cost
   • DVerification ensures the control is implemented correctly; validation ensures it meets the security requirements
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A global company is deploying a new application that processes personal data of EU citizens. The company must comply with GDPR, which requires data protection by design and by default. The application will be hosted in a public cloud with data residency in the EU. The security architect must select controls that meet GDPR requirements while balancing cost and performance. Which control set is the most appropriate?

   • AImplement encryption for data at rest and in transit, and enforce strict access controls based on least privilege.
   • BUse a private cloud to ensure data never leaves the EU, and implement strong authentication.
   • CDeploy a data loss prevention (DLP) solution and conduct regular penetration tests.
   • DImplement all controls from ISO/IEC 27001 Annex A to ensure comprehensive compliance.
   Reveal Solution Discussion Select an answer first