A mid-sized company is evaluating controls to protect its intellectual property stored on a file server. The risk assessment indicates a moderate risk of unauthorized access. The security team has a limited budget and must choose a control that provides the best cost-benefit trade-off. Which control is the most cost-effective and feasible option?

Deploy a full disk encryption solution on all endpoints that access the file server.

Implement role-based access control (RBAC) on the file server and enforce least privilege.

Purchase a data loss prevention (DLP) solution to monitor and block data exfiltration.

Install a network-based intrusion detection system (IDS) to monitor traffic to the file server.

A company is deciding between two security controls to protect its customer database. Control A has a lower upfront cost but requires ongoing manual administration. Control B has a higher upfront cost but is fully automated and requires minimal ongoing effort. The company has a small security team and a limited budget. Which control should the company select?

Defer the decision until more budget is available.

Select both controls to provide defense in depth.

Control A, because the lower upfront cost fits the limited budget.

Control B, because the automation reduces the operational burden on the small team.

A company handles personal data of EU citizens and must comply with GDPR. Which of the following is a key driver for determining security requirements?

The preferences of the IT staff

The age of the company's office building

Regulatory compliance obligations

Certified Information Systems Security Professional

Domain 3Objective 3

3.3 - Select Controls Based Upon Systems Security Requirements CISSP Practice Questions (Page 3)

Part of the Security Architecture and Engineering domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 1–2 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

7concepts

13%of the exam

Questions 11–15

11application · medium
A mid-sized company is evaluating controls to protect its intellectual property stored on a file server. The risk assessment indicates a moderate risk of unauthorized access. The security team has a limited budget and must choose a control that provides the best cost-benefit trade-off. Which control is the most cost-effective and feasible option?
Select an answer first
12expert · hard
A company is deciding between two security controls to protect its customer database. Control A has a lower upfront cost but requires ongoing manual administration. Control B has a higher upfront cost but is fully automated and requires minimal ongoing effort. The company has a small security team and a limited budget. Which control should the company select?
Select an answer first
13foundation · easy
A company handles personal data of EU citizens and must comply with GDPR. Which of the following is a key driver for determining security requirements?
Select an answer first
14foundation · easy
Which international standard specifies requirements for establishing, implementing, maintaining, and improving an information security management system (ISMS)?
Select an answer first
15foundation · easy
Which framework provides a comprehensive catalog of security controls for federal information systems in the United States?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.

3.3 - Select Controls Based Upon Systems Security Requirements CISSP Practice Questions (Page 3)

Questions 11–15

A company handles personal data of EU citizens and must comply with GDPR. Which of the following is a key driver for determining security requirements?

Which international standard specifies requirements for establishing, implementing, maintaining, and improving an information security management system (ISMS)?

Which framework provides a comprehensive catalog of security controls for federal information systems in the United States?

Keep studying — Security Architecture and Engineering