3.3 - Select Controls Based Upon Systems Security Requirements CISSP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A government contractor is required to implement security controls for a new system handling controlled unclassified information (CUI). The organization must follow a recognized framework to ensure compliance with federal regulations. Which approach should the security team take to select the appropriate controls?

   • AUse NIST SP 800-53 as the baseline and tailor the controls based on the system's categorization and risk assessment.
   • BAdopt the ISO/IEC 27001 Annex A controls as a one-size-fits-all baseline for all systems.
   • CImplement all controls from NIST SP 800-53 without modification to ensure full compliance.
   • DSelect controls from the CIS Controls list without considering the system's specific requirements.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial services company is deploying a new customer-facing web application that will process credit card transactions. The compliance team requires that cardholder data be protected both in transit and at rest. The security architect must select controls that satisfy the Payment Card Industry Data Security Standard (PCI DSS) while minimizing impact on application performance. Which control combination best meets the stated requirements?

   • AApply data masking to all cardholder data in the application and use hashing for storage.
   • BImplement TLS 1.2 or higher for all external communications and encrypt the database with AES-256.
   • CDeploy a web application firewall (WAF) and require multi-factor authentication for all administrative access.
   • DUse a VPN for all external connections and store cardholder data in an encrypted database field.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Why is it important for security controls to work cohesively with each other?

   • ATo make the system more complex
   • BTo reduce the total cost of all controls
   • CTo satisfy vendor requirements
   • DTo avoid conflicts and gaps in security coverage
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company has implemented a new security control to detect unauthorized changes to critical files. The control generates an alert when a file is modified without authorization. Which type of control is this?

   • APreventive control
   • BDeterrent control
   • CCorrective control
   • DDetective control
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A healthcare organization is implementing a new electronic health record (EHR) system. The security team has selected a set of controls, including encryption, access controls, and audit logging. During implementation, they realize that the audit logging system is not capturing events from the encryption module. What is the most appropriate action to ensure the controls work cohesively?

   • AAccept the gap and rely on the encryption module's internal logs for future audits.
   • BReplace the encryption module with one that has built-in logging.
   • CReconfigure the audit logging system to integrate with the encryption module's event sources.
   • DDisable the encryption module's own logging to reduce redundancy.
   Reveal Solution Discussion Select an answer first