3.3 - Select Controls Based Upon Systems Security Requirements CISSP Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company has implemented a security control that automatically restores systems to a known good state after a malware infection. This control is part of the company's incident response plan. Which type of control is this?

   • ARecovery control
   • BCorrective control
   • CPreventive control
   • DDetective control
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team has implemented a new access control system that uses biometric authentication. To validate that the control is effective, they plan to test it. Which testing approach would provide the most comprehensive validation?

   • AReview the system's configuration to ensure it matches the security policy.
   • BAttempt to authenticate with unauthorized users to see if they are rejected.
   • CTest the system with a sample of authorized users to ensure they can authenticate successfully.
   • DPerform both authorized and unauthorized authentication attempts to verify both success and rejection.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is integrating a new single sign-on (SSO) solution with its existing identity management system. The security team wants to ensure that the SSO solution does not introduce new vulnerabilities. Which action is most important during the integration phase?

   • AUse a separate set of credentials for the SSO solution to avoid sharing data.
   • BImplement the SSO solution without testing to minimize downtime.
   • CPerform a security review of the integration architecture and test the authentication flow.
   • DDisable the existing identity management system to avoid conflicts.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A retail company is required to comply with the General Data Protection Regulation (GDPR) for its European customers. The company stores personal data in a cloud database. Which control is necessary to meet GDPR requirements for data protection?

   • AEncrypt personal data at rest and in transit.
   • BImplement a data retention policy that deletes data after a specified period.
   • CRequire multi-factor authentication for all database administrators.
   • DConduct regular penetration tests on the database.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is developing a new customer relationship management (CRM) system. The security team is at the beginning of the control selection process. What is the first step they should take to ensure the controls align with the organization's security requirements?

   • APurchase a security information and event management (SIEM) system to monitor all activities.
   • BSelect a security framework, such as NIST SP 800-53, and apply all baseline controls.
   • CImplement the most expensive controls to ensure maximum security.
   • DConduct a risk assessment to identify threats and vulnerabilities.
   Reveal Solution Discussion Select an answer first