7.1 - Understand and Comply with Investigations CISSP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   When documenting investigative findings, what is the most important characteristic of the language used in the report?

   • ATechnical and detailed
   • BObjective and factual
   • CPersuasive and conclusive
   • DConcise and brief
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An investigator is interviewing a witness who may have seen an employee access a secure area. Which interview technique is most effective in obtaining accurate information?

   • AInterrupt the witness to clarify details immediately.
   • BConduct the interview in a group setting with other witnesses.
   • CAsk open-ended questions and let the witness describe the events in their own words.
   • DAsk leading questions that suggest the expected answer.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   After completing an investigation, the security team must present findings to senior management. What is the most important aspect of the presentation to ensure it is legally defensible?

   • AUse technical jargon to show expertise.
   • BInclude all evidence and the chain of custody documentation.
   • CProvide only the conclusions without supporting details.
   • DPresent a verbal summary without written documentation.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An organization is investigating a potential policy violation involving the use of personal email to send confidential data. The investigator has access to the employee's work computer and email logs. Which combination of evidence is most likely to prove the violation?

   • AA colleague's statement that the employee often uses personal email.
   • BThe employee's testimony denying the action.
   • CThe employee's browser history showing visits to a webmail site.
   • DEmail logs showing the confidential data was sent to a personal email address, and the employee's computer showing access to that email account.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is investigating a data breach that may have involved an insider. The team needs to gather information without alerting the suspected employee. Which investigative technique is most appropriate in this situation?

   • AIssue a written warning to the employee about the investigation.
   • BPerform passive surveillance of the employee's network activity.
   • CAsk the employee's colleagues to monitor their behavior.
   • DConduct a formal interview with the employee immediately.
   Reveal Solution Discussion Select an answer first