What is the primary focus of an administrative investigation?

Gathering evidence to support criminal prosecution

Determining facts to support corrective action for policy violations

Assessing compliance with voluntary industry standards

Resolving a legal dispute between two private parties

What is the primary purpose of maintaining a chain of custody?

To ensure that evidence is stored in a secure location

To determine the legal standard of proof for the investigation

To document the collection, handling, and storage of evidence to prove its integrity

To ensure that only authorized personnel have access to evidence

A security professional is supporting a criminal investigation into a cyberattack. The professional discovers that a company executive was involved in the attack. The executive asks the professional to delete evidence in exchange for a promotion. What is the most appropriate action?

Refuse the request and report the executive's conduct to law enforcement

Ignore the request and continue the investigation without reporting

Accept the promotion but do not delete the evidence

Delete the evidence but keep a copy for personal protection

A security analyst discovers that an employee has been accessing customer records without a business need. The company's legal counsel decides this is an internal matter and directs the analyst to gather evidence for a potential disciplinary hearing. Which type of investigation is being conducted, and what is the primary evidentiary standard that will apply?

Administrative investigation; preponderance of the evidence

Criminal investigation; proof beyond a reasonable doubt

Civil investigation; preponderance of the evidence

Regulatory investigation; clear and convincing evidence

An organization is conducting an administrative investigation into an employee's alleged policy violations. The employee is a remote worker in another country. What legal or ethical consideration is most important for the security team to address?

The employee's right to a jury trial

The requirement to notify law enforcement before starting the investigation

The need to obtain a warrant before accessing company-owned devices

Jurisdiction and applicable privacy laws in the employee's location

Certified Information Systems Security Professional

Domain 1Objective 5

1.5 - Understand Requirements for Investigation Types (i.e., Administrative, Criminal, Civil, Regulatory, Industry Standards) CISSP Practice Questions (Page 6)

Part of the Security and Risk Management domain, which accounts for 16% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 1–2 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

10concepts

16%of the exam

Questions 26–30

26foundation · easy
What is the primary focus of an administrative investigation?
Select an answer first
27foundation · easy
What is the primary purpose of maintaining a chain of custody?
Select an answer first
28expert · hard
A security professional is supporting a criminal investigation into a cyberattack. The professional discovers that a company executive was involved in the attack. The executive asks the professional to delete evidence in exchange for a promotion. What is the most appropriate action?
Select an answer first
29application · medium
A security analyst discovers that an employee has been accessing customer records without a business need. The company's legal counsel decides this is an internal matter and directs the analyst to gather evidence for a potential disciplinary hearing. Which type of investigation is being conducted, and what is the primary evidentiary standard that will apply?
Select an answer first
30application · medium
An organization is conducting an administrative investigation into an employee's alleged policy violations. The employee is a remote worker in another country. What legal or ethical consideration is most important for the security team to address?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.