1.5 - Understand Requirements for Investigation Types (i.e., Administrative, Criminal, Civil, Regulatory, Industry Standards) CISSP Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which investigation type typically has the highest burden of proof?

   • AAdministrative investigation
   • BCriminal investigation
   • CCivil investigation
   • DRegulatory investigation
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which legal standard is typically associated with civil investigations?

   • AProbable cause
   • BClear and convincing evidence
   • CBeyond a reasonable doubt
   • DPreponderance of evidence
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is a key responsibility of a security professional in supporting an investigation?

   • ADetermining the guilt or innocence of the accused
   • BConducting the investigation independently without input from other departments
   • CProviding relevant evidence and cooperating with investigators
   • DEnsuring the investigation remains confidential from all parties
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company discovers that a former employee exfiltrated proprietary source code and is selling it to a competitor. The company's legal team wants to pursue criminal charges. What is the most important consideration for the security team when collecting evidence for this investigation?

   • ARely on witness testimony rather than digital evidence to avoid technical challenges
   • BCollect evidence quickly to prevent further loss, even if it means altering the original files
   • CPreserve the original evidence and maintain a documented chain of custody
   • DConduct the investigation internally and do not involve law enforcement until a conviction is guaranteed
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst is asked to support an administrative investigation into a manager's alleged harassment of an employee. The analyst is friends with the manager. What is the most appropriate action for the analyst to take?

   • AContinue the investigation but share findings with the manager to get their side
   • BRefuse to participate and delete any evidence they have
   • CAsk the manager for permission before providing evidence
   • DRecuse themselves from the investigation to maintain impartiality
   Reveal Solution Discussion Select an answer first