Perform Operational Risk Analysis CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is deploying a new system that handles sensitive data. The system administrators will have privileged access. The compliance team requires that administrators receive training on incident response. However, the administrators are already overloaded with operational tasks. What is the most effective way to ensure they receive the necessary training without disrupting operations?

   • AAssign training to a third-party vendor and have them handle incident response.
   • BPostpone training until a security incident occurs, then provide just-in-time training.
   • CProvide concise, role-specific training modules that can be completed online at the administrator's own pace.
   • DProvide a one-time, all-day training session for all administrators.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is deploying a new system that will store personal data of customers in multiple countries. The legal team has identified that the system must comply with GDPR and CCPA. What is the most effective way to mitigate compliance risk during deployment?

   • AObtain consent from all customers to process their data.
   • BEncrypt all data to ensure compliance.
   • CImplement a comprehensive data governance program that includes data mapping, privacy policies, and procedures for fulfilling data subject rights.
   • DStore all data in a single country to simplify compliance.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a primary security risk associated with using a QA environment that contains production-like data?

   • AThe environment cannot be used for load testing
   • BUnauthorized access to sensitive data if the environment is not properly protected
   • CThe environment automatically connects to production services
   • DThe environment is slower than production
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A healthcare organization operates a staging environment that mirrors production for pre-deployment validation. The staging environment contains de-identified patient data but is accessible to a broader group of developers than production. During a recent audit, it was found that some developers had write access to the staging database. What is the most significant operational risk in this scenario?

   • AThe staging environment should be decommissioned because it duplicates production and increases attack surface.
   • BUnauthorized modification of staging data could lead to invalid test results and mask defects before production release.
   • CDe-identified data in staging is not subject to privacy regulations, so no compliance risk exists.
   • DDevelopers should be given production access to ensure they can verify fixes directly.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company has a production environment that is subject to strict regulatory requirements. The security team is conducting an operational risk assessment and has identified that some administrators have excessive privileges. The company wants to reduce the risk of unauthorized access while maintaining operational efficiency. What is the best approach?

   • AGrant all administrators full access to ensure they can handle any situation.
   • BImplement role-based access control (RBAC) to grant administrators only the privileges necessary for their job functions.
   • CRemove all administrative privileges and require a manager to perform all administrative tasks.
   • DUse shared accounts for administrative tasks to simplify management.
   Reveal Solution Discussion Select an answer first