Perform Operational Risk Analysis CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A fintech company is preparing to deploy a new payment processing module. The module must be tested with realistic transaction data before production, but the QA environment is currently shared with another team's testing. The compliance team requires that production data never be used in non-production environments. Which approach best addresses the operational risk of testing with realistic data while maintaining compliance?

   • AUse synthetic data generation tools to create realistic but fake transaction data for QA testing.
   • BDelay testing until the other team finishes, then use the shared QA environment with production data.
   • CCopy a subset of production data to QA and immediately delete it after testing.
   • DMove the QA environment to a separate network segment to isolate it from other teams.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A software company maintains separate environments for development, testing, and production. The testing environment is used by QA testers and sometimes by developers for debugging. The production environment is strictly controlled. What is the primary operational risk of allowing developers to use the testing environment for debugging?

   • AQA testers will lose their jobs because developers are doing their work.
   • BThe testing environment will become slower due to increased usage.
   • CDevelopers may accidentally delete production data.
   • DConfiguration drift between testing and production may cause issues that only appear in production.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When integrating a new system with an external payment gateway, what is a primary security risk to assess?

   • AThe external system may have a different color scheme
   • BThe external system may be slower than expected
   • CThe external system may require a different programming language
   • DInsecure transmission of payment data between the systems
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A software company is deploying a new customer portal that will collect and store personal data. The company must comply with the California Consumer Privacy Act (CCPA). The operations team is planning the deployment. Which control is essential to meet CCPA requirements?

   • ALimit access to personal data to only the development team.
   • BImplement a process to respond to consumer requests for access, deletion, and opt-out of sale of personal information.
   • CEncrypt all personal data at rest and in transit.
   • DConduct regular penetration testing of the portal.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is deploying a new customer relationship management (CRM) system. The system administrators will have privileged access to production servers and customer data. The compliance team requires that administrators understand their responsibilities regarding data privacy. What is the most effective way to ensure administrators are prepared for their role?

   • AProvide generic security awareness training that all employees receive.
   • BRequire administrators to sign a non-disclosure agreement and provide no further training.
   • CProvide role-based training covering privileged access handling, data privacy obligations, and incident response procedures before granting access.
   • DGrant access immediately and provide training only if a security incident occurs.
   Reveal Solution Discussion Select an answer first