Perform Operational Risk Analysis CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is integrating its customer-facing web application with a legacy on-premises system that contains sensitive customer data. The integration will be done via a new API. The security team is concerned about the risk of data exposure. The company has a strict requirement that customer data must not be cached or stored outside the on-premises environment. What is the most important control to implement?

   • AUse a VPN to connect the web application to the on-premises system.
   • BConduct penetration testing on the API.
   • CEnsure the API only returns the minimum necessary data and does not allow caching of responses.
   • DImplement strong authentication for the API.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a common operational risk when integrating a system with a third-party API?

   • AThe API may change its interface or deprecate features, breaking the integration
   • BThe API will eliminate the need for authentication
   • CThe API will require the system to be moved to a different cloud provider
   • DThe API will automatically increase the system's storage capacity
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is integrating its new inventory management system with a third-party logistics provider's API. The integration will transmit order and shipment data. The security team is performing a risk analysis. What is the most important risk to evaluate?

   • AThe cost of the third-party API subscription.
   • BThe number of endpoints the third-party API exposes.
   • CThe third-party's marketing strategy.
   • DThe confidentiality and integrity of data transmitted between the systems, including authentication and encryption mechanisms.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which operational risk is most directly associated with configuration drift in a production environment?

   • AThe system's performance improves without any intervention
   • BThe system automatically scales to handle increased load
   • CThe system becomes more compliant with regulatory standards
   • DThe system becomes less secure over time as manual changes deviate from the approved baseline
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Why is it important for end users to receive training on the proper handling of sensitive data?

   • ATo prevent accidental disclosure or unauthorized sharing of confidential information
   • BTo allow them to bypass security controls when needed
   • CTo help them write security policies
   • DTo enable them to perform system administration tasks
   Reveal Solution Discussion Select an answer first