Perform Operational Risk Analysis CSSLP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which control is most effective for ensuring that a system remains compliant with data protection regulations after deployment?

   • ARelying on the cloud provider's compliance certifications
   • BPerforming a one-time compliance review before go-live
   • CDisabling all logging to reduce data exposure
   • DImplementing automated monitoring and auditing of data access
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization has a production environment that is critical to its operations. The security team is conducting an operational risk assessment. Which factor is most important to consider when assessing the risk of configuration drift in production?

   • AThe physical location of the production servers.
   • BThe process for approving and documenting changes to production configurations.
   • CThe brand of the servers used in production.
   • DThe number of servers in the production environment.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is deploying a new application and has set up staging and production environments. The staging environment is used for final validation before production releases. The operations team has noticed that the staging environment's configuration has drifted from production, causing some tests to pass in staging but fail in production. What is the most effective way to address this risk?

   • AManually update the staging environment to match production before each test cycle.
   • BUse production as the staging environment to eliminate drift.
   • CImplement infrastructure as code (IaC) to manage both staging and production configurations, ensuring they are identical.
   • DIncrease the frequency of testing in production to catch issues early.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is deploying a new customer relationship management (CRM) system that will be used by sales representatives. The system will store customer personal data. The company must comply with GDPR. The sales representatives are remote and have limited time for training. What is the most effective way to ensure they understand their data protection responsibilities?

   • ARely on the IT department to handle all data protection issues, so sales representatives do not need training.
   • BProvide a short, mandatory e-learning module that covers GDPR basics, data handling best practices, and how to report a data breach.
   • CEmail a PDF document outlining GDPR requirements and ask employees to read it.
   • DConduct a full-day, in-person training session for all sales representatives.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which test scenario is most appropriate for integration testing of a system that uses an external authentication service?

   • AVerify that the authentication service is available 100% of the time
   • BVerify that the system correctly handles both successful and failed authentication responses from the service
   • CVerify that the authentication service has a user-friendly interface
   • DVerify that the authentication service is written in the same programming language as the system
   Reveal Solution Discussion Select an answer first