6.5 Document and Manage Compliance Exceptions ISSMP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A university's research department uses a specialized instrument that cannot be updated to comply with the university's data protection standard. The instrument is not connected to the internet and is only accessible from a dedicated lab workstation. What should the security manager do to manage this compliance exception?

   • AIgnore the non-compliance because the instrument is not internet-connected.
   • BReplace the instrument with a compliant model immediately.
   • CConnect the instrument to the internet to allow automatic updates.
   • DDocument the physical isolation and access restrictions as compensating controls in an exception request.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A manufacturing company's quality-control system uses an outdated operating system that is not compliant with the company's security policy. The security manager has documented the compensating controls and prepared the exception request. To whom should the security manager report the risk waiver for approval?

   • AThe system administrator of the quality-control system
   • BThe external auditor for the company
   • CThe Chief Information Security Officer (CISO)
   • DThe quality-control department manager
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A government contractor uses a legacy system that does not meet the required security control baseline. The security manager has documented the compensating controls and prepared the exception request. What is the next step in the exception management process?

   • AImplement additional compensating controls.
   • BNotify all employees of the exception.
   • CArchive the exception request for audit purposes.
   • DReport the risk waiver request to the appropriate authority for approval.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of reporting a risk waiver request to the appropriate authority?

   • ATo inform the authority of the non-compliance for awareness only
   • BTo obtain formal approval for the exception
   • CTo transfer responsibility for the risk to the authority
   • DTo document the non-compliance for the audit trail
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A logistics company has a legacy fleet-tracking system that does not support the required encryption standard. The system is isolated on a separate network and monitored by a security operations center. The compliance team needs to document this exception. What should be included in the exception request?

   • AA statement that the system will be replaced within one year.
   • BThe names of all employees who use the system.
   • CThe compensating controls (network isolation and monitoring) and the residual risk.
   • DThe cost of upgrading the fleet-tracking system.
   Reveal Solution Discussion Select an answer first