6.5 Document and Manage Compliance Exceptions ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Who is typically the designated decision-maker authorized to approve a risk waiver?

   • AThe external auditor
   • BThe Chief Information Security Officer (CISO) or designated risk owner
   • CThe system administrator
   • DThe help desk manager
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A healthcare provider uses a legacy imaging system that does not comply with the latest security standard. The security team has implemented compensating controls and documented them in an exception request. The request has been submitted to the CISO. What is the final step to complete the exception management process?

   • AObtain the CISO's formal approval of the risk waiver.
   • BMonitor the system for any security incidents.
   • CUpdate the system's documentation with the exception details.
   • DInform the system vendor of the exception.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A hospital uses a legacy patient-monitoring system that cannot be patched to meet the security baseline. The system is isolated on a separate VLAN with strict firewall rules and monitored by a 24/7 SOC. The compliance officer wants to document this as an exception. However, the hospital's policy requires that exceptions be approved by the CISO within 30 days. The security manager has identified the controls but has not yet documented them. What should the security manager do FIRST?

   • ASubmit the exception request directly to the CISO for approval.
   • BDocument the compensating controls and residual risk in a formal exception request.
   • CImplement additional compensating controls before documenting the exception.
   • DWait for the next quarterly compliance review to discuss the exception.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A retail company needs to maintain a legacy point-of-sale (POS) system that does not meet the current PCI DSS requirement for encryption. The security team has implemented network segmentation and monitoring as compensating controls. The exception request has been submitted. What is the final step to formally manage this exception?

   • AObtain the authorized approval of the risk waiver from the designated decision-maker.
   • BImplement additional monitoring on the POS system.
   • CDocument the compensating controls in the exception request.
   • DNotify the payment card brands of the exception.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial firm uses a legacy application that does not support multi-factor authentication (MFA). To mitigate the risk, the security team has implemented network-level access controls and enhanced logging. The compliance officer asks for a formal exception request. What must be included in the exception request?

   • AA list of all users who have access to the legacy application.
   • BA description of the compensating controls and the residual risk after their implementation.
   • CThe name of the vendor and the cost of upgrading the application.
   • DA commitment to replace the application within a specific timeframe.
   Reveal Solution Discussion Select an answer first