6.5 Document and Manage Compliance Exceptions ISSMP Practice Questions (Page 4)

Questions 16–19

1. 16foundation · easy

   During a compliance audit, a system is found to be non-compliant with a security standard. The system owner identifies an existing compensating control that reduces the risk to an acceptable level. What is the primary purpose of identifying such existing controls or workarounds?

   • ATo prove that the non-compliance is intentional and justified
   • BTo eliminate the need for any further compliance documentation
   • CTo demonstrate that the residual risk is mitigated to an acceptable level
   • DTo automatically grant the compliance exception without further review
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A utility company has a legacy SCADA system that cannot be updated to meet the current security policy. The system is air-gapped and only accessible via a jump host with multi-factor authentication. What should the security manager do to manage this compliance exception?

   • AConnect the SCADA system to the corporate network for easier monitoring.
   • BRequest approval from the SCADA system administrator.
   • CIgnore the non-compliance because the system is air-gapped.
   • DDocument the air-gap and jump host controls in an exception request.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the significance of obtaining authorized approval for a risk waiver?

   • AIt automatically brings the system into compliance
   • BIt transfers the risk to the approving authority
   • CIt eliminates the need for any further risk management
   • DIt formally accepts the risk and documents the decision
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A defense contractor uses a legacy system that does not comply with the required security control baseline. The security team has implemented compensating controls and documented them in an exception request. The request has been submitted to the designated approval authority. What is the final step to complete the exception management process?

   • AUpdate the system's security plan with the exception details.
   • BInform the system users of the exception.
   • CObtain the formal approval of the risk waiver from the designated authority.
   • DConduct a vulnerability scan of the legacy system.
   Reveal Solution Discussion Select an answer first