CISSP 2023 Practice Questions (Scenario-Based) - Domain 1: Security & Risk Management

[@Tradmos]

This is a surprising answer... Accepting the risk is a big gamble when a critical vulnerability is already identified.

[@InfoSecGuardians]

Considering the criticality of application for daily operation, Business may accept the Risk. While accepting the risk is not always the best long-term solution, in some cases, it may be a pragmatic approach to managing the immediate impact of a critical vulnerability until a permanent fix can be implemented. This approach may be accompanied by temporary measures to mitigate the risk and a plan to implement a permanent fix as soon as feasible.

[@MrNight12pm]

Q3: Right answer : B) Conduct an internal investigation and notify affected customers

[@Tradmos]

Question 4. You cannot provide a secure approved device for the executive, and enforce BYOD at the same time.

[@InfoSecGuardians]

Organizations today operate in a hybrid environment where Organizational Devices and BYOD go hand in hand. Enforcing the BYOD policy and providing a secure, approved device for the executive is the most appropriate action because it ensures security compliance, mitigates risks, maintains consistency in policy enforcement, and helps the executive understand the importance of security practices. In practice, Senior Executives are provided with secure devices (eg. Mobile, iPad etc) while they also use BYOD for ease of business.

[@ArunKumar-jy7cg]

Very useful content 😊

[@anupanu-yc5kq]

Can not agree with Q3 answer, you can not kick someone out & that is not your responsibility. it should be option C, When dealing with a data breach involving sensitive customer information, the first priority should be to understand the full scope of the breach by conducting an internal investigation. This helps determine the extent of the leak, the specific data involved, and the employee's actions. Based on the investigation findings, the organization can take appropriate steps to mitigate damage and ensure future breaches don’t occur. Notifying affected customers is critical in maintaining transparency and complying with regulatory requirements (e.g., GDPR, CCPA) to ensure the organization’s legal obligations are met.

[@JaredEvans]

For Question #5, CISSP preaches that the safety of humans is the #1 priority, no matter what. Why isn't B) Relocating the data center to fire-resistant building, not the best answer? This would warrant immediate action. Developing and testing a DRP would take a while, and humans would still be at risk due to the high possibility of a fire event.

[@faboge]

Why is question 1 not a compliance risk? I keep seeing PCI DSS

[@InfoSecGuardians]

In this scenario the organization may be in compliance with PCI DSS but that doesn't guarantee a protection against a breach. Whenever a business is performed, there are always certain risk involved which in this case was vulnerability in payment system. There is always a time lag between vulnerability identification to its remediation and during this time, the system will be at a risk.

[@pgunwant]

I find explanations not very correct here. Accepting the risk despite knowing critical vulnerability ? Forcing BYOD policy first and then providing separate devices to the executive. I really couldn’t understand it.

[@InfoSecGuardians]

Thanks for your review. Let us understand the rationale. For the First comment:- Risk Acceptance is always decided by Business. While may rate the Issue / Vulnerability as Critical, Business nay still continue with the Risk to cease opportunity. Classic example is WFH during Pandemic. Security is a support function to Business and not a Business in itself. Second Comment:- Organizations today operate in a hybrid environment where Organizational Devices and BYOD go hand in hand. Enforcing the BYOD policy and providing a secure, approved device for the executive is the most appropriate action because it ensures security compliance, mitigates risks, maintains consistency in policy enforcement, and helps the executive understand the importance of security practices. In practice, Senior Executives are provided with secure devices (eg. Mobile, iPad etc) while they also use BYOD for ease of business.

[@danielumeh3610]

Qts 2 .. I disagree with the answer. Let me support my case with this example. Imagine having a car that was recalled due to braking system. Would you accept the risk and keep driving the car? Please I'm here to learn, teach me more. Thank you!

[@InfoSecGuardians]

Thanks @danielumeh3610 for your review. Could you please imagine the same car carrying a critical patient to hospital ? Risk is always proportionate to the Reward. The question mentions "application is critical for daily operations". Always remember, as a CISSP you are only consulted (RACI matrix) but the actual decision will be with the Business. t.me/CisspInfosecGuardians

[@tareknageeb5650]

I disagree too. I think the question lacks details to be sure about an accurate answer. Even in your answer you say the organisation "may" choose ... The answer depends on how "critical" the vulnerability is (software is internet reachable, easy to find/exploit vulnerability, ...etc), and what risks it presents (e.g. attacker might overtaken the whole internal network or just one server, reputation can be ruined, all customer data can be compromised, ..etc). For example, if the risk cost is higher than the "daily operations" disruption costs on the company, avoiding the risk (until the issue is mitigated) could be a better decision. Also "mitigating the risk" could be good, for example, if a FW or a WAF can help controlling some of the risk.

[@tundeayeni4477]

you can also imagine arround a danger zone whereby you need to drive temporarily to save avoid the danger zone... this is what is meant by accepting the risk in the short term while working arround mitigation on the long term.

[@bidztime]

@@InfoSecGuardians I will still mitigate the risk in several ways. I would drive slower and more carefully. I will make sure that if we have an accident the passengers are better secured secured. I will have my flashers on. I will try to take a route with less traffic etc. etc. and definitely once I drop the patient off I will use a different vehicle to ride patients as risk mitigation strategy, until the recall is taken care of. Accepting a risk in this situation is absolutely a big negative.

[@khanget]

Some of the answers are not correct in this video can't agree to the given explanation to the answer.

[@AhsanKhawaja-l4e]

Not accurate