Read each question and choose an answer before opening its explanation. The rationale explains why the keyed response best meets the scenario and why attractive alternatives fall short.
Question 1·Objective 1.1: Professional and organizational ethics
A security director confirms that a reportable breach occurred. An executive instructs the director to omit material facts from the regulator notification to protect an upcoming acquisition. What is the director's BEST response?
- A.Document the concern and escalate through legal and governance channels while ensuring required reporting remains accurate
- B.Publish the available incident details publicly without further consultation
- C.Follow the executive's instruction because management owns organizational risk
- D.Delay the available reporting until the acquisition is complete
Show answer and explanation
Best answer: A. Document the concern and escalate through legal and governance channels while ensuring required reporting remains accurate
Professional duties and organizational governance require truthful compliance. Documented escalation preserves accountability while legal counsel determines the required and appropriately scoped disclosure.
A: Professional duties and organizational governance require truthful compliance. Documented escalation preserves accountability while legal counsel determines the required and appropriately scoped disclosure.
B: Uncontrolled disclosure can violate confidentiality, privacy, evidence-handling, and authorized communication requirements.
C: This choice depends on the mistaken assumption that management authority outweighs the stated professional and ethical duty.
D: This leaves the identified exposure untreated and postpones a decision that the scenario requires now.
Question 2·Objective 1.12: Awareness, education, training, emerging topics, and program effectiveness
All employees completed annual phishing training, yet credential submissions during simulations have not declined. Which measure would BEST help determine whether the program is changing behavior?
- A.The number of training slides viewed
- B.The percentage of employees who signed the policy
- C.Trends in reporting, repeat failures, and credential submission by risk group
- D.The amount spent on the training platform
Show answer and explanation
Best answer: C. Trends in reporting, repeat failures, and credential submission by risk group
Behavioral trends segmented by risk group measure whether people recognize and respond to phishing, rather than merely completing an activity.
A: Slides viewed is an activity measure, not an outcome.
B: This choice depends on the mistaken assumption that participation or activity metrics alone demonstrate improved security behavior.
C: Behavioral trends segmented by risk group measure whether people recognize and respond to phishing, rather than merely completing an activity.
D: Cost does not establish effectiveness.
Question 3·Objective 1.3: Security governance, business alignment, roles, control frameworks, due care, and due diligence
A new CISO inherits dozens of security projects, each justified by a different technical team. Funding is insufficient for all of them, and executives cannot explain which business risks the projects address. What should the CISO do FIRST?
- A.Fund the projects with the most severe vendor ratings
- B.Divide the budget equally among technical teams
- C.Map business objectives and material risks to security outcomes before prioritizing the portfolio
- D.Prioritize projects that deploy the newest controls
Show answer and explanation
Best answer: C. Map business objectives and material risks to security outcomes before prioritizing the portfolio
Governance begins with business objectives, risk, and accountable priorities. That mapping creates defensible criteria for selecting projects and measuring outcomes.
A: Supplier involvement does not transfer the organization's accountability or prove that supplier evidence meets its requirements.
B: Equal allocation is not risk-based prioritization.
C: Governance begins with business objectives, risk, and accountable priorities. That mapping creates defensible criteria for selecting projects and measuring outcomes.
D: Technology novelty is not a business justification.
Question 4·Objective 1.4: Cybercrime, breach, intellectual-property, import/export, privacy, transborder-data, contractual, legal, regulatory, and industry requirements
A global company plans to centralize employee records from several countries in one cloud region. The encryption design is complete, but applicable transfer restrictions have not been identified. What should occur BEFORE migration approval?
- A.Identify the relevant jurisdictions, data roles, transfer requirements, and permitted transfer mechanism
- B.Increase encryption key length for every record
- C.Obtain consent from the cloud provider's administrators
- D.Delete the records immediately after migration
Show answer and explanation
Best answer: A. Identify the relevant jurisdictions, data roles, transfer requirements, and permitted transfer mechanism
Transborder processing must first be scoped to the applicable jurisdictions, roles, and legal transfer requirements. Technical safeguards alone do not establish lawful processing.
A: Transborder processing must first be scoped to the applicable jurisdictions, roles, and legal transfer requirements. Technical safeguards alone do not establish lawful processing.
B: This selects a technical mechanism before resolving the governing requirement and may address only one part of the scenario.
C: Provider administrator consent is irrelevant to employee-data transfer authority.
D: Immediate deletion defeats the stated business purpose and may violate retention duties.
Question 5·Objective 1.6: Policies, standards, procedures, and guidelines
An organization has approved a policy requiring sensitive data to be encrypted. It now needs a mandatory enterprise rule specifying approved algorithms and minimum key sizes. Which document should contain this rule?
- A.Guideline
- B.Procedure
- C.Standard
- D.Risk register
Show answer and explanation
Best answer: C. Standard
A standard translates policy intent into mandatory, repeatable technical requirements such as approved algorithms and key sizes.
A: This choice depends on the mistaken assumption that documentation type and mandatory authority do not affect enforceability.
B: This choice depends on the mistaken assumption that documentation type and mandatory authority do not affect enforceability.
C: A standard translates policy intent into mandatory, repeatable technical requirements such as approved algorithms and key sizes.
D: This choice depends on the mistaken assumption that documentation type and mandatory authority do not affect enforceability.
Question 6·Objective 1.7: Business continuity requirements, business impact analysis, and external dependencies
A business impact analysis lists a customer portal as requiring recovery within four hours, but it does not identify the identity provider or external payment service on which the portal depends. What should the continuity manager do NEXT?
- A.Purchase a hot site for the portal immediately
- B.Set every supporting service to a four-hour recovery objective without consultation
- C.Validate the business process, dependency chain, and recovery requirements with process owners and providers
- D.Remove external services from the analysis because the organization does not operate them
Show answer and explanation
Best answer: C. Validate the business process, dependency chain, and recovery requirements with process owners and providers
Recovery feasibility depends on supporting services. Validating the dependency chain and requirements with accountable owners must precede selecting or imposing recovery solutions.
A: A site cannot ensure recovery when critical dependencies remain unknown.
B: Derived objectives require validation of business need and provider capability.
C: Recovery feasibility depends on supporting services. Validating the dependency chain and requirements with accountable owners must precede selecting or imposing recovery solutions.
D: This choice depends on the mistaken assumption that recovery priorities can be set without validating impacts and dependencies.
Question 7·Objective 1.9: Risk identification, analysis, treatment, controls, assessment, monitoring, reporting, maturity, and frameworks
A company plans to move regulated customer data to a software-as-a-service provider. The provider will not permit customers to perform onsite audits, but it supplies a recent independent assurance report. The business owner wants to approve the service immediately because the migration is behind schedule. What should the security leader do FIRST?
- A.Reject the provider because customers cannot conduct onsite audits
- B.Compare the assurance report's scope, results, and exceptions with the organization's security requirements and risk criteria
- C.Transfer the remaining risk by purchasing additional cyber insurance
- D.Approve the migration and schedule a risk assessment after implementation
Show answer and explanation
Best answer: B. Compare the assurance report's scope, results, and exceptions with the organization's security requirements and risk criteria
The organization should first determine whether the available independent evidence addresses its requirements and whether identified exceptions produce risk outside its established criteria. That analysis gives the accountable risk owner a sound basis for treatment or acceptance. The absence of an onsite audit right is a relevant limitation, but it does not by itself establish that the provider must be rejected.
A: Rejection may eventually be appropriate, but making that decision before evaluating the available assurance evidence and applicable requirements skips the risk assessment.
B: The organization should first determine whether the available independent evidence addresses its requirements and whether identified exceptions produce risk outside its established criteria. That analysis gives the accountable risk owner a sound basis for treatment or acceptance. The absence of an onsite audit right is a relevant limitation, but it does not by itself establish that the provider must be rejected.
C: Insurance can transfer part of the financial impact, but it neither evaluates the provider's controls nor eliminates regulatory and operational responsibilities.
D: This grants approval before requirements and residual risk are evaluated through the accountable governance process.
Question 8·Objective 1.1: Professional and organizational ethics
A security manager learns that a favored supplier offered a personal benefit during an active control-selection process. What should the manager do FIRST?
- A.Disclose the conflict and recuse from the decision
- B.Accept because the supplier is already approved
- C.Continue silently if the choice is technically sound
- D.Ask the supplier to provide the benefit after award
Show answer and explanation
Best answer: A. Disclose the conflict and recuse from the decision
Disclosure and recusal protect impartial governance and professional integrity.
A: Disclosure and recusal protect impartial governance and professional integrity.
B: Approval before requirements and residual risk are evaluated bypasses due diligence and accountable risk acceptance.
C: This choice depends on the mistaken assumption that management authority outweighs the stated professional and ethical duty.
D: Reliance on a supplier does not transfer the organization's accountability or establish that the supplier evidence satisfies its requirements.
Question 9·Objective 1.2: Confidentiality, integrity, availability, authenticity, and nonrepudiation
A legal team must prove that an archived contract has not changed since execution. Which control BEST supports this requirement?
- A.Encrypt the archive with a shared password
- B.Verify a trusted timestamped digital signature
- C.Store two unverified copies
- D.Restrict the file name from changing
Show answer and explanation
Best answer: B. Verify a trusted timestamped digital signature
A validated signature and trusted timestamp provide integrity and evidence tied to the signing event.
A: Selecting a technical control before confirming requirements and risk may address only one part of the scenario and can leave the governing issue unresolved.
B: A validated signature and trusted timestamp provide integrity and evidence tied to the signing event.
C: This choice depends on the mistaken assumption that a related security property is sufficient for the stated requirement.
D: This choice depends on the mistaken assumption that a related security property is sufficient for the stated requirement.
Question 10·Objective 1.3: Security governance, business alignment, roles, control frameworks, due care, and due diligence
Executives request a security dashboard containing hundreds of technical alerts. What should the CISO do FIRST?
- A.Export every SIEM field
- B.Rank teams by alert volume
- C.Define business-risk decisions the dashboard must support
- D.Remove the available qualitative measures
Show answer and explanation
Best answer: C. Define business-risk decisions the dashboard must support
Governance reporting should begin with the decisions and risks executives own.
A: This choice depends on the mistaken assumption that local ownership removes the need for enterprise governance and oversight.
B: This choice depends on the mistaken assumption that local ownership removes the need for enterprise governance and oversight.
C: Governance reporting should begin with the decisions and risks executives own.
D: This choice depends on the mistaken assumption that local ownership removes the need for enterprise governance and oversight.
Continue studying Security and Risk Management
Review the complete Domain 1 guide, then mix this material with the other seven domains in an adaptive mock exam.