CIS CIS Security & Compliance 2 — Questions and Answers
Question 1: Which security practice ensures that system access is reviewed and revoked when no longer needed during a CIS implementation?
- Vulnerability scanning
- Access recertification or user access review (Correct answer)
- Data encryption
- Network segmentation
Correct answer: Access recertification or user access review
Access recertification is a periodic review process where managers confirm that users still require their current access levels, and revoke access that is no longer needed.
Question 2: In CIS security planning, encryption 'at rest' means:
- Data is encrypted only during network transmission
- Data stored on disk or in a database is encrypted to protect it from physical theft (Correct answer)
- Users must rest between login attempts
- Encryption keys are rotated during system downtime
Correct answer: Data stored on disk or in a database is encrypted to protect it from physical theft
Encryption at rest protects stored data by encoding it so that physical access to storage media does not expose readable information.
Question 3: A CIS implementation specialist is reviewing a system for SOX compliance. SOX primarily relates to:
- Protecting consumer payment data
- Financial reporting controls and audit trails for publicly traded companies (Correct answer)
- Healthcare data privacy
- Export control regulations
Correct answer: Financial reporting controls and audit trails for publicly traded companies
The Sarbanes-Oxley Act (SOX) requires publicly traded companies to maintain accurate financial records with strong internal controls and audit trails.
Question 4: What is the purpose of an audit log in a CIS implementation?
- To store system configuration backups
- To record a tamper-evident history of who accessed or changed what and when (Correct answer)
- To monitor server CPU usage
- To document user training completion
Correct answer: To record a tamper-evident history of who accessed or changed what and when
Audit logs provide a chronological, tamper-evident record of system events, user actions, and data changes used for security monitoring and compliance investigations.
Question 5: Which approach to vulnerability management requires assigning a severity score to discovered vulnerabilities to prioritize remediation in a CIS system?
- Zero-trust architecture
- CVSS-based risk scoring (Correct answer)
- Network segmentation
- Data masking
Correct answer: CVSS-based risk scoring
The Common Vulnerability Scoring System (CVSS) provides a standardized numerical score (0–10) indicating a vulnerability's severity, helping teams prioritize which issues to fix first.
Question 6: In CIS implementations handling sensitive data, data masking in non-production environments is used to:
- Speed up database queries
- Replace real sensitive data with realistic but fictional data for testing purposes (Correct answer)
- Prevent users from exporting reports
- Encrypt data transmitted over the internet
Correct answer: Replace real sensitive data with realistic but fictional data for testing purposes
Data masking substitutes real sensitive values with fictional but structurally valid data so developers and testers can work without exposure to actual PII or confidential information.
CIS CIS Security & Compliance 2
Which security practice ensures that system access is reviewed and revoked when no longer needed during a CIS implementation?