CIS CIS Security & Compliance 2

Question 1

Which security practice ensures that system access is reviewed and revoked when no longer needed during a CIS implementation?

Accepted Answer

Access recertification or user access review

Answer

Access recertification is a periodic review process where managers confirm that users still require their current access levels, and revoke access that is no longer needed.

Question 2

In CIS security planning, encryption 'at rest' means:

Accepted Answer

Data stored on disk or in a database is encrypted to protect it from physical theft

Answer

Encryption at rest protects stored data by encoding it so that physical access to storage media does not expose readable information.

Question 3

A CIS implementation specialist is reviewing a system for SOX compliance. SOX primarily relates to:

Accepted Answer

Financial reporting controls and audit trails for publicly traded companies

Answer

The Sarbanes-Oxley Act (SOX) requires publicly traded companies to maintain accurate financial records with strong internal controls and audit trails.

Question 4

What is the purpose of an audit log in a CIS implementation?

Accepted Answer

To record a tamper-evident history of who accessed or changed what and when

Answer

Audit logs provide a chronological, tamper-evident record of system events, user actions, and data changes used for security monitoring and compliance investigations.

Question 5

Which approach to vulnerability management requires assigning a severity score to discovered vulnerabilities to prioritize remediation in a CIS system?

Accepted Answer

CVSS-based risk scoring

Answer

The Common Vulnerability Scoring System (CVSS) provides a standardized numerical score (0–10) indicating a vulnerability's severity, helping teams prioritize which issues to fix first.

(CIS) Certified Implementation Specialist Practice Test

(CIS) Certified Implementation Specialist Practice Test

CIS CIS Security & Compliance 2