CISSP Security and Risk Management 4

Question 1

Which governance framework uses a RACI matrix and focuses on aligning IT processes with business goals using 37 IT processes across five domains?

Accepted Answer

COBIT 2019

Answer

COBIT (Control Objectives for Information and Related Technologies) provides a governance framework with process models and uses RACI charts to define accountability.

Question 2

An organization decides to discontinue a product line because the regulatory compliance cost exceeds potential profit. This represents which risk response?

Accepted Answer

Risk avoidance

Answer

Risk avoidance eliminates the risk entirely by ceasing the activity that creates the risk exposure.

Question 3

Which legal concept holds that an organization can be found liable if it fails to implement security controls that a 'reasonable person' would consider adequate?

Accepted Answer

Due care / Due diligence

Answer

Due care (doing the right thing) combined with due diligence (proving you did it) form the legal standard that organizations must meet to avoid negligence claims.

Question 4

A Recovery Time Objective (RTO) differs from a Recovery Point Objective (RPO) in that RTO defines:

Accepted Answer

The maximum tolerable downtime before a system must be restored

Answer

RTO specifies the maximum acceptable length of time a system can be offline, while RPO defines the maximum acceptable amount of data loss.

Question 5

Which privacy principle requires that personal data collected for one specified purpose should not be used for a different, incompatible purpose?

Accepted Answer

Purpose limitation

Answer

Purpose limitation, a core GDPR principle, restricts use of personal data to the original stated purpose unless new consent is obtained.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Security and Risk Management 4