CISSP Security and Risk Management 5

Question 1

Which type of security policy provides the highest-level direction and is signed by executive leadership to express management commitment to security?

Accepted Answer

Organizational (master) security policy

Answer

The organizational or master security policy is the top-level document that expresses executive commitment and sets the strategic direction for the entire security program.

Question 2

In the context of security governance, which committee typically has responsibility for approving major security investments and accepting residual risk at the enterprise level?

Accepted Answer

Executive management / board of directors

Answer

Ultimate risk ownership and acceptance authority rests with executive management or the board, who are accountable for organizational outcomes.

Question 3

Which attack surface analysis technique involves systematically identifying all entry points where untrusted data enters a system?

Accepted Answer

Attack surface mapping / threat surface analysis

Answer

Attack surface mapping catalogs all points where an adversary could interact with a system, enabling prioritized hardening of the most exposed areas.

Question 4

The Gramm-Leach-Bliley Act (GLBA) primarily requires which type of organization to protect customer financial information?

Accepted Answer

Financial institutions

Answer

GLBA mandates that banks, insurance companies, and other financial institutions implement safeguards to protect the privacy of consumer financial information.

Question 5

Which risk analysis approach assigns probability and impact using descriptive scales, is faster to perform, and is well-suited when hard data is unavailable?

Accepted Answer

Qualitative analysis

Answer

Qualitative analysis uses descriptive ratings (e.g., High/Medium/Low) based on expert opinion, making it faster but more subjective than quantitative methods.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Security and Risk Management 5