Question 10 A remote sensor sends confidential readings over an untrusted wireless link. What primary objective does encrypting the link support? Use validated digital signatures with controlled private keys and trustworthy verification records Preserve confidentiality of readings in transit with appropriately authenticated encryption Strengthen identity-bound authentication and event attribution before relying on action provenance Establish integrity controls including authorized change checks and tamper-evident records Explanation Correct Answer B:Encryption prevents unauthorized observers from learning the transmitted measurements; authorization remains separate. Incorrect Answers A:This option fits a different fact pattern where a financial application must prove that a signed payment instruction originated from its claimed author and was not later repudiated: signatures connect authenticated signing keys to integrity-protected messages and support nonrepudiation evidence; the current case instead requires preserve confidentiality of readings in transit with appropriately authenticated encryption. C:The other scenario states that a confidential briefing was sent from a valid account, but auditors cannot prove which human initiated it, where authenticity requires dependable identity binding, not just possession of a shared account; by contrast, the present case requires preserve confidentiality of readings in transit with appropriately authenticated encryption. D:Integrity is about preventing or detecting unauthorized modification, independent of confidentiality; this responds to the different circumstance in which a warehouse has excellent secrecy controls but unauthorized inventory updates go undetected, while the current case states that a remote sensor sends confidential readings over an untrusted wireless link, calling for preserve confidentiality of readings in transit with appropriately authenticated encryption.
Question 11 A multinational security team proposes a new platform without identifying any business objective it supports. What should be done first? Map the proposed control objectives to board-approved business risks and strategy Present aggregated risk trends, appetite deviations and treatment ownership in business terms Route the risk decision to the formally authorized business risk owner with documented advice Select and tailor the framework against relevant obligations, risks and business context Explanation Correct Answer A:Security governance should support organizational goals and accepted risk, not purchase technology in isolation. Incorrect Answers B:For the separate situation in which a steering committee reviews technical incidents but has no view of increasing enterprise exposure, executive governance needs decision-relevant exposure and accountability, not only counts of technical alerts; here the stated problem requires map the proposed control objectives to board-approved business risks and strategy. C:Security personnel analyze and recommend; delegated business accountability must accept material residual risk; it is relevant where a new product team wants to waive all security review to meet a launch milestone, whereas the current facts require map the proposed control objectives to board-approved business risks and strategy to address the stated problem. D:Frameworks are reference structures; suitability requires mapping actual requirements before implementation; this responds to the different circumstance in which a company adopts a security framework solely because a competitor did, without checking regulatory scope, while the current case states that a multinational security team proposes a new platform without identifying any business objective it supports, calling for map the proposed control objectives to board-approved business risks and strategy.
Question 12 Following a merger, two companies maintain conflicting security decision authorities. What governance action is most appropriate? Define accountable ownership, decision rights and exception authority across the combined organization Map the proposed control objectives to board-approved business risks and strategy Present aggregated risk trends, appetite deviations and treatment ownership in business terms Route the risk decision to the formally authorized business risk owner with documented advice Explanation Correct Answer A:Clear governance separates approval, operation and oversight and removes contradictory accountability. Incorrect Answers B:Security governance should support organizational goals and accepted risk, not purchase technology in isolation; this responds to the different circumstance in which a multinational security team proposes a new platform without identifying any business objective it supports, while the current case states that following a merger, two companies maintain conflicting security decision authorities, calling for define accountable ownership, decision rights and exception authority across the combined organization. C:Executive governance needs decision-relevant exposure and accountability, not only counts of technical alerts; this responds to the different circumstance in which a steering committee reviews technical incidents but has no view of increasing enterprise exposure, while the current case states that following a merger, two companies maintain conflicting security decision authorities, calling for define accountable ownership, decision rights and exception authority across the combined organization. D:For the separate situation in which a new product team wants to waive all security review to meet a launch milestone, security personnel analyze and recommend; delegated business accountability must accept material residual risk; here the stated problem requires define accountable ownership, decision rights and exception authority across the combined organization.
Question 13 A company adopts a security framework solely because a competitor did, without checking regulatory scope. What correction is needed? Select and tailor the framework against relevant obligations, risks and business context Retain documented assessments, reasonable control decisions, follow-up and periodic verification Route the risk decision to the formally authorized business risk owner with documented advice Define accountable ownership, decision rights and exception authority across the combined organization Explanation Correct Answer A:Frameworks are reference structures; suitability requires mapping actual requirements before implementation. Incorrect Answers B:Due diligence is a demonstrable investigation and monitoring process supporting an appropriate standard of care; this responds to the different circumstance in which an executive asks how to demonstrate due diligence rather than merely claim due care, while the current case states that a company adopts a security framework solely because a competitor did, without checking regulatory scope, calling for select and tailor the framework against relevant obligations, risks and business context. C:Security personnel analyze and recommend; delegated business accountability must accept material residual risk; this responds to the different circumstance in which a new product team wants to waive all security review to meet a launch milestone, while the current case states that a company adopts a security framework solely because a competitor did, without checking regulatory scope, calling for select and tailor the framework against relevant obligations, risks and business context. D:Clear governance separates approval, operation and oversight and removes contradictory accountability; although this helps when following a merger, two companies maintain conflicting security decision authorities, it leaves the current case's need to select and tailor the framework against relevant obligations, risks and business context unresolved.
Question 14 An executive asks how to demonstrate due diligence rather than merely claim due care. What evidence best supports this? Select and tailor the framework against relevant obligations, risks and business context Retain documented assessments, reasonable control decisions, follow-up and periodic verification Map the proposed control objectives to board-approved business risks and strategy Present aggregated risk trends, appetite deviations and treatment ownership in business terms Explanation Correct Answer B:Due diligence is a demonstrable investigation and monitoring process supporting an appropriate standard of care. Incorrect Answers A:For the separate situation in which a company adopts a security framework solely because a competitor did, without checking regulatory scope, frameworks are reference structures; suitability requires mapping actual requirements before implementation; here the stated problem requires retain documented assessments, reasonable control decisions, follow-up and periodic verification. C:The other scenario states that a multinational security team proposes a new platform without identifying any business objective it supports, where security governance should support organizational goals and accepted risk, not purchase technology in isolation; by contrast, the present case requires retain documented assessments, reasonable control decisions, follow-up and periodic verification. D:This option fits a different fact pattern where a steering committee reviews technical incidents but has no view of increasing enterprise exposure: executive governance needs decision-relevant exposure and accountability, not only counts of technical alerts; the current case instead requires retain documented assessments, reasonable control decisions, follow-up and periodic verification.
Question 15 A new product team wants to waive all security review to meet a launch milestone. Who should decide on residual material risk? Route the risk decision to the formally authorized business risk owner with documented advice Select and tailor the framework against relevant obligations, risks and business context Map the proposed control objectives to board-approved business risks and strategy Define accountable ownership, decision rights and exception authority across the combined organization Explanation Correct Answer A:Security personnel analyze and recommend; delegated business accountability must accept material residual risk. Incorrect Answers B:This option fits a different fact pattern where a company adopts a security framework solely because a competitor did, without checking regulatory scope: frameworks are reference structures; suitability requires mapping actual requirements before implementation; the current case instead requires route the risk decision to the formally authorized business risk owner with documented advice. C:Security governance should support organizational goals and accepted risk, not purchase technology in isolation; although this helps when a multinational security team proposes a new platform without identifying any business objective it supports, it leaves the current case's need to route the risk decision to the formally authorized business risk owner with documented advice unresolved. D:Clear governance separates approval, operation and oversight and removes contradictory accountability; it is relevant where following a merger, two companies maintain conflicting security decision authorities, whereas the current facts require route the risk decision to the formally authorized business risk owner with documented advice to address the stated problem.
Question 16 A steering committee reviews technical incidents but has no view of increasing enterprise exposure. What reporting improvement is most appropriate? Select and tailor the framework against relevant obligations, risks and business context Present aggregated risk trends, appetite deviations and treatment ownership in business terms Define accountable ownership, decision rights and exception authority across the combined organization Route the risk decision to the formally authorized business risk owner with documented advice Explanation Correct Answer B:Executive governance needs decision-relevant exposure and accountability, not only counts of technical alerts. Incorrect Answers A:For the separate situation in which a company adopts a security framework solely because a competitor did, without checking regulatory scope, frameworks are reference structures; suitability requires mapping actual requirements before implementation; here the stated problem requires present aggregated risk trends, appetite deviations and treatment ownership in business terms. C:Clear governance separates approval, operation and oversight and removes contradictory accountability; although this helps when following a merger, two companies maintain conflicting security decision authorities, it leaves the current case's need to present aggregated risk trends, appetite deviations and treatment ownership in business terms unresolved. D:The other scenario states that a new product team wants to waive all security review to meet a launch milestone, where security personnel analyze and recommend; delegated business accountability must accept material residual risk; by contrast, the present case requires present aggregated risk trends, appetite deviations and treatment ownership in business terms.
Question 17 A payroll service will replicate employee identifiers into a foreign jurisdiction. What should the security manager do before migration? Negotiate appropriate privacy, security assurance, notification and audit obligations before onboarding Obtain privacy and legal assessment of lawful transfer basis, locality and applicable safeguards Perform a jurisdiction-specific obligations and gap assessment alongside certifications Engage counsel to reconcile jurisdiction, preservation duties and lawful disclosure before transfer Explanation Correct Answer B:Cross-border processing obligations depend on data subjects, jurisdictions and contractual arrangements. Incorrect Answers A:Contractual controls clarify accountability and support compliance when data processing is delegated; it is relevant where a vendor stores regulated personal data yet its contract contains no audit or breach-notification terms, whereas the current facts require obtain privacy and legal assessment of lawful transfer basis, locality and applicable safeguards to address the stated problem. C:Framework certification is useful evidence, not a substitute for statutory compliance analysis; although this helps when a manager assumes a security certification automatically satisfies every country's privacy law, it leaves the current case's need to obtain privacy and legal assessment of lawful transfer basis, locality and applicable safeguards unresolved. D:A technical team cannot resolve conflicting legal obligations by releasing records to whichever party asks first; it is relevant where investigators in two countries demand the same cloud records under conflicting orders, whereas the current facts require obtain privacy and legal assessment of lawful transfer basis, locality and applicable safeguards to address the stated problem.
Question 18 Investigators in two countries demand the same cloud records under conflicting orders. What is the prudent first step? Engage counsel to reconcile jurisdiction, preservation duties and lawful disclosure before transfer Perform a jurisdiction-specific obligations and gap assessment alongside certifications Inventory components and have legal and engineering review license and export-control obligations Map each record type to applicable legal duties, business purpose and defensible deletion timelines Explanation Correct Answer A:A technical team cannot resolve conflicting legal obligations by releasing records to whichever party asks first. Incorrect Answers B:For the separate situation in which a manager assumes a security certification automatically satisfies every country's privacy law, framework certification is useful evidence, not a substitute for statutory compliance analysis; here the stated problem requires engage counsel to reconcile jurisdiction, preservation duties and lawful disclosure before transfer. C:Software licensing and cryptographic export restrictions require evidence-based review before distribution; this responds to the different circumstance in which a product includes third-party encryption libraries with unknown redistributable licenses, while the current case states that investigators in two countries demand the same cloud records under conflicting orders, calling for engage counsel to reconcile jurisdiction, preservation duties and lawful disclosure before transfer. D:For the separate situation in which the organization is developing a retention schedule for customer requests in multiple regions, one arbitrary global period can violate both minimum-retention and data-minimization requirements; here the stated problem requires engage counsel to reconcile jurisdiction, preservation duties and lawful disclosure before transfer.
Question 19 A product includes third-party encryption libraries with unknown redistributable licenses. Which action reduces legal exposure? Obtain privacy and legal assessment of lawful transfer basis, locality and applicable safeguards Engage counsel to reconcile jurisdiction, preservation duties and lawful disclosure before transfer Inventory components and have legal and engineering review license and export-control obligations Map each record type to applicable legal duties, business purpose and defensible deletion timelines Explanation Correct Answer C:Software licensing and cryptographic export restrictions require evidence-based review before distribution. Incorrect Answers A:For the separate situation in which a payroll service will replicate employee identifiers into a foreign jurisdiction, cross-border processing obligations depend on data subjects, jurisdictions and contractual arrangements; here the stated problem requires inventory components and have legal and engineering review license and export-control obligations. B:This option fits a different fact pattern where investigators in two countries demand the same cloud records under conflicting orders: a technical team cannot resolve conflicting legal obligations by releasing records to whichever party asks first; the current case instead requires inventory components and have legal and engineering review license and export-control obligations. D:One arbitrary global period can violate both minimum-retention and data-minimization requirements; although this helps when the organization is developing a retention schedule for customer requests in multiple regions, it leaves the current case's need to inventory components and have legal and engineering review license and export-control obligations unresolved.
Question 20 A vendor stores regulated personal data yet its contract contains no audit or breach-notification terms. What should procurement require? Negotiate appropriate privacy, security assurance, notification and audit obligations before onboarding Obtain privacy and legal assessment of lawful transfer basis, locality and applicable safeguards Engage counsel to reconcile jurisdiction, preservation duties and lawful disclosure before transfer Map each record type to applicable legal duties, business purpose and defensible deletion timelines Explanation Correct Answer A:Contractual controls clarify accountability and support compliance when data processing is delegated. Incorrect Answers B:Cross-border processing obligations depend on data subjects, jurisdictions and contractual arrangements; it is relevant where a payroll service will replicate employee identifiers into a foreign jurisdiction, whereas the current facts require negotiate appropriate privacy, security assurance, notification and audit obligations before onboarding to address the stated problem. C:This option fits a different fact pattern where investigators in two countries demand the same cloud records under conflicting orders: a technical team cannot resolve conflicting legal obligations by releasing records to whichever party asks first; the current case instead requires negotiate appropriate privacy, security assurance, notification and audit obligations before onboarding. D:This option fits a different fact pattern where the organization is developing a retention schedule for customer requests in multiple regions: one arbitrary global period can violate both minimum-retention and data-minimization requirements; the current case instead requires negotiate appropriate privacy, security assurance, notification and audit obligations before onboarding.
