Question 40 A new employee receives production privileges based solely on the job title, without manager review. What should change? Require sponsor-approved role-based access with least privilege during onboarding Trigger access recertification and removal of prior role entitlements on transfer Integrate HR departure triggers with timely access removal and session revocation Verify identity, authorize a limited visit and apply escort and visitor logging requirements Explanation Correct Answer A:Employment status alone does not establish a legitimate need for sensitive permissions. Incorrect Answers B:Mover events can create accumulated privileges even without a departure; this responds to the different circumstance in which a high-privilege operator transfers to sales and retains old administration rights, while the current case states that a new employee receives production privileges based solely on the job title, without manager review, calling for require sponsor-approved role-based access with least privilege during onboarding. C:The other scenario states that a departing privileged engineer's account remains active for a month after termination, where personnel lifecycle controls should promptly remove access when employment or role authorization ends; by contrast, the present case requires require sponsor-approved role-based access with least privilege during onboarding. D:The other scenario states that a supplier technician needs rare escorted access to a secure data center, where third-party physical access must reflect specific need, duration and accountable supervision; by contrast, the present case requires require sponsor-approved role-based access with least privilege during onboarding.
Question 41 A high-privilege operator transfers to sales and retains old administration rights. Which control is most relevant? Trigger access recertification and removal of prior role entitlements on transfer Require sponsor-approved role-based access with least privilege during onboarding Verify identity, authorize a limited visit and apply escort and visitor logging requirements Require documented contractual and confidentiality obligations before provisioning access Explanation Correct Answer A:Mover events can create accumulated privileges even without a departure. Incorrect Answers B:For the separate situation in which a new employee receives production privileges based solely on the job title, without manager review, employment status alone does not establish a legitimate need for sensitive permissions; here the stated problem requires trigger access recertification and removal of prior role entitlements on transfer. C:Third-party physical access must reflect specific need, duration and accountable supervision; it is relevant where a supplier technician needs rare escorted access to a secure data center, whereas the current facts require trigger access recertification and removal of prior role entitlements on transfer to address the stated problem. D:Hiring and vendor terms establish obligations that technical permissions cannot replace; it is relevant where a contractor starts before signing confidentiality and acceptable-use agreements, whereas the current facts require trigger access recertification and removal of prior role entitlements on transfer to address the stated problem.
Question 42 A supplier technician needs rare escorted access to a secure data center. How should personnel security handle this? Require sponsor-approved role-based access with least privilege during onboarding Coordinate preservation and production with legal and compliance teams under the applicable authority Require documented contractual and confidentiality obligations before provisioning access Verify identity, authorize a limited visit and apply escort and visitor logging requirements Explanation Correct Answer D:Third-party physical access must reflect specific need, duration and accountable supervision. Incorrect Answers A:Employment status alone does not establish a legitimate need for sensitive permissions; although this helps when a new employee receives production privileges based solely on the job title, without manager review, it leaves the current case's need to verify identity, authorize a limited visit and apply escort and visitor logging requirements unresolved. B:Regulatory requests have distinct legal scope and evidence-retention requirements; this responds to the different circumstance in which a regulator requests records relating to an ongoing investigation, while the current case states that a supplier technician needs rare escorted access to a secure data center, calling for verify identity, authorize a limited visit and apply escort and visitor logging requirements. C:This option fits a different fact pattern where a contractor starts before signing confidentiality and acceptable-use agreements: hiring and vendor terms establish obligations that technical permissions cannot replace; the current case instead requires verify identity, authorize a limited visit and apply escort and visitor logging requirements.
Question 43 A security leader knows the annual probability of a single loss is 0.2 and its expected impact is $300,000. What is the annualized expected loss? Describe credible threat events, likelihood, impact and affected business objectives Calculate an annualized loss expectancy of $60,000 before comparing response costs Transfer part of the financial impact while retaining operational and legal accountability Mitigate exposure with supported isolation, monitoring and a time-bound remediation plan Explanation Correct Answer B:ALE is expected single-loss magnitude multiplied by annual frequency; it supports, but does not decide, treatment. Incorrect Answers A:Risk analysis relates threats and vulnerabilities to consequences, not an inventory of weaknesses alone; this responds to the different circumstance in which the risk register lists only vulnerabilities, with no affected assets or business impacts, while the current case states that a security leader knows the annual probability of a single loss is 0.2 and its expected impact is $300,000, calling for calculate an annualized loss expectancy of $60,000 before comparing response costs. C:This option fits a different fact pattern where a company buys insurance covering incident response expenses: insurance can shift defined costs but does not eliminate the underlying event or statutory duties; the current case instead requires calculate an annualized loss expectancy of $60,000 before comparing response costs. D:Compensating controls reduce likelihood or impact while the residual risk remains tracked; it is relevant where a legacy application cannot be patched immediately, and leadership wants to reduce exposure, whereas the current facts require calculate an annualized loss expectancy of $60,000 before comparing response costs to address the stated problem.
Question 44 A business owner agrees to keep a moderate risk after mitigation. What must be formally recorded? Document residual risk, decision authority, rationale and review conditions Transfer part of the financial impact while retaining operational and legal accountability Mitigate exposure with supported isolation, monitoring and a time-bound remediation plan Describe credible threat events, likelihood, impact and affected business objectives Explanation Correct Answer A:Risk acceptance is an accountable business decision, not a silent vulnerability waiver. Incorrect Answers B:Insurance can shift defined costs but does not eliminate the underlying event or statutory duties; this responds to the different circumstance in which a company buys insurance covering incident response expenses, while the current case states that a business owner agrees to keep a moderate risk after mitigation, calling for document residual risk, decision authority, rationale and review conditions. C:Compensating controls reduce likelihood or impact while the residual risk remains tracked; it is relevant where a legacy application cannot be patched immediately, and leadership wants to reduce exposure, whereas the current facts require document residual risk, decision authority, rationale and review conditions to address the stated problem. D:The other scenario states that the risk register lists only vulnerabilities, with no affected assets or business impacts, where risk analysis relates threats and vulnerabilities to consequences, not an inventory of weaknesses alone; by contrast, the present case requires document residual risk, decision authority, rationale and review conditions.
Question 45 A company buys insurance covering incident response expenses. Which risk treatment does this primarily represent? Mitigate exposure with supported isolation, monitoring and a time-bound remediation plan Avoid the risk by retiring the service and removing the unnecessary exposure Transfer part of the financial impact while retaining operational and legal accountability Calculate an annualized loss expectancy of $60,000 before comparing response costs Explanation Correct Answer C:Insurance can shift defined costs but does not eliminate the underlying event or statutory duties. Incorrect Answers A:Compensating controls reduce likelihood or impact while the residual risk remains tracked; although this helps when a legacy application cannot be patched immediately, and leadership wants to reduce exposure, it leaves the current case's need to transfer part of the financial impact while retaining operational and legal accountability unresolved. B:For the separate situation in which a low-value obsolete service creates an unacceptable external attack surface, ending the activity removes the associated exposure instead of adding layers around an unneeded system; here the stated problem requires transfer part of the financial impact while retaining operational and legal accountability. D:ALE is expected single-loss magnitude multiplied by annual frequency; it supports, but does not decide, treatment; although this helps when a security leader knows the annual probability of a single loss is 0.2 and its expected impact is $300,000, it leaves the current case's need to transfer part of the financial impact while retaining operational and legal accountability unresolved.
Question 46 A legacy application cannot be patched immediately, and leadership wants to reduce exposure. What treatment is appropriate? Transfer part of the financial impact while retaining operational and legal accountability Use forward-looking key risk indicators tied to risk appetite and dependency health Describe credible threat events, likelihood, impact and affected business objectives Mitigate exposure with supported isolation, monitoring and a time-bound remediation plan Explanation Correct Answer D:Compensating controls reduce likelihood or impact while the residual risk remains tracked. Incorrect Answers A:Insurance can shift defined costs but does not eliminate the underlying event or statutory duties; although this helps when a company buys insurance covering incident response expenses, it leaves the current case's need to mitigate exposure with supported isolation, monitoring and a time-bound remediation plan unresolved. B:Operational activity metrics alone do not demonstrate actual risk reduction; it is relevant where security dashboards show patch counts improving while exposure to a critical supplier is growing, whereas the current facts require mitigate exposure with supported isolation, monitoring and a time-bound remediation plan to address the stated problem. C:For the separate situation in which the risk register lists only vulnerabilities, with no affected assets or business impacts, risk analysis relates threats and vulnerabilities to consequences, not an inventory of weaknesses alone; here the stated problem requires mitigate exposure with supported isolation, monitoring and a time-bound remediation plan.
Question 47 A low-value obsolete service creates an unacceptable external attack surface. Which risk treatment may be strongest? Transfer part of the financial impact while retaining operational and legal accountability Use forward-looking key risk indicators tied to risk appetite and dependency health Avoid the risk by retiring the service and removing the unnecessary exposure Describe credible threat events, likelihood, impact and affected business objectives Explanation Correct Answer C:Ending the activity removes the associated exposure instead of adding layers around an unneeded system. Incorrect Answers A:Insurance can shift defined costs but does not eliminate the underlying event or statutory duties; it is relevant where a company buys insurance covering incident response expenses, whereas the current facts require avoid the risk by retiring the service and removing the unnecessary exposure to address the stated problem. B:The other scenario states that security dashboards show patch counts improving while exposure to a critical supplier is growing, where operational activity metrics alone do not demonstrate actual risk reduction; by contrast, the present case requires avoid the risk by retiring the service and removing the unnecessary exposure. D:The other scenario states that the risk register lists only vulnerabilities, with no affected assets or business impacts, where risk analysis relates threats and vulnerabilities to consequences, not an inventory of weaknesses alone; by contrast, the present case requires avoid the risk by retiring the service and removing the unnecessary exposure.
Question 48 The risk register lists only vulnerabilities, with no affected assets or business impacts. What assessment improvement is needed? Document residual risk, decision authority, rationale and review conditions Mitigate exposure with supported isolation, monitoring and a time-bound remediation plan Avoid the risk by retiring the service and removing the unnecessary exposure Describe credible threat events, likelihood, impact and affected business objectives Explanation Correct Answer D:Risk analysis relates threats and vulnerabilities to consequences, not an inventory of weaknesses alone. Incorrect Answers A:This option fits a different fact pattern where a business owner agrees to keep a moderate risk after mitigation: risk acceptance is an accountable business decision, not a silent vulnerability waiver; the current case instead requires describe credible threat events, likelihood, impact and affected business objectives. B:Compensating controls reduce likelihood or impact while the residual risk remains tracked; although this helps when a legacy application cannot be patched immediately, and leadership wants to reduce exposure, it leaves the current case's need to describe credible threat events, likelihood, impact and affected business objectives unresolved. C:The other scenario states that a low-value obsolete service creates an unacceptable external attack surface, where ending the activity removes the associated exposure instead of adding layers around an unneeded system; by contrast, the present case requires describe credible threat events, likelihood, impact and affected business objectives.
Question 49 Security dashboards show patch counts improving while exposure to a critical supplier is growing. What should management monitor? Avoid the risk by retiring the service and removing the unnecessary exposure Transfer part of the financial impact while retaining operational and legal accountability Use forward-looking key risk indicators tied to risk appetite and dependency health Mitigate exposure with supported isolation, monitoring and a time-bound remediation plan Explanation Correct Answer C:Operational activity metrics alone do not demonstrate actual risk reduction. Incorrect Answers A:Ending the activity removes the associated exposure instead of adding layers around an unneeded system; although this helps when a low-value obsolete service creates an unacceptable external attack surface, it leaves the current case's need to use forward-looking key risk indicators tied to risk appetite and dependency health unresolved. B:Insurance can shift defined costs but does not eliminate the underlying event or statutory duties; although this helps when a company buys insurance covering incident response expenses, it leaves the current case's need to use forward-looking key risk indicators tied to risk appetite and dependency health unresolved. D:This option fits a different fact pattern where a legacy application cannot be patched immediately, and leadership wants to reduce exposure: compensating controls reduce likelihood or impact while the residual risk remains tracked; the current case instead requires use forward-looking key risk indicators tied to risk appetite and dependency health.
Question 50 Before designing an Internet-connected payment API, the team wants to identify trust-boundary threats. What should it do? Analyze tampering of messages and verify integrity protection across that boundary Evaluate elevation-of-privilege and authentication/authorization bypass paths Revisit models when architecture and trust relationships change, using multidisciplinary review Draw data flows and trust boundaries, then analyze threats against each interaction Explanation Correct Answer D:Structured modeling identifies attack opportunities before implementation, rather than relying on post-deployment alerts. Incorrect Answers A:The other scenario states that an attacker may alter telemetry crossing a low-trust broker boundary, where unauthorized data modification differs from spoofing identity or denying service; by contrast, the present case requires draw data flows and trust boundaries, then analyze threats against each interaction. B:The other scenario states that a system exposes an admin API that can be invoked anonymously, where a public high-privilege entry point threatens access boundaries more directly than only service performance; by contrast, the present case requires draw data flows and trust boundaries, then analyze threats against each interaction. C:For the separate situation in which a development team is concerned about missing threat scenarios in one microservice, threat models require iteration and reviewer perspectives as assumptions evolve; here the stated problem requires draw data flows and trust boundaries, then analyze threats against each interaction.
