View Full ISC CISSP Exam Dumps and Practice Test Dumps.

 

Question 121

Which security control is most appropriate for ensuring that a user can access only the specific files and resources required to perform their assigned duties?

1. Least privilege
2. Job rotation
3. Mandatory vacation
4. Risk transference

Correct Answer: 1

Explanation

Least privilege requires users, applications, and processes to receive only the permissions necessary to perform their authorized functions. Limiting privileges reduces the potential damage caused by compromised accounts, malicious insiders, or accidental misuse. Permissions should be reviewed periodically because job responsibilities can change over time. Least privilege applies beyond human users and can also be implemented for service accounts, applications, and system processes. Organizations commonly combine it with role-based access control, separation of duties, and strong authentication to create layered protection around sensitive resources.

Question 122

An employee changes departments but retains access privileges associated with the previous position. Which security process should have prevented this situation?

1. Data classification
2. Account provisioning and modification
3. Media sanitization
4. Network segmentation

Correct Answer: 2

Explanation

Account provisioning and modification processes should update a user’s access when their employment status, role, department, or responsibilities change. This process is part of identity and access management and helps prevent privilege accumulation, often called privilege creep. When employees transfer positions, their previous permissions should be reviewed and removed when no longer required, while new permissions should be granted based on the new role. Automated identity governance can help organizations detect inappropriate access. Regular access reviews provide another layer of assurance that permissions remain appropriate.

Question 123

Which access control model assigns permissions according to predefined organizational roles such as manager, accountant, or system administrator?

1. Rule-based access control
2. Mandatory access control
3. Role-based access control
4. Discretionary access control

Correct Answer: 3

Explanation

Role-based access control, or RBAC, assigns permissions according to organizational roles rather than directly assigning every permission to individual users. A user receives access by being assigned to one or more roles, such as accountant, administrator, or human resources employee. RBAC can simplify administration and support least privilege when roles are carefully designed. Mandatory access control bases access on centrally enforced classifications and labels, while discretionary access control allows resource owners to control permissions. Rule-based systems make decisions according to predefined rules or conditions.

Question 124

Which access control model uses security labels and centrally enforced rules to determine whether a subject can access an object?

1. Discretionary access control
2. Mandatory access control
3. Role-based access control
4. Attribute-based access control

Correct Answer: 2

Explanation

Mandatory access control, or MAC, uses centrally managed security labels and rules to control access. Users and resource owners generally cannot arbitrarily change the security classifications or grant access outside the established policy. MAC is commonly associated with environments requiring strong information-flow restrictions, such as military or highly sensitive systems. Discretionary access control gives owners greater control over permissions, while RBAC uses organizational roles. Attribute-based access control evaluates attributes of subjects, objects, actions, and environmental conditions to make access decisions.

Question 125

A security administrator wants access decisions to consider the user’s department, device security status, location, and requested resource simultaneously. Which access control approach is most appropriate?

1. Attribute-based access control
2. Mandatory access control
3. Discretionary access control
4. Rule-based access control

Correct Answer: 1

Explanation

Attribute-based access control, or ABAC, makes authorization decisions by evaluating attributes associated with users, resources, actions, and environmental conditions. For example, an organization could permit access only when the user belongs to the finance department, uses a managed device, connects from an approved location, and requests an authorized resource. ABAC provides highly granular and context-aware decisions compared with simpler role-based models. However, its policies can become complex and require careful administration. Strong governance is necessary to prevent conflicting or overly broad authorization rules.

Question 126

Which principle requires an access control system to verify authorization every time a subject requests access to a protected resource?

1. Open design
2. Complete mediation
3. Economy of mechanism
4. Least common mechanism

Correct Answer: 2

Explanation

Complete mediation requires every access attempt to a protected resource to be checked for proper authorization. A system should not simply verify permissions once and then assume that subsequent requests remain authorized indefinitely. Implementing complete mediation helps prevent situations where access changes are ignored because an existing session or cached permission continues to provide access. Security architectures should balance this principle with performance requirements, but any optimization must not undermine authorization enforcement. Complete mediation is especially important when resources are sensitive or permissions can change during active sessions.

Question 127

Which security principle recommends keeping security mechanisms as simple and small as practical to reduce vulnerabilities and make them easier to review?

1. Open design
2. Fail-safe defaults
3. Economy of mechanism
4. Psychological acceptability

Correct Answer: 3

Explanation

Economy of mechanism recommends keeping security designs and mechanisms simple and minimal. Complex security mechanisms can contain more implementation errors, hidden dependencies, and configuration problems, making them harder to test and maintain. A simpler design is generally easier for security teams to review, audit, and understand. This principle does not mean that security should be weak or incomplete. Instead, unnecessary complexity should be avoided while still providing the required protection. Applying economy of mechanism can improve reliability and reduce the attack surface of security-critical components.

Question 128

Which principle states that a security system should not depend on keeping its implementation secret when the security design can be publicly examined?

1. Fail-safe defaults
2. Open design
3. Least privilege
4. Separation of duties

Correct Answer: 2

Explanation

The principle of open design states that security should not depend on the secrecy of the system’s design or implementation. Instead, security should remain effective even when the architecture, algorithms, and mechanisms are publicly known. Cryptographic systems are a common example because strong encryption should rely on protecting cryptographic keys rather than hiding the algorithm itself. Open design supports peer review, independent testing, and transparent security analysis. It differs from security through obscurity, where protection depends primarily on keeping implementation details secret.

Question 129

Which principle requires a system to deny access by default unless an explicit authorization permits the requested action?

1. Fail-safe defaults
2. Open design
3. Complete mediation
4. Data minimization

Correct Answer: 1

Explanation

Fail-safe defaults means that when a security decision is uncertain or a permission has not been explicitly granted, the system should default to denying access. This approach reduces the chance that configuration errors will accidentally expose protected resources. For example, a newly created account should not automatically receive access to sensitive applications simply because permissions have not yet been configured. Administrators should explicitly grant required privileges. Fail-safe defaults are particularly important in access control systems, firewall configurations, application permissions, and other security mechanisms where accidental authorization can create significant risk.

Question 130

Which control is specifically designed to prevent one employee from completing all critical steps of a sensitive financial transaction alone?

1. Job enlargement
2. Separation of duties
3. Mandatory vacation
4. Security awareness training

Correct Answer: 2

Explanation

Separation of duties divides sensitive responsibilities among multiple individuals so that one person cannot independently complete an entire high-risk process. For example, one employee may create a payment request while another approves it. This reduces opportunities for fraud, abuse, and undetected errors. Separation of duties is particularly valuable for financial transactions, privileged administration, software deployment, and other activities where excessive control by one individual could create significant risk. Organizations should also consider collusion risk because multiple individuals may potentially cooperate to bypass controls.

Question 131

A company requires administrators to take an uninterrupted two-week vacation each year so another employee can perform their duties and identify suspicious activity. Which security control is being used?

1. Job rotation
2. Mandatory vacation
3. Dual control
4. Separation of duties

Correct Answer: 2

Explanation

Mandatory vacation requires employees, particularly those handling sensitive financial or administrative responsibilities, to take an extended period away from their normal duties. During this period, another person performs the employee’s responsibilities. Suspicious activity, unauthorized transactions, hidden processes, or irregularities may become visible when someone else performs the work. Mandatory vacation is a detective-oriented personnel control rather than a technical access control. It is especially useful for reducing risks associated with fraud or abuse that might otherwise remain concealed when one person continuously controls a sensitive process.

Question 132

Which personnel security practice reduces the risk associated with a single employee possessing extensive knowledge or control over one sensitive operational process?

1. Job rotation
2. Data masking
3. Network isolation
4. Encryption

Correct Answer: 1

Explanation

Job rotation periodically moves employees between different responsibilities or positions. This can reduce dependency on a single individual and provide organizations with opportunities to identify unusual activities or process weaknesses. It can also improve employee understanding of organizational operations and support continuity when someone is unavailable. Job rotation does not replace least privilege or separation of duties; rather, it complements them. Organizations should ensure that rotated employees receive appropriate training and access based on their temporary responsibilities so that rotation itself does not create excessive privileges.

Question 133

Which security process evaluates an employee’s background before granting access to highly sensitive organizational resources?

1. Change management
2. Background screening
3. Vulnerability management
4. Data classification

Correct Answer: 2

Explanation

Background screening evaluates relevant information about an individual before granting access to sensitive systems or information. Depending on legal requirements and organizational policy, screening may include employment verification, education verification, identity checks, criminal history checks, or other appropriate investigations. The scope should be proportionate to the sensitivity of the position and performed consistently with applicable privacy and employment laws. Background screening is one part of personnel security and does not eliminate the need for access controls, monitoring, training, and ongoing review after an employee is hired.

Question 134

Which document formally defines the security expectations and responsibilities that an organization requires employees to follow when using company systems?

1. Business continuity plan
2. Disaster recovery plan
3. Acceptable use policy
4. Incident response plan

Correct Answer: 3

Explanation

An acceptable use policy defines how employees and other authorized users may use organizational systems, networks, devices, applications, and information resources. It can address prohibited activities, appropriate internet usage, handling of company information, personal device usage, monitoring expectations, and other requirements. Employees should acknowledge the policy and receive appropriate awareness training. A business continuity plan focuses on maintaining critical operations, a disaster recovery plan addresses restoration after disruptive events, and an incident response plan defines actions for handling security incidents. Policies establish organizational expectations that support consistent security behavior.

Question 135

Which document describes the minimum security requirements that a third-party service provider must satisfy before handling an organization’s sensitive information?

1. Security policy or contractual security requirements
2. Incident ticket
3. Network diagram
4. Change request

Correct Answer: 1

Explanation

Organizations should establish security requirements for third parties through appropriate policies, contracts, service agreements, and security addenda. These requirements may address access control, encryption, incident notification, vulnerability management, data handling, retention, audit rights, regulatory obligations, and breach responsibilities. Clearly documented requirements help ensure that external providers understand the organization’s expectations before accessing sensitive information. Depending on the relationship, organizations may also conduct due diligence, security assessments, audits, and continuous monitoring. Third-party risk management is important because an organization’s security can be affected by weaknesses within its suppliers and service providers.

Question 136

A vendor will process customer information on behalf of a company. Which activity should generally occur before the vendor receives access to the information?

1. Disable all monitoring
2. Conduct third-party risk assessment
3. Remove data classification labels
4. Grant unrestricted administrator access

Correct Answer: 2

Explanation

A third-party risk assessment should generally be performed before a vendor receives access to sensitive organizational information. The assessment helps identify risks associated with the vendor’s security controls, data handling practices, infrastructure, compliance obligations, and operational processes. Organizations can use questionnaires, documentation reviews, independent reports, audits, or technical assessments depending on the risk level. Contractual requirements should also establish responsibilities for protecting information and reporting incidents. Vendor access should follow least privilege and should be monitored throughout the relationship rather than evaluated only during onboarding.

Question 137

Which security activity involves identifying weaknesses in systems, determining their severity, and prioritizing them for remediation?

1. Vulnerability management
2. Incident eradication
3. Change control
4. Disaster recovery

Correct Answer: 1

Explanation

Vulnerability management is a continuous process for identifying, analyzing, prioritizing, remediating, and validating weaknesses in systems and applications. Organizations may use vulnerability scanners, penetration tests, configuration assessments, threat intelligence, and other sources to discover vulnerabilities. Prioritization should consider factors such as severity, asset importance, exploit availability, exposure, and business impact. After remediation, organizations should validate that the vulnerability has been addressed. Effective vulnerability management reduces the attack surface and helps organizations focus limited security resources on weaknesses that represent the greatest risk.

Question 138

Which vulnerability assessment method attempts to identify weaknesses by examining a system without having access to its internal source code?

1. White-box testing
2. Gray-box testing
3. Black-box testing
4. Code review

Correct Answer: 3

Explanation

Black-box testing evaluates a system from an external perspective without providing the tester with detailed knowledge of the internal implementation or source code. This approach can simulate how an external attacker might interact with the target and can reveal weaknesses exposed through interfaces, services, and application behavior. White-box testing provides extensive internal knowledge, including source code or architecture information. Gray-box testing provides partial internal knowledge. Black-box testing can provide useful attacker-perspective results, although combining multiple testing approaches may provide broader coverage.

Question 139

Which testing approach provides testers with detailed knowledge of an application’s source code and internal architecture?

1. Black-box testing
2. White-box testing
3. Blind testing
4. External auditing

Correct Answer: 2

Explanation

White-box testing gives testers extensive knowledge of the system being evaluated, which may include source code, architecture, design documentation, configuration details, and internal logic. This information allows testers to examine code paths and identify vulnerabilities that may not be visible through external testing alone. White-box testing can be particularly useful during secure software development because security weaknesses can be discovered before deployment. Black-box testing instead simulates an external perspective, while gray-box testing provides limited internal knowledge. Organizations may combine these methods for more comprehensive security assessments.

Question 140

Which software security practice requires developers to identify security requirements and risks before implementation begins?

1. Secure requirements analysis
2. Emergency change management
3. Production monitoring
4. Media destruction

Correct Answer: 1

Explanation

Secure requirements analysis incorporates security considerations into the early stages of software development. Developers and security professionals identify security requirements, regulatory obligations, data protection needs, threat scenarios, authentication requirements, authorization rules, and other relevant controls before implementation begins. Addressing security early is generally more efficient than discovering major design weaknesses after deployment. Secure requirements should continue through design, development, testing, deployment, and maintenance. This approach forms part of a secure software development lifecycle and helps ensure that security is treated as a fundamental system requirement rather than an afterthought.