Chapter 1
Security and Risk Management (Domain 1)

SUBDOMAINS

• 1.1 Understand, adhere to, and promote professional ethics
• 1.2 Understand and apply security concepts
• 1.3 Evaluate and apply security governance principles
• 1.4 Determine compliance and other requirements
• 1.5 Understand legal and regulatory issues that pertain to information security in a holistic context
• 1.6 Understand requirements for investigation types (i.e., administrative, criminal, civil, regulatory, industry standards)
• 1.7 Develop, document, and implement security policy, standards, procedures, and guidelines
• 1.8 Identify, analyze, and prioritize Business Continuity (BC) requirements
• 1.9 Contribute to and enforce personnel security policies and procedures
• 1.10 Understand and apply risk management concepts
• 1.11 Understand and apply threat modeling concepts and methodologies
• 1.12 Apply Supply Chain Risk Management (SCRM) concepts
• 1.13 Establish and maintain a security awareness, education, and training program

1. Alyssa is responsible for her organization's security awareness program. She is concerned that changes in technology may make the content outdated. What control can she put in place to protect against this risk?
   1. Gamification
   2. Computer-based training
   3. Content reviews
   4. Live training
2. Gavin is creating a report to management on the results of his most recent risk assessment. In his report, he would like to identify the remaining level of risk to the organization after adopting security controls. What term best describes this current level of risk?
   1. Inherent risk
   2. Residual risk
   3. Control risk
   4. Mitigated risk
3. Francine is a security specialist for an online service provider in the United States. She recently received a claim from a copyright holder that a user is storing information on her service that violates the third party's copyright. What law governs the actions that Francine must take?
   1. Copyright Act
   2. Lanham Act
   3. Digital Millennium Copyright Act
   4. Gramm Leach Bliley Act
4. FlyAway Travel has offices in both the European Union (EU) and the United States and transfers personal information between those offices regularly. They have recently received a request from an EU customer requesting that their account be terminated. Under the General Data Protection Regulation (GDPR), which requirement for processing personal information states that individuals may request that their data no longer be disseminated or processed?
   1. The right to access
   2. Privacy by design
   3. The right to be forgotten
   4. The right of data portability
5. After conducting a qualitative risk assessment of her organization, Sally recommends purchasing cybersecurity breach insurance. What type of risk response behavior is she recommending?
   1. Accept
   2. Transfer
   3. Reduce
   4. Reject
6. Which one of the following elements of information is not considered personally identifiable information that would trigger most United States (U.S.) state data breach laws?
   1. Student identification number
   2. Social Security number
   3. Driver's license number
   4. Credit card number
7. Renee is speaking to her board of directors about their responsibilities to review cybersecurity controls. What rule requires that senior executives take personal responsibility for information security matters?
   1. Due diligence rule
   2. Personal liability rule
   3. Prudent man rule
   4. Due process rule
8. Henry recently assisted one of his co-workers in preparing for the CISSP exam. During this process, Henry disclosed confidential information about the content of the exam, in violation of Canon IV of the Code of Ethics: “Advance and protect the profession.” Who may bring ethics charges against Henry for this violation?
   1. Anyone may bring charges.
   2. Any certified or licensed professional may bring charges.
   3. Only Henry's employer may bring charges.
   4. Only the affected employee may bring charges.
9. Wanda is working with one of her organization's European Union business partners to facilitate the exchange of customer information. Wanda's organization is located in the United States. What would be the best method for Wanda to use to ensure GDPR compliance?
   1. Binding corporate rules
   2. Privacy Shield
   3. Standard contractual clauses
   4. Safe harbor
10. Yolanda is the chief privacy officer for a financial institution and is researching privacy requirements related to customer checking accounts. Which one of the following laws is most likely to apply to this situation?
    1. GLBA
    2. SOX
    3. HIPAA
    4. FERPA
11. Tim's organization recently received a contract to conduct sponsored research as a government contractor. What law now likely applies to the information systems involved in this contract?
    1. FISMA
    2. PCI DSS
    3. HIPAA
    4. GISRA
12. Chris is advising travelers from his organization who will be visiting many different countries overseas. He is concerned about compliance with export control laws. Which of the following technologies is most likely to trigger these regulations?
    1. Memory chips
    2. Office productivity applications
    3. Hard drives
    4. Encryption software
13. Bobbi is investigating a security incident and discovers that an attacker began with a normal user account but managed to exploit a system vulnerability to provide that account with administrative rights. What type of attack took place under the STRIDE threat model?
    1. Spoofing
    2. Repudiation
    3. Tampering
    4. Elevation of privilege
14. You are completing your business continuity planning effort and have decided that you want to accept one of the risks. What should you do next?
    1. Implement new security controls to reduce the risk level.
    2. Design a disaster recovery plan.
    3. Repeat the business impact assessment.
    4. Document your decision-making process.
15. You are completing a review of the controls used to protect a media storage facility in your organization and would like to properly categorize each control that is currently in place. Which of the following control categories accurately describe a fence around a facility? (Select all that apply.)
    1. Physical
    2. Detective
    3. Deterrent
    4. Preventive
16. Tony is developing a business continuity plan and is having difficulty prioritizing resources because of the difficulty of combining information about tangible and intangible assets. What would be the most effective risk assessment approach for him to use?
    1. Quantitative risk assessment
    2. Qualitative risk assessment
    3. Neither quantitative nor qualitative risk assessment
    4. Combination of quantitative and qualitative risk assessment
17. Vincent believes that a former employee took trade secret information from his firm and brought it with him to a competitor. He wants to pursue legal action. Under what law could he pursue charges?
    1. Copyright law
    2. Lanham Act
    3. Glass-Steagall Act
    4. Economic Espionage Act
18. Which one of the following principles imposes a standard of care upon an individual that is broad and equivalent to what one would expect from a reasonable person under the circumstances?
    1. Due diligence
    2. Separation of duties
    3. Due care
    4. Least privilege
19. Brenda's organization recently completed the acquisition of a competitor firm. Which one of the following tasks would be LEAST likely to be part of the organizational processes addressed during the acquisition?
    1. Consolidation of security functions
    2. Integration of security tools
    3. Protection of intellectual property
    4. Documentation of security policies
20. Kelly believes that an employee engaged in the unauthorized use of computing resources for a side business. After consulting with management, she decides to launch an administrative investigation. What is the burden of proof that she must meet in this investigation?
    1. Preponderance of the evidence
    2. Beyond a reasonable doubt
    3. Beyond the shadow of a doubt
    4. There is no standard
21. Keenan Systems recently developed a new manufacturing process for microprocessors. The company wants to license the technology to other companies for use but wants to prevent unauthorized use of the technology. What type of intellectual property protection is best suited for this situation?
    1. Patent
    2. Trade secret
    3. Copyright
    4. Trademark
22. Which one of the following actions might be taken as part of a business continuity plan?
    1. Restoring from backup tapes
    2. Implementing RAID
    3. Relocating to a cold site
    4. Restarting business operations
23. When developing a business impact analysis, the team should first create a list of assets. What should happen next?
    1. Identify vulnerabilities in each asset.
    2. Determine the risks facing the asset.
    3. Develop a value for...