I85PREP
⌘ K
CGSP study materials
CGSP study resources

CGSP practice questions

One question at a time. Build your CGSP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Governance, Risk and Compliance

Under a typical cloud governance model, which document assigns decision rights and accountability for cloud services rather than describing how to configure them?

  1. A disaster recovery test script
  2. A network segmentation standard listing firewall rules
  3. A cloud governance charter defining roles, decision rights, and escalation paths Correct answer.
  4. A cloud infrastructure runbook describing deployment steps

Explanation

Governance artifacts establish who decides, who is accountable, and how disputes escalate; they do not prescribe technical configuration. Runbooks, standards, and test scripts are operational or technical artifacts that sit beneath the governance layer. A charter is the classic instrument for allocating decision rights.

Question 2Governance, Risk and Compliance

A security team wants a single register that maps each cloud control to the specific regulation it satisfies. Which GRC artifact best serves this purpose?

  1. A capacity management plan
  2. A change advisory board agenda
  3. A control-to-compliance mapping matrix Correct answer.
  4. An incident postmortem report

Explanation

A control-to-compliance mapping matrix links implemented controls to the obligations they satisfy, enabling audit traceability and gap analysis. The other artifacts serve operational or reporting purposes and do not provide obligation traceability. Mapping is the core mechanism for demonstrating compliance coverage.

Question 3Governance, Risk and Compliance

Which party in the cloud shared responsibility model is accountable for classifying data before it is placed in a SaaS application?

  1. The internet service provider, because it carries the traffic
  2. The cloud customer, because data classification is a customer-side governance duty Correct answer.
  3. The SaaS provider, because it hosts the data
  4. The auditor, because auditors certify data sensitivity

Explanation

Data classification is a customer governance responsibility in essentially every cloud service model, since only the customer understands the data's business context and sensitivity. Providers secure the platform but do not determine what the data means to the organization. Auditors provide assurance, not classification decisions.

Question 4Governance, Risk and Compliance

An organization requires that all cloud accounts be provisioned through a pipeline that applies a mandatory baseline. Which governance mechanism does this describe?

  1. Preventive control enforced through automation Correct answer.
  2. Detective control relying on periodic sampling
  3. Compensating control for a legacy system
  4. Directive control expressed only in a policy statement

Explanation

Enforcing a baseline at provisioning time through a pipeline stops noncompliant resources from existing, which makes it preventive rather than detective. Automation makes the control consistent and repeatable. A policy statement alone is directive but does not itself enforce the baseline.

Question 5Governance, Risk and Compliance

Which statement best describes the purpose of a risk register in a cloud GRC program?

  1. It lists every employee who has cloud console access
  2. It records identified risks with owners, ratings, and treatment status so they can be tracked and reported Correct answer.
  3. It stores the configuration history of production virtual machines
  4. It archives signed vendor contracts for procurement

Explanation

A risk register is the system of record for identified risks, capturing ownership, likelihood and impact ratings, and treatment decisions. Tracking and reporting are its primary governance value. Configuration history, access lists, and contracts are separate records that may feed risk assessment but do not constitute the register.

Question 6Governance, Risk and Compliance

What is the primary governance reason to require that cloud resource tags include an owner and a data classification?

  1. Tags reduce the storage cost of object metadata
  2. Tags enable accountability and policy scoping across the estate Correct answer.
  3. Tags replace the need for identity and access management
  4. Tags encrypt data at rest automatically

Explanation

Owner and classification tags let the organization attribute cost and risk to a responsible party and scope policies, such as access restrictions, to the right resources. Tagging does not encrypt data or substitute for access control. Its value is accountability and policy targeting.

Question 7Governance, Risk and Compliance

Which activity belongs to the assurance function rather than to first-line cloud operations?

  1. Writing the application's deployment manifest
  2. Approving a vendor's invoice for cloud spend
  3. Deploying a patch to a production cluster
  4. Independently testing whether controls operated as designed Correct answer.

Explanation

Assurance, often a second- or third-line function, independently evaluates whether controls were designed and operated effectively. Deploying patches, approving invoices, and writing manifests are operational or business activities performed by the line that owns the service. Independence is what distinguishes assurance.

Question 8Governance, Risk and Compliance

A regulator requires that cloud logs be retained for one year and protected from alteration. Which combination of governance decisions does this most directly require?

  1. Setting a retention schedule and an integrity control such as immutable storage Correct answer.
  2. Selecting a programming language and a build tool
  3. Defining a marketing taxonomy and a brand style guide
  4. Choosing a container orchestration platform and a service mesh

Explanation

The obligation has two parts: how long records are kept and assurance that they cannot be tampered with. A retention schedule addresses duration, and immutable or write-once storage addresses integrity. The other pairs concern engineering or branding choices unrelated to the obligation.

Question 9Governance, Risk and Compliance

A business unit wants to adopt a new SaaS tool that will process customer personal data. Which governance step should occur before approval?

  1. A privacy impact assessment with a documented risk decision Correct answer.
  2. Transfer of accountability to the SaaS provider
  3. Deletion of the existing risk register to avoid duplication
  4. Immediate production rollout to shorten time to value

Explanation

Processing personal data in a new service triggers an assessment of privacy risks and a documented decision to accept, mitigate, or reject them. Rollout before assessment inverts the governance sequence. Accountability for the data cannot be transferred to the provider under shared responsibility.

Question 10Governance, Risk and Compliance

An auditor finds that a preventive control blocking public storage buckets was disabled for two weeks. Which governance response is most appropriate?

  1. Close the finding because the control is preventive
  2. Extend the audit period until the finding expires
  3. Reclassify the control as detective to avoid the finding
  4. Record the gap, assess exposure during the window, and require evidence of remediation Correct answer.

Explanation

A disabled preventive control creates a period of exposure that must be quantified and remediated with evidence. Recording the gap preserves the audit trail, and assessing exposure determines whether data was affected. Reclassifying or waiting out the finding would misrepresent the control environment.

Question 11Governance, Risk and Compliance

Which risk treatment option is chosen when an organization purchases cyber insurance for residual cloud outage risk?

  1. Transfer Correct answer.
  2. Avoidance
  3. Acceptance
  4. Mitigation

Explanation

Insurance shifts the financial consequence of a risk to a third party, which is transfer. Mitigation reduces likelihood or impact through controls, avoidance eliminates the activity, and acceptance retains the risk without further action. Insurance does not reduce the chance of an outage.

Question 12Governance, Risk and Compliance

A multinational must keep certain customer records within a specific country. Which cloud governance requirement does this impose?

  1. A mandate to use only open-source software
  2. Data residency constraints on storage and processing locations Correct answer.
  3. A requirement to disable all encryption
  4. A requirement to publish the risk register publicly

Explanation

Localization obligations restrict where data may be stored and processed, so the governance requirement is a residency constraint that must be designed into service selection and architecture. Software licensing, encryption, and disclosure practices are separate concerns. Residency is enforced through region and provider selection plus monitoring.

Question 13Governance, Risk and Compliance

Which metric best indicates whether a cloud patching governance program is operating effectively?

  1. The total monthly cloud spend by region
  2. The percentage of in-scope systems patched within the defined remediation window Correct answer.
  3. The number of cloud accounts currently open
  4. The count of employees who completed security awareness training

Explanation

Effectiveness of a patching program is measured by timeliness against the defined window for in-scope assets. That metric reflects whether the control actually operates. Account counts, spend, and training completion measure other governance areas.

Question 14Governance, Risk and Compliance

A third-party cloud provider will store regulated data. Which artifact should the customer obtain to rely on the provider's independent control testing?

  1. The provider's internal engineering wiki
  2. A screenshot of the provider's console
  3. The provider's marketing brochure
  4. An independent assurance report covering the relevant trust services Correct answer.

Explanation

An independent assurance report, such as one covering security, availability, and confidentiality criteria, gives the customer evidence about the provider's controls. Marketing material, internal wikis, and screenshots are not independent evidence. The report also lets the customer assess complementary user entity controls.

Question 15Governance, Risk and Compliance

Which situation most clearly creates a segregation-of-duties conflict in cloud governance?

  1. One engineer writes documentation for a service
  2. One engineer attends architecture review meetings
  3. One engineer both approves production changes and deploys them Correct answer.
  4. One engineer reviews dashboards during on-call

Explanation

Segregation of duties requires that the person who authorizes an action not be the same person who executes it. Combining change approval and deployment in one role removes the independent check. Documentation, monitoring, and meeting attendance do not create approval-execution conflicts.

Question 16Governance, Risk and Compliance

An organization defines a policy that no production data may be copied to developer environments. Which control type is the policy itself?

  1. Detective
  2. Preventive
  3. Corrective
  4. Directive Correct answer.

Explanation

A policy statement that directs behavior is a directive control; it tells people what must be done but does not itself prevent or detect anything. Enforcement requires technical preventive or detective controls. Corrective controls restore state after an event.

Question 17Governance, Risk and Compliance

A cloud risk assessment finds a high-likelihood, high-impact risk with no cost-effective control. Which governance action is most defensible?

  1. Document formal risk acceptance with an accountable executive and a review date Correct answer.
  2. Remove the risk from the register to keep reporting clean
  3. Delegate acceptance to the vendor
  4. Lower the impact rating until the risk appears acceptable

Explanation

When treatment is not cost-effective, the legitimate path is documented acceptance by an accountable owner with a scheduled review. Removing or re-rating the risk misrepresents the exposure, and a vendor cannot accept risk on the customer's behalf. Formal acceptance preserves transparency for oversight bodies.

Question 18Governance, Risk and Compliance

Which element is essential for a cloud exception process to remain governable?

  1. Exceptions granted verbally by any engineer
  2. Permanent waivers that never expire
  3. Time-bound approvals with compensating controls and a named owner Correct answer.
  4. Exceptions recorded only in email threads

Explanation

Exceptions weaken a baseline, so governance requires that each be time-bound, owned, and paired with compensating controls until the deviation is closed. Verbal or email-only grants lack traceability, and permanent waivers let deviations persist unnoticed. These elements keep residual risk visible.

Question 19Governance, Risk and Compliance

A compliance team wants continuous evidence that encryption is enabled on all regulated data stores. Which approach best fits a cloud GRC program?

  1. Annual manual sampling of a few storage volumes
  2. Relying on the provider's marketing statement about encryption
  3. Automated configuration checks that report drift to a compliance dashboard Correct answer.
  4. Asking application owners to self-certify once at launch

Explanation

Continuous compliance requires automated, recurring evaluation of configuration with results routed to a dashboard for oversight. Annual sampling and one-time self-certification leave long blind spots, and provider marketing statements are not evidence about the customer's own configuration. Automation produces timely, auditable evidence.

Question 20Governance, Risk and Compliance

An organization is deciding whether to accept a cloud provider's subprocessors. Which governance concern is most direct?

  1. The color scheme of the provider's status page
  2. Whether the customer receives notice of subprocessor changes and can object Correct answer.
  3. The provider's office floor plan
  4. The number of provider employees with social media accounts

Explanation

Subprocessors extend the chain of data processing, so the customer needs advance notice of changes and a mechanism to object or exit. That preserves control over where and by whom data is handled. The other items have no bearing on data processing risk.

Question 21Governance, Risk and Compliance

A risk heat map shows a cluster of medium risks in one business unit that individually fall below the escalation threshold. What governance conclusion is most sound?

  1. The heat map should be discarded because it shows medium ratings
  2. The aggregate concentration may warrant escalation as a portfolio-level risk Correct answer.
  3. The business unit should lower its ratings to clear the map
  4. Each risk is below threshold, so no action is warranted

Explanation

Individually sub-threshold risks can combine into a material concentration risk when they share a cause or owner, which justifies portfolio-level review. Dismissing them ignores aggregation effects, and altering ratings to clear the map is manipulation. Aggregation is a recognized step in risk analysis.

Question 22Governance, Risk and Compliance

A cloud provider's assurance report lists complementary user entity controls. How should the customer's governance program treat them?

  1. Ignore them because the provider is responsible for all controls
  2. Treat them as optional marketing suggestions
  3. Assume the auditor implemented them on the customer's behalf
  4. Implement and evidence them, since the report's conclusions assume they exist Correct answer.

Explanation

Complementary user entity controls are assumptions the provider's report relies on; if the customer does not perform them, the report's conclusions do not hold for that customer's use. The customer must implement and evidence them. They are neither the provider's responsibility alone nor optional.

Question 23Governance, Risk and Compliance

A governance board must decide whether to migrate a regulated workload to a new region. Which analysis most directly supports a defensible decision?

  1. A comparison of the region's marketing materials
  2. A vote by the engineering team based on personal preference
  3. A documented assessment of legal, residency, and control differences with residual risk stated Correct answer.
  4. A cost estimate alone

Explanation

A defensible decision requires comparing the legal and regulatory obligations, residency constraints, and control coverage of each option, then stating the residual risk the board is accepting. Cost alone or preference alone omits the compliance dimension. Documenting residual risk makes the decision accountable and reviewable.

Question 24Governance, Risk and Compliance

An organization discovers that a business unit built a parallel cloud account outside the approved landing zone. Which governance weakness does this most likely reveal?

  1. Overuse of the risk register
  2. Too many independent assurance reviews
  3. Excessive encryption of data at rest
  4. Insufficient guardrails and account provisioning controls that allow shadow IT Correct answer.

Explanation

Shadow cloud accounts appear when provisioning is difficult or unmonitored and when guardrails do not detect unmanaged accounts. The weakness is in account governance and detection, not in encryption or assurance volume. Strengthening approved provisioning paths and discovery reduces the incentive and the blind spot.

Question 25Governance, Risk and Compliance

A board asks how much risk the organization retains after all cloud controls are applied. Which governance output answers this question directly?

  1. The inventory of cloud regions in use
  2. The count of security awareness completions
  3. The list of open support tickets
  4. The residual risk position documented per material risk Correct answer.

Explanation

Residual risk is what remains after controls are applied, and it must be documented per material risk so leadership can see what it is accepting. Ticket lists, region inventories, and training counts are operational data that do not express retained risk. Residual risk reporting is the bridge between control operation and board oversight.

Question 26Governance, Risk and Compliance

Which document typically defines the high-level goals and responsibilities for protecting information in the cloud and is approved by executive management?

  1. The cloud security policy Correct answer.
  2. The incident response plan
  3. The business continuity plan
  4. The configuration baseline

Explanation

A cloud security policy is a governance document that states management's intent and direction for protecting cloud-hosted information, including roles and high-level requirements. It is approved at the executive level and provides the mandate for lower-level standards and procedures. The other documents address operational response, continuity, or technical settings rather than overarching governance intent.

Question 27Governance, Risk and Compliance

In a cloud shared responsibility model, which governance activity remains the customer's responsibility regardless of the service model (IaaS, PaaS, or SaaS)?

  1. Managing the provider's network infrastructure
  2. Maintaining the physical security of the data center
  3. Classifying and protecting the data they place in the cloud Correct answer.
  4. Patching the underlying hypervisor

Explanation

Under the shared responsibility model, the cloud customer always retains accountability for their own data, including classification, access decisions, and protection appropriate to its sensitivity. The provider is responsible for the underlying infrastructure, hypervisor, and facilities, which vary by service model but never transfer data ownership to the provider. Governance programs must therefore define customer-side data controls explicitly.

Question 28Governance, Risk and Compliance

What is the primary purpose of a cloud governance risk register?

  1. To document the technical configuration of each cloud service
  2. To track identified risks, their owners, and treatment status over time Correct answer.
  3. To record employee training completion
  4. To list all cloud resources and their tags

Explanation

A risk register is a governance tool that records identified risks, assigns risk owners, and tracks the status of treatment actions so that management can monitor and review risk over time. It supports accountability and informed decision-making. Resource inventories, configuration documentation, and training records serve different operational or compliance purposes.

Question 29Governance, Risk and Compliance

Which concept describes the maximum acceptable level of disruption to a business process before its continuity is seriously affected?

  1. Maximum tolerable downtime (MTD) Correct answer.
  2. Service level objective (SLO)
  3. Recovery point objective (RPO)
  4. Recovery time objective (RTO)

Explanation

Maximum tolerable downtime (MTD) is the total time a business process can be unavailable before the impact becomes unacceptable. RTO is the target time to restore a service, which must be set within the MTD. RPO defines acceptable data loss, and an SLO is a service performance target.

Question 30Governance, Risk and Compliance

A cloud governance team is drafting a policy for data residency. Which requirement should the policy explicitly address to be enforceable?

  1. The number of administrators employed by the provider
  2. The programming languages used to build cloud applications
  3. The list of approved cloud regions where regulated data may be stored and processed Correct answer.
  4. The brand of hardware used in the provider's data centers

Explanation

To be enforceable, a data residency policy must specify the geographic locations (regions) where regulated data may be stored and processed, so that technical controls and audits can verify compliance. Hardware brands, provider staffing, and development languages do not determine where data resides and are not governance requirements for residency.

Question 31Governance, Risk and Compliance

Which control type is a cloud governance policy that mandates multi-factor authentication for all administrative access?

  1. Preventive Correct answer.
  2. Detective
  3. Compensating
  4. Corrective

Explanation

A policy requiring multi-factor authentication for administrators is preventive because it is intended to stop unauthorized access before it occurs. Detective controls identify events after they happen, corrective controls respond to incidents, and compensating controls substitute for another control. The mandate aims to preclude compromise, making preventive the correct classification.

Question 32Governance, Risk and Compliance

When evaluating a cloud provider's SOC 2 report, what should governance verify about the period and scope of the report?

  1. That the report is printed on company letterhead
  2. That the report includes the provider's marketing materials
  3. That the report lists all customer names
  4. That the report covers the relevant systems and the current period of reliance Correct answer.

Explanation

A SOC 2 report is useful for reliance only if its scope includes the systems and services the organization uses and if the period covered aligns with the organization's reliance period. Governance should confirm the system description and period, and check for gaps or exceptions. Letterhead, marketing content, and customer names are not relevant to the report's assurance value.

Question 33Governance, Risk and Compliance

Which governance mechanism best ensures that cloud service changes are reviewed for security and compliance impact before deployment?

  1. Annual penetration testing only
  2. Post-incident root cause analysis
  3. A change advisory board with defined cloud security review criteria Correct answer.
  4. Automated provisioning of all resources without review

Explanation

A change advisory board (CAB) with explicit cloud security and compliance review criteria provides a governance gate that evaluates proposed changes before they are deployed. Automated provisioning without review bypasses oversight, annual testing is too infrequent and retrospective, and post-incident analysis occurs after harm. The CAB is the preventive governance mechanism.

Question 34Governance, Risk and Compliance

A cloud governance board is reviewing a proposal to use a provider's managed database service for regulated data. Which factor is most directly a governance concern regarding the provider's subcontractors?

  1. Whether the provider remains accountable for subcontractor compliance with the customer's requirements Correct answer.
  2. Whether the subcontractor uses the same office furniture as the provider
  3. Whether the subcontractor's employees have the same job titles
  4. Whether the subcontractor's website uses the same color scheme

Explanation

When a provider uses subcontractors, governance must ensure the provider remains contractually accountable for the subcontractor's compliance with security, privacy, and residency requirements. This includes flow-down of obligations and notification of changes. Office furniture, job titles, and website design are irrelevant to compliance accountability.

Question 35Governance, Risk and Compliance

Which of the following best describes the purpose of a cloud governance exception process?

  1. To eliminate the need for a risk register
  2. To transfer all risk to the cloud provider
  3. To permit permanent bypass of all security controls for convenience
  4. To allow documented, time-bound deviations from policy with risk acceptance by an authorized owner Correct answer.

Explanation

An exception process enables controlled, documented deviations from policy when justified, with a defined expiry and formal risk acceptance by an accountable owner. This maintains governance while allowing business flexibility. Permanent bypasses, eliminating risk tracking, and transferring risk to the provider are not valid purposes and undermine governance.

Question 36Governance, Risk and Compliance

An organization wants to ensure that only approved cloud services are used. Which governance control is most appropriate?

  1. Relying on employees to self-report new services after use
  2. Blocking all internet access for all employees
  3. Maintaining an approved services catalog and requiring procurement review before adoption Correct answer.
  4. Allowing any employee to sign up for any cloud service with a corporate card

Explanation

An approved services catalog combined with a procurement review gate prevents unvetted cloud services from entering the environment and provides a basis for monitoring. Allowing open sign-up, relying on after-the-fact self-reporting, or blocking all internet access does not provide governed, risk-based adoption. The catalog and review process are preventive governance controls.

Question 37Governance, Risk and Compliance

Which practice best supports continuous compliance monitoring in a cloud environment?

  1. Manual quarterly reviews of a static spreadsheet
  2. Automated configuration checks mapped to control requirements with alerting on drift Correct answer.
  3. Relying on provider assurances without customer-side checks
  4. Annual third-party audits only

Explanation

Continuous compliance monitoring relies on automated checks that evaluate cloud configurations against control requirements and alert on drift, enabling timely remediation. Manual quarterly reviews, annual audits, and reliance on provider assurances alone are periodic or indirect and cannot provide continuous evidence. Automation provides the frequency and coverage needed for ongoing governance.

Question 38Governance, Risk and Compliance

A cloud governance program discovers that a critical control has failed, but the failure is not yet known to be exploited. What should the program do first under a risk-based approach?

  1. Assess the exposure and potential impact, then initiate remediation according to severity Correct answer.
  2. Wait for the next scheduled audit cycle
  3. Immediately terminate all cloud services
  4. Publish the failure to all employees

Explanation

A risk-based response begins with assessing exposure and potential impact to determine severity, then triggering remediation and escalation appropriate to that severity. Waiting for an audit delays action, terminating all services is disproportionate, and broad publication may not be appropriate. The governance process should prioritize based on risk.

Question 39Governance, Risk and Compliance

Which set of metrics best demonstrates that a cloud access governance program is operating effectively?

  1. Count of marketing campaigns launched and website visits
  2. Percentage of accounts with least privilege, time to revoke access on termination, and number of orphaned accounts Correct answer.
  3. Number of cloud regions available and total storage capacity
  4. Average number of applications deployed per developer

Explanation

Effective access governance is evidenced by metrics such as the proportion of accounts adhering to least privilege, the speed of access revocation upon termination, and the count of orphaned or excessive accounts. These directly measure control operation. Region availability, storage capacity, marketing activity, and deployment counts do not measure access governance effectiveness.

Question 40Governance, Risk and Compliance

An organization is adopting a multi-cloud strategy. Which governance challenge is most directly introduced by using multiple providers?

  1. Automatic compliance with all regulations
  2. Elimination of the need for a risk register
  3. Inconsistent policy enforcement and fragmented identity management across providers Correct answer.
  4. Reduced need for staff training

Explanation

Multi-cloud adoption creates governance complexity because policies, identity, and controls must be consistently enforced across different provider platforms, which often have distinct native tools and models. This can lead to fragmented identity management and inconsistent policy application. It does not eliminate risk tracking, guarantee compliance, or reduce training needs; in fact, it increases them.

Question 41Information Security

Under a formal information security management system, which statement best describes the purpose of classifying information assets?

  1. To guarantee that no asset can ever be disclosed to third parties
  2. To ensure every asset is encrypted with the same algorithm regardless of its use
  3. To transfer ownership of each asset to the security team permanently
  4. To assign each asset a value and sensitivity level so that proportionate controls can be applied Correct answer.

Explanation

Classification assigns value and sensitivity so controls are proportionate to risk. It is a risk-based decision, not a blanket technical mandate. Ownership normally stays with business owners, and disclosure can still be legitimate under agreements.

Question 42Information Security

A user receives an email claiming to be from the IT helpdesk asking them to confirm their password via a linked page. Which control most directly reduces the likelihood of compromise from this attack?

  1. Deploying anti-phishing filtering with link inspection and user reporting Correct answer.
  2. Shortening the session timeout on the internal wiki
  3. Requiring quarterly reviews of privileged accounts
  4. Increasing password complexity requirements for all staff

Explanation

Phishing relies on luring users to credential-harvesting pages, so mail filtering with link inspection and easy reporting attacks the delivery channel. Password complexity does not stop a user from typing a valid password into a fake page. Session timeouts and access reviews address different risks.

Question 43Information Security

Which principle states that a subject should be granted only the access necessary to perform its assigned tasks?

  1. Defense in depth
  2. Separation of duties
  3. Least privilege Correct answer.
  4. Need-to-know

Explanation

Least privilege limits permissions to the minimum required for the job function. Separation of duties divides tasks to prevent fraud, while defense in depth layers controls. Need-to-know is related but narrower, focused on information access rather than permission scope generally.

Question 44Information Security

An organization must retain audit logs for one year and protect them from alteration. Which combination best meets both requirements?

  1. Compressing logs and deleting them after 30 days to save space
  2. Storing logs on the same server that generates them with local administrator access
  3. Writing logs to write-once media or an append-only log service with defined retention Correct answer.
  4. Emailing log exports to administrators weekly for manual filing

Explanation

Integrity of audit records requires that they cannot be modified or deleted by the systems or staff they record, and retention must match policy. Append-only or write-once storage with a defined retention period satisfies both. Local administrator access and manual filing do not prevent tampering.

Question 45Information Security

Which statement correctly distinguishes symmetric from asymmetric cryptography?

  1. Symmetric algorithms provide non-repudiation because both parties hold the key
  2. Asymmetric algorithms cannot be used to establish a shared session key
  3. Symmetric algorithms always use longer keys than asymmetric algorithms for equivalent strength
  4. Symmetric algorithms use a shared secret key, while asymmetric algorithms use a public and private key pair Correct answer.

Explanation

Symmetric cryptography relies on one shared secret key for encryption and decryption. Asymmetric cryptography uses a mathematically related key pair, where the public key can be distributed openly. Key length comparisons and non-repudiation claims are incorrect as stated.

Question 46Information Security

A security policy requires that users authenticate with something they know plus something they possess. Which authentication method satisfies this requirement?

  1. A single sign-on session cookie
  2. A hardware token generating one-time codes combined with a PIN Correct answer.
  3. A username and a memorized passphrase
  4. A fingerprint scan alone

Explanation

Multi-factor authentication combines factors from different categories, such as knowledge and possession. A hardware token plus a PIN meets that requirement. A passphrase is knowledge only, a fingerprint is one biometric factor, and a session cookie is not an authentication factor.

Question 47Information Security

What is the primary purpose of a business impact analysis within continuity planning?

  1. To select the cheapest backup vendor available
  2. To identify critical business functions and quantify the consequences of their disruption Correct answer.
  3. To list every server in the data center with its IP address
  4. To determine which employees should be disciplined for outages

Explanation

A business impact analysis identifies critical functions and the operational and financial consequences of disruption over time. Those findings drive recovery objectives and continuity strategies. Asset inventories and vendor selection are supporting activities, not the purpose of the analysis.

Question 48Information Security

Which practice best reduces the risk of malware spreading from a compromised workstation to file shares on the corporate network?

  1. Granting all staff write access to shared drives to speed collaboration
  2. Relying on users to detect and remove malicious files manually
  3. Segmenting network access and applying least privilege to file shares Correct answer.
  4. Disabling antivirus scanning on servers to improve performance

Explanation

Network segmentation limits lateral movement, and least privilege on shares restricts what a compromised account can modify. Together they contain the spread of malware. Broad write access and disabled scanning increase exposure, and manual detection is unreliable.

Question 49Information Security

An application accepts user-supplied input that is later displayed to other users. Which control most directly prevents stored cross-site scripting?

  1. Enabling verbose error messages for debugging
  2. Storing passwords using a fast hashing algorithm
  3. Using HTTP instead of HTTPS for internal pages
  4. Encoding output for the correct context and validating input on the server Correct answer.

Explanation

Stored cross-site scripting arises when untrusted data is rendered as active content. Context-aware output encoding prevents the browser from interpreting data as code, and server-side input validation reduces malicious payloads. Password hashing and transport choices address different threats.

Question 50Information Security

A security team wants to detect unauthorized changes to critical operating system files. Which approach is most appropriate?

  1. Reviewing firewall rules monthly for accuracy
  2. Enabling DHCP logging on the guest wireless network
  3. Using file integrity monitoring with cryptographic hashes and baselines Correct answer.
  4. Running a vulnerability scan once per year

Explanation

File integrity monitoring compares current file hashes against a trusted baseline and alerts on deviations, which directly detects unauthorized modification. Firewall reviews, DHCP logs, and annual scans address other control areas and cannot reliably detect file tampering.