I85PREP
⌘ K
CPSS study materials
CPSS study resources

CPSS practice questions

One question at a time. Build your CPSS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Supply Chain Security Foundations, Governance and Risk Management

Which statement best describes the purpose of a software bill of materials (SBOM) in supply chain security?

  1. It encrypts the build artifacts so that only authorized customers can download them.
  2. It certifies that a supplier's development process complies with a recognized security standard.
  3. It provides a runtime firewall that blocks malicious network traffic from third-party libraries.
  4. It records the components and dependencies that make up a software artifact so consumers can assess exposure to known vulnerabilities. Correct answer.

Explanation

An SBOM is an inventory-style record of the components and dependencies inside a software artifact. Its main defensive value is enabling consumers and producers to map those components to known vulnerabilities and licenses. It is a transparency document, not a certification, encryption mechanism, or runtime control.

Question 2Supply Chain Security Foundations, Governance and Risk Management

In supply chain risk management, what does the term 'fourth-party risk' refer to?

  1. Risk from physical theft at a distribution warehouse
  2. Risk from employees who leave the organization and join a competitor
  3. Risk arising from vendors used by your direct suppliers, which you do not contract with directly Correct answer.
  4. Risk created by customers misusing a delivered product

Explanation

Fourth-party risk describes exposure that reaches your organization through your suppliers' own suppliers and service providers. Because there is no direct contract, visibility and control are limited, so mapping the extended supply chain is essential. The other options describe insider, customer misuse, and physical security risks rather than extended supply chain relationships.

Question 3Supply Chain Security Foundations, Governance and Risk Management

A development team wants to verify that a container image was built by their CI pipeline and has not been altered since. Which control most directly provides this assurance?

  1. Running the image in a sandbox to observe behavior
  2. Storing the image in a private registry with access controls
  3. Scanning the image for vulnerable packages before pushing
  4. Signing the image digest and verifying the signature at deployment Correct answer.

Explanation

Signing ties an identity to a specific immutable digest, and verification at admission confirms provenance and integrity. Vulnerability scanning and sandboxing address different concerns and do not prove who built the artifact. Private registry access control limits who can pull images but does not attest to origin.

Question 4Supply Chain Security Foundations, Governance and Risk Management

Which practice most effectively mitigates the risk of a compromised upstream open-source maintainer account pushing malicious code?

  1. Relying on the popularity of the package as a proxy for its trustworthiness
  2. Allowing automatic upgrades to the latest release to receive security patches quickly
  3. Disabling dependency management tooling so developers vendor code manually
  4. Pinning dependencies to reviewed versions and verifying integrity hashes before updates are adopted Correct answer.

Explanation

Pinning to vetted versions with hash verification prevents silent adoption of a malicious or unexpected release. Automatic upgrades widen exposure because a compromised release is consumed immediately. Popularity is not a security control, and manual vendoring without verification does not improve integrity.

Question 5Supply Chain Security Foundations, Governance and Risk Management

Which document type is designed to convey a supplier's security posture and control coverage to a prospective customer in a standardized questionnaire format?

  1. An end-user license agreement
  2. A penetration test scope statement
  3. A software bill of materials
  4. A security questionnaire response or standardized assessment report such as a SOC 2 report Correct answer.

Explanation

Standardized assessment reports and questionnaire responses communicate a supplier's controls and posture to customers. They summarize how security requirements are met and are commonly used in vendor due diligence. An SBOM lists components, a scope statement defines testing boundaries, and a license agreement governs usage rights.

Question 6Supply Chain Security Foundations, Governance and Risk Management

An organization wants to limit the damage if a widely used logging library is found to contain a critical remote code execution flaw. Which combination best reflects defense in depth for this scenario?

  1. Requiring developers to read release notes for every dependency update
  2. Removing all third-party libraries and rewriting them internally
  3. Increasing the frequency of full-disk backups of build servers
  4. Maintaining a component inventory, monitoring vulnerability feeds, and having a tested patch and rollback process Correct answer.

Explanation

Inventory gives visibility into where the library is used, monitoring provides timely alerting, and a tested patch process enables rapid remediation. These layers together reduce both detection and response time. Manual release-note review, wholesale rewriting, and backup frequency do not address exploit exposure systematically.

Question 7Supply Chain Security Foundations, Governance and Risk Management

What is the primary security rationale for using a private, curated package repository inside an enterprise?

  1. To eliminate the need for vulnerability scanning of dependencies
  2. To increase download speeds for developers in remote offices
  3. To reduce the license cost of open-source dependencies
  4. To vet and approve components before they are available to internal developers Correct answer.

Explanation

A curated internal repository acts as a control point where components can be reviewed and approved before internal consumption. It centralizes policy enforcement and provides an audit trail of what entered the environment. Speed, licensing, and scan elimination are not its security purpose.

Question 8Supply Chain Security Foundations, Governance and Risk Management

A supplier notifies a customer that a subcontractor used to host backups suffered a breach. Which governance gap does this most likely reveal?

  1. Incomplete mapping and disclosure of subcontractors in the supplier relationship Correct answer.
  2. Absence of a business continuity plan at the customer
  3. Failure to encrypt customer endpoints
  4. Insufficient patch management on customer workstations

Explanation

The event shows the customer lacked visibility into the supplier's subcontractor chain, which is a fourth-party governance gap. Contracts and due diligence should require disclosure and equivalent controls for subcontractors. Customer endpoint patching and continuity planning are separate internal controls.

Question 9Supply Chain Security Foundations, Governance and Risk Management

Which statement accurately describes the role of SLSA provenance in a software supply chain?

  1. It encrypts source code at rest in the repository
  2. It provides verifiable information about how and where an artifact was built Correct answer.
  3. It replaces the need for code review in the development process
  4. It guarantees that the artifact contains no vulnerabilities

Explanation

SLSA provenance describes the build process, including the builder identity and inputs, in a verifiable form. Consumers use it to enforce policy on how artifacts are produced. It does not assert vulnerability-free code, substitute for review, or provide encryption.

Question 10Supply Chain Security Foundations, Governance and Risk Management

A risk manager is prioritizing remediation of supply chain findings. Which approach best aligns with a standard risk-based methodology?

  1. Fix all low-severity findings first because they are quick to close
  2. Remediate in alphabetical order of vendor name to ensure fairness
  3. Defer all decisions until the next annual audit
  4. Rank findings by likelihood and business impact, then address the highest combined exposure first Correct answer.

Explanation

Risk-based prioritization weighs likelihood of exploitation against business impact so effort goes where exposure is greatest. This produces defensible, resource-efficient remediation. Alphabetical ordering, severity-only triage, and deferred decisions ignore business context and urgency.

Question 11Supply Chain Security Foundations, Governance and Risk Management

Which control most directly reduces the risk of tampering with a software release between the build system and the customer?

  1. Publishing checksums on the same server that hosts the download
  2. Cryptographically signing release artifacts and verifying signatures on consumption Correct answer.
  3. Compressing release artifacts to reduce transfer size
  4. Adding a version number to each release file name

Explanation

Signing artifacts lets consumers verify authenticity and integrity independent of the transport channel. Checksums hosted alongside the artifact can be altered by the same attacker who tampers with the download. Versioning and compression provide no integrity assurance.

Question 12Supply Chain Security Foundations, Governance and Risk Management

An organization adopts a policy that no software component may enter production unless it appears on an approved list maintained by security. What is the main operational risk of this approach if poorly implemented?

  1. The approved list becomes stale and blocks legitimate urgent security patches Correct answer.
  2. Developers gain too much autonomy over component selection
  3. Provenance verification is no longer needed
  4. Vulnerability scanning becomes redundant

Explanation

Allow-list governance depends on timely maintenance; if the list lags, critical patches may be blocked and teams may bypass the process. The risk is administrative staleness, not excessive developer autonomy. Scanning and provenance remain complementary controls.

Question 13Supply Chain Security Foundations, Governance and Risk Management

What does a vendor risk tiering model typically determine?

  1. The physical location of the supplier's headquarters only
  2. The number of employees a supplier must hire
  3. The retail price negotiated with each supplier
  4. The depth of due diligence and contractual controls applied to each supplier Correct answer.

Explanation

Tiering classifies suppliers by factors such as data access and criticality, which then sets the required depth of assessment and contractual safeguards. It is a governance mechanism for proportionate oversight. Pricing, headcount, and headquarters location alone are not the basis of security tiering.

Question 14Supply Chain Security Foundations, Governance and Risk Management

Which activity best exemplifies continuous monitoring in a third-party risk program?

  1. Reviewing supplier security ratings and breach notifications on an ongoing basis between annual assessments Correct answer.
  2. Sending a questionnaire only when a renewal is due
  3. Performing a one-time site visit before contract signature
  4. Collecting a signed contract once at onboarding

Explanation

Continuous monitoring uses ongoing data sources such as security ratings and threat intelligence to detect changes between formal assessments. One-time onboarding activities and renewal-only questionnaires are point-in-time and miss emerging risk. Continuous monitoring complements periodic deep assessments.

Question 15Supply Chain Security Foundations, Governance and Risk Management

What is the primary purpose of a software composition analysis (SCA) tool in the supply chain?

  1. Identifying known vulnerable and license-encumbered third-party components in a codebase Correct answer.
  2. Enforcing coding style conventions during review
  3. Detecting SQL injection in custom application code
  4. Measuring code coverage of unit tests

Explanation

SCA examines declared and transitive dependencies to flag known vulnerabilities and license obligations. It works at the component level rather than analyzing custom code logic. SAST, coverage tooling, and linters address different concerns.

Question 16Supply Chain Security Foundations, Governance and Risk Management

An attacker compromises a build server and injects code into artifacts during compilation. Which control would most likely detect this tampering?

  1. Increasing the frequency of developer password rotations
  2. Enabling verbose logging on developer laptops
  3. Adding more unit tests to the application
  4. Comparing build provenance and reproducible build outputs against expected values Correct answer.

Explanation

Tampering at build time can be exposed by verifying provenance and by reproducible builds that should yield identical outputs. Deviations signal unauthorized modification. Password rotation, unit tests, and laptop logging do not verify build output integrity.

Question 17Supply Chain Security Foundations, Governance and Risk Management

Which contractual clause most directly supports supply chain security governance with a critical software vendor?

  1. A discount schedule for multi-year renewals
  2. A right-to-audit and breach notification obligation with defined timelines Correct answer.
  3. A clause allowing the vendor to change subcontractors without notice
  4. An agreement that the vendor determines all security requirements unilaterally

Explanation

Audit rights and timely breach notification give the customer leverage to verify controls and respond to incidents. These clauses operationalize governance expectations. Discounts are commercial, and unilateral subcontractor changes or vendor-set requirements erode customer oversight.

Question 18Supply Chain Security Foundations, Governance and Risk Management

Which statement best captures the difference between a vulnerability and a threat in supply chain risk analysis?

  1. A vulnerability is an external attacker, while a threat is an internal coding error
  2. A vulnerability is a legal obligation, while a threat is a contractual penalty
  3. A vulnerability and a threat are synonyms in risk analysis
  4. A vulnerability is a weakness that can be exploited, while a threat is an actor or event that could exploit it Correct answer.

Explanation

In risk terminology a vulnerability is a weakness in a system or process, and a threat is a potential actor or event that could exploit that weakness. Risk combines the two with impact. Treating them as synonyms or swapping their meanings leads to flawed assessments.

Question 19Supply Chain Security Foundations, Governance and Risk Management

A company discovers that a widely used library has reached end-of-life and will no longer receive security patches. What is the most appropriate governance response?

  1. Remove the library from the SBOM so audits no longer flag it
  2. Assess where the library is used, evaluate replacement options, and set a time-bound migration plan with compensating controls Correct answer.
  3. Continue using it indefinitely because it has no known vulnerabilities today
  4. Immediately shut down all systems that depend on it without a migration plan

Explanation

End-of-life components accumulate unpatched vulnerabilities, so the organization should scope usage, plan a migration, and apply compensating controls in the interim. Ignoring the issue, abrupt shutdowns, and hiding inventory entries all increase risk or disruption.

Question 20Supply Chain Security Foundations, Governance and Risk Management

Which metric best indicates the effectiveness of an organization's supply chain vulnerability response process?

  1. Count of open-source licenses in use
  2. Number of developers who attended security training
  3. Median time from public disclosure to remediation of affected components Correct answer.
  4. Total number of dependencies in the codebase

Explanation

Time-to-remediate after disclosure directly measures how quickly exposure is reduced. Dependency counts, training attendance, and license counts describe context but not response effectiveness. A shorter median remediation time indicates a more effective process.

Question 21Supply Chain Security Foundations, Governance and Risk Management

What is the main purpose of an incident response playbook specific to supply chain compromises?

  1. To provide a list of approved programming languages
  2. To document the company's marketing response to negative press
  3. To define pre-agreed roles, escalation paths, and containment steps when a supplier or dependency is compromised Correct answer.
  4. To replace the need for supplier contracts

Explanation

A supply chain incident playbook assigns responsibilities and prescribes escalation, containment, and communication steps so the organization can react quickly. It coordinates response rather than addressing marketing, contracts, or language standards. Pre-agreed procedures reduce confusion during an incident.

Question 22Supply Chain Security Foundations, Governance and Risk Management

An organization requires that all container base images be rebuilt weekly from trusted sources. Which risk does this primarily reduce?

  1. Risk of physical theft of servers
  2. Risk of phishing emails reaching staff
  3. Risk of employees sharing passwords
  4. Accumulation of unpatched vulnerabilities in the base layer over time Correct answer.

Explanation

Regular rebuilds pull updated base layers, reducing the window in which known vulnerabilities persist in deployed images. This practice addresses image freshness and patch currency. Password sharing, physical theft, and phishing are unrelated control domains.

Question 23Supply Chain Security Foundations, Governance and Risk Management

A procurement team wants to compare two software vendors' security postures objectively before signing. Which evidence set is most appropriate?

  1. Each vendor's marketing brochure and customer testimonials
  2. Independent audit reports, questionnaire responses, and documented incident history Correct answer.
  3. The vendors' stock price trends over the past year
  4. The number of features listed in each vendor's product page

Explanation

Objective comparison relies on independent assurance, structured questionnaire responses, and incident history, which reflect actual controls and outcomes. Marketing materials, feature lists, and financial trends do not demonstrate security posture. Triangulating multiple evidence sources strengthens the decision.

Question 24Supply Chain Security Foundations, Governance and Risk Management

Which statement correctly describes the relationship between an SBOM and a VEX document?

  1. An SBOM lists components, while VEX communicates the exploitability status of specific vulnerabilities in a product Correct answer.
  2. An SBOM is encrypted, while VEX is unencrypted
  3. An SBOM and VEX are both runtime protection tools
  4. An SBOM is issued by regulators, while VEX is issued by customers

Explanation

An SBOM inventories components, and a VEX statement conveys whether a product is affected or not affected by a given vulnerability. Together they help consumers prioritize real exposure. Neither is a runtime protection tool, and issuance is not tied to regulators or customers as described.

Question 25Supply Chain Security Foundations, Governance and Risk Management

In a governance framework, what is the function of a risk appetite statement for supply chain security?

  1. To list every vulnerability found in supplier products
  2. To define the level of supply chain risk the organization is willing to accept in pursuit of its objectives Correct answer.
  3. To specify the exact firewall rules to deploy
  4. To name the individuals responsible for code review

Explanation

A risk appetite statement sets the boundaries for acceptable risk and guides decisions about suppliers and controls. It is a governance instrument, not a technical inventory or task assignment. Clear appetite enables consistent, defensible risk decisions across teams.

Question 26Supply Chain Security Foundations, Governance and Risk Management

Which governance body or role is typically accountable for approving the organization's overall supply chain security risk tolerance and accepting residual risk that exceeds operational thresholds?

  1. The individual developer who authored the affected component
  2. The executive leadership or board-level risk committee Correct answer.
  3. The help desk team that handles software installation tickets
  4. The build engineering team that maintains CI runners

Explanation

Risk tolerance and residual risk acceptance above operational limits are governance decisions reserved for executive leadership or a board-level risk committee, which owns enterprise risk appetite. Engineering and support roles implement controls but do not hold accountability for accepting enterprise-level residual risk.

Question 27Supply Chain Security Foundations, Governance and Risk Management

An organization maps its software supply chain and identifies that a single upstream maintainer controls a component embedded in most of its products. Which risk analysis concept does this finding most directly illustrate?

  1. Inherent risk arising from data classification
  2. Control risk arising from a failed audit
  3. Residual risk arising from a completed remediation
  4. Concentration risk arising from a shared dependency Correct answer.

Explanation

Concentration risk occurs when many products depend on one shared upstream source, so a single failure or compromise propagates widely. Mapping the maintainer's reach across products is exactly how concentration exposure is surfaced in supply chain risk analysis.

Question 28Supply Chain Security Foundations, Governance and Risk Management

A regulated firm must demonstrate to its auditor that third-party software suppliers meet security obligations throughout the contract lifecycle. Which combination of governance artifacts best provides that evidence?

  1. An internal memo stating that procurement trusts the vendor based on prior working relationships
  2. The marketing brochure describing the vendor's security certifications and a sales presentation
  3. Signed security requirements in contracts, documented periodic reassessments, and records of remediation follow-up Correct answer.
  4. A list of open-source licenses used in the product and the corresponding attribution notices

Explanation

Auditable third-party governance requires documented obligations (contractual security clauses) plus evidence that they were monitored over time, such as reassessment records and tracked remediation. This creates a traceable lifecycle trail from requirement to verification.

Question 29Supply Chain Security Foundations, Governance and Risk Management

A risk manager is building a heat map of supply chain findings and wants each finding scored consistently. Which practice best supports defensible, repeatable prioritization?

  1. Ranking findings by the order in which scanners reported them
  2. Applying a documented likelihood-by-impact rubric with defined severity bands and approval for overrides Correct answer.
  3. Scoring every finding as critical to guarantee nothing is missed
  4. Prioritizing findings based on which team raised the loudest objection

Explanation

A documented likelihood-by-impact rubric with defined bands produces consistent, explainable scores and makes exceptions auditable when overrides are approved. This is the core of a repeatable risk-based prioritization method.

Question 30Supply Chain Security Foundations, Governance and Risk Management

A board asks why the organization should fund supply chain security controls when no incident has occurred. Which argument best frames the business case in governance and risk terms?

  1. Controls guarantee that no supplier will ever be breached in the future
  2. Controls are required only if a competitor has already suffered a public incident
  3. Controls eliminate the need to assess third parties because technology handles the risk
  4. Controls reduce expected loss from plausible compromise scenarios and lower the likelihood of regulatory and contractual penalties Correct answer.

Explanation

A defensible business case quantifies expected loss reduction across plausible scenarios and links controls to regulatory and contractual obligations. It frames spending as risk treatment rather than as a guarantee of immunity.

Question 31Threats, Vulnerabilities and Risk Assessment

Under the CPSS framework, which statement best describes the difference between a threat and a vulnerability?

  1. A threat and a vulnerability are interchangeable terms describing the same exposure condition.
  2. A threat is the measured likelihood of loss, while a vulnerability is the financial impact of that loss.
  3. A threat is a weakness in a system, while a vulnerability is an external attacker who targets that weakness.
  4. A threat is a potential cause of an unwanted incident, while a vulnerability is a weakness that a threat can exploit. Correct answer.

Explanation

Threats are potential causes of an unwanted incident, such as an attacker, malware, or a natural event. Vulnerabilities are weaknesses in assets or controls that a threat may exploit. Keeping the two distinct is essential because risk arises from their interaction, not from either element alone.

Question 32Threats, Vulnerabilities and Risk Assessment

A payment switch processes card transactions in real time. Which characteristic most directly makes it a CPSS-relevant system?

  1. It hosts the corporate intranet for bank staff.
  2. It stores archived statements for customer download.
  3. It clears and settles payment obligations between participants. Correct answer.
  4. It provides general office productivity software.

Explanation

CPSS concerns payment, clearing, and settlement systems, so the defining feature is the clearing and settlement of payment obligations among participants. Real-time processing alone is not the criterion; the function of transferring and settling value is. Ancillary services such as statements or office software do not define the system's CPSS status.

Question 33Threats, Vulnerabilities and Risk Assessment

Which practice most directly reduces the risk that a single compromised administrator credential leads to full control of a payment system?

  1. Storing administrator credentials in a shared team spreadsheet.
  2. Increasing the password length requirement for all users.
  3. Enforcing least privilege with separation of duties and just-in-time access. Correct answer.
  4. Sending weekly security awareness emails to administrators.

Explanation

Least privilege, separation of duties, and just-in-time elevation limit what any single credential can do and require collusion or additional compromise to reach full control. Password length helps against guessing but does not contain the blast radius once a credential is stolen. Shared storage of credentials increases, rather than reduces, the risk.

Question 34Threats, Vulnerabilities and Risk Assessment

In a CPSS risk assessment, what does the term 'inherent risk' refer to?

  1. The risk remaining after all controls have been applied and tested.
  2. The risk that exists before considering the effect of mitigating controls. Correct answer.
  3. The risk transferred to an insurer under a policy.
  4. The risk that a control itself will fail during an audit.

Explanation

Inherent risk is the exposure that exists before controls are taken into account. Residual risk is what remains after controls are applied, and the gap between them shows control effectiveness. Auditors compare inherent and residual risk to judge whether mitigation is proportionate.

Question 35Threats, Vulnerabilities and Risk Assessment

Which type of control is a transaction velocity limit that blocks a card from being used more than a set number of times per hour?

  1. Corrective control
  2. Preventive detective control
  3. Preventive control Correct answer.
  4. Compensating control

Explanation

A velocity limit stops or blocks transactions before they complete, so it acts preventively. Detective controls identify events after they occur, and corrective controls restore conditions afterward. A compensating control substitutes for another control rather than blocking the activity directly.

Question 36Threats, Vulnerabilities and Risk Assessment

Which of the following best describes a 'threat actor' in the context of a payment system risk assessment?

  1. A documented procedure for restoring service after an outage.
  2. A software defect that causes a transaction to be processed twice.
  3. An individual or group with the intent and capability to exploit weaknesses. Correct answer.
  4. A metric that quantifies the financial loss from an incident.

Explanation

A threat actor is an individual or group with intent and capability to cause harm, such as criminals, insiders, or nation-state groups. Threat actors are distinguished from the vulnerabilities they exploit and from the impacts that result. Profiling actors by motivation and capability informs the threat landscape.

Question 37Threats, Vulnerabilities and Risk Assessment

An analyst needs to express the risk of a denial-of-service attack on a payment gateway as a single value. Which approach is consistent with common CPSS risk assessment practice?

  1. Rank the threat by the alphabetical order of asset names.
  2. Divide the control budget by the number of system users.
  3. Multiply the annualized rate of occurrence by the single loss expectancy. Correct answer.
  4. Add the number of vulnerabilities found to the number of incidents reported.

Explanation

Annualized loss expectancy is calculated by multiplying the annualized rate of occurrence by the single loss expectancy, giving a comparable monetary risk value. This supports prioritization across different threats and assets. The other options combine unrelated quantities and produce no meaningful risk measure.

Question 38Threats, Vulnerabilities and Risk Assessment

A payment processor discovers that a third-party library used in its settlement application contains a known remote code execution flaw. Which action best reflects a vulnerability management process?

  1. Record the finding, assess exploitability and exposure, and prioritize remediation by risk. Correct answer.
  2. Disable all logging to reduce the evidence of the flaw.
  3. Ignore the flaw because the library is third-party.
  4. Wait for the next annual audit before taking any action.

Explanation

Vulnerability management requires recording findings, assessing exploitability and business exposure, and prioritizing remediation according to risk. Third-party components are in scope because the organization remains accountable for the systems it operates. Deferring action to an audit cycle leaves a known exploitable flaw unmanaged.

Question 39Threats, Vulnerabilities and Risk Assessment

A risk register entry shows a threat with high likelihood and low impact, and another with low likelihood and severe impact. What is the primary purpose of plotting both on a risk heat map?

  1. To compare and prioritize exposures using combined likelihood and impact. Correct answer.
  2. To eliminate the need for any further qualitative judgment.
  3. To assign legal liability to individual employees.
  4. To prove that the low-likelihood threat can be ignored.

Explanation

A heat map combines likelihood and impact so exposures can be compared and prioritized consistently. It supports judgment rather than replacing it, and severe-impact events still warrant attention even when unlikely. Heat maps do not determine legal liability or justify ignoring tail risks.

Question 40Threats, Vulnerabilities and Risk Assessment

Which scenario most clearly represents an insider threat to a settlement system?

  1. A phishing email is blocked by the mail gateway before delivery.
  2. A departing operator copies settlement credentials to use after leaving. Correct answer.
  3. An external actor scans the internet-facing firewall for open ports.
  4. A vendor releases a patch for a known library flaw.

Explanation

Insider threats involve people with legitimate access who misuse it, such as an employee exfiltrating credentials for later use. External scanning and blocked phishing are outsider activity, and a vendor patch is remediation. The distinguishing feature is abuse of authorized access.

Question 41Threats, Vulnerabilities and Risk Assessment

An organization identifies a risk to its clearing service that exceeds its appetite and decides to purchase cyber insurance. Which risk treatment option does this represent?

  1. Risk avoidance
  2. Risk acceptance
  3. Risk transfer Correct answer.
  4. Risk mitigation

Explanation

Purchasing insurance shifts part of the financial consequence to a third party, which is risk transfer. Avoidance would mean ceasing the activity, mitigation would reduce likelihood or impact through controls, and acceptance would mean tolerating the risk without further action. Note that transfer does not remove reputational or operational consequences.

Question 42Threats, Vulnerabilities and Risk Assessment

Why is a 'defense in depth' strategy important for a payment system's exposure to a single control failure?

  1. It ensures that no single control failure results in complete loss of protection. Correct answer.
  2. It allows the organization to reduce all controls to the cheapest option.
  3. It guarantees that attacks will never succeed against the system.
  4. It removes the need to monitor controls once deployed.

Explanation

Defense in depth layers independent controls so that the failure of one does not expose the whole system. It reduces the probability of complete compromise but cannot guarantee that attacks never succeed. Layering complements, rather than replaces, ongoing monitoring and testing.

Question 43Threats, Vulnerabilities and Risk Assessment

A vulnerability scan of a payment environment returns a large number of findings. Which factor is most useful for prioritizing which findings to remediate first?

  1. The number of users who have read the report.
  2. The exploitability of the flaw and the criticality of the affected asset. Correct answer.
  3. The file size of the scanner's output log.
  4. The order in which the findings appear in the report.

Explanation

Prioritization should combine the exploitability and severity of the flaw with the criticality of the asset it affects, because a critical flaw on a core settlement host matters more than a low-risk finding on a test server. Report order and administrative factors carry no risk meaning. This aligns remediation effort with actual exposure.

Question 44Threats, Vulnerabilities and Risk Assessment

Which control most directly mitigates the risk of a man-in-the-middle attack on transaction data in transit between participants?

  1. Publishing the system architecture on the corporate website.
  2. Requiring monthly password changes for tellers.
  3. Encrypting the channel with mutually authenticated TLS. Correct answer.
  4. Storing transaction logs on a local disk.

Explanation

Mutually authenticated TLS encrypts data in transit and verifies both endpoints, which blocks interception and impersonation. Local log storage and password rotation do not protect the communication channel. Publishing architecture details could increase rather than reduce exposure.

Question 45Threats, Vulnerabilities and Risk Assessment

A payment system operator identifies that a key settlement server has no tested failover. Which risk category does this most directly represent?

  1. A compliance risk from missing audit records.
  2. A confidentiality breach caused by data disclosure.
  3. An integrity risk from unauthorized data modification.
  4. An availability risk from a single point of failure. Correct answer.

Explanation

The absence of a tested failover threatens continued service if the server fails, which is an availability risk from a single point of failure. Confidentiality, integrity, and compliance concerns involve disclosure, modification, and records respectively, none of which is the primary issue described. Availability is central to CPSS because settlement disruption affects participants.

Question 46Threats, Vulnerabilities and Risk Assessment

What is the primary benefit of conducting threat modeling during the design phase of a new payment application?

  1. It replaces the organization's risk appetite statement.
  2. It guarantees the application will pass regulatory inspection.
  3. It eliminates the need for security testing after deployment.
  4. It identifies likely threats and weaknesses early, when changes are cheaper. Correct answer.

Explanation

Threat modeling during design surfaces likely threats and weaknesses before code is built, when remediation is far cheaper. It informs security requirements and testing but does not replace post-deployment testing, risk appetite, or regulatory review. Early identification reduces the chance of costly redesign later.

Question 47Threats, Vulnerabilities and Risk Assessment

An attacker sends crafted input to a payment web form and retrieves records from the backend database. Which vulnerability class does this most likely represent?

  1. Session fixation
  2. Cross-site scripting
  3. SQL injection Correct answer.
  4. Denial of service

Explanation

Retrieving backend database records through crafted form input is characteristic of SQL injection, where unsanitized input alters a database query. Cross-site scripting executes script in a victim's browser, denial of service degrades availability, and session fixation manipulates session identifiers. Parameterized queries and input validation are the standard mitigations.

Question 48Threats, Vulnerabilities and Risk Assessment

Which metric best expresses how long a payment system can be unavailable before participants suffer material disruption?

  1. Annualized rate of occurrence
  2. Single loss expectancy
  3. Mean time between failures
  4. Recovery time objective Correct answer.

Explanation

The recovery time objective defines the maximum tolerable time to restore service after disruption. Mean time between failures describes reliability, while annualized rate of occurrence and single loss expectancy are quantitative risk inputs. The recovery time objective drives continuity planning for CPSS operators.

Question 49Threats, Vulnerabilities and Risk Assessment

A risk assessment team finds that two threats have similar annualized loss expectancy, but one threatens the integrity of settlement records while the other affects a marketing website. Why should the team still prioritize the settlement threat?

  1. Because marketing websites are never targeted by attackers.
  2. Because integrity threats are always more expensive than availability threats.
  3. Because annualized loss expectancy calculations are always wrong.
  4. Because equal loss figures ignore the systemic consequences of compromised settlement data. Correct answer.

Explanation

Quantitative loss figures may not capture systemic consequences, such as loss of confidence or cascading disruption among participants when settlement records are corrupted. Risk decisions should weigh impact beyond the monetary estimate. The other options make absolute claims that are not generally true.

Question 50Threats, Vulnerabilities and Risk Assessment

An operator wants to detect anomalous large-value transfers in near real time. Which control is most appropriate?

  1. Storing backups offsite on a weekly basis.
  2. Automated behavioral monitoring with alerting thresholds. Correct answer.
  3. A quarterly manual review of printed transaction reports.
  4. Annual penetration testing of the settlement application.

Explanation

Automated behavioral monitoring with thresholds can flag unusual transfers as they occur, enabling timely investigation. Quarterly manual review, annual penetration testing, and weekly backups operate too slowly or address different risks. Detection of fraud or anomalous activity requires near real-time telemetry.