I85PREP
⌘ K
IIBA CCA study materials
IIBA CCA study resources

IIBA CCA practice questions

One question at a time. Build your IIBA CCA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cybersecurity Analysis (domain breakdown not published in source)

In cybersecurity business analysis, what does the CIA triad primarily describe?

  1. The three tiers of a data center redundancy model
  2. The three roles in a security operations center
  3. The three core properties used to classify security requirements and controls Correct answer.
  4. The three phases of a penetration test engagement

Explanation

The CIA triad names confidentiality, integrity, and availability, which are the core properties analysts use to frame security requirements and evaluate whether controls address them. It is a requirements-classification model, not a process lifecycle or an organizational structure.

Question 2Cybersecurity Analysis (domain breakdown not published in source)

A stakeholder states that customer records must remain unreadable to unauthorized staff. Which CIA property is being expressed?

  1. Confidentiality Correct answer.
  2. Non-repudiation
  3. Availability
  4. Integrity

Explanation

Confidentiality concerns preventing unauthorized disclosure of information, which is exactly what 'unreadable to unauthorized staff' describes. The requirement says nothing about uptime, tamper detection, or proof of origin.

Question 3Cybersecurity Analysis (domain breakdown not published in source)

Which statement best describes the role of a business analyst when eliciting security requirements?

  1. Translating stakeholder security needs into testable, prioritized requirements Correct answer.
  2. Approving the organization's risk appetite on behalf of the board
  3. Configuring firewalls to enforce the requirements
  4. Signing off on residual risk acceptance

Explanation

The analyst's contribution is turning stakeholder concerns into requirements that are clear, verifiable, and prioritized alongside other needs. Risk appetite, control configuration, and risk acceptance belong to governance, engineering, and accountable risk owners respectively.

Question 4Cybersecurity Analysis (domain breakdown not published in source)

Which document is the most appropriate place to record the agreed acceptable level of risk for a new payment feature?

  1. The network diagram
  2. The risk register entry with an owner and treatment decision Correct answer.
  3. The requirements traceability matrix
  4. The test case repository

Explanation

A risk register captures the risk description, its owner, the assessed level, and the agreed treatment or acceptance decision, which is where an acceptable risk level belongs. Traceability matrices, diagrams, and test repositories record links, architecture, and verification, not risk decisions.

Question 5Cybersecurity Analysis (domain breakdown not published in source)

What is the primary purpose of a data classification scheme in security analysis?

  1. To measure network throughput per department
  2. To assign user passwords to information owners
  3. To determine which controls and handling rules apply to information Correct answer.
  4. To schedule backup windows across servers

Explanation

Classification (for example public, internal, confidential, restricted) drives which handling rules, access controls, and protections apply to each information asset. It is a governance label, not a credential mechanism, a performance metric, or a backup schedule.

Question 6Cybersecurity Analysis (domain breakdown not published in source)

A regulation requires that personal data be deleted within 30 days of an account closure. How should the analyst express this in requirements terms?

  1. As a business goal without acceptance criteria
  2. As a verifiable non-functional requirement with a measurable retention limit Correct answer.
  3. As an assumption that deletion happens automatically
  4. As a design constraint describing the preferred database engine

Explanation

A mandated, measurable retention limit is a non-functional (quality or compliance) requirement that can be verified through testing or audit evidence. Expressing it as an assumption, a goal, or a technology preference leaves the obligation untestable.

Question 7Cybersecurity Analysis (domain breakdown not published in source)

During elicitation, a business owner says 'we need to be secure' but cannot specify further. What is the analyst's best next step?

  1. Decompose it using threat scenarios and stakeholder prompts to derive specific, testable needs Correct answer.
  2. Record the statement verbatim as an approved requirement
  3. Escalate to the security team to write all requirements alone
  4. Defer the requirement until the system is built

Explanation

Vague security goals must be decomposed into concrete, testable requirements, typically by walking through threat scenarios, data flows, and stakeholder concerns. Recording verbatim or deferring leaves an unverifiable requirement, and delegating entirely to security staff loses business context.

Question 8Cybersecurity Analysis (domain breakdown not published in source)

Which technique best helps an analyst understand how sensitive data moves between systems before defining controls?

  1. Force field analysis of stakeholder positions
  2. MoSCoW prioritization of features
  3. Data flow mapping of the solution scope Correct answer.
  4. Benchmarking against competitor pricing

Explanation

Mapping data flows shows where sensitive information is created, stored, and transmitted, revealing the points where controls are needed. The other techniques address stakeholder dynamics, prioritization, or market positioning rather than data movement.

Question 9Cybersecurity Analysis (domain breakdown not published in source)

What does the principle of least privilege require of a solution design?

  1. Granting each identity only the access needed for its function and time span Correct answer.
  2. Granting administrators full access to simplify troubleshooting
  3. Encrypting all data at rest with a single shared key
  4. Rotating all passwords every 30 days

Explanation

Least privilege limits access rights to the minimum necessary for a role and duration, reducing the blast radius of misuse or compromise. Broad admin access, password rotation, and encryption are separate controls and do not express the least-privilege principle.

Question 10Cybersecurity Analysis (domain breakdown not published in source)

An analyst is defining acceptance criteria for a multi-factor authentication requirement. Which criterion is most verifiable?

  1. MFA should be user friendly and widely adopted
  2. The system should be reasonably secure for login
  3. The vendor claims strong authentication support
  4. Users must complete a second factor from a distinct category before a session token is issued Correct answer.

Explanation

Verifiable acceptance criteria state a specific, observable behavior that can be tested, such as a second factor from a different category being required before a token is issued. Subjective terms, adoption goals, and vendor claims cannot be objectively verified.

Question 11Cybersecurity Analysis (domain breakdown not published in source)

Which pair correctly distinguishes a threat from a vulnerability?

  1. A threat is a potential cause of harm; a vulnerability is a weakness that can be exploited Correct answer.
  2. A threat is a weakness; a vulnerability is an attacker
  3. A threat is a control; a vulnerability is a policy
  4. A threat is a risk score; a vulnerability is a mitigation

Explanation

A threat is any potential event or actor that could cause harm, while a vulnerability is a weakness in a system or process that such a threat could exploit. Risk arises from the combination of threat, vulnerability, and impact.

Question 12Cybersecurity Analysis (domain breakdown not published in source)

A team proposes accepting a risk because implementing a control is too costly. What should the analyst ensure is documented?

  1. A list of all employees who disagreed
  2. The rationale, the accountable risk owner, and the review date Correct answer.
  3. The project's original budget estimate
  4. The control vendor's marketing materials

Explanation

Risk acceptance must record why the risk is tolerated, who is accountable for it, and when it will be revisited, so the decision is auditable and time-bound. Marketing materials, dissent lists, and budget figures do not constitute a valid acceptance record.

Question 13Cybersecurity Analysis (domain breakdown not published in source)

Which requirement type best captures 'the audit log must be retained for one year and be tamper-evident'?

  1. A transition requirement about migration
  2. A functional requirement about logging
  3. A business rule about user roles
  4. A non-functional requirement about logging integrity and retention Correct answer.

Explanation

Retention duration and tamper-evidence are quality attributes of the logging capability, making them non-functional (security and compliance) requirements. They do not describe a user-facing function, a role rule, or a cutover activity.

Question 14Cybersecurity Analysis (domain breakdown not published in source)

What is the main purpose of maintaining bidirectional traceability between security requirements and controls/tests?

  1. To replace the need for a risk assessment
  2. To increase the number of requirements in the backlog
  3. To reduce the size of the design document
  4. To demonstrate that each requirement is implemented and verified, and that each control is justified Correct answer.

Explanation

Bidirectional traceability shows that every security requirement is realized and tested, and that every implemented control traces back to a requirement or risk. It supports audit and change impact analysis rather than inflating the backlog or replacing risk work.

Question 15Cybersecurity Analysis (domain breakdown not published in source)

A new regulation takes effect mid-project and changes encryption obligations. What is the most appropriate analyst response?

  1. Implement the change silently without notifying stakeholders
  2. Ignore it because requirements were already baselined
  3. Perform impact analysis, update the requirements baseline, and re-trace affected controls and tests Correct answer.
  4. Close the project and restart from scratch

Explanation

Regulatory change triggers impact analysis against the baselined requirements, followed by controlled updates and re-tracing to affected design and tests. Ignoring, silently changing, or restarting the project all bypass proper change control.

Question 16Cybersecurity Analysis (domain breakdown not published in source)

Which statement correctly describes defense in depth as a design principle?

  1. Applying the same control repeatedly to the same asset
  2. Layering independent controls so failure of one does not eliminate protection Correct answer.
  3. Removing controls once a newer one is deployed
  4. Relying on a single strong perimeter control for all protection

Explanation

Defense in depth layers complementary, ideally independent controls so that a single failure or bypass does not expose the asset. Single-perimeter reliance, control removal, and duplicating one control do not achieve layered protection.

Question 17Cybersecurity Analysis (domain breakdown not published in source)

What distinguishes a misuse case from a standard use case in security analysis?

  1. It describes an attacker or abuser intentionally causing harm to the system Correct answer.
  2. It replaces the need for threat modeling
  3. It lists hardware specifications
  4. It documents only successful user journeys

Explanation

A misuse case models adversarial or abusive behavior that the system must resist, complementing normal use cases. Standard use cases describe intended interactions, and misuse cases feed threat modeling rather than replacing it.

Question 18Cybersecurity Analysis (domain breakdown not published in source)

An analyst must decide whether a proposed third-party service can process regulated data. Which evidence is most relevant?

  1. The vendor's office locations
  2. The vendor's independent security certification and its scope statement Correct answer.
  3. The vendor's customer satisfaction score
  4. The vendor's marketing website design

Explanation

An independent certification with a defined scope shows which controls were assessed and whether the regulated data processing is covered. Satisfaction scores, office locations, and website design do not demonstrate control effectiveness.

Question 19Cybersecurity Analysis (domain breakdown not published in source)

Which of the following best describes an assumption that should be recorded during security requirements analysis?

  1. A control that has been implemented
  2. A verified fact confirmed by testing
  3. A regulatory obligation
  4. A belief taken as true for planning that must be validated if it affects risk Correct answer.

Explanation

An assumption is something accepted as true without proof to allow progress, and it should be validated when it materially affects risk or design. Verified facts, implemented controls, and legal obligations are not assumptions.

Question 20Cybersecurity Analysis (domain breakdown not published in source)

What is the analyst's most useful contribution to a threat modeling session?

  1. Selecting the firewall hardware vendor
  2. Writing the exploit code for validation
  3. Approving the residual risk on behalf of the business
  4. Ensuring the model reflects business context, data sensitivity, and prioritized requirements Correct answer.

Explanation

The analyst grounds threat modeling in business context, data classification, and prioritized requirements so identified threats map to meaningful risks and requirements. Vendor selection, exploit development, and risk approval sit with other roles.

Question 21Cybersecurity Analysis (domain breakdown not published in source)

A solution must support both privacy by design and operational monitoring. Which requirement conflict should the analyst surface first?

  1. The color scheme of the monitoring dashboard
  2. The choice of programming language for the front end
  3. The number of meetings scheduled for design review
  4. The tension between minimizing collected personal data and the breadth of monitoring telemetry Correct answer.

Explanation

Data minimization and extensive monitoring pull in opposite directions, so the analyst should surface that trade-off and negotiate scope, retention, and anonymization. The other items are implementation or cosmetic details that do not represent a substantive requirements conflict.

Question 22Cybersecurity Analysis (domain breakdown not published in source)

Which metric best indicates whether security requirements are being verified rather than merely written?

  1. The percentage of security requirements with passing linked test evidence Correct answer.
  2. The count of security requirements in the backlog
  3. The page count of the security policy
  4. The number of stakeholders interviewed

Explanation

Verification is demonstrated by evidence that requirements have linked, passing tests, so the coverage percentage with test evidence is the meaningful indicator. Backlog counts, interview counts, and document length measure volume, not verification.

Question 23Cybersecurity Analysis (domain breakdown not published in source)

What does a security control gap analysis compare?

  1. Two competing project schedules
  2. Current control state against a target framework or requirement set Correct answer.
  3. The salaries of security staff
  4. Historical stock prices

Explanation

Gap analysis compares the controls currently in place with the target state defined by a framework, standard, or requirement set, identifying shortfalls to address. The other comparisons are unrelated to control coverage.

Question 24Cybersecurity Analysis (domain breakdown not published in source)

An analyst notices that a requirement to encrypt backups conflicts with a recovery time objective of two hours. What is the best course of action?

  1. Extend the recovery objective without stakeholder agreement
  2. Raise the trade-off with stakeholders and evaluate options such as key availability and pre-staged recovery environments Correct answer.
  3. Drop encryption to meet the recovery target
  4. Document the conflict and proceed without resolution

Explanation

The analyst should surface the trade-off and facilitate evaluation of options that satisfy both needs, such as ensuring key availability during recovery or pre-staging environments. Unilaterally dropping encryption, changing objectives, or leaving the conflict unresolved undermines both security and stakeholder agreement.

Question 25Cybersecurity Analysis (domain breakdown not published in source)

Which statement about security requirements prioritization is most accurate?

  1. Security requirements are always lowest priority
  2. Prioritization should reflect risk, regulatory obligation, and business impact Correct answer.
  3. All security requirements are equally critical and cannot be ranked
  4. Prioritization should be based only on implementation cost

Explanation

Security requirements should be prioritized using risk exposure, legal or regulatory obligation, and business impact, so effort focuses where it matters most. Treating all as equal, as lowest priority, or ranking only by cost ignores the underlying risk.

Question 26Cybersecurity Analysis (domain breakdown not published in source)

In a cybersecurity analysis effort, which term describes the potential for a threat source to exploit a weakness and cause harm to an asset?

  1. Exposure
  2. Likelihood
  3. Impact
  4. Risk Correct answer.

Explanation

Risk combines the likelihood that a threat exploits a vulnerability with the resulting impact on the asset, so it is the composite measure of potential harm. The other terms describe components or inputs used when calculating risk rather than the combined potential for harm itself.

Question 27Cybersecurity Analysis (domain breakdown not published in source)

Which document typically assigns a specific, named individual as accountable for treating a particular identified risk?

  1. A business continuity plan
  2. A vulnerability scan report
  3. A risk register entry with an owner Correct answer.
  4. A security awareness policy

Explanation

A risk register records each risk with attributes such as likelihood, impact, and a designated risk owner who is accountable for the treatment decision. Scan reports, continuity plans, and awareness policies do not assign per-risk accountability to a named individual.

Question 28Cybersecurity Analysis (domain breakdown not published in source)

An analyst is classifying data so that handling rules can be applied. Which classification approach is most defensible for a regulated dataset?

  1. Base the classification on the sensitivity and regulatory obligations attached to the data Correct answer.
  2. Base the classification on the file format used to store the data
  3. Base the classification on the job title of the employee who created the data
  4. Base the classification on the storage system where the data currently resides

Explanation

Data classification should reflect the sensitivity of the information and any legal or regulatory obligations, because those drive the handling controls. Storage location, creator job title, and file format are incidental attributes that can change without altering the underlying sensitivity.

Question 29Cybersecurity Analysis (domain breakdown not published in source)

Which authentication factor category is represented by a hardware token that generates a time-based one-time code?

  1. Somewhere you are
  2. Something you have Correct answer.
  3. Something you are
  4. Something you know

Explanation

A physical device in the user's possession that produces a code is a possession factor, categorized as something you have. Knowledge factors are memorized secrets, inherence factors are biometric traits, and location is a contextual signal rather than a possession factor.

Question 30Cybersecurity Analysis (domain breakdown not published in source)

Which concept describes granting a subject only the access rights necessary to complete its assigned task, for only as long as needed?

  1. Privilege escalation
  2. Least privilege Correct answer.
  3. Separation of duties
  4. Mandatory access control

Explanation

Least privilege limits access rights to the minimum required for the task and duration, reducing the blast radius of misuse or compromise. Separation of duties splits tasks among people, mandatory access control enforces system-wide labels, and privilege escalation is an attack or elevation event rather than a restriction principle.

Question 31Cybersecurity Analysis (domain breakdown not published in source)

Which activity establishes the acceptable level of risk that a system is authorized to operate with before it goes live?

  1. Security authorization, where an authorizing official accepts residual risk Correct answer.
  2. Vulnerability scanning, which enumerates known technical weaknesses
  3. Penetration testing, which demonstrates exploitability of weaknesses
  4. Log monitoring, which detects anomalous activity after deployment

Explanation

Authorization is the formal decision in which an accountable official accepts the residual risk of operating the system based on assessment evidence. Scanning, penetration testing, and monitoring generate evidence or detect events but do not themselves confer authority to operate.

Question 32Cybersecurity Analysis (domain breakdown not published in source)

Which statement best distinguishes a security control from a security safeguard implemented as a process?

  1. A control is only a technical device such as a firewall or encryption module
  2. A control is only a documented policy approved by management
  3. A control is any measure that modifies risk, whether technical, administrative, or physical Correct answer.
  4. A control is only a physical barrier such as a locked door

Explanation

In cybersecurity analysis, a control is any measure that modifies risk, which includes technical, administrative, and physical categories. Restricting the definition to a single category excludes valid controls and misrepresents how layered protection works.

Question 33Cybersecurity Analysis (domain breakdown not published in source)

During requirements elicitation, a stakeholder asks for 'strong encryption everywhere.' Which analyst action best turns this into an analyzable requirement?

  1. Defer the requirement to the implementation team because encryption is a technical detail
  2. Record the stakeholder's statement verbatim as the requirement and move on to the next topic
  3. Specify the data at rest and in transit, the approved algorithms and key lengths, and the conditions under which each applies Correct answer.
  4. Replace the statement with a general goal that all data should be protected

Explanation

An analyzable security requirement states measurable conditions: which data, in which state, protected by which approved algorithms and key strengths. Recording vague wording verbatim or deferring it leaves the requirement untestable and open to inconsistent interpretation.

Question 34Cybersecurity Analysis (domain breakdown not published in source)

An analyst is building a data flow diagram for security analysis. Which element must be shown to reason about where controls are needed at trust boundaries?

  1. The salary band of the system administrator
  2. The boundaries where data crosses between zones of differing trust Correct answer.
  3. The physical dimensions of the server room
  4. The version history of the source code repository

Explanation

Trust boundaries mark where data moves between components or zones with different levels of trust, and controls are typically required at those crossings. Physical dimensions, repository history, and staffing details do not inform where data crosses a trust boundary.

Question 35Cybersecurity Analysis (domain breakdown not published in source)

A system owner proposes to outsource a payment function to a processor. Which analysis step most directly determines whether the arrangement meets the organization's security obligations?

  1. Assess the processor against the specific security and contractual requirements that apply to the data Correct answer.
  2. Check whether the processor's staff have similar job titles to internal staff
  3. Confirm that the processor's marketing materials mention security certifications
  4. Compare the processor's pricing against competing vendors

Explanation

Third-party risk analysis compares the processor's actual controls and contractual commitments against the specific obligations attached to the data being shared. Marketing claims, pricing, and job titles do not demonstrate that the required security outcomes are met.

Question 36Cybersecurity Analysis (domain breakdown not published in source)

An analyst is reviewing a proposed architecture and finds that a single authentication service, if unavailable, would block all users from every application. Which analysis conclusion is most appropriate?

  1. The design is acceptable because authentication is a security control
  2. The design has excessive redundancy that should be reduced
  3. The design has a single point of failure that threatens availability and should be addressed Correct answer.
  4. The design is acceptable because availability is an operational concern only

Explanation

A component whose failure halts all dependent services is a single point of failure, and the analyst should flag it as an availability risk requiring mitigation such as redundancy. Treating availability as outside security analysis ignores that availability is a core security objective.

Question 37Cybersecurity Analysis (domain breakdown not published in source)

Which element of a threat model captures the paths an adversary could take from an entry point to a valuable asset?

  1. Attack paths Correct answer.
  2. Asset inventory
  3. Change control log
  4. Data retention schedule

Explanation

Attack paths describe how an adversary could move from an entry point through the environment to reach and affect a valuable asset. Asset inventory, retention schedules, and change logs provide context but do not express adversarial routes.

Question 38Cybersecurity Analysis (domain breakdown not published in source)

An analyst needs to evaluate whether a proposed logging control will actually support incident investigation. Which criterion is most relevant?

  1. The font and color scheme used in the log viewer
  2. The events captured, retention period, and integrity protection of the logs Correct answer.
  3. The physical location of the analyst who reads the logs
  4. The number of developers who wrote the logging code

Explanation

Investigative value depends on capturing the right events, keeping them long enough, and ensuring they cannot be altered. Presentation styling, developer headcount, and reader location do not determine whether logs support investigation.

Question 39Cybersecurity Analysis (domain breakdown not published in source)

A risk assessment finds a high-impact risk that cannot be eliminated before launch. Which treatment option involves proceeding while consciously accepting the remaining exposure?

  1. Risk acceptance Correct answer.
  2. Risk mitigation
  3. Risk avoidance
  4. Risk transfer

Explanation

Acceptance is the deliberate decision to retain residual risk, typically with documented rationale and approval by an accountable owner. Avoidance eliminates the activity, transfer shifts financial or contractual burden, and mitigation reduces likelihood or impact.

Question 40Cybersecurity Analysis (domain breakdown not published in source)

An analyst is assessing whether a web application properly enforces authorization. Which test approach most directly evaluates server-side enforcement?

  1. Measure the page load time for the login screen
  2. Review the application's marketing page for a security statement
  3. Attempt to access another user's resources by manipulating identifiers while authenticated as a lower-privileged user Correct answer.
  4. Count the number of user interface buttons visible to administrators

Explanation

Authorization must be enforced on the server, so the direct test is to attempt access to resources outside the user's permitted scope and observe whether the server denies it. Marketing statements, page timing, and interface element counts do not reveal server-side enforcement behavior.

Question 41Cybersecurity Analysis (domain breakdown not published in source)

Which artifact best demonstrates that each security requirement has a corresponding verification activity?

  1. A list of open vulnerabilities sorted by severity
  2. A requirements traceability matrix linking requirements to tests and controls Correct answer.
  3. A network diagram labeled with device hostnames
  4. A training completion roster for staff

Explanation

A traceability matrix maps each requirement to the controls that satisfy it and the tests that verify it, providing evidence of coverage. Network diagrams, vulnerability lists, and training rosters do not link requirements to verification activities.

Question 42Cybersecurity Analysis (domain breakdown not published in source)

An analyst finds that a proposed monitoring capability would capture individual user behavior in a way that exceeds what privacy obligations permit. What is the most appropriate response?

  1. Escalate the conflict without proposing any alternative or documenting the trade-off
  2. Document the conflict and propose an alternative that meets the monitoring objective with less personal data Correct answer.
  3. Implement the monitoring as designed because security objectives override privacy obligations
  4. Remove all monitoring because privacy obligations always prohibit user monitoring

Explanation

The analyst should surface the conflict between monitoring and privacy obligations and propose a design that achieves the security objective with reduced personal data, such as aggregation or minimization. Treating either objective as absolute, or escalating without analysis, fails to resolve the tension.

Question 43Cybersecurity Analysis (domain breakdown not published in source)

Which pair correctly matches a control with its primary function?

  1. Detective control: blocks an action before it occurs
  2. Preventive control: restores systems after an incident
  3. Corrective control: detects an event as it occurs
  4. Preventive control: blocks an action before it occurs Correct answer.

Explanation

Control functions describe timing and purpose: preventive controls stop actions before they happen, detective controls identify events, and corrective controls restore normal operation afterward. Each incorrect option assigns a function that belongs to a different control category.

Question 44Cybersecurity Analysis (domain breakdown not published in source)

An analyst is evaluating a vendor's assertion that its service is secure. Which evidence provides the strongest independent basis for the assessment?

  1. A verbal assurance from the vendor's sales representative
  2. A screenshot of the vendor's security dashboard
  3. An independent audit report scoped to the relevant controls and period Correct answer.
  4. A customer testimonial published on the vendor's website

Explanation

An independent audit scoped to the relevant controls and time period provides third-party evidence that those controls operated as described. Testimonials, verbal assurances, and screenshots are self-reported or unverifiable and cannot substantiate control effectiveness.

Question 45Cybersecurity Analysis (domain breakdown not published in source)

A security requirement states that session tokens must expire after inactivity. Which acceptance criterion makes this requirement verifiable?

  1. The system should use modern session management practices
  2. Session handling should follow industry standards where feasible
  3. Sessions should generally be secure and expire at a reasonable time
  4. After the defined inactivity interval, the session is rejected and re-authentication is required Correct answer.

Explanation

A verifiable criterion states the observable behavior and the condition under which it is checked, such as rejection of the session after a defined inactivity interval. General references to reasonable, modern, or industry-standard practice cannot be tested objectively.

Question 46Cybersecurity Analysis (domain breakdown not published in source)

An analyst must record how a sensitive data element flows from capture through processing to disposal. Which model best supports this analysis?

  1. A staff organization chart showing reporting lines
  2. A hardware inventory listing device serial numbers
  3. A data lifecycle model mapping each stage to the controls applied at that stage Correct answer.
  4. A project schedule showing milestone dates

Explanation

A lifecycle model follows the data through creation, use, sharing, retention, and disposal, allowing controls to be mapped to each stage. Organization charts, schedules, and hardware inventories do not track data movement or the controls applied at each stage.

Question 47Cybersecurity Analysis (domain breakdown not published in source)

An analyst is assessing a system that relies on a shared secret embedded in client software to authenticate to a backend service. What is the most significant security concern?

  1. The secret is too long to be remembered by users
  2. The secret changes too frequently for the backend to process
  3. The secret can be extracted from the client and used by anyone who obtains it Correct answer.
  4. The secret is stored in a configuration file on the server

Explanation

Any secret shipped inside client software is accessible to whoever controls the client environment, so it cannot serve as a reliable authenticator for the client. Length, rotation frequency, and server-side configuration storage are not the core weakness described.

Question 48Cybersecurity Analysis (domain breakdown not published in source)

Two controls are proposed: one reduces the likelihood of an attack, the other reduces its impact. How should the analyst represent their combined effect in a risk assessment?

  1. Assess each control's effect on its respective risk factor and evaluate the residual risk after both are applied Correct answer.
  2. Ignore both controls because risk factors are independent and cannot be modeled together
  3. Assume the controls are redundant and count only the stronger one
  4. Assume the effects are additive in all cases and sum the risk reductions

Explanation

Likelihood-reducing and impact-reducing controls act on different factors, so the analyst evaluates each effect and then estimates residual risk with both in place. Treating them as redundant, blindly summing reductions, or refusing to model them misrepresents the combined exposure.

Question 49Cybersecurity Analysis (domain breakdown not published in source)

An analyst must determine whether a proposed solution meets a requirement for timely detection of unauthorized configuration changes. Which analysis approach is most rigorous?

  1. Review the tool's user manual for a chapter on configuration monitoring
  2. Accept the vendor's claim that the tool detects changes promptly
  3. Define the change events to be detected, the maximum detection latency, and the test that demonstrates both Correct answer.
  4. Ask the implementation team whether they believe detection works

Explanation

Rigorous analysis converts the requirement into observable criteria such as which events must be detected and the maximum acceptable latency, then defines a test that demonstrates both. Vendor claims, documentation, and team opinion do not verify that the requirement is met.

Question 50Cybersecurity Analysis (domain breakdown not published in source)

A system processes data from two jurisdictions with conflicting breach-notification timelines. What is the analyst's most appropriate contribution?

  1. Defer the decision entirely to the development team without analysis
  2. Apply only the jurisdiction with the longest notification timeline
  3. Apply only the jurisdiction where the system is physically hosted
  4. Identify the conflict, determine the strictest applicable obligation, and document how the design satisfies it Correct answer.

Explanation

When obligations conflict, the analyst identifies the conflict and typically designs to the strictest applicable requirement so that all jurisdictions are satisfied, documenting the rationale. Choosing by hosting location or leniency, or deferring without analysis, leaves the organization exposed.