How to Ace the CISSP: Certified Information Systems Security Professional

Question 1 · Security and Risk Management

A multinational corporation is preparing to implement a new global privacy compliance program. Which approach would BEST align with comprehensive risk management principles?

• Write a single US-based privacy policy and apply it without change across every region
• Depend entirely on the organization's existing IT security controls to manage privacy risk
• Maintain a wholly separate and independent privacy policy for each country of operation
• Develop a unified privacy framework that considers regional regulations and conducts a thorough data mapping exercise

Correct answer: Develop a unified privacy framework that considers regional regulations and conducts a thorough data mapping exercise

A comprehensive approach requires understanding the nuanced privacy requirements across different jurisdictions while creating a unified framework. This strategy addresses the complexity of trans-border data flows and ensures compliance with regulations like GDPR, CCPA, and other regional privacy laws.

Question 2 · Asset Security

A multinational corporation is developing its first comprehensive data classification policy. What should be the PRIMARY focus when creating the classification framework?

• Create the most granular classification scheme possible to maximize the number of distinct sensitivity tiers
• Mirror the classification system used by the largest competitor in the same industry sector
• Adopt a standard government classification model exactly as written without tailoring it to the business
• Align classification levels with the organization's business value and regulatory requirements

Correct answer: Align classification levels with the organization's business value and regulatory requirements

The most effective data classification framework must be tailored to the specific business context, considering the organization's unique risk profile, regulatory environment, and strategic objectives. Simply copying existing models fails to address the organization's specific needs and potential risks.

Question 3 · Security and Risk Management

During a security governance review, an organization discovers inconsistent implementation of security policies across different business units. What should be the FIRST action to address this issue?

• Establish a cross-functional governance committee with executive sponsorship
• Rewrite all existing security policies into a single standardized master document
• Roll out mandatory company-wide security training before any structural changes
• Immediately audit every department to catalog each policy deviation in detail

Correct answer: Establish a cross-functional governance committee with executive sponsorship

Creating a cross-functional governance committee with executive sponsorship ensures strategic alignment, provides oversight, and creates a mechanism for consistent policy development and implementation across the organization.

Question 4 · Security and Risk Management

A healthcare organization is evaluating its risk management approach for protecting patient data. Which strategy would BEST demonstrate due diligence in managing information risk?

• Conduct annual compliance checklist reviews as the organization's sole risk management activity
• Rely exclusively on quantitative risk analysis to express all risk as a single dollar figure
• Implement the most expensive security controls available regardless of the actual risk assessed
• Use a risk assessment framework integrating qualitative and quantitative analysis

Correct answer: Use a risk assessment framework integrating qualitative and quantitative analysis

A comprehensive risk assessment approach using both qualitative and quantitative methods provides a more holistic view of risks, capturing both measurable financial impacts and nuanced organizational vulnerabilities, which is crucial for healthcare data protection.

Question 5 · Security and Risk Management

An organization is developing its business continuity plan and wants to ensure comprehensive coverage. What is the MOST critical initial step?

• Design and build the technical recovery solutions before any business priorities have been established
• Conduct a thorough Business Impact Analysis (BIA) to identify critical business functions
• Purchase disaster recovery insurance to transfer the financial risk of major operational disruptions
• Create an emergency communication protocol so staff can be notified the moment a disruption occurs

Correct answer: Conduct a thorough Business Impact Analysis (BIA) to identify critical business functions

A Business Impact Analysis is fundamental to business continuity planning as it systematically identifies and prioritizes critical business functions, their dependencies, and potential recovery requirements before developing specific recovery strategies.