Exam: Chapters 108–112 · Security+ SY0-701

Chapters 108–112 Practice Exam

📝 20 scored questions ⏱️ 25-minute target 🎯 Pass threshold: 80% (16/20)

Time remaining

25:00

Part A — Multiple Choice (Questions 1–20)

Ch 108 · Security Considerations

Question 1 of 20

A financial controller at a 50-person privately held software startup is briefing a new board member. The board member asks: "Are we subject to Sarbanes-Oxley (SOX) Section 404 requirements for our IT controls over financial reporting?" The controller responds: "SOX does not apply to us." Under what condition is this response accurate, and what is the key SOX applicability criterion?

A. The response is accurate because the company is privately held. SOX Section 404 applies exclusively to publicly traded companies — those with publicly traded equity or debt securities. Private companies, nonprofits, and government entities are entirely exempt from SOX IT control and attestation requirements. B. The response is inaccurate; SOX applies to all companies with more than $10 million in annual revenue, regardless of whether shares are publicly traded C. The response is accurate only if the company processes fewer than 10,000 financial transactions per year; transaction volume determines SOX applicability thresholds D. The response is inaccurate; all companies that process employee payroll using automated systems must comply with SOX IT control requirements regardless of their ownership structure

✅ A — Privately held companies are exempt from SOX. The Sarbanes-Oxley Act was enacted in response to Enron-era public company accounting fraud. Its Section 404 IT control requirements apply exclusively to publicly traded companies — companies with publicly traded equity or debt securities registered with the SEC. Private companies are entirely exempt. The exam facts: SOX requires CEOs/CFOs to personally attest to the effectiveness of internal controls over financial reporting (executive attestation), mandates 7-year audit record retention, and applies only to publicly traded companies. The controller's response is accurate precisely because the company is private.

Ch 108 · Security Considerations

Question 2 of 20

A healthcare organization's records management system is configured to automatically delete patient communications older than 7 years in accordance with the applicable state retention schedule. The organization is named as a defendant in a class-action lawsuit alleging improper PHI disclosure. Legal counsel issues a formal written directive to the IT department citing the pending litigation. What must the IT department do immediately, and what is the specific legal risk of non-compliance?

A. Continue normal automated deletions; only records created after the litigation filing date are legally relevant, and the 7-year retention policy already satisfies discovery requirements B. Suspend all automated deletion of records potentially relevant to the litigation immediately; continuing scheduled deletions after receiving legal counsel's directive constitutes spoliation of evidence — intentional or negligent destruction of material subject to a legal hold — which can result in severe court sanctions including adverse inference instructions, case dismissal, or default judgment C. Move records scheduled for deletion into a legal hold folder but continue the automated deletion schedule for records unrelated to the specific plaintiffs named in the complaint D. Contact the plaintiff's attorneys to identify which specific records are needed, and preserve only those records while continuing normal retention operations for all others

✅ B — Suspend all automated deletion immediately. A litigation hold (legal hold) is a formal directive from legal counsel that suspends ALL automated deletion processes for records potentially relevant to the litigation. "Potentially relevant" is interpreted broadly — far beyond just records about named plaintiffs. The risk of non-compliance is spoliation of evidence: intentional or negligent destruction of material that was under a legal obligation to preserve. Spoliation consequences include adverse inference instructions (the jury is told to assume destroyed records were damaging), case dismissal, or default judgment. The retention schedule — however well-designed — must stop for covered records when legal counsel issues a hold directive.

Ch 108 · Security Considerations

Question 3 of 20

A EU-regulated company's security operations team receives an alert at 8:00 AM Monday indicating unusual data access patterns. By 2:00 PM Monday the team confirms that personal data of 3,000 EU data subjects was exfiltrated — the breach itself occurred at 11:00 PM the previous Friday. Under GDPR Article 33, when does the 72-hour notification clock for the supervisory authority begin?

A. 11:00 PM Friday — when the breach actually occurred; the 72-hour obligation runs from the moment of the breach event, regardless of when the organization learns about it B. 8:00 AM Monday — when the organization first received the alert indicating a possible incident C. 2:00 PM Monday — when the organization became aware of and confirmed the breach; GDPR Article 33's 72-hour clock starts at the moment of awareness (confirmation), not when the breach occurred and not when the initial alert was received D. 72 hours is measured from when the organization completes its root cause analysis; preliminary notifications before a full investigation are not required under Article 33

✅ C — The clock starts at 2:00 PM Monday (moment of confirmed awareness). GDPR Article 33 requires notification to the supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become AWARE of it." The operative word is aware — not when the breach occurred, and not when an ambiguous alert arrived. In this scenario: breach Friday 11 PM → alert Monday 8 AM → confirmation Monday 2 PM → 72-hour clock starts at 2 PM Monday. If the full notification cannot be completed within 72 hours, the initial notification may include what is known with additional information to follow — but the deadline still runs from the moment of awareness.

Ch 108 · Security Considerations

Question 4 of 20

A manufacturing plant's SCADA system manages production line equipment. The security team identifies a critical CVE (CVSS 9.1) in the SCADA software. The vendor releases a patch. The IT security manager wants to deploy the patch immediately given the critical severity. The OT engineer objects, arguing the patch cannot be deployed on an accelerated schedule. Which argument best justifies the OT engineer's position?

A. OT systems are air-gapped and cannot be reached by external attackers, making the vulnerability effectively unexploitable despite the critical CVSS score B. The CVSS 9.1 score reflects IT assumptions; OT vulnerabilities are inherently less dangerous because production systems do not process sensitive data like patient records or financial transactions C. All patches require a 6-month compatibility testing window as a standard IT change management requirement before production deployment D. In OT/ICS environments, availability is the highest-priority security property; an untested patch that causes a system crash or equipment malfunction could halt production, damage physical equipment, or create worker safety hazards. OT patches require extensive testing in isolated lab environments that replicate exact hardware and software configurations — the operational and safety risk of a hasty patch may exceed the risk of the known vulnerability

✅ D — OT/ICS availability takes priority; patching has physical consequences. The CIA triad priority order is reversed in OT/ICS/SCADA environments compared to traditional IT: Availability > Integrity > Confidentiality. A SCADA system crash could cause a physical process to fail in an unsafe state — equipment damage, production shutdown, or worker injury. This is why OT patching cycles are inherently slower: patches must be validated in isolated environments replicating exact hardware/software configurations before production deployment. The known vulnerability risk must be weighed against the operational and safety risk of an untested patch. Air-gapping may reduce (not eliminate) exposure, but the primary argument here is the physical consequence of downtime.

Ch 109 · Data Roles

Question 5 of 20

A healthcare organization designates its Chief Medical Officer (CMO) as Data Owner for the patient records system. The CMO has no administrator account, cannot execute database queries, and has never logged into the database management console. The IT department argues the CMO cannot be the Data Owner without system access. Which response correctly evaluates this argument?

A. The IT department's argument is incorrect. The Data Owner role is defined by organizational accountability, not technical access. The CMO determines data classification (sensitivity of patient records), approves access, defines retention policies, and bears ultimate accountability for data governance — none of these responsibilities require system access. Technical implementation of those decisions is the Data Custodian's responsibility. B. The IT department's argument is correct; the Data Owner must be able to perform access reviews, which requires system access to audit current permission assignments C. The Data Owner requires at least read-only system access to verify that data classifications are correctly implemented in the system's security controls D. The CMO should be redesignated as a Data Steward; Data Owners must be within the IT organization because data governance requires technical oversight of the systems storing the data

✅ A — Data Owner accountability is organizational, not technical. The Data Owner is typically a senior organizational leader (CMO, CFO, department head) who: (1) determines data sensitivity classification, (2) approves who may access the data, (3) defines data retention and disposal policies, and (4) bears ultimate organizational accountability for data governance decisions. The Data Custodian (technical IT staff) implements those decisions — configuring RBAC per the owner's approvals, managing encryption, performing backups, running audit logs. The CMO's lack of system access is correct and expected: the CMO decides, the custodian implements. This separation of accountability from technical access is a foundational exam concept.

Ch 109 · Data Roles

Question 6 of 20

A company's HR department collects employee payroll data and shares it with a third-party payroll processing company to handle paycheck calculations and direct deposit disbursement. Under GDPR's data role framework, what are the correct role designations and what documentation is required between them?

A. Both the HR department and the payroll processor are Data Controllers; whenever two organizations both have access to personal data, both bear full controller responsibilities simultaneously B. The HR department is the Data Controller (it determines the purpose — payroll administration — and means of processing employee data); the payroll processor is a Data Processor (it processes personal data on behalf of and under the instructions of the HR department). A Data Processing Agreement (DPA) is required — the processor cannot use the data for any purpose beyond what the controller instructs. C. The payroll processor is the Data Controller because it performs the actual data processing operations and is directly responsible for the technical security of the data during processing D. The HR department is the Data Processor because it collects the raw data before sending it to the actual controller (payroll company) which determines how payroll calculations are performed

✅ B — HR department = Controller; payroll company = Processor. The controller/processor distinction turns entirely on who determines purpose and means: the HR department decides why employee data is collected (payroll administration) and what is done with it — this is controller status. The payroll company processes data according to the HR department's instructions and for the HR department's purposes — this is processor status. A Data Processing Agreement (DPA) is mandatory under GDPR Article 28; it specifies what the processor can and cannot do with the data, security requirements, breach notification obligations, and sub-processor rules. The processor cannot use the data for its own independent purposes — doing so would make it a controller for that additional use.

Ch 109 · Data Roles

Question 7 of 20

An organization assigns a senior clinical leader as Data Owner and a database administrator (DBA) team as Data Custodians for a new patient records system. A junior analyst asks: "What specific tasks fall under the Data Custodian role?" Which description correctly defines the Data Custodian's responsibilities?

A. Data Custodians are responsible for deciding which users need access to patient records and approving access requests from clinical staff B. Data Custodians define the retention schedule for patient records and determine the sensitivity classification level for each record type C. Data Custodians handle the operational, day-to-day technical implementation: configuring role-based access controls per the owner's approval decisions, applying and managing encryption at rest and in transit, performing and verifying backups, managing audit logging, and operating SIEM monitoring — they implement policy decisions but do not make them D. Data Custodians bear ultimate organizational accountability for patient record security and are the primary point of contact for regulatory auditors examining PHI protection controls

✅ C — Data Custodian = operational technical implementation. The Data Custodian (also called Data Steward) is the technical staff who run the system day-to-day: configuring RBAC per the owner's access decisions, managing encryption, performing backups, reviewing audit logs, and operating monitoring and SIEM tools. Key distinction: the Data Owner decides WHO can access data and at what classification; the Custodian configures the system to implement those decisions. The Data Owner bears ultimate organizational accountability; the Custodian bears operational responsibility for technically implementing the owner's policies correctly. Approving access and defining classification are Data Owner functions, not Custodian functions.

Ch 109 · Data Roles

Question 8 of 20

A European retail company (Data Controller) stores customer purchase history with a cloud analytics provider (Data Processor) under a valid Data Processing Agreement. The cloud provider suffers a breach exposing 180,000 customer records. The retail company's legal team argues: "The breach occurred entirely at the processor's infrastructure — our DPA transfers all breach accountability to the processor. The supervisory authority should hold the processor, not us." Which statement correctly evaluates this argument?

A. The argument is correct; a validly signed DPA transfers all regulatory accountability from the controller to the processor for breaches occurring within the processor's infrastructure B. The argument is partially correct; the controller is exempt from regulatory action if it can demonstrate that the DPA contained adequate security requirements and the breach resulted from the processor's failure to comply with those requirements C. The argument is correct if the DPA specifies security standards that the processor failed to meet; contractual non-compliance by the processor shifts GDPR regulatory liability entirely to the processor D. The argument is incorrect. A DPA defines security obligations and creates contractual liability, but it cannot transfer GDPR regulatory accountability from the controller to the processor. The controller selected this processor, was responsible for due diligence on their security posture, and remains the supervisory authority's primary point of regulatory accountability. Both the controller and processor may face independent regulatory consequences from the same incident.

✅ D — A DPA cannot transfer GDPR regulatory accountability. Under GDPR, the Data Controller cannot outsource regulatory accountability to a processor through contract. The DPA creates contractual obligations that may support a civil claim if the processor violated those terms, but the supervisory authority holds the controller primarily accountable for: (1) choosing to work with this processor, (2) conducting adequate due diligence on their security controls, (3) including appropriate technical and organizational requirements in the DPA, and (4) the ongoing processing relationship. A controller cannot shield itself from GDPR enforcement by pointing to the processor's contractual breach. Both parties may face separate, simultaneous enforcement actions arising from the same incident.

Ch 110 · Risk Management

Question 9 of 20

A company deploys a new enterprise ERP system. The CISO establishes a dedicated risk assessment team to evaluate the ERP's security controls, data exposure risks, integration points, and access control architecture before go-live. After deployment, the team disbands. Six months later, the CISO does not schedule another ERP-specific assessment. What type of risk assessment was conducted, and why is not scheduling a follow-up consistent with this type?

A. A one-time assessment; it was scoped to a specific discrete event (ERP deployment) and is not intended to repeat. The same assessment approach would only recur if the same triggering event — another major system deployment — occurs again. The ERP system is now covered by the organization's ongoing recurring and continuous assessment programs, not by the one-time deployment team. B. A recurring assessment; the absence of a follow-up six months later represents a scheduling gap that should be flagged as a compliance finding for the security program C. A continuous assessment; one-time major system deployment assessments are a component of the continuous assessment program, which continues through SIEM monitoring after go-live D. An ad hoc assessment; the ERP deployment was an unplanned event that required an emergency team to form and assess quickly before go-live

✅ A — One-time assessment. A one-time assessment is scoped to a specific, bounded event (an acquisition, a new system deployment, a major infrastructure migration) and is not repeated once that event concludes. The assessment team forms, evaluates, and disbands. There is no expectation of a recurring follow-up — the same methodology would only be re-applied if the same type of triggering event occurs again (e.g., another major system deployment). This contrasts with recurring assessments (calendar-driven, repeating), ad hoc assessments (triggered by unplanned concerns), and continuous assessments (permanently integrated with no defined end). Not scheduling a follow-up is correct behavior for a one-time assessment.

Ch 110 · Risk Management

Question 10 of 20

A healthcare organization's CISO reads a news report that a competitor — a similarly sized regional health system — was hit by ransomware through exploitation of a specific EMR vulnerability. The organization runs the same EMR software. The CISO immediately assembles a cross-functional team of security analysts, system administrators, and the EMR vendor's support contact to assess exposure. The team disbands after completing the assessment and implementing mitigations. What type of risk assessment is this, and what three characteristics identify it?

A. A recurring assessment triggered by an external event; recurring assessments incorporate threat intelligence and are updated whenever major incidents occur in the industry B. An ad hoc assessment, identified by three characteristics: (1) triggered by an unplanned external event (competitor breach intelligence), not a calendar date; (2) the team was assembled specifically for this concern and disbanded after completion; (3) not scheduled to repeat unless a similar triggering event occurs C. A continuous assessment; analyzing threat intelligence about competitor incidents is a component of the continuous monitoring program that operates without defined start or end dates D. A one-time assessment; the competitor breach is a non-recurring external event that triggered a discrete bounded assessment that will not repeat

✅ B — Ad hoc assessment, identified by three markers. An ad hoc assessment is triggered by an unplanned, specific concern — a competitor breach, a new threat intelligence report, a CEO's concern about a particular risk area. All three markers are present: (1) trigger was unplanned external intelligence, not a calendar date; (2) the team formed specifically for this concern and disbanded after completion; (3) there is no repeat schedule. This distinguishes it from: one-time assessment (triggered by a specific internal event like a deployment), recurring assessment (calendar-driven, repeating), and continuous assessment (permanently integrated into all operations). Ad hoc assessments are reactive; the team dissolves when the specific concern is resolved.

Ch 110 · Risk Management

Question 11 of 20

A financial services company conducts risk assessments on a fixed quarterly schedule using the same methodology and scoring framework each time. The CISO presents a chart showing risk scores across eight consecutive quarterly assessments over two years. A board member asks: "What is the primary advantage of this quarterly fixed-calendar approach over conducting assessments only when significant concerns arise?" What is the correct response?

A. Quarterly assessments satisfy PCI DSS Requirement 12.3 and SOX internal control testing requirements, ensuring continuous regulatory compliance — satisfying multiple frameworks simultaneously is the primary advantage B. Quarterly assessments cost less per engagement than ad hoc assessments because the methodology, team, and tooling are already established and do not need to be rebuilt each time C. The consistent methodology applied at regular intervals enables trend analysis: the CISO can show whether the overall risk posture is improving, stable, or deteriorating across periods, and which specific risk categories are trending upward. This longitudinal view is impossible without the consistent baseline that recurring assessments provide. D. Recurring assessments produce more accurate individual findings than ad hoc assessments because the fixed team develops deep familiarity with the organization's systems and risk profile over time

✅ C — Recurring assessments enable trend analysis. The defining advantage of recurring assessments over ad hoc ones is trend analysis: because the same methodology is applied at consistent calendar intervals, the CISO can compare results across periods and determine whether the risk posture is improving, stable, or deteriorating. An ad hoc assessment produces a point-in-time finding — valuable but not comparable to prior periods if methodologies differ or timing is irregular. The board chart showing eight quarters of data is only meaningful because the underlying assessments used consistent methodology; without that consistency, the scores cannot be validly compared over time.

Ch 110 · Risk Management

Question 12 of 20

An organization's security program includes: (1) Automated vulnerability scans running against all production systems every 4 hours, 24/7. (2) A SIEM aggregating logs from all network devices and servers with real-time correlation rules. (3) Every Change Control Board (CCB) change request includes a mandatory risk impact analysis evaluated by the security team before approval. (4) No defined start or end dates for any of these activities — all are permanently integrated into operations. What type of risk assessment framework does this describe?

A. Ad hoc assessment; the CCB trigger and SIEM alert trigger are both unplanned event-driven activations rather than scheduled calendar assessments B. Recurring assessment; the 4-hour vulnerability scan interval and regular SIEM reviews constitute a repeating scheduled cadence C. One-time assessment; deploying permanent scanning infrastructure is a bounded deployment project that becomes a set-and-forget operational tool once live D. Continuous assessment; it is integrated into all operations — every change, every hour, every system — with no defined start or end date. All three assessment dimensions are present: time-based (ongoing scanning), event-based (CCB change requests), and real-time (SIEM monitoring). This is the highest-maturity assessment model.

✅ D — Continuous assessment. Continuous assessment is permanently integrated into all organizational operations with no defined start or end date. The three defining characteristics are all present: (1) time-continuous (4-hour automated scanning), (2) real-time event monitoring (SIEM), and (3) per-change risk analysis (CCB integration — every change request includes a mandatory risk impact analysis). The critical exam distinction: PCI DSS Requirement 12.3 requires risk assessments at least annually (recurring), but the continuous model goes further by making risk evaluation a component of every operational activity. Continuous assessment is the highest-maturity model and is the only type with no defined start or end.

Ch 111 · Risk Analysis

Question 13 of 20

A company's data center contains a production database server valued at $120,000. A flood risk assessment determines that if a flood occurs, it will destroy approximately 25% of the data center's equipment (Exposure Factor = 0.25). What is the Single Loss Expectancy (SLE) for a flood event affecting this server?

A. $30,000 — SLE = Asset Value × Exposure Factor = $120,000 × 0.25. The SLE represents the expected financial loss per flood event, reflecting that only 25% of the asset is lost in each occurrence. B. $90,000 — the SLE reflects the remaining 75% asset value that survives; the organization retains $90,000 worth of functioning equipment after each flood event C. $120,000 — SLE always equals the full Asset Value because any incident that triggers a loss calculation implies total asset destruction D. $480,000 — flood risk is calculated by multiplying Asset Value by 4 to account for the compounding probability multiplier applied to critical infrastructure

✅ A — SLE = $30,000. The formula: SLE = Asset Value (AV) × Exposure Factor (EF). Here: $120,000 × 0.25 = $30,000. The Exposure Factor is the percentage of asset value LOST per incident (not the percentage remaining). EF = 0.25 means 25% of the asset is destroyed; 75% survives. A complete theft scenario would have EF = 1.0 (total loss). A partial damage scenario uses a fraction. Common exam trap: confusing the EF with the surviving fraction — the EF represents what is lost, not what is preserved. SLE is always AV × EF.

Ch 111 · Risk Analysis

Question 14 of 20

A company experiences an average of 3 server hardware failures per year (Annual Rate of Occurrence = 3). Each server failure has an SLE of $15,000 (including emergency hardware replacement, data recovery labor, and business downtime costs). What is the Annualized Loss Expectancy (ALE), and what security investment decisions does this figure support?

A. ALE = $5,000; dividing total annual loss by rate of occurrence produces the maximum investment cap per individual failure response B. ALE = $45,000; ALE = ARO × SLE = 3 × $15,000. Server failures cost $45,000 annually on average. Any control costing less than $45,000 per year that fully eliminates the risk is cost-justified; controls that reduce (but don't eliminate) failures proportionally reduce the effective ALE and are justified if cost < reduction achieved. C. ALE = $180,000; the ALE for hardware failure is calculated by multiplying SLE by 12 months to normalize to annual dollar terms D. ALE = $15,000; the SLE already represents the annual exposure because it incorporates average annual occurrence probability into the single-event loss estimate

✅ B — ALE = $45,000. The formula: ALE = Annual Rate of Occurrence (ARO) × Single Loss Expectancy (SLE). Here: 3 × $15,000 = $45,000. The ALE represents the expected annual financial cost of a specific risk. It is the foundational figure for security investment justification: any control costing less than $45,000 per year that fully eliminates the risk produces a net positive ROI. Controls that partially reduce occurrence (e.g., reduce from 3 to 1 failure/year) reduce the effective ALE proportionally, and are justified if their annual cost is less than the ALE reduction they produce. This is the quantitative risk analysis framework used to justify security spending to management.

Ch 111 · Risk Analysis

Question 15 of 20

A CISO presents the board with a risk matrix: a grid with "Likelihood" on the X-axis (Rare / Unlikely / Possible / Likely / Almost Certain) and "Impact" on the Y-axis (Insignificant / Minor / Moderate / Major / Catastrophic). Each identified risk is plotted as a colored dot — green in the lower-left, yellow along the middle diagonal, red in the upper-right. What type of risk analysis does this represent, and what is its primary limitation?

A. Quantitative analysis; color-coded matrices use numeric scoring systems where each color zone corresponds to a calculated ALE threshold representing a specific dollar range B. Hybrid analysis; the matrix combines quantitative elements (numerical axis positions) with qualitative elements (color zones), making it neither fully quantitative nor fully qualitative C. Qualitative analysis; it uses descriptive categories (likelihood and impact adjectives) and color-coded visual zones rather than dollar figures. Primary limitation: the matrix cannot quantify financial impact — a "Catastrophic" event might mean $10K or $10B depending on context, and provides no mechanism to compare risks within the same color zone by financial magnitude. D. Quantitative analysis; the five-point scales on each axis generate a numerical risk score (1–25) for each plotted risk that can be objectively compared and ranked by magnitude

✅ C — Qualitative analysis with financial quantification as its primary limitation. Qualitative risk analysis uses descriptive categories — adjective labels for likelihood and impact — and visual tools such as traffic light grids, heat maps, and color-coded risk matrices. It does not produce dollar figures. The primary limitation is that a "Catastrophic" label cannot differentiate between a $50K loss and a $500M loss; two risks in the same red zone cannot be prioritized by financial magnitude. Qualitative analysis is valuable for board-level visibility and executive communication — it presents complex risk information in an accessible format — but must be supplemented with quantitative analysis (ALE, SLE) when dollar justification for security investments is required.

Ch 111 · Risk Analysis

Question 16 of 20

A company's board-approved risk policy states two things: (1) "The organization's risk appetite for system downtime is 7 hours per quarter." (2) "The acceptable variance above the stated appetite before formal escalation is triggered is 3 hours." Last quarter, a server failure caused 9 hours of downtime. Does the 9-hour incident trigger the mandatory board notification and executive escalation requirement?

A. Yes; 9 hours exceeds the 7-hour risk appetite, which is an absolute hard limit with no permitted variance above it B. No; 9 hours is within the 3-hour variance band above the appetite (7+3=10 hours maximum), so the incident falls within acceptable operating parameters and no escalation is required C. Yes; any incident exceeding the stated risk appetite requires immediate escalation regardless of whether a tolerance variance band exists in the policy D. No; 9 hours falls within the 10-hour risk tolerance ceiling (appetite 7h + tolerance variance 3h = 10h maximum). Risk tolerance is the acceptable variance above the stated appetite. An incident must exceed the tolerance ceiling — not just the appetite — to trigger mandatory escalation.

✅ D — 9 hours is within tolerance; no escalation required. Risk appetite is the board-approved policy-level acceptable risk limit — in this case, 7 hours of quarterly downtime. Risk tolerance is the acceptable variance ABOVE the stated appetite before formal action is triggered — in this case, 3 additional hours. The tolerance ceiling = appetite + tolerance = 7 + 3 = 10 hours. An incident must exceed the tolerance ceiling (10 hours) to trigger mandatory escalation. At 9 hours, the incident exceeds the stated appetite (7h) but remains within tolerance (10h). This means management should note the breach of appetite and investigate, but board escalation is not yet mandated. If downtime had been 11 hours, escalation would be required.

Ch 112 · Risk Management Strategies

Question 17 of 20

A company purchases a $2 million annual cyber insurance policy covering ransomware incidents. Three months later, ransomware encrypts the ERP system. Recovery takes 11 days; the policy pays out $800,000 covering recovery costs and lost revenue. During those 11 days, customer orders cannot be processed, partners miss SLAs, and a major client terminates their contract. Which statement most accurately describes what the insurance policy achieved?

A. The insurance policy transferred the financial consequences of the ransomware incident to the insurer — shifting $800,000 in financial liability. However, risk transfer does not eliminate the underlying threat, prevent the attack from occurring, or avoid the operational disruption. The 11 days of downtime, SLA violations, and lost client are real consequences that insurance cannot transfer or compensate. B. The insurance policy eliminated the ransomware risk; purchasing cyber insurance demonstrates a mature risk management posture that deters ransomware attackers who prefer uninsured targets C. The insurance policy represents risk acceptance; paying premiums is an explicit organizational acknowledgment that ransomware is a tolerable operational risk that requires no additional technical controls D. The insurance policy transferred all ransomware risk to the insurer; once the payout is complete, the organization's ransomware risk exposure returns to zero for the remainder of the policy period

✅ A — Risk transfer shifts financial consequences; it does not eliminate the threat. Risk transfer (insurance, outsourcing) moves the financial consequences of a risk to another party — in this case, $800,000 moved from the company's balance sheet to the insurer's. What risk transfer cannot do: prevent the attack from happening, restore the 11 days of lost operations, recover the terminated client contract, or repair SLA damage. The underlying ransomware threat is unchanged by the insurance purchase. This is the critical exam distinction: risk transfer is a financial mechanism, not a security control. Organizations that rely solely on insurance without implementing technical controls are managing financial consequences, not reducing the probability of incidents.

Ch 112 · Risk Management Strategies

Question 18 of 20

An industrial manufacturer operates a legacy ICS managing critical production equipment. The ICS vendor went out of business in 2019; no security patches have been released since 2018 and no future patches will ever be provided. The company's security policy requires all systems to receive patches within 30 days of vendor release. The security team must document a formal policy deviation for this system. Which type of deviation is appropriate, and why?

A. A time-limited exception; the organization should request a 6-month window to evaluate replacement options, then either replace the system or renew the exception quarterly until replacement is complete B. A permanent exemption; this system falls outside the patch policy's applicability entirely — no patches exist and none will ever exist. An exemption acknowledges that the policy CANNOT apply (vs. an exception where the policy CAN apply but has a temporary conflict). Exemptions require compensating controls (network isolation, enhanced monitoring, physical access restrictions) and permanent documentation. C. No deviation document is needed; systems without available patches are automatically excluded from patch compliance requirements because the 30-day window is measured from vendor release date, and no release has occurred D. A renewable exception; exceptions can be designated long-term or permanent when the underlying conflict is unlikely to resolve, making the practical outcome equivalent to an exemption with additional administrative flexibility

✅ B — Permanent exemption. The exemption/exception distinction is a critical exam concept: an exemption applies when the policy fundamentally CANNOT apply to the system (no patches exist, legacy system, vendor prohibition, physical constraint) — it is a permanent deviation with compensating controls documented. An exception applies when the policy CAN eventually apply but has a temporary, resolvable conflict (ERP incompatibility, pending vendor fix) — it is time-limited and expires when the conflict is resolved. Since this ICS vendor no longer exists and no patches will ever be produced, the policy cannot apply. This is an exemption, not an exception. Compensating controls (network segmentation, enhanced monitoring, physical access control) are mandatory to document alongside the exemption.

Ch 112 · Risk Management Strategies

Question 19 of 20

A mobile fitness application collects precise GPS route data. The security team identifies significant regulatory exposure under GDPR and CCPA, reputational risk if the data is breached (location histories can reveal sensitive behavioral patterns), and limited internal resources to secure it adequately. The product team proposes: "We will completely remove all location data collection and storage from the app — the app will provide fitness tracking without storing GPS routes." What risk management strategy does this represent, and what is its key trade-off?

A. Risk mitigation; removing the most sensitive data elements reduces overall risk exposure while preserving the core fitness tracking functionality B. Risk acceptance; choosing not to collect data acknowledges that the risk cannot be adequately managed and accepts the permanent loss of the feature as an unavoidable outcome C. Risk avoidance; the organization is eliminating the risk entirely by stopping the risk-creating activity — GPS data collection and storage. This is the ONLY strategy that fully removes the risk. The trade-off: losing the capability entirely. Users who wanted GPS route tracking cannot be served. D. Risk transfer; outsourcing location data storage to a third-party cloud provider with stronger data security capabilities transfers the data custody risk to the provider

✅ C — Risk avoidance. Risk avoidance is the strategy of eliminating the risk entirely by stopping the risk-creating activity. It is the ONLY risk management strategy that fully removes the risk — not reduces it, not transfers it, but eliminates it. The mechanism: stop collecting GPS data → no GPS data to breach, no GDPR/CCPA GPS data obligations, no reputational exposure from location history theft. The mandatory trade-off: the organization loses the capability entirely. GPS route tracking cannot be offered to users. This distinguishes avoidance from mitigation (reduces risk while keeping the activity) and transfer (keeps the activity, shifts financial consequences). Avoidance sacrifices capability to achieve zero risk from that activity.

Ch 112 · Risk Management Strategies

Question 20 of 20

A company identifies credential theft as the leading attack vector in their threat model. The security team implements: MFA on all corporate accounts (eliminating password-only access), Privileged Access Workstations (PAWs) for all administrator accounts (isolated workstations used exclusively for privileged operations), and a company-wide password manager with breach detection (preventing reuse and detecting compromised credentials). After implementation, the risk of successful credential attacks is substantially reduced. What risk management strategy was applied, and what important limitation remains?

A. Risk avoidance; removing password-only access eliminates the most common attack vector entirely, which constitutes elimination of credential theft risk from the threat model B. Risk transfer; implementing security controls transfers the responsibility for credential security from individual employees to the IT department's security infrastructure C. Risk acceptance; the organization acknowledges that some credential attacks will succeed despite these controls and has invested in limiting their impact when they do D. Risk mitigation; the controls reduce the likelihood and impact of credential theft attacks but do not eliminate the risk entirely. Sophisticated attackers can still attempt MFA bypass (SIM swapping, MFA fatigue attacks), physical compromise of PAWs, or supply-chain attacks against the password manager. Mitigation always leaves residual risk.

✅ D — Risk mitigation. Risk mitigation implements controls to reduce the likelihood or impact of a risk — it is the most common risk management strategy. The key characteristic: the risk is reduced to a more acceptable level but is not fully eliminated. MFA + PAWs + password manager substantially reduce the attack surface for credential theft, but sophisticated adversaries still have attack paths (MFA bypass, hardware supply chain, manager compromise). Avoidance would require ceasing all use of credentials — impossible for a functioning organization. Mitigation is the correct strategy when the risk cannot be fully avoided but can be meaningfully reduced to within the organization's risk appetite. Residual risk always remains after mitigation.

Part B — Scenario Questions (unscored — self-assess)

Ch 108–109 · Scenario

Scenario Question A

A European retail company outsources employee payroll processing to a cloud HR platform under a signed Data Processing Agreement. The HR platform suffers a ransomware attack on Saturday evening that exposes employee personal data — SSNs, bank accounts, and salary information — for 3,100 employees. The retail company's security team receives an alert from the provider at 9 AM Monday and confirms the breach at 11 AM Monday. Separately, the retail company is also named as a defendant in litigation from 18 months ago; the company's automated records deletion system is scheduled to purge two years of HR communications this Friday.

Address: (1) When does the GDPR Article 33 72-hour notification clock start, and what must the initial notification contain if investigation is incomplete? (2) Identify the data controller and data processor in this scenario, and explain what documentation governs their relationship. (3) The retail company's legal team argues the DPA transfers all regulatory accountability to the HR platform. Evaluate this argument. (4) What must happen to the scheduled Friday records purge given the pending litigation, and what is the legal risk if the purge proceeds?

1. GDPR Article 33 clock and initial notification:

The 72-hour clock starts at 11 AM Monday — when the organization confirmed (became aware of) the breach. Not Friday when the breach occurred; not 9 AM when the ambiguous alert arrived. Article 33 says "having become aware" — awareness means confirmed knowledge, not suspicion.

If the full investigation is incomplete at the 72-hour mark, the initial notification may include what is currently known with a note that further information will follow. The supervisory authority notification must include at minimum: nature of the breach, approximate number of data subjects affected, categories of personal data involved, likely consequences, and measures taken. Missing details can be provided in a phased notification — but the 72-hour deadline still runs from 11 AM Monday regardless.

2. Data controller vs. data processor:

Retail company = Data Controller: it determines the purpose (payroll administration) and means (how employee data is collected and processed) — the defining controller criteria.
HR platform = Data Processor: it processes personal data on behalf of and under the instructions of the retail company, for the retail company's purposes, not its own.
Governing documentation: a Data Processing Agreement (DPA) under GDPR Article 28, specifying what the processor can do with the data, security requirements, breach notification obligations to the controller, sub-processor rules, and data return/deletion obligations after the contract ends.

3. DPA accountability transfer argument:

The legal team's argument is incorrect. A DPA creates contractual obligations and may support a civil claim if the processor violated those obligations, but it cannot transfer GDPR regulatory accountability from the controller to the processor. The supervisory authority holds the controller primarily responsible for: choosing this processor, conducting due diligence on their security posture, writing appropriate technical and organizational requirements into the DPA, and the ongoing data processing relationship. Both the retail company and the HR platform may face independent, simultaneous regulatory enforcement actions from the same incident. The DPA does not shield the controller from regulatory scrutiny.

4. Litigation hold and the scheduled purge:

The scheduled Friday purge must be suspended immediately. The pending litigation creates a legal hold obligation: all automated deletion processes for records potentially relevant to the litigation must stop. Legal counsel's involvement in the litigation (from 18 months ago) likely already triggered a litigation hold — if a formal hold has been issued, the IT department is already obligated to have suspended automated deletions of covered records.

Legal risk of proceeding with the purge: Spoliation of evidence — the intentional or negligent destruction of material subject to a legal preservation obligation. Court consequences: adverse inference instructions (the jury is instructed to assume the destroyed records contained damaging evidence), case dismissal, default judgment, or monetary sanctions against the company and potentially its counsel. The severity of spoliation sanctions means the cost of the Friday purge vastly exceeds any storage cost savings from the deletion.

Ch 110–112 · Scenario

Scenario Question B

A technology company's annual risk assessment (conducted every January) identifies two critical findings: (1) A critical vulnerability (CVSS 9.4) in their customer-facing web application has a public exploit available; the vendor will not release a patch for at least 90 days. (2) A legacy billing system deployed in 2007 runs an OS version for which the manufacturer stopped all security updates three years ago; replacing it requires 18 months of regulatory certification. The CISO also proposes integrating automated vulnerability scanning into the Change Control Board so that every proposed infrastructure change receives a real-time risk analysis before CCB approval.

Address: (1) What four risk management strategies are available for the unpatched web application vulnerability (Finding 1)? Evaluate each option's trade-offs. (2) What type of policy deviation (exemption vs. exception) applies to each finding, and why are they different types? (3) What type of risk assessment does the proposed CCB-integrated scanning represent, and how does it differ from the annual January assessment that found these issues? (4) What information must the CISO include in the board risk report regarding these unresolved findings?

1. Four risk management strategies for Finding 1 (unpatched web application):

Risk Mitigation: Deploy compensating controls — WAF rules targeting the specific exploit pattern, enhanced logging and alerting on affected endpoints, network segmentation to limit blast radius, temporary removal of the most vulnerable features. Trade-off: reduces likelihood/impact but does not eliminate risk; attacker creativity may bypass WAF rules; residual risk remains for 90 days until patch available.

Risk Avoidance: Shut down the customer-facing web application entirely until the patch is available. Trade-off: fully eliminates the vulnerability but also eliminates revenue and customer access — the most protective option is often operationally unacceptable. Only appropriate if the business can tolerate 90 days of no web service.

Risk Transfer: Notify cyber insurance carrier of the active vulnerability; verify policy coverage for exploitation events; engage incident response retainer. Trade-off: shifts financial consequences of a breach but does nothing to prevent exploitation. The underlying vulnerability and all operational disruption from a breach remain.

Risk Acceptance: Formally document the unmitigated vulnerability, acknowledge the risk, and continue operations as-is pending the patch. Trade-off: appropriate only if the organization's risk appetite explicitly permits this level of exposure and leadership understands the specific CVSS 9.4 risk being accepted. Must be a documented, deliberate decision — not a default due to inaction.

Recommended approach: Mitigation (WAF + segmentation + enhanced monitoring) while the patch cycle runs, combined with documented acceptance of residual risk and insurance notification.

2. Policy deviation types:

Finding 1 (web application, 90-day patch delay) → Exception: The patch policy CAN eventually apply — the vendor will release a patch in 90 days. The conflict is temporary and has a defined resolution date. An exception is appropriate: time-limited (90 days), expires when the vendor releases the patch, documents the compensating controls in effect during the window.

Finding 2 (legacy billing system, no OS updates ever) → Exemption: The patch policy CANNOT apply — the OS manufacturer will never release updates. The conflict is permanent with no resolution path (replacing the system takes 18 months, and even then, the replacement is a different system). An exemption is appropriate: permanent deviation acknowledging the policy does not apply to this system, with documented compensating controls (network isolation, application whitelisting, enhanced monitoring) and a note that replacement is in progress.

Key distinction: exception = CAN apply, temporarily doesn't; exemption = CANNOT apply, permanently doesn't.

3. CCB-integrated scanning = Continuous assessment:

The proposed CCB-integrated scanning is a continuous assessment component: it is permanently integrated into all operations (every change request), has no defined start or end date, and evaluates risk in real-time at the moment of each proposed change. It is the event-based dimension of continuous assessment — risk analysis triggered by the operational event of each CCB submission.

The annual January assessment is a recurring assessment: it runs on a fixed calendar schedule (every January), uses a consistent methodology across years to enable trend analysis, and produces a point-in-time snapshot of the risk posture. These two approaches are complementary, not redundant: the recurring assessment provides the longitudinal risk posture view; the continuous CCB integration catches new risks introduced by specific changes between January cycles.

4. Board risk report requirements:

The board risk report must include both findings in full — specifically as unmitigated or partially mitigated risks:
• Finding 1: Active CVSS 9.4 vulnerability in production system, public exploit available, 90-day patch timeline; compensating controls in effect; estimated ALE during the 90-day window; recommended board action if risk appetite is exceeded
• Finding 2: Legacy billing system permanently outside patch policy; exemption documentation status; compensating controls; replacement timeline (18 months); cost and risk of accelerating replacement vs. operating with compensating controls

The board cannot make informed budget and risk appetite decisions without visibility into unresolved risks. Reporting only fully mitigated risks creates a false sense of security posture. The board's risk governance role requires them to understand what risks remain, at what level, and for how long — so they can decide whether the current risk acceptance posture is consistent with the organization's stated risk appetite.

← Back to Study Hub

—

Pass threshold: 80% (16 / 20 correct)

← Back to Study Hub

Exam: Security Considerations & Risk