Try the questions in the test above first, then open each one here to see the correct answer and why every other option is wrong.
01During a client assessment, the client's CIO asks the assessor to omit a failed access-control test from the final report because remediation is already underway. What should the assessor do?
Practice question Unit: Security and Risk Management
ARetest after remediation and report only the retest result
Retesting after remediation is good practice, but the report must state the condition that existed when the test was performed. Reporting only the later pass misrepresents the assessment period.
BMove the finding to a separate management letter at the client's request
A management letter can carry supplementary comments, but moving a failed control out of the report that stakeholders rely on, simply because the client asked, conceals a material result.
CLower the finding's severity to reflect the remediation in progress
Severity reflects the weakness actually observed and its potential impact. Remediation that is only planned or in progress does not reduce it, although it can be reported alongside the finding.
DReport the failed test accurately and note the planned remediation ✓ Correct answer
Correct. ISC2 Code of Ethics Canon II (act honorably, honestly, justly, responsibly and legally) requires truthful reporting. Stating the failure accurately while noting the remediation plan gives the client context without concealing the result.
Reference: ISC2 Code of Ethics, Canon II: "Act honorably, honestly, justly, responsibly, and legally." https://www.isc2.org/ethics
Ask a friend
02Northbridge Health has finished assessing a new telehealth platform. Residual risk remains above the previously documented organizational tolerance, and the authorization package is complete. Under the NIST Risk Management Framework, who has the authority to accept this risk and make the authorization decision?
Practice question Unit: Security and Risk Management
AThe independent assessor validating the controls
The independent assessor produces the security and privacy assessment report, which is evidence for the decision. The assessor has no authority to accept risk or grant authorization.
BThe senior official designated as authorizing official ✓ Correct answer
Correct. Under SP 800-37 Rev. 2 task R-4, the authorizing official is a senior official with authority to formally assume responsibility for operating a system at an acceptable level of risk. The AO decides whether the residual risk is acceptable and authorizes or denies operation.
CThe system owner preparing the authorization package
The system owner assembles and submits the authorization package and maintains the plan of action and milestones. Owning the system does not confer authority to accept organizational risk.
DThe risk executive advising on organizational tolerance
The risk executive (function) gives an organization-wide view of risk and advises the AO on tolerance. The explicit authorization decision still rests with the authorizing official.
Reference: NIST SP 800-37 Rev. 2, Task R-4 (Authorization Decision), printed p. 73; Appendix D.12 (Authorizing Official). https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf
Ask a friend
03A Meridian Retail department labels a USB drive 'Restricted' after copying campaign customer lists, then leaves the drive overnight on an open desk near the lobby. Which statement BEST describes the residual risk?
Practice question Unit: Asset Security
AThe drive should be relabeled with a higher classification
The classification is not the problem: the label already reflects the data's sensitivity. A higher marking changes the words on the drive, not who can physically pick it up.
BThe drive is compliant because it is correctly marked
Marking (MP-3) is only one media-protection requirement. MP-4 also requires media to be physically controlled and securely stored, so a correct label alone does not make unattended storage compliant.
CThe label communicates restrictions but does not enforce access ✓ Correct answer
Correct. Marking tells handlers about distribution limits and handling caveats, but it is an administrative cue, not an access control. With the drive left on an open desk, the MP-4 physical control and secure storage are missing, and anyone passing the lobby could take it.
DThe risk is acceptable as long as the drive is in the media inventory
Inventory tracking supports accountability and may reveal a loss after the fact. It does not prevent unauthorized access to an unattended drive.
Reference: NIST SP 800-53 Rev. 5, MP-3 Media Marking and MP-4 Media Storage (a–b), printed pp. 172–173. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
Ask a friend
04Cedar Bank must protect customer archives that must remain confidential for at least twenty years. Current public-key algorithms used for key exchange could be broken by a future large-scale quantum computer. Which decision BEST addresses this long-term confidentiality requirement?
Practice question Unit: Security Architecture and Engineering
AKeep RSA-2048 for archives and enlarge classical key sizes only after a cryptanalytically relevant quantum computer appears
Waiting fails long-lived secrets. Key exchanges and ciphertext recorded today can be decrypted later (harvest now, decrypt later), and larger RSA keys are still broken by Shor's algorithm.
BSwitch only the bulk data cipher from AES-128 to AES-256
AES-256 gives ample margin against Grover's algorithm for the bulk cipher. However, the symmetric keys are still delivered by quantum-vulnerable public-key exchange, so the weak link remains.
CAdopt a hybrid key-establishment design that includes a NIST-standardized post-quantum algorithm ✓ Correct answer
Correct. Data that must stay confidential for 20 years is already exposed to harvest-now-decrypt-later attacks, so migration planning should start now. A properly designed and reviewed hybrid can preserve key security if one component remains secure; the combiner and implementation require case-by-case analysis. NIST-standardized ML-KEM is specified in FIPS 203.
DRely on quantum key distribution for every branch-to-data-center link immediately
QKD needs dedicated hardware on point-to-point links, does not authenticate parties by itself, and does nothing for archives at rest. It is not the recommended general enterprise route; standardized post-quantum algorithms are.
Reference: NIST IR 8547 (final, October 2026), §3.1 (long-lived confidentiality) and §§3.2–3.2.1 (hybrid key establishment), pp. 8–11; FIPS 203 ML-KEM (August 2024). https://nvlpubs.nist.gov/nistpubs/ir/2026/NIST.IR.8547.pdf
Ask a friend
05Two Cedar Bank departments must exchange only a short list of approved customer fields while remaining administratively separate systems. Direct database links keep leaking extra columns. Which architectural approach BEST enforces the restriction?
Practice question Unit: Security Architecture and Engineering
AA site-to-site VPN between departments
A site-to-site VPN encrypts and authenticates traffic in transit, but whatever the database link sends, extra columns included, still flows through the tunnel. It protects the channel, not the content.
BFederated identity trust between directories
Federation lets each department trust the other's identities. It decides who may connect, not which data fields may cross the boundary.
CA controlled cross-domain interface ✓ Correct answer
Correct. A controlled cross-domain interface (a guard or cross-domain solution) enforces information-flow policy at the boundary, passing only the approved fields and blocking everything else, while the two systems stay administratively separate (SP 800-53 AC-4).
DA shared database with view-level permissions
View-level permissions can limit columns, but one shared database merges both domains under a single administrative control, which breaks the requirement that they remain separate systems.
Reference: NIST SP 800-53 Rev. 5, AC-4 Information Flow Enforcement (control and discussion of cross-domain guards), pp. 29–30. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
Ask a friend
06A managed laptop at Helios Energy falls behind on critical patches during a long VPN session that started when it was compliant. Continuous access evaluation is being designed. What should influence whether the session may continue?
Practice question Unit: Communication and Network Security
ACurrent device posture and policy ✓ Correct answer
Correct. In zero trust (SP 800-207 §2.1), access is granted per session by dynamic policy that includes the observable state of the requesting asset, and asset posture is monitored continuously. A laptop that falls out of patch compliance mid-session should be re-evaluated against current policy and restricted or disconnected if needed.
BStrength of the user's chosen MFA method
MFA strength proves who the user is at sign-in. It says nothing about whether the laptop is now missing critical patches.
CThe next scheduled patch window
Tying the decision to the next patch window keeps a non-compliant device connected until then, which is exactly the risk continuous evaluation is meant to remove.
DDevice enrollment status at login
Enrollment at login is a point-in-time check made while the device was still compliant. It does not reflect the posture change that occurred during the session.
Reference: NIST SP 800-207, Zero Trust Architecture, §2.1 Tenets of Zero Trust (tenets 4–6), PDF p. 15. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf
Ask a friend
07Meridian Retail's customer portal, acting as a relying party (RP), receives a federation assertion with a valid IdP signature, but its audience restriction names the company's separate loyalty-app RP. What should the portal do?
Practice question Unit: Identity and Access Management
AAccept it if the signature is valid
A valid signature proves the IdP issued the assertion and that it was not altered, not that it was issued for this RP. Accepting it would let an assertion captured at another RP log users in here.
BAccept it if it has not expired
The validity period is a separate check. An unexpired assertion intended for another RP is still not addressed to this one.
CReject it; the audience is a different RP ✓ Correct answer
Correct. SP 800-63C-4 requires the RP to validate the assertion's audience restriction and accept only assertions issued for it. An assertion addressed to another RP must be rejected even when the signature and validity time check out.
DAccept it if the subject has a local account
A local account linked to the subject does not show that this assertion was meant for this RP. Account existence is not part of assertion validation.
Reference: NIST SP 800-63C-4 (2025), Federation and Assertions: assertion audience restriction and RP assertion validation; §2.2 FAL1. https://pages.nist.gov/800-63-4/sp800-63c.html
Ask a friend
08A two-day external penetration test against Helios Energy's new portal finds no successful exploit. Marketing wants to announce that the portal is 'fully secure.' Which report statement is MOST appropriate?
Practice question Unit: Security Assessment and Testing
ANo exploit succeeded in scope and time ✓ Correct answer
Correct. SP 800-115 stresses that test results reflect the scope, techniques and time allowed. A penetration test that finds no exploit shows only that this team, with these methods, in this window, did not succeed, and the report should say exactly that rather than certify the system.
BThe controls meet the organization's baseline
A penetration test probes exploitability. It is not a controls assessment against the organization's baseline, so it cannot support a baseline-compliance conclusion.
CNo critical vulnerabilities exist
No test can prove that no critical vulnerability exists. Untested paths, new code and newly disclosed flaws may remain, so this statement overclaims.
DThe system is secure against attack
This is the claim marketing wants. The absence of a successful exploit during a time-boxed test is not proof that the system is secure against attack.
Reference: NIST SP 800-115, Technical Guide to Information Security Testing and Assessment, §5.2.2 (penetration testing limits) and §7.2 (time constraints on results). https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
Ask a friend
09An attacker's actions against Meridian Retail appear as separate weak signals in VPN, identity, and database logs, and no single alert fired. Which detection improvement BEST addresses that pattern?
Practice question Unit: Security Operations
AIncrease logging on each system
More logging on each system only adds data inside the same silos. Without linking the sources, each weak signal still looks harmless on its own.
BHave each team review its own logs closely
Separate team reviews look at one source at a time, so the cross-system pattern (VPN login, then identity change, then database access) stays invisible.
CCorrelate events across log sources ✓ Correct answer
Correct. SP 800-53 AU-6(3) calls for analyzing and correlating audit records across different repositories to gain organization-wide situational awareness. Correlation, typically in a SIEM, links the low-level events into one attack chain that warrants an alert.
DAlert on high-severity events
Severity-based alerting misses this attack by design: each individual step was low severity, which is why no single alert fired.
Reference: NIST SP 800-53 Rev. 5, AU-6(3) Audit Record Review, Analysis, and Reporting: Correlate Audit Record Repositories. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
Ask a friend
10A compromised continuous-integration runner at Meridian Retail can still reach production deployment credentials stored as plaintext pipeline variables. Which change BEST limits what a compromised runner can reach?
Practice question Unit: Software Development Security
ARotate the deployment credentials more often
More frequent rotation shortens the life of an exposed credential, but each new value goes back into the same plaintext variables, so a compromised runner simply reads the current one.
BEncrypt the stored credentials
Encrypting the variables at rest does not help if the runner itself is trusted to decrypt them at job time. A compromised runner still obtains the plaintext.
CMonitor the runner for misuse
Monitoring may detect misuse once it starts, but it does not remove the runner's access to production credentials.
DSeparate environments and scope secrets ✓ Correct answer
Correct. SSDF task PO.5.1 calls for separating and protecting each environment involved in software development. Build and test runners should not hold production deployment secrets; secrets are scoped to a specific environment and job, for example short-lived, least-privilege credentials issued from a vault only to the protected deployment stage.
Reference: NIST SP 800-218, SSDF v1.1, practice PO.5 (Implement and Maintain Secure Environments for Software Development), task PO.5.1. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf
Ask a friend
