ISC2 CISSP QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
, Domain 1: Security and Risk Management (Q1–15)
Q1. Which framework is BEST used to align security objectives with business strategy?
A) OSI model
B) COBIT
C) TCP/IP
D) RAID
Answer: B
Rationale: COBIT is an IT governance framework that directly links IT/security objectives to business goals.
The OSI and TCP/IP models are technical reference models, and RAID is a storage technology.
Q2. A company accepts a risk because the cost of the control exceeds the potential loss. This is:
A) Risk transfer
B) Risk avoidance
C) Risk acceptance
,D) Risk mitigation
Answer: C
Rationale: Risk acceptance means acknowledging the risk and choosing not to act because the cost/benefit
doesn't justify a control. Transfer shifts risk (e.g., insurance); avoidance eliminates the activity; mitigation
reduces it.
Q3. What is the PRIMARY purpose of a security awareness program?
A) To eliminate all phishing attacks
B) To change user behavior to reduce risk
C) To satisfy auditors
D) To replace technical controls
Answer: B
Rationale: Awareness programs aim to modify behavior and build a security culture. They cannot eliminate
attacks and never replace technical controls.
, Q4. Which is the FIRST step in the risk management process?
A) Select controls
B) Identify assets and threats
C) Calculate ALE
D) Implement monitoring
Answer: B
Rationale: You cannot assess or treat risk without first identifying assets, threats, and vulnerabilities. Everything
else follows.
Q5. A "top-down" approach to security policy development means:
A) Policies are written by IT staff
B) Management initiates and supports policy
C) Only technical controls are used
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
, Domain 1: Security and Risk Management (Q1–15)
Q1. Which framework is BEST used to align security objectives with business strategy?
A) OSI model
B) COBIT
C) TCP/IP
D) RAID
Answer: B
Rationale: COBIT is an IT governance framework that directly links IT/security objectives to business goals.
The OSI and TCP/IP models are technical reference models, and RAID is a storage technology.
Q2. A company accepts a risk because the cost of the control exceeds the potential loss. This is:
A) Risk transfer
B) Risk avoidance
C) Risk acceptance
,D) Risk mitigation
Answer: C
Rationale: Risk acceptance means acknowledging the risk and choosing not to act because the cost/benefit
doesn't justify a control. Transfer shifts risk (e.g., insurance); avoidance eliminates the activity; mitigation
reduces it.
Q3. What is the PRIMARY purpose of a security awareness program?
A) To eliminate all phishing attacks
B) To change user behavior to reduce risk
C) To satisfy auditors
D) To replace technical controls
Answer: B
Rationale: Awareness programs aim to modify behavior and build a security culture. They cannot eliminate
attacks and never replace technical controls.
, Q4. Which is the FIRST step in the risk management process?
A) Select controls
B) Identify assets and threats
C) Calculate ALE
D) Implement monitoring
Answer: B
Rationale: You cannot assess or treat risk without first identifying assets, threats, and vulnerabilities. Everything
else follows.
Q5. A "top-down" approach to security policy development means:
A) Policies are written by IT staff
B) Management initiates and supports policy
C) Only technical controls are used
