CISSP CHAPTER 1 – SECURITY AND RISK
MANAGEMENT COMPLETE STUDY GUIDE
2026 | PRACTICE QUESTIONS & ANSWERS
| GRADED A+ | GUARANTEED SUCCESS
Updated 2026 Questions and Answers
100% Verified Exam Prep and Comprehensive
Rationales Included
, Which of the following is not considered a violation of C. Hardware destruction is a violation of availability and possibly integrity.
confidentiality? Violations of confidentiality include capturing network traffic, stealing password
files, social engineering, port scanning, shoulder surfing, eavesdropping, and
A. Stealing passwords sniffing.
B. Eavesdropping
C. Hardware destruction
D. Social engineering
Which of the following is not true? C. Violations of confidentiality are not limited to direct intentional attacks. Many
instances of unauthorized disclosure of sensitive or confidential information are
A. Violations of confidentiality include human error. due to human error, oversight, or ineptitude.
B. Violations of confidentiality include management
oversight.
C. Violations of confidentiality are limited to direct
intentional attacks.
D. Violations of confidentiality can occur when a
transmission is not properly encrypted.
STRIDE is often used in relation to assessing threats D. Disclosure is not an element of STRIDE. The elements of STRIDE are spoofing,
against applications or operating systems. Which of the tampering, repudiation, information disclosure, denial of service, and elevation of
following is not an element of STRIDE? privilege.
A. Spoofing
B. Elevation of privilege
C. Repudiation
D. Disclosure
If a security mechanism offers availability, then it offers a C. Accessibility of data, objects, and resources is the goal of availability. If a
high level of assurance that authorized subjects can ______ security mechanism offers availability, then it is highly likely that the data, objects,
the data, objects, and resources. and resources are accessible to authorized subjects.
A. Control
B. Audit
C. Access
D. Repudiate
______ refers to keeping information confidential that is C. Privacy refers to keeping information confidential that is personally identifiable
personally identifiable or which might cause harm, or which might cause harm, embarrassment, or disgrace to someone if revealed.
embarrassment, or disgrace to someone if revealed. Seclusion is to store something in an out of the way location. Concealment is the
act of hiding or preventing disclosure. The level to which information is mission
A. Seclusion critical is its measure of criticality.
B. Concealment
C. Privacy
D. Criticality
MANAGEMENT COMPLETE STUDY GUIDE
2026 | PRACTICE QUESTIONS & ANSWERS
| GRADED A+ | GUARANTEED SUCCESS
Updated 2026 Questions and Answers
100% Verified Exam Prep and Comprehensive
Rationales Included
, Which of the following is not considered a violation of C. Hardware destruction is a violation of availability and possibly integrity.
confidentiality? Violations of confidentiality include capturing network traffic, stealing password
files, social engineering, port scanning, shoulder surfing, eavesdropping, and
A. Stealing passwords sniffing.
B. Eavesdropping
C. Hardware destruction
D. Social engineering
Which of the following is not true? C. Violations of confidentiality are not limited to direct intentional attacks. Many
instances of unauthorized disclosure of sensitive or confidential information are
A. Violations of confidentiality include human error. due to human error, oversight, or ineptitude.
B. Violations of confidentiality include management
oversight.
C. Violations of confidentiality are limited to direct
intentional attacks.
D. Violations of confidentiality can occur when a
transmission is not properly encrypted.
STRIDE is often used in relation to assessing threats D. Disclosure is not an element of STRIDE. The elements of STRIDE are spoofing,
against applications or operating systems. Which of the tampering, repudiation, information disclosure, denial of service, and elevation of
following is not an element of STRIDE? privilege.
A. Spoofing
B. Elevation of privilege
C. Repudiation
D. Disclosure
If a security mechanism offers availability, then it offers a C. Accessibility of data, objects, and resources is the goal of availability. If a
high level of assurance that authorized subjects can ______ security mechanism offers availability, then it is highly likely that the data, objects,
the data, objects, and resources. and resources are accessible to authorized subjects.
A. Control
B. Audit
C. Access
D. Repudiate
______ refers to keeping information confidential that is C. Privacy refers to keeping information confidential that is personally identifiable
personally identifiable or which might cause harm, or which might cause harm, embarrassment, or disgrace to someone if revealed.
embarrassment, or disgrace to someone if revealed. Seclusion is to store something in an out of the way location. Concealment is the
act of hiding or preventing disclosure. The level to which information is mission
A. Seclusion critical is its measure of criticality.
B. Concealment
C. Privacy
D. Criticality
