Activity
Mon
Wed
Fri
Sun
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Dec
Jan
What is this?
Less
More
Memberships
CISSP Study Group
1.9k members • Free
8 contributions to CISSP Study Group
6d •
The Beast has been conquered.
They call the CISSP the "Gold Standard" for a reason. It isn't just an exam; it is a mental wave where every question sends you into an imaginary, real-life scenario. After 3 hours and 150 questions, I am thrilled to announce that I have officially passed!
0 likes • 3d
@Indy B Thanks a bunch!
0 likes • 3d
@Annette Corona thanks a bunch!
4d •
CISSP Practice Question (Domain 3: Security Architecture and Engineering)
A financial services company needs to share highly sensitive customer transaction data with a third-party analytics provider. The company's legal department mandates that the third-party must be able to perform statistical analysis on the data, but the data must remain encrypted at all times, including while it is being processed by the provider's algorithms to ensure the company never loses control over the plaintext. What is the MOST appropriate cryptographic solution to meet this requirement? A. Symmetric encryption using AES-256 with a managed Key Vault B. Asymmetric encryption using RSA-4096 with Perfect Forward Secrecy C. Homomorphic encryption D. Quantum-resistant cryptography
1 like • 3d
My answer is C. Homomorphic encryption. (Data in Use Protection: The scenario specifies that data must remain encrypted while it is being processed to ensure the company never loses control over the plaintext. This addresses the challenge of securing Data in Use, which is traditionally the hardest state to protect because standard encryption requires data to be decrypted (turned into plaintext) for applications to process it.)
5d •
CISSP Practice Question (Domain 1: Security and Risk Management)
A business unit deploys an AI agent that autonomously negotiates vendor contracts within predefined spend limits. The agent improves efficiency but occasionally commits the company to unfavorable terms. Executives want to continue using it. What is the MOST appropriate action for the security leader? A. Disable autonomous execution and require human approval for commitments B. Update the organization’s risk register to reflect agent decision authority C. Require explainability reports for every AI-driven contract decision D. Transfer contractual risk to vendors through revised legal language Come back for the answer tomorrow, or study more now!
2 likes • 5d
My answer is B - Update the organization’s risk register to reflect agent decision authority. (Risk Acceptance and Documentation: The scenario states that executives have decided to continue using the AI agent despite the known issue of occasional unfavorable terms. This constitutes a risk acceptance decision, where the organisation chooses to tolerate the potential loss (unfavorable terms) in exchange for the benefit (efficiency) As a security leader acting as an advisor, you must ensure this decision is formally documented in the risk register to establish accountability and an audit trail).
7d •
CISSP Practice Question (Domain 8: Software Development Security)
A company deploys an internal generative AI assistant trained on corporate documents to support developers and analysts. Leadership wants rapid adoption, but legal raises concerns about sensitive data being exposed through prompts and outputs. What is the MOST appropriate control to implement FIRST? A. Log and monitor all AI prompts and responses for misuse B. Classify and restrict training and prompt-accessible data sources C. Add contractual liability clauses for AI misuse to employment agreements D. Conduct periodic audits of AI model accuracy and bias Come back for the answer tomorrow, or study more now!
1 like • 7d
My answer is B. Classify and restrict training and prompt-accessible data sources. (Foundation of Asset Security: According to standard security practices (Domain 2: Asset Security), you must identify and classify data based on its sensitivity and value before you can effectively protect it. Classification is the primary step that allows an organisation to determine appropriate security controls, such as which data the AI is permitted to ingest or access).
8d •
CISSP Practice Question (Domain 1: Security and Risk Management)
A global organization adopts a cloud service to accelerate operations, despite unresolved concerns about data residency and regulatory exposure. Senior leadership accepts the business risk to meet market pressure. As the security leader, what is the MOST appropriate next action? A. Document the risk acceptance decision and associated residual risk B. Implement compensating technical controls to reduce exposure C. Transfer the risk through expanded cyber insurance coverage D. Escalate the decision to regulators for formal guidance Study more now!
2 likes • 8d
My answer is A. Document the risk acceptance decision and associated residual risk. Formal Risk Management Process: In the risk management lifecycle, once a risk assessment is complete and senior management has decided to accept a risk (often because the cost of mitigation outweighs the benefit or to meet business objectives like market pressure), the decision must be formally documented and most importantly "Do Nothing After That".
1 like • 8d
@Martin Joplin Once a risk acceptance decision is authorised by senior management, it must be formally documented to create an audit trail. This decision is based on a prior assessment confirming the risk falls within the organization's risk appetite or that the cost of mitigation outweighs the potential loss. However, the risk cannot simply be ignored moving forward; it must be continuously monitored to ensure it remains within acceptable levels, but nothing else needs to be done at the moment after the documentation.
1-8 of 8
@harrison-efijemue-9135
I'm an Information Security Analyst with over 12 years of practical experience within the confines of IT.
Active 12h ago
Joined Jan 15, 2026
Powered by