Security and Risk Management

A finance team encrypts quarterly reports so that only board members holding the decryption key can read them in transit and at rest. Which element of the CIA triad is the encryption primarily intended to preserve?

• AConfidentiality, because the cryptographic control restricts disclosure of the report content to authorised key holders only.check_circle Correct
• BIntegrity, because encryption mathematically prevents undetected modification of the protected report content.
• CAvailability, because keyed access guarantees the reports remain reachable to authorised board members at any time.
• DNon-repudiation, because encrypted reports cannot later be denied as having been authored by the finance team.

Why A is correct: Confidentiality is the property that information is not disclosed to unauthorised parties. Encrypting the reports so that only key-holding board members can read them is a textbook confidentiality control.

Why B is wrong: Integrity controls such as hashes or digital signatures detect tampering, but symmetric or asymmetric confidentiality encryption alone does not reliably reveal modifications. Treating encryption as an integrity control is a common conflation.

Why C is wrong: Availability is supported by redundancy, capacity planning, and resilience, not by restricting who can read a file. Encryption can actually reduce availability if keys are lost.

Why D is wrong: Non-repudiation is achieved through digital signatures bound to a verified identity, not through encryption used to hide content. The scenario does not describe any signing or identity binding.

A regional bank's CISO learns that a critical legacy payment-processing application has a newly disclosed authentication flaw. The vendor will not release a patch for six months, the platform handles roughly 30 per cent of daily transactions, and an in-place compensating control would require taking the system offline during a strategic product launch. The board has asked the CISO for a recommendation by tomorrow. What should the CISO do FIRST?

• ADocument the situation as a formal risk acceptance, signed at the board level, and continue monitoring the threat landscape for active exploitation.
• BSchedule emergency downtime to deploy the available compensating control before the product launch, on the basis that any unpatched authentication flaw must be remediated immediately.
• CEngage the cyber-insurance carrier to confirm coverage for the exposure window and treat the residual risk as transferred for the duration of the vendor patch cycle.
• DConduct a focused risk assessment that quantifies likelihood, business impact, and treatment options, then present the analysis with a recommended response to the board.check_circle Correct

Why A is wrong: Risk acceptance can be a valid response, but it is only defensible after the residual exposure has been quantified against the organisation's risk appetite and alternative treatments have been weighed. Recommending acceptance without that analysis pre-empts the very decision the board has asked the CISO to inform.

Why B is wrong: Treating every unpatched authentication flaw as requiring immediate downtime ignores business impact and is the over-technical answer CISSP cautions against. The compensating control may still be the right call, but it should follow, not precede, a risk-informed recommendation to the board.

Why C is wrong: Insurance can offset financial loss but does not transfer regulatory, reputational, or operational risk, and carriers rarely consider a known unpatched flaw as covered without compensating controls. Treating the risk as transferred without assessment misrepresents the residual exposure to the board.

Why D is correct: The CISO has been asked to recommend a course of action under time pressure with material business trade-offs. A targeted risk assessment that frames likelihood, impact, and the cost of each treatment option is the management-led step that makes any subsequent acceptance, mitigation, or transfer decision defensible to the board.

A multinational manufacturer suspects that a regional sales director has been falsifying expense reports to fund a side business. Human resources and the general counsel want to determine whether to terminate the employee and recover the funds, but they have not decided whether to pursue prosecution or a lawsuit. Which type of investigation should the security manager initially scope the work as?

• AAn administrative investigation conducted to the preponderance of evidence standard, focused on internal policy violations and employment outcomes.check_circle Correct
• BA criminal investigation conducted to the beyond reasonable doubt standard, preserving evidence under formal chain of custody for prosecutors.
• CA civil investigation conducted to the preponderance of evidence standard, focused on producing pleadings and discovery for a lawsuit.
• DA regulatory investigation conducted to the standard set by the relevant supervisory authority, focused on demonstrating compliance to an external examiner.

Why A is correct: Administrative investigations look at whether internal policies and the employment contract were breached. The standard of proof is preponderance of evidence, which fits an initial scoping where the decision points are termination and internal recovery, with the option to escalate to criminal or civil later if findings warrant.

Why B is wrong: Criminal investigations are appropriate when law enforcement is engaged and the goal is prosecution by the state. At this stage the organisation has not decided to involve police, so framing the work as criminal commits the team to the strictest evidentiary burden prematurely and is not the best initial scoping.

Why C is wrong: Civil investigations support lawsuits between private parties seeking damages or specific performance. The organisation has not committed to litigation, so structuring the work around discovery filings and pleadings now is premature and may waste effort if termination alone resolves the issue.

Why D is wrong: Regulatory investigations are driven by a supervisory body such as a financial regulator examining a licensee. Expense fraud by an employee is not, by itself, a regulatory matter unless reporting obligations are triggered, so this framing does not match the facts and decision points.