Cybersecurity Consultant

Sample question 1

Meridian Freight Logistics' VP of Sales has committed to a major retail client that a new EDI integration portal will go live in six weeks to close a $2M contract. The CISO's board approved priority for the year is closing last quarter's penetration test finding of unencrypted data at rest on the shared storage platform, the same platform the new portal's transaction store will run on, before any new customer facing system launches on it. The cybersecurity consultant is asked to build the security plan for the portal launch. Which plan best integrates both priorities?

1. A.Make encrypting the shared storage platform a portal go live gate inside the six week plan, so remediation and launch land together.
2. B.Ship the portal on schedule with its transaction store hosted on a third party managed database, assigning the encryption finding to that vendor's compliance attestations.
3. C.Pause the portal build until the encryption finding is closed across the entire storage estate, then restart the six week commitment with the client.
4. D.Prepare two plan variants, one protecting the launch date and one protecting the board priority, and ask the board to choose between them.

Sample question 2

A consultant is scoring a manufacturing client's vulnerability management program against a five-level process maturity model (Initial, Managed, Defined, Quantitatively Managed, Optimizing) as part of a maturity assessment engagement. The client's security team shows a written vulnerability management policy, standardized workflows, and consistent execution of those workflows across every business unit for the past eighteen months. The team does not collect or review metrics such as mean-time-to-remediate, and does not compare performance against numeric targets. The client's VP of IT argues the program should score at 'Quantitatively Managed' because it has been executed consistently for a year and a half. Based on the evidence provided, how should the consultant score the program?

1. A.Score the program at 'Managed,' since 'Defined' status also requires a documented process-tailoring or continuous-improvement mechanism that the client has not yet shown evidence of using.
2. B.Score the program at 'Defined,' since it has a documented, standardized process consistently followed org-wide, but lacks the quantitative performance metrics required to reach 'Quantitatively Managed.'
3. C.Score the program at 'Quantitatively Managed,' as the VP argues, since eighteen months of consistent execution across all business units demonstrates the process is under quantitative control.
4. D.Score the program at 'Optimizing,' since sustained consistent execution over an extended period reflects the continuous process improvement that defines the highest maturity level.

Sample question 3

A cybersecurity consultant is testing a control at a mid-size fintech client: a policy requiring senior-engineer review before merging any AI-suggested code change that touches authentication or cryptography modules. The policy has been in force for four months. Reviewing the git history, the consultant finds 14 AI-assisted commits touched the authentication module in that period, but only 3 carry a recorded senior-engineer review comment. Engineering leadership points out that the policy exists and that engineers were trained on it at rollout. Which conclusion best reflects a sound assessment of this control's effectiveness?

1. A.The control is effective, because the written policy clearly assigns mandatory pre-merge review responsibility to senior engineers for authentication and cryptography changes.
2. B.The control's effectiveness cannot yet be judged, because a separate, formal AI risk assessment specifically covering this particular coding assistant still needs to be completed and formally signed off by security leadership.
3. C.The control is designed well but is not operating effectively, since only 3 of 14 relevant commits show the required review; testing should expand and the consultant should report a deficiency.
4. D.The control is ineffective, and the consultant should immediately require that AI-suggested commits be blocked automatically pending cryptographic sign-off from a security lead.