Cybersecurity Specialist

Sample question 1

A cybersecurity specialist is engaged by a mid-size insurance company that has deployed a generative AI chatbot to handle policyholder inquiries. The chatbot calls an API into the claims database to look up policy status for the person it is chatting with. A penetration test finds that carefully crafted prompts can manipulate the chatbot into revealing claims data belonging to other policyholders, and that the API credential the chatbot uses grants read access to the entire claims table rather than being scoped to one policyholder at a time. Leadership asks the specialist to recommend a remediation approach before the next release. Which recommendation should the specialist make?

1. A.Scope the chatbot's database credential so each session can only query the authenticated policyholder's own records, add input and output filtering for cross-account references, and log anomalous query patterns for review.
2. B.Rely on the chatbot's built-in safety training to refuse improper requests, and add an interface disclaimer telling policyholders that responses may occasionally be inaccurate or incomplete during busy periods.
3. C.Rewrite the system prompt to instruct the model never to disclose another policyholder's information, verify the fix with a short manual test, and revisit the issue at the next quarterly security review.
4. D.Instruct customer service staff to remind policyholders during escalated calls not to ask about other people's claims, and watch overall call volume for signs of unusual or suspicious activity.

Sample question 2

At Meridian Health Analytics, the acceptable use policy prohibits installing unapproved software on endpoints. A project manager emails the on-call Cybersecurity Specialist asking her to grant a contractor local administrator rights for two weeks so the contractor can install a specialized modeling tool the IT service catalog does not yet support. The company's cybersecurity policy manual defines a documented exception process for cases like this: a written business justification, a defined expiration date, and sign-off from the asset owner or a delegated risk owner, all recorded in the GRC exception register before elevated access is provisioned. No active incident or emergency condition applies; the modeling work is not blocking anything time-critical. What should the specialist do?

1. A.Assemble the full exception file, the written business justification, a defined expiration date, sign-off from the asset owner or a delegated risk owner, and the GRC exception register entry, but provision the contractor's local administrator access first so the modeling work can begin, then close out and file all four elements within that same week.
2. B.Prepare the written business justification, set a defined expiration date, and record the GRC exception register entry, then provision the contractor's local administrator access on the strength of the project manager's written confirmation of the engagement, treating that confirmation as the sign-off the process calls for.
3. C.Obtain the asset owner or a delegated risk owner's agreement by phone and set the two-week expiration date, provision the contractor's local administrator access, and then capture the written business justification and the GRC exception register entry once the engagement is under way.
4. D.Work the documented exception process to completion, the written business justification, a defined expiration date, sign-off from the asset owner or a delegated risk owner, and the logged GRC exception register entry, and provision the contractor's local administrator access only once all four are on file.

Sample question 3

A fire suppression system malfunction forces Helio Systems to power down its primary data center for an estimated 14 hours. Multiple applications are affected. The organization's BCDR plan, developed jointly with business unit leaders, assigns each business function a recovery tier with a maximum tolerable downtime and a designated failover order: Tier 1 is claims payment processing with a 2-hour RTO, Tier 2 is the customer portal with an 8-hour RTO, and Tier 3 is internal analytics dashboards with a 48-hour RTO. The on-call Cybersecurity Specialist, coordinating the technical failover, finds that the analytics dashboards are the fastest and least risky system to fail over to the secondary site, while claims payment processing requires a more complex, higher-risk failover procedure. In what order should the specialist direct the failover work?

1. A.Fail over the analytics dashboards first since it carries the lowest technical risk, then the customer portal, then claims payment processing once the team gains confidence from the earlier failovers.
2. B.Fail over all three systems simultaneously, splitting the on-call team across each one so every system is restored as close to the same time as possible.
3. C.Contact each business unit leader individually and let them decide the order live during the outage, since they know their own function's urgency better than the BCDR plan document.
4. D.Fail over claims payment processing first, then the customer portal, then the analytics dashboards, following the recovery tiers and RTOs defined in the BCDR plan regardless of which failover is technically simplest.