Free ISC2 CISSP-ISSMP Practice Questions

Correct answer: C. Clark-Wilson

The Clark-Wilson model is an integrity-based security model that enforces the principle that subjects can only access objects through applications, not directly. This model includes well-formed transactions and separation of duties to maintain data integrity. Applications act as intermediaries that enforce business rules and constraints on data access.

Why the other options are wrong

• A. Biba-Clark model does not exist as a standard security model.
• B. Bell-LaPadula is a confidentiality model focused on preventing information disclosure through read-down and write-up restrictions, not application-mediated access.
• D. The Biba model addresses integrity through strict controls but does not specifically mandate application-mediated access like Clark-Wilson does.

Correct answer: C. Biometrics

Biometrics relies on physical characteristics of a user such as fingerprints, iris scans, facial recognition, or voice patterns to verify identity. These are inherent to the individual and cannot be easily lost or stolen like passwords or tokens.

Why the other options are wrong

• A. Social engineering is a manipulation technique used to deceive users, not an authentication method.
• B. Kerberos v5 is a network authentication protocol using tickets and cryptography, not physical characteristics.
• D. CHAP (Challenge Handshake Authentication Protocol) is a network authentication protocol using password-based challenges, not biometric verification.

Correct answer: B, C, D. File and object access; Network logons and logoffs; Printer access

File and object access, network logons and logoffs, and printer access are all common auditable security activities that organizations track to monitor system usage and security events. These activities generate logs that help detect unauthorized access, policy violations, and security incidents. Data downloading from the Internet is not typically classified as a standard auditable security activity in most audit frameworks.

Why the other options are wrong

• A. Data downloading from the Internet is not a standard security audit activity that most organizations formally track in their audit logs.

Correct answer: D. Independent audit

An independent audit is conducted by a third party not affiliated with the organization to provide objective evaluation without bias. In this scenario, an independent auditor would objectively investigate John's computer issues and the wireless network security to ensure impartial findings and recommendations.

Why the other options are wrong

• A. An operational audit evaluates whether systems are functioning correctly according to procedures, but does not necessarily provide the objectivity needed for investigating potential security issues.
• B. A dependent audit is not a standard audit classification in security frameworks.
• C. A non-operational audit is not a standard audit type; the distinction between operational and independent audits better fits this scenario.

Correct answer: B. Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act, enacted in 1986, was the first major U.S. federal law to establish criminal penalties for creating and distributing malicious code such as viruses and worms that cause harm to computer systems. It addresses unauthorized access and malicious code distribution comprehensively.

Why the other options are wrong

• A. The Gramm-Leach-Bliley Act addresses financial privacy and data protection, not malicious code creation.
• C. The Computer Security Act predated comprehensive malicious code penalties and focused more on government information security standards.
• D. The Digital Millennium Copyright Act focuses on copyright protection and circumvention of copy protection mechanisms, not malware creation.

Correct answer: A, D. It can be achieved by installing service packs and security updates on a regular basis; It is used for securing an operating system.

System hardening is achieved by installing service packs and security updates regularly to patch vulnerabilities and strengthen the operating system against attacks. It focuses on securing the operating system and software, not physical security measures. Installing updates and patches directly reduces exploitable weaknesses in the system.

Why the other options are wrong

• B. System hardening is used for securing the operating system and software, not the computer hardware itself.
• C. Locking a computer room is a physical security measure, not part of system hardening which focuses on software and configuration security.

Correct answer: B, C, E. Custodian; Owner; User

In an information classification program, the common data roles are custodian (responsible for protecting and maintaining data), owner (responsible for classifying and managing data), security auditor (responsible for verifying compliance with classification policies), and user (who accesses and uses the classified data). The editor role is not a standard classification role in information security frameworks.

Why the other options are wrong

• A. Editor is not a standard role in information classification programs; the roles focus on ownership, custody, auditing, and usage of data.

Correct answer: B. Project management plan

When new risks are identified and risk responses are created, the project management plan must be updated to reflect these changes. The project management plan contains the risk management plan and other subsidiary plans that govern how the project will be executed. Updating it ensures all project management components remain aligned with the current risk posture and approved responses.

Why the other options are wrong

• A. While vendor relationships may be affected, updating the contract is not the primary document that should reflect risk response strategies.
• C. Communications plans address how stakeholders will be informed, but they don't document the risk responses themselves.
• D. The scope statement defines project boundaries and deliverables; new risks don't necessitate scope statement updates unless the scope has actually changed.

Correct answer: C. Risk register

The risk register is the primary document where all identified risks, their analysis, proposed responses, and current status are recorded and maintained throughout the project. It serves as the central repository for risk information and is continuously updated as new risks are identified and risk responses are implemented.

Why the other options are wrong

• A. The risk management plan describes the processes and procedures for managing risk, not the actual risks and responses themselves.
• B. Lessons learned documentation is created at project closure to capture insights for future projects, not for documenting current risk responses.
• D. Stakeholder management strategy addresses how to engage with stakeholders, not where to document risk responses.

Correct answer: B. NDA

A Non-Disclosure Agreement (NDA) is a legal contract that creates a confidential relationship between parties and protects confidential information, trade secrets, and proprietary data from unauthorized disclosure. An SLA defines service levels and performance metrics, Non-price competition and CNC are not standard agreement types for confidentiality protection.

Why the other options are wrong

• A. SLA is a Service Level Agreement defining performance standards, not confidentiality protection.
• C. Non-price competition is an economic concept, not a confidentiality agreement type.
• D. CNC is not a recognized agreement type for protecting confidential information.

Correct answer: D. RFI

An RFI (Request for Information) is the appropriate document when seeking general information, demonstrations, and samples from a vendor about products or services with which the organization has no prior experience. It is less formal than an RFP and is used to gather preliminary information to inform future procurement decisions.

Why the other options are wrong

• A. IFB (Invitation for Bid) is used when specifications are already defined and the organization is ready to receive formal competitive bids.
• B. RFQ (Request for Quote) is used when specific products or services are already defined and quotes on price are needed.
• C. RFP (Request for Proposal) is used when the organization has defined requirements and seeks detailed proposals, not preliminary information gathering.

Correct answer: A, C, D. Request for Change; Change; Forward Schedule of Changes

Change Management relies on specific terminology and processes. Request for Change (RFC) is the formal request to make a change, Change is the modification itself, and Forward Schedule of Changes (FSC) is the planned schedule of upcoming changes. These three terms are core terminologies used throughout the change management process to standardize procedures and ensure controlled implementation of modifications.

Why the other options are wrong

• B. Service Request Management is a separate ITIL process focused on fulfilling user requests for services, not a Change Management terminology.

Correct answer: A. Configuration management

Configuration management establishes and maintains consistency of a system's or product's performance and its functional and physical attributes with its requirements, design, and operational information throughout its life. It ensures that all components, versions, and changes are tracked and documented to maintain system integrity and compliance with specifications.

Why the other options are wrong

• B. Risk management focuses on identifying, analyzing, and mitigating risks rather than maintaining consistency of system attributes.
• C. Procurement management deals with acquiring goods and services from external sources, not maintaining system consistency.
• D. Change management controls the process of implementing changes but does not specifically focus on maintaining consistency of performance and attributes.

Correct answer: D. Illegal activities

Contracts cannot include provisions for illegal activities. Any clause attempting to require, permit, or protect illegal conduct is void and unenforceable. Subcontracting, penalties for breaching confidentiality, and deadlines are all standard, legal contractual provisions.

Why the other options are wrong

• A. Subcontracting clauses are common and enforceable contract provisions.
• B. Penalties and fines for disclosure of intellectual property are standard contract provisions protecting confidentiality.
• C. Deadlines for work completion are fundamental contractual terms.

Correct answer: A, B. Troubleshooting; Investigation

Audit records serve two primary purposes: troubleshooting by helping identify system issues and anomalies, and investigation by providing evidence of system activities for security incidents or policy violations. These records create an accountability trail and support both operational and security functions within information systems.

Why the other options are wrong

• C. Upgradation is not a purpose of audit records; they document activities rather than support system upgrades.
• D. While audit logs may be included in backups, backup is not a primary purpose of audit records themselves.

Correct answer: B, D. Clark-Wilson; Biba

The Biba model and Clark-Wilson model are both integrity-focused security models. The Biba model (also called Biba-Wilson in some contexts) is specifically designed to protect integrity through simple and star integrity properties. The Clark-Wilson model extends this by adding commercial integrity concepts and preventing both unauthorized modification and unexpected change. These models focus on preventing data modification rather than controlling information flow as in confidentiality models.

Why the other options are wrong

• A. Biba-Wilson is another name for the Biba model itself, making this redundant with option D.
• C. The Bell-LaPadula model is designed for confidentiality protection, not integrity.

Correct answer: A. Collusion

Job rotation and separation of duties are administrative controls specifically designed to prevent collusion, which is the unauthorized cooperation between employees to commit fraud or circumvent security controls. By rotating employees through different positions and ensuring no single person controls an entire process, organizations eliminate the opportunity for coordinated misconduct.

Why the other options are wrong

• B. Eavesdropping is prevented through technical controls like encryption and secure communications channels, not administrative policies.
• C. Buffer overflow is a technical vulnerability prevented through secure coding practices and input validation, not administrative controls.
• D. Phishing is prevented through security awareness training and email filtering, not through job rotation or separation of duties.

Correct answer: C. The Change Manager

The Change Manager is responsible for deciding the category of a change within the change management process. The Change Manager assesses incoming change requests, categorizes them according to established criteria (such as standard, normal, or emergency changes), and determines the appropriate approval pathway and management procedures. This decision is central to ensuring changes are handled with appropriate rigor and speed based on their impact and complexity.

Why the other options are wrong

• A. The Problem Manager addresses root causes of incidents but does not categorize changes.
• B. The Process Manager oversees process design but is not responsible for individual change categorization decisions.
• D. The Service Desk logs changes and may provide initial information but does not make categorization decisions.
• E. The Change Advisory Board reviews and approves changes but does not make the initial categorization decision.

Correct answer: A. Bell-La Padula model

The Bell-LaPadula model is specifically designed to address data confidentiality through the control of access to classified information. It uses security clearances and classification levels to enforce a strict hierarchy that prevents unauthorized disclosure of sensitive data. The model's primary focus is preventing information from flowing to lower classification levels.

Why the other options are wrong

• B. The Take-Grant model focuses on how access rights are granted and transferred between subjects and objects.
• C. The Clark-Wilson model is designed for integrity, not confidentiality.
• D. The Biba model focuses on integrity protection rather than confidentiality.

Correct answer: A. Firm Fixed Price

A Firm Fixed Price contract establishes a specific price for precisely defined services or deliverables. Any changes or deviations from the original specifications result in cost adjustments to the buyer, as described in the scenario. This contract type provides cost certainty for the vendor and cost predictability for the buyer when requirements are well-defined.

Why the other options are wrong

• B. A Fixed Price Incentive Fee contract includes incentive clauses that adjust payment based on performance metrics.
• C. A Cost Plus Fixed Fee contract reimburses actual costs plus a fixed fee, allowing for specification changes.
• D. A Fixed Price with Economic Price Adjustment allows for price adjustments based on economic factors, not specification changes.

Correct answer: C. Contract

A Contract is a binding legal agreement between two or more parties that creates enforceable obligations under law. An Outsource is a business decision to delegate work, a Proposal is an offer or suggestion, and a Service Level Agreement is a specific type of contract defining service standards, only a Contract itself represents the binding legal instrument.

Why the other options are wrong

• A. Outsource is a business strategy, not a legally binding agreement.
• B. Proposal is an offer or suggestion that is not yet binding.
• D. A Service Level Agreement is a type of contract but not the general term for all binding agreements.

Correct answer: D. Backup policy

A Backup policy is the formal documentation of guidelines and procedures for creating archival copies of important data. It specifies frequency, retention periods, storage locations, testing requirements, and recovery procedures. User policy addresses user behavior, Security policy covers protection mechanisms, and Audit policy documents review procedures, none specifically document backup procedures.

Why the other options are wrong

• A. User policy governs user behavior and access, not backup procedures.
• B. Security policy addresses protection mechanisms and controls, not backup archival guidelines.
• C. Audit policy documents review and examination procedures, not backup creation guidelines.

Correct answer: D. Installing service packs and updates

Installing service packs and updates is the most effective method to stop vulnerability attacks on a web server because it addresses the root cause, unpatched security vulnerabilities in the server software. Service packs and updates contain patches that fix known vulnerabilities that attackers exploit. While firewalls, strong passwords, and virus scanners provide some protection, they are defensive measures that don't eliminate the underlying vulnerabilities in the server itself.

Why the other options are wrong

• A. Strong passwords protect user accounts but do not address the underlying software vulnerabilities that web servers are susceptible to.
• B. A firewall can filter some malicious traffic but cannot prevent attacks that exploit unpatched vulnerabilities in the web server application itself.
• C. Virus scanners primarily detect malware after infection and do not prevent exploitation of server software vulnerabilities.

Correct answer: C. Separation of duties

Separation of duties is a fundamental security principle that divides critical tasks among multiple people so that no single individual can compromise the system. By requiring different people to authorize, approve, and execute transactions, the potential damage from one person's actions, whether accidental or malicious, is significantly reduced. This is a core control in preventing fraud and errors.

Why the other options are wrong

• A. CSA (Cloud Security Alliance) is an organization providing security guidance, not a policy that limits individual damage.
• B. Risk assessment identifies and evaluates risks but does not directly control or limit individual actions.
• D. Internal audit reviews and evaluates controls after the fact rather than preventing damage from a single person's actions.

Correct answer: A. Patent

A patent is a set of exclusive rights granted by a government to an inventor or assignee for a fixed period, in exchange for public disclosure of the invention. Patents protect novel inventions and prevent others from making, using, or selling the patented invention without permission during the protection period.

Why the other options are wrong

• B. A utility model is a similar but distinct form of intellectual property protection with different requirements and shorter duration.
• C. Snooping refers to unauthorized surveillance or access to information, not a legal intellectual property right.
• D. Copyright protects original works of authorship such as literature, music, and software code, not mechanical or technical inventions.

Correct answer: A, B, C, E, F. Internet telephony; Instant messaging; Electronic mail; Blogs; Internet teleconferencing

Internet telephony, instant messaging, electronic mail, blogs, and internet teleconferencing are all electronic communication technologies that use digital devices and networks to facilitate communication. Post-it notes are physical, non-electronic communication and therefore not included.

Why the other options are wrong

• D. Post-it notes are a physical paper-based communication method, not electronic communication technology.

Correct answer: D. Confidentiality

Confidentiality is the security principle that ensures unauthorized parties cannot access data. This directly addresses the concern stated, preventing unauthorized access to sensitive police data is a confidentiality requirement.

Why the other options are wrong

• A. Availability ensures data and systems are accessible when needed, not that they are protected from unauthorized access.
• B. Encryption is a technical mechanism that supports confidentiality but is not the principle itself.
• C. Integrity ensures data has not been altered, not that it remains inaccessible to unauthorized parties.

Correct answer: C, D. Risk control; Risk identification

Risk identification and risk control are the two major foundational tasks of risk management. Risk identification involves discovering, analyzing, and documenting potential risks, while risk control involves implementing measures to mitigate, avoid, or manage those identified risks. Assuring data integrity is a security concern rather than a risk management task, and building risk-free systems is an unrealistic objective.

Why the other options are wrong

• A. Assuring the integrity of organizational data is a data security objective, not a primary task of risk management.
• B. Building completely risk-free systems is not a realistic or achievable goal; risk management focuses on managing risks, not eliminating them entirely.

Correct answer: B. Patent

A patent is a form of intellectual property protection that enables an inventor to legally enforce the right to exclude others from using, making, or selling their invention for a specified period. It provides exclusive legal rights granted by a government authority. Spam is unsolicited communication, artistic license relates to creative works, and phishing is a cybersecurity attack.

Why the other options are wrong

• A. Spam is unsolicited bulk messaging and has no connection to protecting inventions.
• C. Artistic license refers to creative freedom in artistic works, not legal protection for inventions.
• D. Phishing is a social engineering attack used to steal information, not a legal protection mechanism.

Correct answer: A, B, C. Resource requirements identification; Criticality prioritization; Down-time estimation

Business Impact Analysis (BIA) objectives include resource requirements identification, which determines what resources are needed to maintain operations; criticality prioritization, which ranks business functions by importance; and down-time estimation, which calculates how long the organization can sustain disruption to each function. These three components work together to create a comprehensive understanding of business impacts from disruptive events.

Why the other options are wrong

• D. Performing vulnerability assessment is part of risk management and threat analysis, not a BIA objective; BIA focuses on impact rather than vulnerability identification.

Correct answer: C. It identifies the level of confidentiality of information.

Due Care policy identifies the level of confidentiality and classification of information within an organization. It establishes standards for how different types of information should be handled, protected, and accessed based on their sensitivity level. This is distinct from authentication methods, database security mechanisms, or virus threat intelligence.

Why the other options are wrong

• A. Authentication is handled by separate security mechanisms, not by Due Care policy.
• B. Database security requires specific technical controls, not general Due Care policy frameworks.
• D. Virus information comes from threat intelligence and security updates, not from Due Care policy.

Correct answer: B. Configuration Item Costing

Configuration management activities include Configuration Identification (defining what to track), Configuration Status Accounting (recording status), and Configuration Verification and Auditing (ensuring compliance). Configuration Item Costing, while valuable for project management, is a financial/budgeting activity rather than a core configuration management function.

Why the other options are wrong

• A. Configuration Verification and Auditing is a standard configuration management activity.
• C. Configuration Identification is fundamental to configuration management.
• D. Configuration Status Accounting is a core configuration management activity.

Correct answer: B. Risk transfer

Risk transfer involves shifting the financial impact of a risk to a third party through mechanisms like insurance. By obtaining a liability insurance policy that covers information security risks including physical damage and hacking attacks, SoftTech Inc. is transferring the risk to the insurance company.

Why the other options are wrong

• A. Risk mitigation reduces the probability or impact of a risk through preventive measures, not insurance.
• C. Risk acceptance acknowledges a risk and absorbs its impact without action.
• D. Risk avoidance eliminates the activity that creates the risk entirely.

Correct answer: C. FERPA

FERPA (Family Educational Rights and Privacy Act) is the specialized privacy bill that applies to any educational institution receiving federal funding. It protects the privacy of student education records and gives parents and students rights regarding those records.

Why the other options are wrong

• A. HIPAA applies to healthcare providers and health plans, not educational institutions.
• B. COPPA (Children's Online Privacy Protection Act) regulates online collection of data from children under 13, not educational records broadly.
• D. GLBA (Gramm-Leach-Bliley Act) applies to financial institutions, not educational institutions.

Correct answer: B, C, D. Top Secret; Confidential; Secret

The U.S. military uses four levels of classification: Top Secret, Secret, Confidential, and Unclassified. These are the official security classification levels for government and military information. Sensitive is not a classification level but rather a handling caveat used in combination with classifications. Public is not a formal military classification level.

Why the other options are wrong

• A. Sensitive is a handling marking or caveat (such as Sensitive Compartmented Information), not a classification level itself.
• E. While Unclassified is correct, it is included in the correct answer set BCD.
• F. Public is not a formal military data classification level; unclassified information is the lowest level.

Correct answer: D. Annualized Rate of Occurrence (ARO)

Annualized Rate of Occurrence (ARO) represents the estimated frequency or likelihood at which a specific threat is expected to occur within a one-year period. A Safeguard is a control, Single Loss Expectancy calculates monetary impact per incident, and Exposure Factor measures the percentage of asset loss, none of these measure threat frequency.

Why the other options are wrong

• A. Safeguard is a protective control or countermeasure, not a frequency measure.
• B. Single Loss Expectancy quantifies monetary loss per occurrence, not frequency.
• C. Exposure Factor measures the proportion of an asset affected, not how often threats occur.

Correct answer: B. Evaluation and acceptance

The evaluation and acceptance phase is where system validation and verification occur. During this phase, the system and data are validated to ensure correctness, the system is verified to meet all user requirements, and controls are verified to meet all organizational requirements. This phase serves as the quality assurance checkpoint before the system is accepted for production use. The other phases focus on planning, coding, or initial setup rather than comprehensive validation.

Why the other options are wrong

• A. Programming and training focuses on code development and user instruction, not system validation.
• C. Definition involves establishing requirements and system specifications, not validating completed systems.
• D. Initiation is the project startup phase, not the validation phase.

Correct answer: B. Packet sniffing

Packet sniffing is the process of intercepting and monitoring data packets that travel across a network. Packet sniffers capture network traffic to analyze, inspect, or record data being transmitted. This technique can be used for legitimate network analysis and troubleshooting or for malicious purposes to intercept sensitive information.

Why the other options are wrong

• A. Password guessing is an attack method attempting to gain unauthorized access by trying multiple password combinations.
• C. Shielding refers to protective measures like electromagnetic shielding to prevent interference or eavesdropping.
• D. Packet filtering is a firewall technique that allows or blocks packets based on predefined rules, not a monitoring process.

Correct answer: B. The Supplier Manager

The Supplier Manager role is responsible for managing relationships with external suppliers and vendors, including regular review and risk analysis of all contracts. This role ensures that contracts align with service requirements, monitors vendor performance, and assesses ongoing contractual and financial risks. The Supplier Manager conducts periodic reviews to ensure compliance and identify potential issues before they impact service delivery.

Why the other options are wrong

• A. The Configuration Manager maintains records of IT assets and their relationships, not contract analysis.
• C. The Service Catalogue Manager maintains the service catalogue and service information, not contract review.
• D. The IT Service Continuity Manager focuses on business continuity planning and disaster recovery, not contract management.

Correct answer: A, C, D. Change control; Request control; Release control

The maintenance phase of system life cycle models includes multiple subphases to manage ongoing system updates and changes. Change control manages modifications to the system, configuration control tracks system components and their versions, and release control oversees the deployment of updates and new versions. These three mechanisms work together to maintain system stability and integrity during the maintenance phase.

Why the other options are wrong

• B. Configuration control is included in the maintenance phase subphases, so this is correct and should not be marked wrong; however, the answer set ACD does not include it, indicating that while configuration management occurs, configuration control as a distinct subphase is not listed in this framework.

Correct answer: D. Analyze the current business strategy.

Analyzing the current business strategy is the initial step in developing an information security strategy. Security must align with and support business objectives, so understanding the organization's business direction, goals, and priorities must come first before assessing vulnerabilities, awareness levels, or business impacts.

Why the other options are wrong

• A. Technical vulnerability assessment is a later step, performed after strategic alignment is established.
• B. Security awareness assessment comes after business strategy alignment is determined.
• C. Business impact analysis is conducted after understanding the business strategy to identify which assets are most critical.

Correct answer: D. Contingency plan

A contingency plan includes specific strategies and actions to deal with particular variances to assumptions that result in specific security problems, emergencies, or states of affairs. Contingency plans are developed for identified scenarios and provide predetermined responses to handle deviations from normal operations or assumptions.

Why the other options are wrong

• A. A business continuity plan focuses on maintaining critical business functions during and after disruptive events but is broader in scope.
• B. A disaster recovery plan specifically addresses recovery of IT systems and data after disasters but does not emphasize specific variances to assumptions.
• C. A Continuity of Operations Plan (COOP) is a government-specific planning document addressing essential functions during continuity events, broader than handling specific variances.

Correct answer: A, B, C, D. Names of the victims; Location of each incident; Nature of harassment; Date and time of incident

Complete and thorough documentation of sexual harassment incidents requires recording all relevant details to support legal proceedings and investigations. Names of victims identify those affected, location establishes context and patterns, nature of harassment describes the specific conduct, and date and time create a chronological record. Together, these elements form a comprehensive documentation package necessary for legal action and organizational response.

Correct answer: B. Cost Plus Percentage of Cost

Cost Plus Percentage of Cost (CPPC) contracts provide no incentive for cost control because the contractor's fee increases as costs increase, creating a perverse incentive to spend more. This contract type is rarely used due to this flaw.

Why the other options are wrong

• A. Cost Plus Fixed Fee provides some cost control incentive since the fee remains fixed regardless of costs incurred.
• C. Cost Plus Incentive Fee includes incentive mechanisms to encourage cost control and efficiency.
• D. Cost Plus Award Fee includes performance-based incentives that encourage the contractor to control costs and meet objectives.

Correct answer: A. Configuration management

Configuration management controls the features, functions and physical characteristics of the product, which is the product scope. The scope change control system deals with changes to the project scope, meaning the work required, so it is not the answer here.

Why the other options are wrong

• B. Product scope is very much a concern of the project, since the project exists to deliver that product.
• C. The scope change control system governs changes to the project scope, not the product's features and functions.
• D. Project integration management coordinates all knowledge areas and is not the specific process that controls product features and functions.

Correct answer: C. It depends on what the termination clause of the contract stipulates.

Whether an organization must pay for completed work upon termination depends entirely on the specific terms outlined in the termination clause of the contract. Different contracts contain different provisions regarding payment for work completed up to the point of termination, which may require full payment, partial payment, or no payment depending on the circumstances and contract language. This is a matter of contract law and the specific agreement between the parties.

Why the other options are wrong

• A. Liability is not determined by who chose to terminate the contract, but by contractual terms.
• B. The answer is determined by the contract terms, not by the uncertain outcome of litigation.
• D. Nearly complete work does not negate liability; payment obligations are based on contract terms, not completion percentage.

Correct answer: B. Circumstantial

Circumstantial evidence consists of individual facts that, when considered together, can be used to infer a conclusion about malicious activity or a person's involvement. Unlike direct evidence which directly proves a fact, circumstantial evidence requires logical inference and the connection of multiple pieces of information to reach a conclusion about guilt or malicious intent.

Why the other options are wrong

• A. Direct evidence proves a fact independently without requiring inference or connection to other evidence.
• C. Incontrovertible evidence refers to evidence that is irrefutable, not evidence that requires inference from multiple facts.
• D. Corroborating evidence supports or confirms other evidence but does not specifically refer to collections of facts that must be considered together to infer conclusions.

Correct answer: A, B, D. Vulnerability Assessment and Penetration Testing; Security Certification and Accreditation (C&A); Risk Adjustments

In the deployment phase of the SDLC, the system is tested through vulnerability assessment and penetration testing, then formally certified and accredited before it goes live. Any residual risk found is handled through risk adjustments so the authorising official accepts a known risk level.

Why the other options are wrong

• C. Change and configuration control is an ongoing operations and maintenance activity that manages the system after deployment, not a deployment-phase control.