Chapter 5 Domain 5.0 Security Program Management and Oversight

Chapter 5 1. 2. 3. 4. 5. 6. ■ Domain 5.0: Security Program Management and Oversight The company that Scott works for has experienced a data breach, and the personal information of thousands of customers has been exposed. Which of the following impact categories is not a concern as described in this scenario? A. Reputation B. Financial C. Availability loss D. Data loss Sameer wants to assess whether the key risk indicators (KRIs) his team have suggested are appropriate for his organization. Which of the following is not a common characteristic of a useful KRI? A. Actionable B. Measurable C. Relevant D. Inexpensive Jill’s organization wants to ensure that services and systems are back online and functioning normally within 4 hours of an event or incident. What term best describes this goal? A. An RTO B. An MTTR C. An RPO D. An MTBF Eric’s organization has created a policy document that describes how users can and cannot use the organization’s network, systems, and services. What type of policy has he created? A. Business continuity policy. B. An acceptable use policy. C. An incident response policy. D. This is a standard, not a policy. Angie is performing a penetration test and has gathered information using the Shodan search engine about her target. What type of reconnaissance has she performed? A. Active B. Commercial C. Scanner-­based D. Passive What role do data processors have in an organization? A. They determine how data is processed. B. They own the data. C. They process data on behalf of a controller. D. They contract with third parties to use the data. Chapter 5 7. 8. 9. ■ Domain 5.0: Security Program Management and Oversight Ginger’s personal data is used by an organization, including identifiable information like her name, address, and Social Security number. What term best describes Ginger? A. Data owner B. Data controller C. Data processor D. Data subject Hong’s company conducts regular risk assessments. As part of their assessment process, they gather a team of experts who assess risks on a scale from low to high based on their knowledge and experience. What type of risk assessment is Hong’s company conducting? A. Ad hoc B. Quantitative C. Qualitative D. Continuous How is likelihood measured in qualitative risk assessments? A. A scale like high, medium, low B. A numeric scale from 0 to 1 C. By calculating loss events per year D. A numeric scale from 1 to 100 10. Grace wants to establish a governance structure that will leverage third-­party experts who are paid by her organization. What governance structure should she select? A. Board-­based B. Committee-­based C. Government-­based D. Market-­based 11. Carmen’s organization wants to purchase cybersecurity insurance to offset the cost of potential breaches. What risk management strategy has her organization adopted? A. Transfer B. Accept C. Avoid D. Mitigate 12. Marissa has been recruited to a group that provides oversight for an organization but that doesn’t engage in the day-­to-­day operations of the organization. The group focuses on strategy and direction for the organization and meets a few times a year. What type of governance group is Marissa part of? A. An activist investor’s group B. A committee C. A board D. A regulator Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 13. Governance at Selah’s organization is delegated to business units. This allows the units to determine how to balance their operational needs against their governance processes. What type of governance is this? A. Centralized B. Board-­based C. Decentralized D. Committee-based 14. Sharon’s organization wants to understand the risks that it will experience due to acquiring a new subsidiary, but it needs to conduct the assessment quickly while leveraging their industry expertise. Which of the following risk assessment options should Sharon recommend to address this need? A. Conduct an ad hoc risk assessment. B. Conduct a one-­time risk assessment. C. Conduct a third-­party risk assessment. D. Build a continuous risk assessment process. 15. What term describes a third party that takes actions on behalf of a data controller? A. Data subject B. Data owner C. Data processor D. Data administrator 16. Which of the following will provide a customer the opportunity to engage a third party to deliver an SOC 2, Type 1 report created by third-­party assessors? A. A penetration testing agreement B. A risk assessment agreement C. A vulnerability scan clause D. A right-­to-­audit clause 17. Isaac has been asked to be his organization’s data owner for customer data. Which of the following is not a typical part of that role? A. Processing the data B. Classifying data C. Protecting data D. Ensuring the quality of the data 18. Pedro’s organization uses industrial machinery, which runs an RTOS that is no longer supported. His organization’s policies require systems to be removed from service if they cannot be patched for security issues, and the RTOS has a known vulnerability. The machines are Chapter 5 ■ Domain 5.0: Security Program Management and Oversight very expensive and are a core part of the organization’s industrial processes. What risk process would Pedro follow if he wanted to retain the devices, despite the risk? A. Transfer the risk. B. Seek an exception. C. Document the risk. D. Mitigate the risk. 19. Jake’s team has begun handling new data related to customers, including their personally identifiable information. Jake takes on a new role that has responsibilities including classifying each data element gathered about customers. What is Jake’s role in the data handling process? A. Controller B. Custodian C. Owner D. Processor 20. Which of the following measures is not commonly used as part of a business impact analysis? A. RTO B. MTTR C. ARO D. MTBF 21. As part of her organization’s marketing efforts, Julie’s team gathers information about customers and others who visit their website. Julie has engaged an analytics company that uses the data gathered to identify trends and potential new market opportunities. What data role does this third-­party company play? A. Data owner B. Data processor C. Data controller D. Data custodian 22. Neil’s organization has signed a contract that includes guarantees of 99.9 percent uptime. What type of agreement has Neil’s organization created? A. An MSA B. An NDA C. A MTBF D. An SLA 23. Which of the following best describes a data controller? A. Manages the flow of data between custodians B. Creates and formats data when it is collected or created C. Any system that handles data D. Determines the purpose and methods of processing data Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 24. As part of his role, Augie is responsible for implementation of business rules related to data, as well as for storage, and use of data and datasets. What data-­related role does Augie hold? A. Data owner B. Data custodian C. Data processor D. Data subject 25. Which of the following penalties is most typically imposed on a country rather than on a company? A. Fines B. Loss of license C. Sanctions D. Mandatory reporting 26. Which of the following is not a commonly used term to describe risk appetite? A. Intentional B. Neutral C. Expansionary D. Conservative 27. What does a data steward do? A. Create data. B. Carry out data use and security policies. C. Explain compliance requirements for data. D. Oversee data throughout its life cycle. 28. Marcus determines what organizationally owned data is used for a given purpose and how it is processed. What data role does he have in his organization? A. He is a data controller. B. He is a supervisory authority. C. He is a data protection officer. D. He is a data processor. 29. Colleen’s organization has deployed web application firewalls (WAFs) to protect their web services from being impacted by a known SQL injection attack. What risk management strategy has the organization adopted? A. Transfer B. Accept C. Avoid D. Mitigate Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 30. Requiring all web traffic to be sent via HTTPS is an example of what type of standard? A. Access control B. Encryption C. Password D. Physical security 31. Why are cloud IaaS vendors unlikely to agree to including a right-­to-­audit clause in their contracts? A. The risk to their other customers is too great. B. The cost of the assessment is too high. C. They may not pass the audit. D. They have competing regulatory requirements. 32. Chuck’s organization requires that user accounts only be able to log in during the staff member’s working hours. What type of standard would drive a setting like this? A. Access control B. Encryption C. Password D. Physical security 33. Frankie wants to establish her organization’s encryption standard. Which of the following should she recommend for a default encryption algorithm for general use if cryptographic strength is a critical feature? A. AES-­128 B. SHA-­1 C. AES-­256 D. SHA-­2 34. Jill’s organization has selected Agile with a CI/CD process for their organization. What type of policy would document this selection? A. Business continuity B. Disaster recovery C. Incident response D. Software development life cycle 35. Megan’s organization wants to create a change management policy. Which of the following is not a typical change type found in a change policy? A. Preauthorized changes B. Emergency changes C. Legislated changes D. Standard changes Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 36. Liz wants to assess the critical functions of her business and ensure that the systems that are part of those functions are assessed to determine how often they are likely to fail, how long it would take to restore them, and what recovery objectives will be. What process should she engage in? A. A quantitative risk assessment B. A business impact analysis C. A qualitative risk assessment D. A penetration test 37. What describes the key difference between policies and standards? A. Policies are defined by third parties; standards are defined by organizations. B. Policies are defined by organizations; standards are defined by third parties. C. Policies are a statement of intent; standards define how rules help enforce policy. D. Policies are legally enforceable; standards are optional. 38. Sophie wants to ensure that her vendor meets their SLA. What does Sophie need to do? A. Ensure performance targets are defined in the contract with appropriate penalties. B. Establish key performance indicators (KPIs) for her team and assess them regularly. C. Ensure that security levels are not reduced when performing maintenance. D. Determine if supply chain levels are met in order to meet demand. 39. Tuan is assessing risk and knows that he needs to be able to explain risk to his management. What two factors are combined to describe risk? A. Impact and acceptance B. Likelihood and ALE C. Probability and impact D. Probability and SLE 40. Marco wants to conduct active reconnaissance of a target for a penetration test. Which of the following is an appropriate action based on this desire? A. Looking up information in Shodan B. Conducting a nmap scan C. Querying local DNS for the organization D. Using public records to gather information 41. Beth is a data owner in her company. Which of the following is not a typical part of the role of data owner? A. They categorize data. B. They are responsible for processing data. C. They are responsible for protecting data. D. They are responsible for data quality. Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 42. NIST SP 800-­63B, Digital Identity Guidelines, provides advice on passwords and password standards. Why does the guide recommend that knowledge-­based authentication like “What was your mother’s maiden name?” not be used for processes like password reset and recovery? A. Users may not remember the answer. B. Knowledge-­based authentication information is often easily discovered through searches and social media. C. Knowledge-­based authentication information is not a valid factor for MFA. D. Attackers can easily recover knowledge-­based information from compromised authentication stores. 43. The company that Leon works for has experienced a significant malware infection and has segmented their network to prevent further spread. What risk mitigation strategy have they chosen? A. Avoid B. Transfer C. Accept D. Mitigate 44. Not using hints, preventing password expiration, storing passwords only in a hashed and salted form, and using minimum password length settings are all examples of what? A. Password standards B. Multifactor authentication C. Establishing knowledge-­based passwords D. Biometrics 45. Anastasia works for a government entity that requires very strong risk controls and that has significant regulatory requirements it must meet. What risk appetite model should she expect her organization to adopt? A. Expansionary B. Conservative C. Authoritarian D. Legislative 46. Jack recently joined his organization’s security team. A system was identified as likely being impacted by ransomware, and Jack was given a document that described the organization’s ransomware handling practices. What common security document has he been given? A. The IR policy B. A ransomware cookbook C. A ransomware playbook D. A disaster recovery handbook Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 47. Connie wants to explain the consequences of noncompliance with data regulations to her organization’s management. Which of the following is the most common statutory consequence of noncompliance with regulations? A. Data breaches B. Reputational damage C. Contractual impacts D. Fines 48. Hank wants to create a playbook for his incident response process. What will he create? A. A detailed process for incident response B. A legal document describing incident response C. A high-­level statement of purpose for incident response D. A document describing the general incident response (IR) process 49. What type of agreement is used by organizations that want to protect their proprietary data while working with third parties or individuals who will have access to the data? A. SLAs B. NDAs C. MSAs D. BPAs 50. Oliver has joined an organization and has completed employee orientation, has received his username and password, and has reviewed the new employee security training. What process has he participated in? A. Identity proofing B. Mandatory access control C. Onboarding D. Biometric enrollment 51. What GDPR provision allows individuals to ask organization to delete their personal data? A. The right to be forgotten B. The right to deletion C. The right to privacy D. The right to ownership 52. Damian has provided a comprehensive risk register to his management, including a risk of employees violating policy by taking pictures of sensitive information displayed on their screens using their cell phones. Damian’s recommendation was to ban employees from carrying personal cell phones inside the office, but management has overruled that recommendation and will allow phones. What risk management strategy has his organization’s leadership chosen? A. Transfer B. Accept C. Avoid D. Mitigate Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 53. Which of the following is not a typical part of an offboarding process? A. Returning company equipment B. Copying files to a USB drive for the departing employee C. Disabling or removing accounts D. Changing passwords on shared accounts 54. Daryl wants to ensure that his organization balances risks and its goals. What risk appetite model should he suggest the organization adopts? A. Conservative B. Expansionary C. Reactionary D. Neutral 55. Charlene is preparing to conduct a penetration test and has been provided with access to all of her organization’s information about the systems, services, and configurations involved. What type of penetration test is she conducting? A. A partially known environment test B. An unknown environment test C. A known environment test D. A third-­party test 56. The company that Omar works for wants to co-­develop a mobile application with a third-­ party company. What type of agreement should they both sign as part of this? A. An SLA B. An NDA C. An MSA D. A BPA 57. Alex wants to hire a penetration tester who will simulate an attacker’s potential attacks against his environment. What type of test best fits this model? A. A partially known environment test B. An unknown environment test C. A known environment test D. A third-­party test 58. What term describes the possibility of a risk occurring? A. Impact B. Likelihood C. Potential D. Rate of occurrence Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 59. Killian’s organization wants to perform a penetration test that will provide the maximum amount of information about his organization and that will optimize penetration testers’ time. What type of test should he have conducted? A. A partially known environment test B. An unknown environment test C. A known environment test D. A third-­party test 60. Justin’s organization has recently undergone a third-­party audit that determined that their data-­handling processes don’t comply with the GDPR. Changes to become compliant will take almost a year due to existing systems and software. What risk management strategy is Justin’s organization choosing if they continue to operate knowing they are noncompliant? A. Transfer B. Exception C. Avoidance D. Mitigate 61. Risk assessments required for regulatory compliance are most frequently conducted in which of the following modes? A. As ad hoc risk assessments B. As one-­time risk assessments C. As recurring risk assessments D. As continuous risk assessments 62. Jack’s organization has engaged penetration testers for their annual penetration test. As part of the contract, the testers are provided with a list of target systems, operating systems, and software that they will be testing. What type of penetration test is Jack’s organization conducting? A. A partially known environment test B. An unknown environment test C. A known environment test D. A third-­party test 63. The company that Jim works for is willing to accept significant risk in order to expand. How should Jim describe the organization’s risk appetite? A. Conservative B. Expansionary C. Limited D. Neutral Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 64. As part of the early stages of a penetration test, Hui has researched her target organization’s domain names and IP addresses, and has conducted a port scan. What type of activity is Hui engaging in? A. Reconnaissance B. An unknown environment test C. A known environment test D. OSINT gathering 65. What role does a person who has exercised the GDPR’s right to be forgotten hold? A. Data subject B. Data controller C. Data processor D. Data owner 66. How is exposure factor (EF) expressed for risk calculations? A. As a calculation of the ALE multiplied by the ARO B. As the likelihood of loss C. As a potential percentage of loss D. As a calculation of the SLE multiplied by the ARO 67. As part of his penetration testing process Nick intends to follow an employee of his target company into a secured area. What type of penetration testing is Nick engaged in? A. Defensive B. Offensive C. Physical D. Integrated 68. Valerie’s organization wants to ensure that their access control vestibule, ID card system, and guards are effective in stopping unwanted entrance. What type of penetration test should she use to validate this? A. Physical B. Offensive C. Defensive D. Integrated 69. Jason’s organization has engaged a penetration testing firm that specializes in using techniques commonly employed by nation-­state actors, including using social engineering techniques, advanced tools, and methods that will provide significant footholds within his infrastructure. What type of penetration test best describes this? A. Physical B. Offensive C. Defensive D. Integrated Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 70. Joshua’s organization is required to comply with the EU’s GDPR. As part of their annual assessments, they conduct a GDPR compliance review and receive a report from their auditors. What type of assessment is this? A. A penetration test B. A regulatory assessment C. An internal audit D. An attestation-­based assessment 71. Alexandria wants to mitigate the risk of ransomware during its initial infection stages. Which of the following strategies should she employ? A. Deploy an EDR tool. B. Purchase cybersecurity insurance. C. Use secure, ransomware-­resistant backups. D. Continue to operate as usual. 72. Shane’s organization has determined that they can accept up to $10,000,000 a year in risk-­ related loss in support of their strategic plans. What term best describes this? A. Risk acceptance B. Risk appetite C. Ad hoc risk D. A conservative risk tolerance 73. Eric manages his organization’s internal security team and wants to leverage a penetration test as part of his team’s testing that allows them to respond to simulated attacks. What type of model best describes this? A. Physical B. Offensive C. Defensive D. Integrated 74. Henry’s organization leverages penetration testing as part of its ongoing security practices, using attacker techniques as well as blue teaming to improve security constantly. What type of penetration testing methodology is Henry’s organization using? A. Physical B. Offensive C. Defensive D. Integrated 75. Jackie is an auditor and has completed an SOC 2, Type 2 audit. Her firm then provides a statement about the organization’s audit results and posture. What is this process known as? A. Penetration testing B. Audit sign-­off C. Regulatory defense D. Attestation Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 76. Joe is an auditor who is on the staff of an organization that employs him to audit their own practices. What type of audit does Joe perform? A. Internal B. Regulatory C. External D. Compliance 77. Irene’s organization needs to follow PCI DSS standards. If she engages a third party to assess this, what type of audit is she having performed? A. An internal regulatory audit B. An external regulatory audit C. An internal compliance audit D. An external compliance audit 78. Anton’s organization processes credit cards but is a small organization. As part of their annual requirements related to PCI DSS, Anton fills out a form about their PCI DSS compliance and submits it to their acquiring bank. What type of assessment has his organization conducted? A. An internal regulatory audit B. A self-­assessment C. An independent, third-­party audit D. An external compliance audit 79. What organization typically includes an audit committee for a company? A. The security office B. The shareholders C. The board of directors D. The third-­party assessors 80. What type of risk assessment process is most commonly associated with a CI/CD pipeline model? A. Ad hoc risk assessments B. One-­time risk assessments C. Third-­party risk assessments D. Continuous risk assessments 81. Cristobal wants to ensure that a vendor his company is considering hiring has conducted an SOC 2, Type 2 audit that is reliable and that will reveal any critical issues. What should he ensure was done? A. An internal audit with attestation by the CEO B. An independent, third-­party audit C. A self-­assessment D. A third-­party penetration test with attestation Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 82. Kim’s organization has assessed the risk of floods that may impact their datacenter and has determined that the likely rate of occurrence and its cost if it does occur are not acceptable. Given this, the organization has opted to move their datacenter in the next year. What has occurred? A. The risk dropped below their risk threshold. B. The risk assessment failed. C. A control failure occurred. D. The risk passed their risk threshold. 83. Vanessa’s organization is a US-­based health-­care organization that is required to be compliant with HIPAA. What type of external assessment should they conduct? A. Regulatory B. Offensive C. Known environment D. Physical 84. Jaime wants to establish her organization’s change management policy. What should the policy include? A. High-­level descriptions of how the organization will review, approve, and implement proposed changes B. A detailed process for review and approval of changes C. Descriptions of how a change request should be created, formatted, reviewed, and approved D. An outline of the regulatory requirements for changes 85. Marek’s organization has a system that needs to receive a deviation from a defined security process. What best practice should he follow to ensure that this is done correctly? A. He should conduct a risk assessment and document the results. B. He should remove the system from the network segment to protect it. C. He should ensure the deviation is approved through change management processes. D. All of the above. 86. What is the key difference between a business continuity plan and a business continuity policy? A. The plan describes how an organization will respond, whereas the policy outlines the high-­level intent of the organization’s business continuity efforts. B. The plan includes detailed steps for each part of the response, including how to restore systems and investigate issues, whereas the policy outlines the high-­level intent of the organization’s business continuity efforts. C. The plan describes the high-­level intent of the organization’s business continuity efforts, whereas the incident response policy describes how the organization will respond. D. They are the same; the terms are interchangeable. Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 87. Christina has prepared a document that includes high-­level statements about how her organization will handle major incidents and what its overall stance on incidents is. What has she created? A. An incident response process B. A runbook C. An incident response policy D. An incident response standard 88. Terry wants to have all of his account data removed from organizations he has interacted with. What GDPR right can he leverage if he is an EU citizen? A. Data stewardship B. Personal data ownership C. The right to be forgotten D. His HIPAA rights 89. Probability and impact are used to rate what key security item? A. Cost B. Risk C. Vulnerability D. Audit findings 90. Gary wants to determine the probability of a risk occurring. What should he base his assessment on if he is performing a qualitative risk assessment? A. A calculated rate of occurrence using industry statistical data B. A rating from an experienced team of staff C. The number of times it has happened to their competitors in a year D. Actuarial tables provided by his insurance broker 91. Which of the following is not a common element for a penetration test’s rules of engagement? A. Handling of sensitive and pentest-­related data B. A list of passwords C. A list of in-­scope IPs or domains D. A list of emergency contacts 92. Maeve is preparing to sign a penetration testing contract with a third-­party security service provider. The security service provider provides a questionnaire that asks the scope of systems that can and cannot be tested, the schedule and times that penetration testing can and cannot occur, and what to do if a preexisting compromise is discovered. What document is the third-­party service provider assembling? A. A right-­to-­audit clause B. A service-­level agreement C. A memorandum of understanding D. Rules of engagement Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 93. Alaina wants to describe the level of impact and probability where her organization will either accept or attempt to mitigate or otherwise handle a risk at. What term describes this? A. Risk threshold B. Ad hoc risk level C. Third-­party risk level D. Risk appetite 94. Alaina has been asked to create an AUP for her organization. Which of the following should she include? A. An access and usage policy that lists times and roles allowed to access specific resources B. A document that describes how the organization intends to approach change and related functions C. An antivirus (AV) update policy that describes when and how AV updates are deployed D. A description of acceptable use by organizational users 95. Kyle’s organization is a very well-­known, multinational organization. A recent data breach has exposed data for millions of customers, including all of their account information. As part of the breach, Kyle’s company was discovered to have not followed common security practices, and in fact was operating in intentionally careless ways. Which of the following consequences should he highlight as most critical to the organization’s ongoing operations when he considers their customer base? A. Fines B. Due diligence C. Reputational damage D. Contractual impacts 96. What type of agreement do organizations create after signing an MSA that describes the specific tasks or deliverables that will be created or performed? A. A MOU B. A SOW C. A punch list D. A BPA 97. Jack’s organization recently received a shipment of SSDs and has begun to deploy them. What information would best help Jack assess the useful life of the devices? A. An RTO B. An MTTR C. An RPO D. An MTBF Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 98. The hard drives that Jason’s organization recently purchased have an MTBF of 300,000 hours. When can Jason expect the first drive to fail? A. At 150,000 hours B. At 300,000 hours C. At 450,000 hours D. None of the above 99. Melissa’s organization wants to establish a metric that defines how much data could be lost if an issue occurs. What should they set? A. An RTO B. An MTTR C. An RPO D. An MTBF 100. What common terms are used to categorize anomalous behavior? A. Risky, unexpected, and unintentional B. Recurring, occasional, and unique C. Unintentional, insider, and accidental D. Active, passive, and integrated 101. Greg is reviewing a server and notices that it is both running outdated software and that the organization heavily relies on the services that it provides. He pulls together a team to determine what the risk of operating the server is and what issues would occur if it were removed from service that day. What type of assessment has he conducted? A. An ad hoc risk assessment B. A one-­time risk assessment C. A third-­party risk assessment D. A continuous risk assessment 102. Olivia’s organization operates servers in a datacenter that support customers across the country. As Olivia is determining her service level agreements, what information is most important in determining how quickly a server can be restored to operation if its motherboard fails? A. An RTO B. An MTTR C. An RPO D. An MTBF 103. Irina’s organization wants to work with one of their vendors and wishes to establish an ongoing relationship with them. What type of agreement should they create between the Chapter 5 ■ Domain 5.0: Security Program Management and Oversight organizations so that they can create SOWs as they determine what services they need from their service provider’s organization? A. An MOU B. An SLA C. An MSA D. A BPA 104. Dani’s organization relies on journaling to help protect transactions that occur through its database. Which of the following does journaling impact the most? A. An RTO B. An MTTR C. An RPO D. An MTBF 105. Henry’s organization has set their RTO to 12 hours. What does this mean? A. Outages must be less than 6 hours long. B. Recovery from outages should take less than 12 hours. C. Outages longer than 12 hours will require fail over to a warm site. D. SLAs for third-­party services should specify a 12 hour MTBF. 106. Valerie knows that her organization’s datacenter power infrastructure has an MTTR of 24 hours. What should she do if there is a critical component failure in her power infrastructure, and the organization has a warm site with an activation of 12 hours and needs to be back online as soon as possible? A. Wait to see if the recovery can be done in less than 24 hours. B. Immediately begin a move to the warm site. C. Wait to see if the recovery can be done in less than12 hours. D. Wait for 12 hours, then begin the move to the warm site. 107. Peter’s risk assessment process includes calculations of single loss expectancy, the annualized rate of occurrence of risks, and the annualized loss expectancy. What type of risk assessment is Peter conducting? A. Quantitative B. Calculated C. Qualitative D. Registered 108. What organizational document is used to enumerate and rate an organization’s risks? A. A risk appetite plan B. A risk register C. A quantitative register D. A qualitative assessment report Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 109. Amanda’s organization wants to conduct a risk assessment and needs to prioritize a timely completion of the process over rigorous detail. What type of assessment should she advise her organization to select? A. Internal B. External C. Qualitative D. Quantitative 110. Chuck wants to conduct a quantitative risk assessment. Which of the following will he need to be able to determine the single loss expectancy for a server? A. Its purchase date B. Which department manages the server C. The operating system the server uses D. The cost of the server 111. Shawna’s organization has undertaken reasonable steps to meet their compliance requirements for data handling. What is this process or effort called? A. Data stewardship B. Due diligence C. Attestation D. Data sanctioning 112. Jeremy knows that his customer data is worth $500,000, and that the value of the data would be reduced by 25 percent if it was exposed. What is the SLE for this data? A. $25,000 B. $125,000 C. $250,000 D. $375,000 113. Ian wants to calculate the annualized loss expectancy for an asset. What two values does he need to know? A. SLE and ARO B. ARO and MTBF C. SLE and RPO D. MTBF and RTO 114. Waylon is charged with ensuring that risks related to customer data used as part of his organization’s primary application are managed appropriately. What is his role? A. Board member B. Data processor C. Auditor D. Risk owner Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 115. Nathaniel’s organization is reviewing potential issues that may result from noncompliance with regulations that apply to his company. Which of the following would create the most significant operational harm? A. Reputational damage B. Loss of license C. Fines D. Contractual impacts 116. Susan wants to calculate the annualized loss expectancy for an asset that has a value of $50,000, an exposure factor of 50 percent, and an annual rate of occurrence of 2. What is the annualized loss expectancy for the asset? A. $5,000 B. $25,000 C. $50,000 D. $100,000 117. Tim’s organization knows that a major breach occurs once every four years, resulting in a loss of $250,000 for his organization. What is the annual rate of occurrence that Tim should use in his risk calculations? A. .25 B. $75,000 C. .75 D. $50,000 118. Charlene wants to calculate the annualized loss expectancy for a risk event. What two factors does she need to know to calculate the ALE for a risk? A. ARO and TCO B. SLE and RPO C. TCO and RPO D. ARO and SLE 119. John is conducting a penetration test of a client’s network. He is currently gathering information from sources such as archive.org, netcraft.com, social media, and information websites. What best describes this stage? A. Active reconnaissance B. Passive reconnaissance C. Initial exploitation D. Pivot 120. Juan is responsible for incident response at a large financial institution. He discovers that the company Wi-­Fi has been breached. The attacker used the same login credentials that ship with the wireless access point (WAP). The attacker was able to use those credentials Chapter 5 ■ Domain 5.0: Security Program Management and Oversight to access the WAP administrative console and make changes. Which of the following best describes the lack of standards or procedures that caused this vulnerability to exist? A. Improperly configured accounts B. Untrained users C. Using default settings D. Failure to patch systems 121. What is the primary difference between active and passive reconnaissance? A. Active will be done manually, passive with tools. B. Active is done with unknown environment tests and passive with known environment tests. C. Active is usually done by attackers and passive by testers. D. Active will actually connect to the network and could be detected; passive won’t. 122. The type and scope of testing, client contact details, how sensitive data will be handled, and the type and frequency of status meetings and reports are all common elements of what artifact of a penetration test? A. The unknown environment (black-­box) outline B. The rules of engagement C. The known environment (white-­box) outline D. The close-­out report 123. Charlene has been asked to write a business continuity (BC) plan for her organization. Which of the following will a BC plan best handle? A. How to respond during a person-­made disaster B. How to keep the organization running during a system outage C. How to respond during a natural disaster D. All of the above 124. Alaina’s company is considering signing a contract with a cloud service provider and wants to determine how secure their services are. Which of the following is a method she is likely to be able to use to assess it? A. Ask for permission to vulnerability scan the vendor’s production service. B. Conduct an audit of the organization. C. Review an existing SOC audit. D. Hire a third party to audit the organization. 125. Gurvinder’s corporate datacenter is located in an area that FEMA has identified as being part of a 100-­year flood plain. He knows that there is a chance in any given year that his datacenter could be completely flooded and underwater, and he wants to ensure that his organization knows what to do if that happens. What type of plan should he write? A. A continuity of operations plan B. A business continuity plan C. A flood insurance plan D. A disaster recovery plan Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 126. Which of the following environments is least likely to allow a right-­to-­audit clause in a contract? A. A datacenter co-­location facility in your state B. A rented facility for a corporate headquarters C. A cloud server provider D. A datacenter co-­location facility in the same country but not the same state 127. Ben writes down the checklist of steps that his organization will perform in the event of a cryptographic malware infection. What type of response document has he created? A. A playbook B. A DR plan C. A BC plan D. A runbook 128. Caroline has been asked to find an international standard to guide her company’s choices in implementing information security management systems. Which of the following would be the best choice for her? A. ISO 27002 B. ISO 27701 C. NIST 800-­12 D. NIST 800-­53 129. Which of the following principles stipulates that multiple changes to a computer system should not be made at the same time? A. Due diligence B. Acceptable use C. Change management D. Due care 130. You are a security engineer and discovered an employee using the company’s computer systems to operate their small business. The employee installed their personal software on the company’s computer and is using the computer hardware, such as the USB port. What policy would you recommend the company implement to prevent any risk of the company’s data and network being compromised? A. Acceptable use policy B. Clean desk policy C. Mandatory vacation policy D. Job rotation policy 131. What standard is used for credit card security? A. GDPR B. COPPA C. PCI DSS D. CIS Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 132. Which of the following techniques attempts to predict the likelihood a threat will occur and assigns monetary values should a loss occur? A. Change management B. Vulnerability assessment C. Qualitative risk assessment D. Quantitative risk assessment 133. Which of the following agreements is less formal than a traditional contract but still has a certain level of importance to all parties involved? A. SLA B. BPA C. ISA D. MOU 134. You have an asset that is valued at $16,000, the exposure factor of a risk affecting that asset is 35 percent, and the annualized rate of occurrence is 75 percent. What is the SLE? A. $5,600 B. $5,000 C. $4,200 D. $3,000 135. You are a security administrator for your company and you identify a security risk. You decide to continue with the current security plan. However, you develop a contingency plan in case the security risk occurs. Which of the following type of risk response technique are you demonstrating? A. Accept B. Transfer C. Avoid D. Mitigate 136. Which of the following is not a common security policy type? A. Acceptable use policy B. Business continuity C. Incident response D. Parking policy 137. Your security manager wants to decide which risks to mitigate based on cost. What is this an example of? A. Quantitative risk assessment B. Qualitative risk assessment C. Business impact analysis D. Threat assessment Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 138. Your company has outsourced its proprietary processes to Acme Corporation. Due to technical issues, Acme wants to include a third-­party vendor to help resolve the technical issues. Which of the following must Acme consider before sending data to the third party? A. This data should be encrypted before it is sent to the third-­party vendor. B. This may constitute unauthorized data sharing. C. This may violate the privileged user role-­based awareness training. D. This may violate a nondisclosure agreement. 139. Which of the following is typically included in a BPA? A. Clear statements detailing the expectation between a customer and a service provider B. The agreement that a specific function or service will be delivered at the agreed-­on level of performance C. Sharing of profits and losses and the addition or removal of a partner D. Security requirements associated with interconnecting IT systems 140. A security administrator is reviewing the company’s continuity plan, and it specifies an RTO of four hours and an RPO of one day. Which of the following is the plan describing? A. Systems should be restored within one day and should remain operational for at least four hours. B. Systems should be restored within four hours and no later than one day after the incident. C. Systems should be restored within one day and lose, at most, four hours’ worth of data. D. Systems should be restored within four hours with a loss of one day’s worth of data at most. 141. Which of the following statements is true regarding a data retention policy? A. Regulations require financial transactions to be stored for seven years. B. Employees must remove and lock up all sensitive and confidential documents when not in use. C. It describes a formal process of managing configuration changes made to a network. D. It is a legal document that describes a mutual agreement between parties. 142. How do you calculate the annual loss expectancy (ALE) that may occur due to a threat? A. Exposure factor (EF) / single loss expectancy (SLE) B. Single loss expectancy (SLE) × annual rate of occurrence (ARO) C. Asset value (AV) × exposure factor (EF) D. Single loss expectancy (SLE) / exposure factor (EF) 143. You are a security administrator for your company and you identify a security risk that you do not have in-­house skills to address. You decide to acquire contract resources. Chapter 5 ■ Domain 5.0: Security Program Management and Oversight The contractor will be responsible for handling and managing this security risk. Which of the following type of risk response techniques are you demonstrating? A. Accept B. Mitigate C. Transfer D. Avoid 144. You are a server administrator for your company’s private cloud. To provide service to employees, you are instructed to use reliable hard disks in the server to host a virtual environment. Which of the following best describes the reliability of hard drives? A. MTTR B. RPO C. MTBF D. ALE 145. Which of the following best describes a key challenge of quantitative risk analysis compared to qualitative risk analysis? A. Quantitative risk analysis requires detailed financial data. B. Quantitative risk analysis is sometimes subjective. C. Quantitative risk analysis requires expertise on systems and infrastructure. D. Quantitative risk provides clear answers to risk-­based questions. 146. Categorizing residual risk is most important to which of the following risk response techniques? A. Risk mitigation B. Risk acceptance C. Risk avoidance D. Risk transfer 147. You are the IT manager and one of your employees asks who assigns data labels. Which of the following assigns data labels? A. Owner B. Custodian C. Privacy officer D. System administrator 148. A security analyst is analyzing the cost the company could incur if the customer database was breached. The database contains 2,500 records with personally identifiable information (PII). Studies show the cost per record would be $300. The likelihood that the database would be breached in the next year is only 5 percent. Which of the following would be the ALE for a security breach? A. $15,000 B. $37,500 C. $150,000 D. $750,000 Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 149. Which of the following concepts defines a company goal for system restoration and acceptable data loss? A. MTBF B. MTTR C. RPO D. ARO 150. You are a network administrator and have been given the duty of creating user accounts for new employees the company has hired. These employees are added to the identity and access management (IAM) system and assigned mobile devices. What process are you performing? A. Offboarding B. System owner C. Onboarding D. Executive user 151. Visa’s published documentation for “What to Do if Compromised” includes requirements to notify Visa within 3 days of an incident, to provide notice to other relevant parties, and to conduct forensic investigations while preserving evidence. What type of document is this? A. A policy B. A playbook C. A checklist D. A procedure 152. An organization’s information security policy framework typically contains what four types of documents? A. A risk register, an audit report, a vulnerability scan, and a pentest report B. Policies, standards, procedures, and guidelines C. Laws, policies, standards, and practices D. Policies, practices, procedures, and playbooks 153. Which of the following terms is used to measure how maintainable a system or device is? A. MTBF B. MTTF C. MTTR D. MITM 154. Helen’s organization provides telephone support for their entire customer base as a critical business function. She has created a plan that will ensure that her organization’s Voice over IP (VoIP) phones will be restored in the event of a tornado. What type of plan has she created? A. A disaster recovery plan B. An RPO plan C. An incident response plan D. An MTBF plan Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 155. Greg has data that is classified as health information that his organization uses as part of their company’s HR data. Which of the following statements is true for his company’s security policy? A. The health information must be encrypted. B. Greg should review relevant law to ensure the health information is handled properly. C. Companies are prohibited from storing health information and must outsource to third parties. D. All of the above. 156. What type of impact is an individual most likely to experience if a data breach that includes PII occurs? A. IP theft B. Reputation damage C. Fines D. Identity theft 157. Isaac has been asked to write his organization’s access control standards. What policy is commonly put in place for service accounts? A. They must be issued only to system administrators. B. They must use multifactor authentication. C. They cannot use interactive logins. D. All of the above. 158. Emma is reviewing third-­party risks to her organization, and Nate, her organization’s procurement officer, notes that purchases of some laptops from the company’s hardware vendor have been delayed due to lack of availability of SSDs (solid-­state drives) and specific CPUs (central processing units) for specific configurations. What type of risk should Emma describe this as? A. Financial risk B. A lack of vendor support C. System integration D. Supply chain 159. Patching systems immediately after patches are released is an example of what risk management strategy? A. Acceptance B. Avoidance C. Mitigation D. Transference Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 160. What key element of regulations, like the European Union’s GDPR, drive organizations to include them in their overall assessment of risk posture? A. Potential fines B. Their annual loss expectancy (ALE) C. Their recovery time objective (RTO) D. The likelihood of occurrence 161. What phases of handling a disaster are covered by a disaster recovery plan? A. What to do before the disaster B. What to do during the disaster C. What to do after the disaster D. All of the above 162. Naomi’s organization has recently experienced a breach of credit card information. After investigation, it is discovered that her organization was inadvertently not fully compliant with PCI DSS and is not currently fully compliant. Which of the following penalties is her organization most likely to incur? A. Criminal charges B. Fines C. Termination of the credit card processing agreement D. All of the above 163. What law or regulation requires a DPO in organizations? A. FISMA B. COPPA C. PCI DSS D. GDPR 164. Your company is considering moving its mail server to a hosting company. This will help reduce hardware and server administrator costs at the local site. Which of the following documents would formally state the reliability and recourse if the reliability is not met? A. MOU B. SLA C. ISA D. BPA 165. Risk severity is calculated using the equation shown here. What information should be substituted for X? Risk severity = X * Impact A. Inherent risk B. MTTR (mean time to repair) C. Likelihood of occurrence D. RTO (recovery time objective) Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 166. How is asset value determined? A. The original cost of the item B. The depreciated cost of the item C. The cost to replace the item D. Any of the above based on organizational preference 167. What process is used to help identify critical systems? A. A BIA B. An MTBF C. An RTO D. An ICD 168. Zarmeena wants to transfer the risk for breaches to another organization. Which of the following options should she use to transfer the risk? A. Explain to her management that breaches will occur. B. Blame future breaches on competitors. C. Sell her organization’s data to another organization. D. Purchase cybersecurity insurance. 169. The financial cost of a breach is an example of what component of risk calculations? A. Probability B. Risk severity C. Impact D. All of the above 170. Joanna’s penetration test target is an unknown environment that is isolated from the Internet and requires VPN access. What type of testing will she need to do to gather vulnerability information from systems? A. Passive reconnaissance B. OSINT reconnaissance C. Active reconnaissance D. Known environment reconnaissance 171. Olivia’s cloud service provider claims to provide zero data loss from storage, and Olivia’s company wants to take advantage of that service because loss of data would be extremely costly for the business. What business agreement can Oliva put in place to help ensure that the reliability that the vendor advertises is maintained? A. An MOU B. An SLA C. An MSA D. A BPA Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 172. How is SLE calculated? A. AV * EF B. RTO * AV C. MTTR * EF D. AV * ARO 173. Wayne has estimated the ARO for a risk in his organization to be 3. How often does Wayne think the event will happen? A. Once every 3 months B. Three times a year C. Once every three years D. Once a year for three years 174. Elle works for a credit card company that handles credit card transactions for businesses around the world. What data privacy role does her company play? A. A data controller B. A data steward C. A data custodian D. A data processor 175. Nicole determines how her organization processes data that it collects about its customers and also decides how and why personal information should be processed. What role does Nicole play in her organization? A. Data steward B. Data custodian C. Data controller D. Data consumer 176. Kirk’s organization has been experiencing large-­scale denial-­of-­service (DoS) attacks against their primary website. Kirk contracts with his Internet service provider to increase the organization’s bandwidth and expands the server pool for the website to handle significantly more traffic than any of the previous DoS attacks. What type of risk management strategy has he employed? A. Acceptance B. Avoidance C. Transfer D. Mitigation 177. After Angela left her last organization, she discovered that she still had access to her shared drives and could log in to her email account. What critical process was likely forgotten when she left? A. An exit interview B. Job rotation C. Offboarding D. Governance Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 178. Kelly’s organization has created an incident response policy that outlines the high-­level goals of the IR process. Next, she wants to create detailed documents that describe the steps to handle specific incident types like denial-­of-­service attacks. What document should she create? A. Standards B. Playbooks C. Regulations D. Guidelines 179. Mohammed wants to show his organization’s senior leadership the impact of their risk management process over time. What risk reporting method effectively conveys this in an easily digestible visual format for senior leadership? A. Ad hoc reports B. Risk registers C. Risk trend analysis D. Risk event reports 180. Presenting certification that a third-­party organization has validated a vendor’s practices against ISO 27001 is an example of what practice? A. Internal audit B. Vendor assessment C. Vulnerability scanning D. Data inventory 181. What common limitation do IaaS vendors place on penetration testing by their customers? A. It can only be done by third parties. B. It must be prescheduled. C. It can only be done by the customers themselves. D. Notification must be sent immediately after it occurs. 182. Chandra is providing guidance on recognizing phishing campaigns. Which of these is not a common way to recognize phishing emails? A. It creates a false sense of urgency. B. The IP address of the recipient. C. The attachment is encrypted and password protected. D. The email claims that there is a problem with your password. 183. Juan’s company trains users to be cautious about revealing information about security controls, practices, configurations, and even the tools and software the company deploys. What is this practice known as? A. Awareness training B. Social engineering C. An insider threat D. Operational security Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 184. Mark’s organization operates in the EU and sells products in multiple countries. It wants to determine its compliance requirements based on regulations that will impact it. Which of the following regions should it focus its review of legal implication on? A. Local B. National C. Global D. All of the above 185. What occurs when a vendor has a competing interest that could influence their behavior in a way that is not aligned with the best interests of one of their customers? A. An insider threat B. A MOU violation C. A conflict of interest D. A SOW violation 186. Selma’s organization allows individual business units to manage their cybersecurity needs and practices as they see fit. What type of governance structure have they adopted? A. Centralized B. Board-­based C. Committee-­based D. Decentralized 187. The US Treasury Department regulates banks and their behaviors, including security-­related regulations. What term best describes this type of governance structure? A. Government entity–based B. Shareholder driven C. Board-­based D. Centralized 188. The company that Sandra wants to work with does not provide third-­party audit statements. If Sandra wants to engage with them, what should she request as part of her vendor assessment process prior to signing a contract in order to have the most useful data available? A. A right-­to-­audit clause B. A supply chain analysis C. Evidence of internal audits D. A due diligence statement 189. Leigh wants to provide new users with information about her organization’s security goals and high-­level practices. What do organizations typically provide to accomplish this? A. Audit reports B. Policy handbooks C. Runbooks D. User awareness training Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 190. Jodi wants to prepare her staff to defend against social engineering. What should she invest in to help her staff address this threat? A. EDR tools B. Awareness training C. A NGFW D. Security policies 191. How do audits and examinations differ? A. An examination is simpler and less costly. B. Audits are external and examinations are internal. C. Audits are internal and examinations are external. D. An audit is simpler and less costly. 192. Evangeline wants to develop a security training program. What should she do first? A. Determine how the training will be presented. B. Establish a budget. C. Review regulatory requirements for training. D. Assess the threats and risks the organization faces. 193. Angelo is designing his organization’s security governance groups and has created a committee. Which of the following is not a typical member of internal security governance committees? A. Subject matter experts B. Regulators C. Management D. Internal legal counsel 194. Dana wants to assess regulatory impacts on her organization’s security policy. Which of the following is not a typical regulatory impact she will need to assess? A. Global B. National C. Local D. Corporate 195. Marty wants to ensure that his security policies are up-to-date and effective. Which of the following data sources is least likely to be useful as he reviews his organization’s security policies? A. Security system logs and reports B. Staff feedback C. NDAs D. Review of regulations Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 196. What term describes a formal document that outlines the terms and details of an agreement between two organizations, including the roles and responsibilities each will have? A. A statement of work B. A business partners agreement C. A memorandum of agreement D. A service level agreement 197. Victoria wants to understand a potential vendor’s security practices. Which of the following is the simplest way for her to gather that information from multiple potential vendors? A. Third-­party audits B. Questionnaires C. Penetration testing D. OSINT 198. What two things most frequently drive external compliance reporting? A. Regulatory bodies and contractual obligations B. Internal and external audit C. Contractual requirements and board reporting D. Regulatory bodies and KPIs 199. Blaine wants to ensure that his organization consistently meets PCI DSS requirements. What should he implement to meet this goal? A. Annual PCI DSS internal audits B. Automated compliance monitoring C. Annual PCI DSS external audits D. Compliance KPIs 200. Ujama is reviewing logs and notices that one of his users has repeatedly failed their login process. After calling the user, he discovers that the user had mistyped their password multiple times. What type of anomalous behavior should he classify this as? A. Insider B. Risky C. Unintentional D. Unexpected 201. Common password management practices include which of the following? A. Disabling MFA B. Reusing passwords across multiple sites C. Enabling password hints D. Changing passwords only when necessary Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 202. Mark is responsible for the execution of his organization’s security awareness program. Why might he deploy multiple training methods like workshops, online training, and simulations as part of the training? A. To meet compliance requirements B. To address learning preferences C. To decrease costs for training D. To meet KPIs 203. Natasha wants to establish a vendor monitoring practice for her organization. What should she establish to ensure that her vendor is performing as expected? A. A MOU B. Ongoing compliance audits C. Regulatory requirements D. KPIs 204. Mikayla is working remotely in a public space and has been trained to make sure that others cannot see her screen or keyboard. What term is used to describe this? A. Insider threats B. Situational awareness C. Social engineering D. Unintentional risky behavior 205. What data role is typically the most senior in an organization? A. Data processor B. Data controller C. Data owner D. Data steward 206. Which of the following is not a common hybrid work environment security practice? A. Use of VPNs B. Use of secure Wi-­Fi networks C. Ensuring physical security D. Deploying security cameras 207. Which of the following is not a common driver of external compliance reporting? A. Contracts B. Regulation C. Reputation D. Licensing Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 208. Justin wants to have work done by a contractor with whom his organization has a master services agreement. What should he prepare to fully document the required work? A. A work order B. A service level agreement C. A memorandum of understanding D. A memorandum of agreement 209. What measure is used to describe the average functional lifespan of a device in use? A. An RTO B. An MTTR C. An RPO D. An MTBF 210. Jackie wants to use an ISO standard to help her select and implement information security controls and to develop information security management guidelines. Which ISO standard should she use? A. ISO 27001 B. ISO 27701 C. ISO 27002 D. ISO 31000 211. Establishing requirements like the height of fences is part of what standard for most organizations? A. Physical security B. Access control C. Business continuity D. Onboarding 212. What organization typically elects an organization’s board of directors in a public company? A. The employees B. The CEO C. Shareholders D. All relevant stakeholders 213. Greg wants to classify anomalous behavior he has observed. The behavior involves a user’s workstation sending large volumes of data to an off-­site web server. How should he classify this behavior? A. Risky B. Unexpected C. Unintentional D. An insider threat Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 214. Amber is responsible for compliance with PCI DSS in her organization and wants to ensure that she meets ongoing compliance monitoring requirements. Which of the following options will best help her achieve ongoing compliance? A. Conduct quarterly audits. B. Use compliance monitoring capabilities in scanning and management tools. C. Conduct regular training on compliance requirements. D. Require an auditor’s attestation of compliance. 215. The third-­party auditors that Dion hired for his organization have completed their audit. What action does the audit firm take after management acknowledgment is received from Dion’s company? A. Compliance reports are sent to third parties. B. Regulatory statements are sent to customers. C. Attestation is provided by the auditor. D. Follow-­up vulnerability scans will validate findings. 216. Latisha is conducting a security review and notices that one of her users consistently uses her organization’s VPN from Chile while the employee is based in the United States. After reviewing logs, she notes that the user is sometimes logged in from both the US and the remote location in Chile, and believes that the user may be allowing a third party to access their VPN account to perform some or all of their job tasks. What type of threat most accurately describes this? A. Anomalous B. Insider C. Social engineering D. Nation-­state 217. Marzita wants to respond to a phishing campaign that is sending links to malware to organizations. What effective tactic can she use to react to these campaigns quickly? A. Deploy a WAF to block suspicious links. B. Subscribe to a threat feed and automatically block phishing campaign URLs. C. Manually block phishing URLs as they are reported by users. D. Implement user awareness training. 218. Amanda discovers that a member of her organization’s staff has installed a remote access Trojan on their accounting software server and has been accessing it remotely. What type of threat has she discovered? A. Zero-­day B. Insider threat C. Misconfiguration D. Weak encryption Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 219. Phil recently received an email claiming to be from HR with a link to a list of every employee’s compensation attached. Phil clicks on it without checking the URL because he is curious about the pay that others in his department receive. How would this behavior be classified? A. Risky B. Irresponsible C. Unexpected D. Unintentional 220. What should Ben do if he wants to assess the initial state of his information security awareness? A. Implement security awareness based on a standard like ISO 27001. B. Conduct a baseline analysis to determine his starting state. C. Implement security awareness based on NIST standards. D. Conduct a penetration test to determine how staff respond to security issues. 221. During an incident investigation, Naomi notices that a second keyboard was plugged into a system in a public area of her company’s building. Shortly after that event, the system was infected with malware, resulting in a data breach. What should Naomi look for in her in-­ person investigation? A. A Trojan horse download B. A malicious USB cable or drive C. A worm D. None of the above 222. Jill wants to train her users to appropriately respond to suspicious email messages. Which of the following will provide her organization with the most useful input from users? A. Ask users to report the email to the email provider using a reporting button. B. Ask users to report the email to an internal security team. C. Ask users to delete the email to avoid further issues. D. Ask users to click on the message and links to explore the potential security issue. 223. Marcia wants to assess the effectiveness of her security awareness program. What should she do? A. Establish and monitor awareness KPIs. B. Require a third-­party awareness audit. C. Conduct regular surveys about security awareness. D. Track incident rates versus training participation. 224. Myles wants to describe the impact of noncompliance with regulations on his organization’s business. If his organization is not compliant, what impact is most likely to occur related to his customers? A. Fines B. Contractual impacts C. Loss of license D. Sanctions Chapter 5 ■ Domain 5.0: Security Program Management and Oversight 225. Sabrina wants to train her users on password management best practices. Which of the following options will have the largest impact on her organization’s password security? A. Implementing biometrics authentication factors B. Conducting annual training on password best practices C. Adopting NIST password length and complexity standards D. Requiring staff to use an enterprise password manager 226. Jill wants to explain her organization’s risks to senior management, but she knows that the risk register is lengthy and detailed. What type of document is commonly used to convey the most important high-­level information found in a risk register to senior leaders? A. A risk matrix B. An SLE report C. An ALE report D. A risk KPI list 227. Which of the following best describes guidelines? A. They outline the principles and rules that guide the execution of security efforts throughout the enterprise. B. They provide advice to organizations seeking to comply with the policies and standards. C. They provide mandatory requirements describing how an organization will carry out its information security policies. D. They are detailed, step-­by-­step processes that individuals and organizations must follow in specific circumstances. Chapter 5: Domain 5.0: Security Program Management and Oversight 1. C. This description does not include any risk to availability since there is no information about systems or services being down or offline. This scenario would likely result in reputational, financial, and data loss impacts for Scott’s company. 2. D. KRIs, or key risk indicators, need to be actionable so that the organization can use them to control or manage risk, they need to be measurable so that they can be assessed, and they must be relevant to the risks that they measure. They don’t necessarily have to be inexpensive, as organizations may make choices about costs based on their risks and business models. 3. A. A recovery time objective (RTO) is set by organizations to describe how long restoring systems or services to normal function after a disruption can take. Mean time to repair (MTTR) is the average time it takes to repair a system or device. A recovery point objective (RPO) describes how much data can be lost in the event of an outage or issue, and the mean time between failures (MTBF) is a measure of the reliability of a system. It is the expected amount of time that will elapse between system failures. 4. B. Acceptable use policies (AUPs) describe how and what users can use organizational resources, systems, and services for. Business continuity policies describe how an organization approaches business continuity, and incident response policies focus on how organizations respond to incidents. A standard acts as the rules to achieve an intent, while policies describe the organization’s intent. This policy describes intent, not specific implementations. 5. D. Angie has conducted passive reconnaissance. She did not perform a scan or otherwise take direct active action to gather her information. Instead, she used the existing Shodan engine to gather information. While Shodan is a commercial product and does gather information using scans, databases like Shodan are considered passive reconnaissance, and the Security+ exam objectives recognize two types of reconnaissance: active and passive. 6. C. Data processors do just that—­they process the data on behalf of a data controller, who determines how data is processed and what purposes it is used for. They do not own the data, and they are typically contracted to process the data rather than contracting with third parties themselves. 7. D. Ginger is a data subject, a person who can be identified by her personally identifiable information (PII). Data owners are responsible for protection, usage, and quality Appendix ■ Answers to Review Questions of datasets. Data controllers determine how data will be used, and processors do the actual data processing. 8. C. Qualitative risk assessment uses knowledge and expertise to assess risk rather than assigning numeric values and calculations like a quantitative assessment process would. Ad hoc risk assessment is done when risks need to be assessed for a specific, immediate need unlike the planned, regular risk assessments described. Continuous risk assessment is ongoing, whereas this is conducted regularly. 9. A. Qualitative risk assessments measure likelihood on a descriptive scale like high, medium, or low. Quantitative assessments measure likelihood on a numeric scale using known event occurrence rates where possible. 10. A. Boards often include external members who may have industry or other experience and expertise that will benefit the organization, and they are sometimes, but not always, paid as part of their work on the board. Committees are frequently composed of internal staff; government-­based governance occurs through laws or as part of public service. Market-­based is not a type of governance outlined by the Security+ exam objectives. 11. A. Risk transfer options move the costs of risks to another organization such as through insurance. Acceptance involves management acknowledging that the risk and its impacts may occur, and that the organization will move forward despite that chance. Avoidance seeks to prevent the risk from occurring. Mitigation works to limit the impact of a risk. 12. C. Boards provide strategic oversight and direction for organizations. Boards may form subcommittees to accomplish specific tasks or to provide oversight over specific areas. Regulators oversee an industry based on law. Activist investor’s groups are not covered by the exam, but typically they own stock in an organization and seek to direct the organization through their activism and stock ownership. 13. C. This governance approach is a decentralized approach with each unit or area providing their own governance. While flexible, this can be problematic because of a lack of consistency and overhead due to unique circumstances and requirements. Centralized designs do not delegate authority and instead place authority in a central place, organization, or individual. There is no mention of a board or committee. 14. B. A one-­time risk assessment that addresses the acquisition will best meet Sharon’s needs. Ad hoc assessments are less formal, and they are often used to quickly assess a system or other potential risk. There is no requirement listed for third-­party assessment, and they can be both expensive and time-consuming. Continuous risk assessment efforts are typically built into ongoing processes and are not suited to this type of one-­time review. 15. C. Data processors process data on behalf of controllers. Data subjects are the individuals or organizations that data describes. Data owners create and are responsible for data, and data administrator is not a broadly or consistently used term in this context. 16. D. Right-­to-­audit clauses provide customers with the right to have an audit of their vendor like an SOC 2, Type 1 assessment performed. SOC 2, Type 1 reports are not penetration testing reports, vulnerability scan reports, or risk assessment reports. Chapter 5: Domain 5.0: Security Program Management and Oversight 17. A. Data owners are responsible for data, including classifying it, protecting it, overseeing the use of it, and ensuring the quality of the overall data. They are not, however, responsible for directly processing the data. 18. B. Risk exceptions are granted when a risk is accepted by the organization, despite not following typical organizational policies or processes. This is not a transfer or mitigation, and simply documenting the risk does not cause it to be accepted. 19. C. Data owners classify, protect, oversee the use of, and ensure the quality of data. Controllers are responsible for the procedures and purposes of data use, often described as the why and how. Custodians are the staff and teams who handle data, and processors work with data on behalf of a controller. 20. C. There are four commonly used business impact analysis (BIA) measures that are part of the Security+ exam objectives: recovery time objectives (RTOs), recovery point objectives (RPOs), mean time to repair (MTTR), and mean time between failures (MTBF). ARO, or annual rate of occurrence, is associated with risk assessment, not BIA. 21. B. Data processors process data for data controllers. In this scenario, Julie or a member of her staff is the data controller and the third-­party organization is a processor. They do not own the data, and they are not custodians who are responsible for the data on an ongoing basis. 22. D. Service level agreements (SLAs) set forth the expected service level as well as penalties for nonperformance. A master services agreement (MSA) is a broad agreement that additional work may be performed under. An NDA, or nondisclosure agreement, sets forth what information may and may not be shared or disclosed. The mean time between failures (MTBF) is a measure of the reliability of a system. It is the expected amount of time that will elapse between system failures. 23. D. Data controllers determine the purpose and methods of data processing. They may be individuals, groups, or organizations. This is defined by the General Data Protection Regulation (GDPR). That may involve how data flows, and the formats or other details of data, but the best—­and legally defined—­role of a controller is the one set by the GDPR. 24. B. Augie is a data custodian. In this role he is responsible for data’s use in the business, including storing and properly handling data. Data owners are responsible and accountable for data as well as ensuring that custodians and others are handling the data appropriately. Data processors do actual data processing, and may be an individual, organization, or group. Data subjects are the people who the data describes or is about. 25. C. Sanctions are typically applied to countries rather than companies or individuals. Fines and loss of license are typically aimed at companies and individuals, and mandatory reporting is not a penalty included in the Security+ exam. 26. A. Terms used for risk appetite in the Security+ exam objectives include conservative, neutral, and expansionary. Intentional is not a term used for risk appetite. Appendix ■ Answers to Review Questions 27. B. Data stewards are responsible for the data in their charge. That means they carry out data usage and security policies and ensure that data is handled appropriately. Creating data is typically done by data owners, who also explain and set data security policies. Multiple roles oversee data throughout its life cycle, not just a data steward. 28. A. Data controllers determine what data is used and how it is processed. Supervisory authorities are public authorities in the European Union (EU) that monitor for compliance with the General Data Protection Regulation (GDPR). Data protection officers are required by the GDPR and oversee data protection strategies and their implementation. Data processors do just that—­they process the data on behalf of a data controller who determines how data is processed and what purposes it is used for. They do not own the data, and are typically contracted to process the data rather than contracting with third parties themselves. 29. C. Avoidance seeks to prevent the risk from occurring. In this case, the WAF is a method of preventing the attack, thus avoiding the risk. Risk transfer options move the costs of risks to another organization such as through insurance. Acceptance involves management acknowledging that the risk and its impacts may occur and that the organization will move forward despite that chance. Mitigation works to limit the impact of a risk. 30. B. HTTPS using TLS is a form of encryption for data in motion. Encryption standards often require specific ways to use encryption, encryption algorithms, settings or configurations for encryption, or times and places where encryption must be used. Access control standards focus on how access is controlled, by whom, and who is impacted. Password standards define settings and requirements related to passwords, and physical security standards address physical security requirements. 31. A. Cloud vendors rarely agree to right-­to-­audit clauses, instead choosing to provide their own third-­party audit results. This reduces the chances of an audit or assessment causing issues with their other customers. Third-­party audit costs covered by right-­to-­audit clauses are often borne by the customers, not the vendor. Not passing an audit is unlikely for major vendors, regulatory requirements are more likely to require audits, and regulations rarely limit auditability. 32. A. Access control standards often define how and when users can access or use systems and services. Defining user access to only be allowed during working hours is an example of an access control standard. Encryption standards often require specific ways to use encryption, encryption algorithms, settings or configurations for encryption, or times and places where encryption must be used. Password standards define settings and requirements related to passwords, and physical security standards address physical security requirements. 33. C. The Advanced Encryption Standard (AES) is the most commonly accepted and used encryption standard as of this writing. Selecting a longer key length like 256 over a 128-­bit option provides greater resistance to brute-­force attacks. SHA-­1 and SHA-­2 are hashing algorithms, not encryption algorithms. 34. D. Agile, along with continuous integration/continuous delivery (CI/CD) pipelines, describes a software development life cycle. Business continuity, disaster recovery, and incident response policies may mention the Agile process and impacts on the CI/CD pipeline, but it is not the primary focus of those types of policies. Chapter 5: Domain 5.0: Security Program Management and Oversight 35. C. Change management practices often include options for preapproved changes, emergency changes, and standard changes. Changes required by legislation or other external factors are not typically built into most change management processes. 36. B. A business impact analysis (BIA) is a formal process used to identify mission-­critical functions and to ensure that critical systems that support those functions are identified and assessed. Risk assessment seeks to identify risks and their probability and impact, and a penetration test attempts to emulate how attackers might gain access to or otherwise impact systems and services. 37. C. Policies are a statement of organizational intent. Standards are defined to help organization achieve that intent through the use of rules. Policies are typically defined by an organization, and standards may be adopted from third parties or created by the organization itself. Policies might be defined by law but are not required to be defined that way. 38. A. Service level agreements set forth the expected service level as well as penalties for nonperformance. That means that Sophie needs to determine whether her vendor is meeting their promised delivery levels or availability levels and to claim appropriate penalties as defined in the contract if they are not met. KPIs may be involved but would be measured against her vendor’s performance, not her team’s performance. Security levels and supply chain availability levels are not the only potential items covered by an SLA. 39. C. Probability and impact are used to describe risk. ALE is the annual loss expectancy, or how much risks will likely cost an organization per year, and SLE is the single loss expectancy, or how much a single risk will cost if it occurs. Acceptance is a risk-­handling process, not a way of describing risks. 40. B. The only active reconnaissance task listed here is the nmap scan. Looking up information in Shodan, querying local DNS, and using public records are all examples of passive information gathering that does not actively probe the organization. 41. B. Data owners are responsible for categorizing, overseeing the usage of, and protecting data, but are typically not directly responsible for processing it. 42. B. Knowledge-­based authentication information is often easily available via social media or searches. Thus, using it as part of password recovery processes is problematic for organizations. Users will typically remember answers to knowledge-­based authentication questions. While knowledge-­based authentication isn’t typically used for multifactor, something you know is a legitimate option, and knowledge-­based authentication information could be recovered from compromised organizations, but this is not a common threat model. 43. D. Mitigation works to limit the impact of a risk, such as by taking action like segmenting the network to prevent further malware spread. Avoidance seeks to prevent the risk from occurring. Risk transfer options move the costs of risks to another organization such as through insurance. Acceptance involves management acknowledging that the risk and its impacts may occur, and that the organization will move forward despite that chance. 44. A. Password standards typically include elements like the NIST 800-­63B recommendations, not using password hints, not expiring passwords, storing passwords in a secure way, Appendix ■ Answers to Review Questions and establishing a minimum password length of at least 8 characters for user-­generated passwords. 45. B. Organizations that focus on reducing risk and that have significant compliance requirements are likely to adopt a conservative risk appetite. Expansionary risk appetite is rare when compliance and risk reduction are primary goals of the organization. Authoritarian and legislative are not typically used terms to describe risk appetite. 46. C. Detailed guides to organization practices for security events are called playbooks. In this case, Jack received the organization’s ransomware playbook. A policy would include high-­ level statements of intent, cookbooks are not a typical term used for documents like these, and this situation involves ransomware, not a disaster recovery scenario. 47. D. Regulations most commonly have fines and sanctions as their primary punishments levied against noncompliant organizations. Data breaches and reputational damage may occur, but are they are not enforced by regulation. Contractual impacts may occur, but again are not directly enforced by regulations. 48. A. Playbooks are detailed documents describing how to respond to a type of incident or event. An example is the CISA’s Cybersecurity Incident and Vulnerability Response playbook, which includes steps like identifying anomalous activity, identifying root cause, and analyzing for common adversary TTPs (www.cisa.gov/sites/default/files/publications/ Federal_Government_Cybersecurity_Incident_and_Vulnerability_ Response_Playbooks_508C.pdf). They are not legal documents, are detailed instead of high-level like a policy, and are more detailed than a general IR process document. 49. B. Nondisclosure agreements (NDAs) are used to protect sensitive data. Service level agreements (SLAs) determine service levels and penalties if they are not met. Master service agreements (MSAs) are foundational documents determining how organizations will work together as a foundation for specific work covered in SOWs (statements of work). BPAs (business partners agreements) are used when two organizations want to do business as a partnership. 50. C. Onboarding processes commonly include things like new employee orientation, creation of user accounts and provisioning of rights for the employee’s account, and ensuring the employee has completed security training. Identity proofing may be part of that process, but was not mentioned here. Mandatory access control is an access control model, and biometric enrollment involves capturing information about an individual’s biometric markers or profile. 51. A. The GDPR provides the right to be forgotten, which allows individuals to request that their data be deleted. The rights to deletion, privacy, and ownership were made up for this question. 52. B. Acceptance involves management acknowledging that the risk and its impacts may occur, and that the organization will move forward despite that chance. Risk transfer options move the costs of risks to another organization such as through insurance. Avoidance seeks to prevent the risk from occurring. Mitigation works to limit the impact of a risk, such as by taking action to prevent further malware spread. Chapter 5: Domain 5.0: Security Program Management and Oversight 53. B. Sending organizational data with a departing employee is not a common practice. In fact, organizations often ask employees to certify that they have returned all organizational devices and data. Returning company equipment, disabling the departing employee’s accounts or removing them, and changing any passwords on shared accounts are all common offboarding practices. 54. D. Neutral risk appetites balance organizational goals against risk. Conservative risk appetites seek to reduce risks over addressing other goals, and expansionary risk appetites will accept risk to achieve goals. Reactionary is not a typical description of risk appetite. 55. C. Known environment tests provide full information to testers, allowing them to use information about the environment without having to discover it. Partially known environment tests provide some, but not all information about the environment for testers. Unknown environment tests simulate what an attacker would encounter and do not provide information; instead, the testers have to discover it themselves. Third-­party tests are conducted by external groups or individuals and may be known, unknown, or partial knowledge tests. 56. D. BPAs, or business partners agreements, are used when two organizations want to do business as a partnership. SLAs, or service level agreements, determine service levels and penalties if they are not met. Nondisclosure agreements, or NDAs, are used to protect sensitive data. Master service agreements, or MSAs, are foundational documents determining how organizations will work together as a foundation for specific work covered in SOWs, or statements of work. 57. B. Unknown environment tests simulate what an attacker would encounter and do not provide information; instead, the testers have to discover it themselves. Known environment tests provide full information to testers, allowing them to use information about the environment without having to discover it. Partially known environment tests provide some, but not all information about the environment for testers. Third-­party tests are conducted by external groups or individuals and may be known, unknown, or partial knowledge tests. 58. B. Likelihood describes the possibility of a risk occurring. Impact describes what will happen if it does, potential is not a term used in this space, and rate of occurrence is how often a risk occurs on an annual basis. 59. C. Known environment tests provide full information to testers, allowing them to use information about the environment without having to discover it. This means that the testing will be more efficient and will provide more information in most cases. Partially known environment tests provide some, but not all information about the environment for testers. Unknown environment tests simulate what an attacker would encounter and do not provide information; instead, the testers have to discover it themselves. Third-­party tests are conducted by external groups or individuals and may be known, unknown, or partial knowledge tests. 60. B. Risk exception recognizes risk areas where an organization may not be in compliance with policies or regulations, and may be acknowledged because they cannot be addressed in a timely manner or are required for the organization to conduct business. Risk transfer options move the costs of risks to another organization such as through insurance. Risk avoidance Appendix ■ Answers to Review Questions involves preventing the risk from occurring. Mitigation works to limit the impact of a risk, such as by taking action to prevent further malware spread. 61. C. Regulatory compliance typically requires risk assessment on a regular basis, often once a year. Ad hoc, one-­time, and continuous risk assessments are used for other purposes to serve the organization but are not as common for regulatory compliance. 62. A. Partially known environment tests provide some, but not all information about the environment for testers. In this case, knowledge of the systems, IPs, and services is an example of partial knowledge. Known environment tests provide full information to testers, allowing them to use information about the environment without having to discover it. Unknown environment tests simulate what an attacker would encounter and do not provide information; instead, the testers have to discover it themselves. Third-­party tests are conducted by external groups or individuals and may be known, unknown, or partial knowledge tests. 63. B. An organization willing to accept significant risk has adopted an expansionary risk appetite. Neutral risk appetites balance risk and other factors, conservative appetites seek to limit risk rather than prioritize other goals or objectives, and limited is not a term used on the Security+ exam objectives in this area. 64. A. Information gathering and scanning together are common elements of reconnaissance. Since this involves both scanning and OSINT gathering, this is reconnaissance instead of passive information gathering via OSINT. Known environment tests provide full information to testers, allowing them to use information about the environment without having to discover it. Unknown environment tests simulate what an attacker would encounter and do not provide information; instead, the testers have to discover it themselves. 65. A. Individuals who use the GDPR’s right to be forgotten are data subjects, a person who can be identified by their personally identifiable information. Data controllers determine how data will be used, and processors do the actual data processing. Data owners are responsible for protection, usage, and quality of datasets. 66. C. Exposure factors are the percentage of value of an asset that would be lost due to an incident. ALE is the annual loss expectancy, and the ARO is the annual rate of occurrence. SLE is the single loss expectancy. Calculating these gives the cost of an incident, but EF is the impact of the risk and is not calculated using these, nor does it involve the likelihood of the risk. 67. C. Physical security testing involves testing an organization’s physical security defenses and practices, including guards, locks and doors, and other physical security components. Offensive penetration testing involves acting like attackers, while defensive penetration testing seeks to learn as defenders. Integrated penetration testing combines both. 68. D. Integrated penetration testing combines both offensive and defensive penetration testing, and testing guards as well as attempting to make it through access controls is an example of an integrated test. Physical security testing involves testing an organization’s physical security defenses and practices, including guards, locks and doors, and other physical security components like access control vestibules. Offensive penetration testing involves acting like attackers, while defensive penetration testing seeks to learn as defenders. Chapter 5: Domain 5.0: Security Program Management and Oversight 69. B. Offensive penetration testing involves acting like attackers, including nation-­state actors with advanced capabilities like those described in this question. Physical security testing involves testing an organization’s physical security defenses and practices, including guards, locks and doors, and other physical security components like access control vestibules. Defensive penetration testing seeks to learn as defenders. Integrated penetration testing combines both. 70. B. The GDPR is a regulation, making this a regulatory assessment or audit. There is no penetration testing mentioned, the auditors are not described as internal or external, and no attestation is mentioned. 71. A. Secure, ransomware resistant backups can mitigate the impact of ransomware but cannot stop it from impacting systems like an endpoint detection and response (EDR) tool can. Since Alexandria’s focus is on immediate mitigation, her best answer is EDR. Cybersecurity insurance is a means of transferring risk, and simply operating as usual is an acceptance strategy. 72. B. Shane’s organization has determined their risk appetite. They are willing to accept some risk, but may also choose to mitigate, transfer, or otherwise deal with their risk to match their appetite. Ad hoc describes risk assessment, not risk appetite or thresholds, and there is no way to determine if this is a conservative, neutral, or expansionary risk appetite. 73. C. Defensive penetration testing seeks to allow the organization to learn as defenders. Offensive penetration testing involves acting like attackers, including nation-­state actors with advanced capabilities like those described in this question. Physical security testing involves testing an organization’s physical security defenses and practices, including guards, locks and doors, and other physical security components like access control vestibules. Integrated penetration testing combines both. 74. D. Integrated penetration testing combines both offensive and defensive techniques and is often woven into an organization’s practices on an ongoing basis. Offensive penetration testing involves acting like attackers, including nation-­state actors with advanced capabilities like those described in this question. Defensive penetration testing seeks to allow the organization to learn as defenders. Physical security testing involves testing an organization’s physical security defenses and practices, including guards, locks and doors, and other physical security components like access control vestibules. 75. D. Auditors provide a statement about an organization’s posture as part of an attestation process. This provides assurance that the auditors have reviewed the organization’s practices and have found them suitable or that deficiencies have been identified. Penetration testing is the process of testing the security of an organization and is not an audit. Audit sign-­off occurs when management signs an audit to acknowledge their awareness of its results. Regulatory defense was made up for this question. 76. A. Without more information about the specific audits that Joe conducts, all we know is that he is an internal auditor. As an employee of the company that he is working for, he is considered an internal auditor. External audits are conducted by third parties. Regulatory audits assess compliance with laws, whereas compliance audits may look at laws or other compliance targets. Appendix ■ Answers to Review Questions 77. D. The Payment Card Industry Data Security Standard (PCI DSS) is an industry standard, not a law, so this is a compliance audit, not a regulatory audit. Third-­party auditors make it an external rather than an internal audit. 78. B. Filling out forms attesting to your own organization’s compliance status is an example of a self-­assessment. This is not an audit activity, PCI DSS is not a regulation, and no third parties were involved to make it external or independent and third party. 79. C. Audit committees are typically part of the organization’s board of directors, and they oversee financial reporting–related activities. Audit committees are required for US-­traded companies that are listed on stock exchanges. Shareholders, third-­party assessors, and the security office are not typical places to find an audit committee. 80. D. Continuous integration/continuous delivery (CI/CD) pipelines deploy software on an ongoing basis, making them a good fit for continuous risk assessment techniques. Ad hoc, one-­time, and third-­party assessments are not suited to the ongoing, rapid assessment pace needed for a CI/CD model. 81. B. External audits like a SOC 2, Type 2 audit should be conducted by an independent third party to be considered valid. An internal audit, no matter who signs off on it, is not used for this purpose, nor are self-­assessments. Penetration tests do not generate an SOC 2 audit report. 82. D. An organization’s risk threshold is the level where they will switch from accepting a risk to seeking to handle the risk. In this case, the risk has surpassed the organization’s risk threshold, resulting in a plan to avoid the risk. The risk did not drop below the threshold, the risk assessment was successful in helping the organization identify a concern, and no controls failed. 83. A. The Health Insurance Portability and Accountability Act (HIPAA) is a regulation, and organizations that must comply with laws need to conduct regulatory assessments. Offensive testing is a penetration testing model that mirrors actual attackers. Known environment testing leverages full knowledge of an organization as part of a penetration test. Physical testing validates physical security controls. 84. A. Policies are high-­level descriptions of an organization’s intent and understanding of their topic. Procedures will have descriptions of how a change is made in detailed form, while standards will describe how changes are created, made, and approved. Regulatory requirements are most likely to be part of standards or procedures. 85. C. Marek should follow his organization’s change management process to document the change required and to ensure that it is regularly reviewed. This may not require a risk assessment since it may be a simple requirement or may have already been assessed. The type of security variance needed is not described, so it is not clear if removing the system from the network is necessary. 86. A. Business continuity plans address how the organization will respond, including referencing runbooks that may detail how to handle restoration or other efforts on a step-­by-­ step basis, but doesn’t itself include that level of detail. Business continuity policies describe the organization’s intent at a high level and are likely to reference the business continuity plan. They are not the same, as the policy is a higher-­level document than the plan is. Chapter 5: Domain 5.0: Security Program Management and Oversight 87. C. Policies are distinct from procedures and standards because they include high-­level statements of intent rather than specific practices. Procedures document the practices an organization will use, whereas standards set expectations or specific configurations or details about how something is done or set up. 88. C. The EU’s GDPR provides the right to be forgotten, which allows Terry to request that organizations remove all of his data from their systems. HIPAA is a US regulation; data stewardship is an organizational role, not a right; and personal data ownership is not a right. 89. B. Risk exposure is calculated by multiplying probability and impact. Cost is measured in currency, time, or other cost metrics; vulnerability is often measured using CVSS scores; and audit findings may have criticality ratings. 90. B. Qualitative risk assessment relies on expertise and staff members who have relevant knowledge to provide a rating based on their experience, skills, and knowledge. A common rating for probability in a qualitative risk assessment might be low, medium, or high, rather than a 0–100 rating based on statistics or large datasets. 91. B. Rules of engagement determine how a penetration tester will conduct an engagement. Passwords may be part of the information provided before the test for a full knowledge or partial knowledge test but are not part of the rules of engagement. 92. D. Rules of engagement are created for penetration testing efforts that include a wide variety of information, including scope, schedules, what to do if a preexisting compromise is discovered, requirements for how to handle third-­party-­hosted tools and environments, how sensitive data and data related to the penetration test will be handled, and who to contact in emergencies. A right-­to-­audit clause is included in contracts, allowing audits to occur as part of the contract. SLAs are used to set service levels and penalties if they are not met, and MOUs document organizations’ interest and willingness to work together. 93. A. An organization’s risk threshold is the level where they will switch from accepting a risk to seeking to handle the risk. Their risk appetite is the amount of risk an organization is willing to accept to achieve its goals. Ad hoc risk level and third-­party risk level were made up for this question. 94. D. AUPs, or acceptable use policies, describe how organizational resources, systems, and services can and should be used. 95. C. Large breaches, particularly when the organization has been negligent, can have large impacts on the organization’s reputation, resulting in long-­term damage. Fines and contractual impacts may be impactful but are often resolved relatively quickly. Due diligence was not shown but is not an impact—­rather, it is part of an organization’s responsibilities. 96. B. A statement of work (SOW) or work order (WO) is created to list the tasks and deliverables that will be performed under the blanket master services agreement (MSA). An MOU, or memorandum of understanding, declares how two organizations want to work together; a business partners agreement (BPA) establishes a partnership between two organizations; and punch lists are not covered under the Security+ exam outline but are a list of tasks that must be accomplished for a contractor to be paid. Appendix ■ Answers to Review Questions 97. D. Jack should use the manufacturer’s published mean time between failures (MTBF), which is a measure of the reliability of a system. It is the expected amount of time that will elapse between system failures. While organizations typically replace devices well before their MTBF ratings, knowing how long the devices should last on average can be useful in long-­lived applications and for budgetary planning. A recovery time objective, or RTO, is set by organizations to describe how long restoring systems or services to normal function after a disruption can take. Mean time to repair, or MTTR, is the average time it takes to repair a system or device. A recovery point objective, or RPO, describes how much data can be lost in the event of an outage or issue. 98. D. Mean time between failures (MTBF) is a measure of the reliability of a system. It is the expected amount of time that will elapse between system failures, but it is merely an average. Jason should expect that drives will fail, and that their average service life will be 300,000 hours. That means that half of the drives are likely to fail before 300,000 hours, and half will fail after that number. 99. C. A recovery point objective, or RPO, describes how much data can be lost in the event of an outage or issue. A recovery time objective, or RTO, is set by organizations to describe how long restoring systems or services to normal function after a disruption can take. Mean time to repair, or MTTR, is the average time it takes to repair a system or device. The mean time between failures (MTBF) is a measure of the reliability of a system. It is the expected amount of time that will elapse between system failures. 100. A. The Security+ exam objectives list three categorizations you need to be familiar with for anomalous behavior: risky, unexpected, and unintentional. The other terms listed are not ways that the exam categorizes anomalous behavior. 101. A. Greg has conducted an ad hoc assessment by quickly pulling together a team without a formal process or procedure. Instead, he is seeking to quickly assess risk and take action. A one-­time assessment typically follows an established methodology but is only conducted once. Third-­party risk assessment uses external teams or staff, and continuous risk assessment is done on an ongoing basis. 102. B. Mean time to repair, or MTTR, is the average time it takes to repair a system or device, and Olivia needs to know that to determine what she can promise in her service level agreements that rely on server repair timelines. A recovery time objective, or RTO, is set by organizations to describe how long restoring systems or services to normal function after a disruption can take; it doesn’t determine how fast the server can be fixed but sets a goal that needs to take things like repair and recovery time into account as it is determined. A recovery point objective, or RPO, describes how much data can be lost in the event of an outage or issue, and the mean time between failures (MTBF) is a measure of the reliability of a system. It is the expected amount of time that will elapse between system failures. 103. C. The underlying agreement between two organizations that determines how the organizations will work together is a master services agreement (MSA). A MOU, or memorandum of understanding, declares how two organizations want to work together; a business partners agreement (BPA) establishes a partnership between two organizations; SLAs (service level agreements) set service level expectations and penalties if they are not met; and a business partners agreement (BPA) establishes two organizations as partners rather than establishing a working relationship for services as set forth in SOWs. Chapter 5: Domain 5.0: Security Program Management and Oversight 104. C. A recovery point objective, or RPO, describes how much data can be lost in the event of an outage or issue, and journaling allows recovery of database transactions by replaying them against the database once it is restored. Journaling may slow down recovery time objectives as the actions are replayed. A recovery time objective, or RTO, is set by organizations to describe how long restoring systems or services to normal function after a disruption can take. Mean time to repair, or MTTR, is the average time it takes to repair a system or device. The mean time between failures (MTBF) is a measure of the reliability of a system. It is the expected amount of time that will elapse between system failures. 105. B. A recovery time objective, or RTO, is set by organizations to describe how long restoring systems or services to normal function after a disruption can take. A 12-­hour RTO means that recovery from outages should take less than 12 hours. Failing over to a warm site will typically take a while, meaning that starting to fail over after 12 hours will miss the RTO, and MTBF is the mean time between failures, not a recovery timeframe. Failing every 12 hours on average would be unacceptable for almost any technical service or system! 106. B. Valerie should immediately begin a move to the warm site. She knows that moving to her warm site takes half the average time to repair for her datacenter’s power infrastructure. That means that in most cases, moving will result in at least a 12-­hour shorter outage. If the time to repair proves to be shorter than 12 hours, she can simply stop the move. Waiting does not restore her to operation sooner than 24 hours in the average case, and waiting to make the decision reduces the amount of advantage she gets from moving to the warm site. 107. A. Quantitative risk assessments assign numeric values and calculations to determine relative risk. Qualitative risk assessment uses knowledge and expertise to assess risk. Calculated risk is not a term that is commonly used to describe assessment processes like these, and risk registers list risks that an organization has identified but that don’t necessarily involve calculations. 108. B. Risk registers list organizations risks and their ratings, along with additional information that the organization uses to track or describe risks. Risk appetite plans, quantitative registers, and qualitative assessment reports were made up for this question. 109. C. Qualitative risk assessment uses knowledge and expertise to assess risk and are thus typically faster and more likely to be completed than a quantitative risk assessment. Quantitative risk assessments assign numeric values and calculations to determine relative risk. Choosing internal or external risk assessments is not a primary driver of speed compared to choosing quantitative over qualitative risk assessments. 110. D. SLE, or single loss expectancy, uses the asset value (AV) and exposure factor (EF) to determine the SLE. Purchase date, which department manages the server, and its operating system are not part of the calculation. 111. B. Undertaking reasonable steps to meet legal requirements like compliance with regulations is known as due diligence. Data stewardship may be part of those actions, but it focuses on oversight of data and data governance and may not be specifically regulatory focused. Appendix ■ Answers to Review Questions 112. B. Single loss expectancy, or SLE, is calculated by multiplying the asset value (AV) by the exposure factor (EF). In this case, that means that the potential loss during a loss event would be $125,000. 113. A. Annualized loss expectancy (ALE) is calculated by multiplying the annual rate of occurrence (ARO) by the single loss expectancy (SLE). If a single loss expectancy for a $1,000,000 asset is $100,000 and the annual rate of occurrence is .5—­in other words, it happens every two years on average—­then the ALE is $50,000. 114. D. Waylon is a risk owner. He is responsible for ensuring that the risks related to data and the application are managed appropriately. Board members have overall responsibility for an organization. Data processors have a data role, not a risk ownership role, and auditors assess organizations against standards and practices rather than owning risk. 115. B. Without a license to operate, Nathaniel’s organization will be unable to conduct business. Reputational damage, fines, and contractual impacts can all be navigated if the organization can continue to do business. 116. C. Susan can calculate the single loss expectancy (SLE) by multiplying the asset value (AV) by the exposure factor (EF), resulting in $25,000. If this loss occurs twice a year, then the annualized loss expectancy (ALE) is $50,000. 117. A. Annual rate of occurrence is calculated by determining how many times in a year the event happens, on average. If it happens less than once a year, the rate is a fraction based on that rate. Here the event happens once every four years, or .25 of the time during a given year. 118. D. Annualized loss expectancy is calculated by multiplying the annualized rate of occurrence (ARO) and the single loss expectancy (SLE). Total cost of ownership (TCO) and recovery point objectives (RPO) are not part of this type of risk calculation. 119. B. Passive reconnaissance is any reconnaissance that is done without actually connecting to the target. In this case, John is conducting a form of OSINT, or open source intelligence, by using commonly available third-­party information sources to gather information about his target. Active reconnaissance involves communicating with the target network, such as doing a port scan. The initial exploitation is not information gathering; it is actually breaking into the target network. A pivot is when you have breached one system and use that to move to another system. 120. C. Using default settings is a form of weak configuration and indicates that the organization is not using baselines effectively and may not have appropriate processes and standards in place. Many vulnerability scanners and attack tools have default settings built-­in to test with, and default settings are easily obtained for most devices with a quick search of the Internet. Configuring the accounts is not the issue; using default credentials and settings is. Although training users is important, that’s not the issue in this scenario. Patching systems is important, but that won’t change default settings. 121. D. Active reconnaissance connects to the network using techniques such as port scanning. Both active and passive reconnaissance can be done manually or with tools. Unknown and known environment tests refer to the amount of information the tester is given. Attackers and testers use both types of reconnaissance. Chapter 5: Domain 5.0: Security Program Management and Oversight 122. B. The rules of engagement for a penetration test typically include the type and scope of testing, client contact information and requirements for when the team should be notified, sensitive data handling requirements, and details of regular status meetings and reports. The remaining options were made up for this question. 123. B. Unlike a disaster recovery plan that is written to help an organization recovery from a person-­made or natural disaster, a business continuity plan focuses on how to keep the business running when it is disrupted. Thus, Charlene’s BC plan would detail how to keep the organization running when a system outage occurs. 124. C. Many cloud service providers do not allow customer-­driven audits, either by the customer or a third party. They also commonly prohibit vulnerability scans of their production environment to avoid service outages. Instead, many provide third-­party audit results in the form of a service organization controls (SOC) report or similar audit artifact. 125. D. A disaster recovery plan addresses what to do during a person-­made or natural disaster. A flood that completely fills a datacenter would require significant efforts to recover from, and Gurvinder will need a solid disaster recovery plan—­and perhaps a new datacenter location as soon as possible! A COOP, or continuity of operations plan, is needed for U.S. government agencies but is not required for businesses. A business continuity plan would cover how to keep the business running, but it does not cover all the requirements in a natural disaster of this scale, and a flood insurance plan is not a term used in the Security+ exam objectives. 126. C. Right-­to-­audit clauses are commonly accepted as part of service and leasing contracts regardless of location for datacenter co-­location and facility rental contracts. Cloud service providers, however, are less likely to sign a right-­to-­audit contract. Instead, they may provide third-­party audit data to customers or even to potential customers. 127. A. Playbooks list the actions that an organization will take as part of a response process. A runbook lists the steps required to perform an action like notification, removing malware, or similar tasks. Playbooks tend to be used to document processes, whereas runbooks tend to be used for specific actions. A disaster recovery (DR) plan is used to recover from disasters, and a business continuity (BC) plan is used to ensure that the organization continues to function. 128. A. Caroline should select ISO 27002. ISO 27002 is an international standard for implementing and maintaining information security systems. ISO 27701 is an international standard security technique for privacy information management systems; NIST 800-­12 is a general security standard and it is a US standard, not an international one; and NIST 800-­53 is a collection of security and privacy controls for information systems and organizations. 129. C. Change management is the process of documenting all changes made to a company’s network and computers. Avoiding making changes at the same time makes tracking any problems that can occur much simpler. Due diligence is the process of investigation and verification of the accuracy of a particular act. Acceptable use policies state what actions and practices are allowed in an organization while using technology. Due care is the effort made by a reasonable party to avoid harm to another. It is the level of judgment, care, determination, and activity a person would reasonably expect to do under certain conditions. Appendix ■ Answers to Review Questions 130. A. An acceptable use policy (AUP) is a document stating what a user may or may not have access to on a company’s network or the Internet. A clean desk policy ensures that all sensitive/confidential documents are removed from an end-­user workstation and locked up when the documents are not in use. Mandatory vacation policy is used by companies to detect fraud by having a second person, familiar with the duties, help discover any illicit activities. Job rotation is a policy that describes the practice of moving employees between different tasks. Job rotation can help detect fraud because employees cannot perform the same actions for long periods of time. 131. C. The PCI DSS, or Payment Card Industry Data Security Standard, is a security standard that is mandated by credit card vendors. The Payment Card Industry Security Standards Council is responsible for updates and changes to the standard. GDPR, or the General Data Protection Regulation, is a standard for data privacy and security in the European Union (EU). COPPA is the Children’s Online Privacy Protection Act, a U.S. federal law. CIS is the Center for Internet Security and is not a law or a regulation. 132. D. Quantitative risk assessment is the process of assigning numerical values to the probability an event will occur and what the impact of the event will have. Change management is the process of managing configuration changes made to a network. Vulnerability assessment attempts to identify, quantify, and rank the weaknesses in a system. Qualitative risk assessment is the process of ranking which risk poses the most danger using ratings like low, medium, and high. 133. D. A memorandum of understanding (MOU) is a type of agreement that is usually not legally binding. This agreement is intended to be mutually beneficial without involving courts or money. An SLA (service level agreement) defines the level of service the customer expects from the service provider. The level of service definitions should be specific and measurable in each area. A BPA (business partner agreement) is a legal agreement between partners. It establishes the terms, conditions, and expectations of the relationship between the partners. An ISA (interconnection security agreement) is an agreement that specifies the technical and security requirements of the interconnection between organizations. 134. A. The single loss expectancy (SLE) is the product of the asset value ($16,000) and the exposure factor (.35), or $5,600. 135. A. Risk acceptance is a strategy of recognizing, identifying, and accepting a risk that is sufficiently unlikely or that has such limited impact that a corrective control is not warranted. Risk transfer is the act of moving the risk to hosted providers who assume the responsibility for recovery and restoration or by acquiring insurance to cover the costs emerging from a risk. Risk avoidance is the removal of the vulnerability that can increase a particular risk so that it is avoided altogether. Risk mitigation is when a company implements controls to reduce vulnerabilities or weaknesses in a system. It can also reduce the impact of a threat. 136. D. A parking policy generally outlines parking provisions for employees and visitors. This includes the criteria and procedures for allocating parking spaces for employees and is not a part of organizational security policy. Instead, it is an operational or business policy. An acceptable use policy (AUP) describes the limits and guidelines for users to make use of an Chapter 5: Domain 5.0: Security Program Management and Oversight organization’s physical and intellectual resources. This includes allowing or limiting the use of personal email during work hours. Business continuity policies describe how the organization approaches business continuity efforts, and incident response (IR) policies document the organization’s IR intentions and high-­level goals. 137. A. Quantitative risk assessment is the process of assigning numerical values like cost and frequency of occurrence to the probability an event will occur and what impact the event will have, and thus directly evaluates the cost of a risk occurring. Qualitative risk assessment is the process of ranking which risk poses the most danger such as low, medium, and high. A business impact analysis (BIA) is used to evaluate the possible effect a business can suffer should an interruption to critical system operations occur. This interruption could be as a result of an accident, emergency, or disaster. Threat assessment is the process of identifying and categorizing different threats such as environmental and person-­made. It also attempts to identify the potential impact from the threats. 138. D. A nondisclosure agreement (NDA) protects sensitive and intellectual data from getting into the wrong hands. An NDA is a legal contract between the company and a third-­party vendor to not disclose information per the agreement. Encrypted data that is sent can still be decrypted by the third-­party vendor if they have the appropriate certificate or the key but does not restrict access to the data. Violating an NDA would constitute unauthorized data sharing, and a violation of privileged user role-­based awareness training has nothing to do with sharing proprietary information. 139. C. Sharing of profits and losses and the addition or removal of a partner, as well as the responsibilities of each partner, are typically included in a BPA (business partner agreement). Expectations between parties such as a company and an Internet service provider are typically found in a service level agreement (SLA). Expectations include the level of performance given during the contractual service. An SLA will provide a clear means of determining whether a specific function or service has been provided according to the agreed-­on level of performance. Security requirements associated with interconnecting IT systems are typically found in an interconnection security agreement, or ISA. 140. D. Systems should be restored within four hours with a minimum loss of one day’s worth of data. The RTO (recovery time objective) is the amount of time within which a process or service must be restored after a disaster to meet business continuity. It defines how much time it takes to recover after notification of process disruption. The recovery point objective, or RPO, specifies the amount of time that can pass before the amount of data lost may exceed the organization’s maximum tolerance for data loss. 141. A. A data retention policy defines how long an organization will keep data. Removing sensitive documents not in use is a clean desk policy. A formal process for managing configuration changes is change management, and a memorandum of understanding consists of legal documents that describe mutual agreement between two parties. 142. B. ALE (annual loss expectancy) is the product of the ARO (annual rate of occurrence) and the SLE (single loss expectancy) and is mathematically expressed as ALE = ARO × SLE. Single loss expectancy is the cost of any single loss, and it is mathematically expressed as SLE = AV (asset value) × EF (exposure factor). Appendix ■ Answers to Review Questions 143. C. Risk transfer is the act of moving the risk to hosted providers who assume the responsibility for recovery and restoration or by acquiring insurance to cover the costs emerging from a risk. Risk acceptance is a strategy of recognizing, identifying, and accepting a risk that is sufficiently unlikely or that has such limited impact that a corrective control is not warranted. Risk mitigation is when a company implements controls to reduce vulnerabilities or weaknesses in a system. It can also reduce the impact of a threat. Risk avoidance is the removal of the vulnerability that can increase a particular risk so that it is avoided altogether. 144. C. The mean time between failures (MTBF) is a measure of the reliability of a system or component. It is the expected amount of time that will elapse between system or device failures. MTTR (mean time to repair) is the average time it takes for a failed device or component to be repaired or replaced. An RPO (recovery point objective) is the period of time a company can tolerate lost data being unrecoverable between backups. ALE (annual loss expectancy) is the product of the annual rate of occurrence (ARO) and the single loss expectancy (SLE). 145. A. Quantitative risk analysis requires complex calculations and is more time-­consuming because it requires detailed financial data and calculations. Quantitative risk assessment is often subjective and requires expertise on systems and infrastructure, and both types of assessment can provide clear answers on risk-­based questions. 146. B. Risk acceptance is a strategy of recognizing, identifying, and accepting a risk that is sufficiently unlikely or that has such limited impact that a corrective control is not warranted. Risk mitigation is when a company implements controls to reduce vulnerabilities or weaknesses in a system. It can also reduce the impact of a threat. Risk avoidance is the removal of the vulnerability that can increase a particular risk so that it is avoided altogether. Risk transfer is the act of moving the risk to other organizations like insurance providers or hosting companies who assume the responsibility for recovery and restoration or by acquiring insurance to cover the costs emerging from a risk. 147. A. Data owners assign labels such as top secret to data. Custodians assign security controls to data. A privacy officer ensures that companies comply with privacy laws and regulations. System administrators are responsible for the overall functioning of IT systems. 148. B. ALE (annual loss expectancy) = SLE (single loss expectancy) × ARO (annualized rate of occurrence). SLE equals $750,000 (2,500 records × $300), and ARO equals 5%, so $750,000 times 5% equals $37,500. 149. C. RPO (recovery point objective) specifies the allowable data loss. It is the amount of time that can pass during an interruption before the quantity of data lost during that period surpasses business continuity planning’s maximum acceptable threshold. MTBF (mean time between failures) is the rating on a device or component that predicts the expected time between failures. MTTR (mean time to repair) is the average time it takes for a failed device or component to be repaired or replaced. ARO (annual rate of occurrence) is the ratio of an estimated possibility that a threat will take place within a one-­year time frame. 150. C. Onboarding is the process of adding an employee to a company’s identity and access management system. Offboarding is the process of removing an employee from the Chapter 5: Domain 5.0: Security Program Management and Oversight company’s identity and access management system. A system owner is an individual who is in charge of managing one or more systems and can include patching and updating operating systems. An executive user was made up for this question. 151. D. This is a procedure, which documents what you should do in general terms. A policy lays out an organization’s intent, and this is more specific than that. A playbook has specific, detailed action, and this procedure does not include that level of detail. Checklists are a step-­by-­step guide to accomplishing a task, and this document outlines required steps, not step-­by-­step detail. 152. B. Organizational policy frameworks typically contain policies, standards and procedures that support and expand on the policy, and guidelines. Risk registers, audit reports, vulnerability scans, and pentest reports are all artifacts organizations generate in support of information security practices. Laws are not part of a policy framework but may influence it. 153. C. The mean time to repair (MTTR) for a system or devices is the average time that it will take to repair it if it fails. The MTTR is used as part of business continuity planning to determine if a system needs additional redundancy or other options put in place if a failure and repair would exceed the maximum tolerable outage. It is calculated by dividing the total maintenance time by the total number of repairs. MTBF is the mean time between failures, MTTF the mean time to failure, and MITM is an on-­path attack. 154. A. Helen has created a disaster recovery plan (DRP). RPOs, or recovery point objectives, are set to determine how much data may be lost if an event or incident occurs; incident response plans focus on incidents, not outages or disasters; and MTBF, or mean time between failures, is not a type of plan. 155. B. Personal health information (PHI) may be covered by state, local, or federal law, and Greg’s organization should ensure that they understand any applicable laws before storing, processing, or handling health information. 156. D. An individual is most likely to face identity theft issues if their personally identifiable information (PII) is stolen or breached. 157. C. It is common practice to prohibit interactive logins to a GUI or shell for service accounts. Use of a service account for interactive logins or attempting to log in as one should be immediately flagged and alerted on as an indicator of compromise (IoC). 158. D. Emma should categorize this as a supply chain risk. When organizations cannot get the systems, equipment, and supplies they need to operate, it can have a significant impact on their ability to conduct business. That could create financial risk, but financial risk is not the direct risk here. There is no indication that the vendor will not support the systems, nor is there any information about whether there is an integration issue in the description. 159. B. Patching is a form of avoidance because it works to remove a risk from the environment. Acceptance of flaws that need patching would involve leaving the software unpatched; mitigation strategies might include firewalls, intrusion prevention systems (IPSs), or web application firewall (WAF) devices; and transference options include third-­party hosting or services. Appendix ■ Answers to Review Questions 160. A. The fines that can result from violation or infringement of regulations like the General Data Protection Regulation (GDPR) can have a significant impact on an organization, or could even potentially put it out of business. Due to this, organizations will track compliance with regulations as part of their risk posture. 161. D. Disaster recovery requires forethought and preparation, response to issues to minimize impact during a disaster, and response activities after a disaster. Thus, a complete disaster recovery plan should include actions that may or will occur before, during, and after a disaster, and not just the recovery process after the fact. 162. B. Although data breaches could result in termination of a card processing agreement, the fact that her organization is noncompliant is most likely to result in a fine. PCI DSS, or Payment Card Industry Data Security Standard, is a vendor standard, not a law, and criminal charges would not typically be filed in a situation like this. 163. D. The General Data Protection Regulation, or GDPR, requires a data protection officer (DPO). They oversee the organization’s data protection strategy and implementation, and make sure that the organization complies with the GDPR. 164. B. An SLA (service level agreement) defines the level of service the customer expects from the service provider. The level of service definitions should be specific and measurable in each area. An MOU (memorandum of understanding) is a legal document that describes a mutual agreement between parties. An ISA (interconnection security agreement) is an agreement that specifies the technical and security requirements of the interconnection between organizations. A BPA (business partners agreement) is a legal agreement between partners. It establishes the terms, conditions, and expectations of the relationship between the partners. 165. C. The likelihood of occurrence, or probability, is multiplied by the impact to determine a risk’s severity. 166. D. Organizations can determine how they want to determine asset value, but consistency is important in many cases. Thus, the original cost, the replacement cost, or a depreciated cost may be used. 167. A. A business impact analysis (BIA) helps to identify critical systems by determining which systems will create the largest impact if they are not available. MTBF is the mean time between failures, an RTO is a recovery time objective, and an ICD was made up for this question. 168. D. The most common means of transferring breach risk is to purchase cybersecurity insurance. Accepting breaches is rarely considered a valid risk process, blaming breaches on competitors does not actually transfer risk, and selling data to another organization is not a risk handling process but may be a business process. 169. C. The cost of a breach is an example of the impact of a breach. Probability is how likely the risk is to occur, and risk severity is calculated by multiplying probability and impact. Chapter 5: Domain 5.0: Security Program Management and Oversight 170. C. Gathering vulnerability information for a system that isn’t scannable from the Internet will require active reconnaissance as part of the penetration testing effort. OSINT and passive reconnaissance do not involve active scans, and known environments provide full knowledge of the environment. 171. B. Olivia should establish a service level agreement (SLA) with her provider to ensure that they meet the expected level of service. If they don’t, financial or other penalties are typically included. Olivia should ensure that those penalties are meaningful to her vendor to make sure they are motivated to meet the SLA. An MOU is a memorandum of understanding and explains the relationship between two organizations; an MSA is a master services agreement, which establishes a business relationship under which additional work orders or other documentation describe the actual work that is done; and a BPA is a business partners agreement, which is used when companies wish to partner on efforts and may outline division of profits or responsibilities in the partnership. 172. A. The single loss expectancy (SLE) describes what a single risk event is likely to cost. It is calculated using the asset value (AV) times the exposure factor (EF), which is an estimated percentage of the cost that will occur in damage if the loss occurs. MTTR is the mean time to repair, ARO is the annual rate of occurrence, and RTO is the recovery time objective. These are not part of the SLE equation. 173. B. Annual rate of occurrence (ARO) is expressed as the number of times an event will occur in a year. Wayne has estimated that the risk event that is being assessed will happen three times a year. 174. D. Data processors are service providers that process data for data controllers. A data controller or data owner is the organization or individual who collects and controls data. A data steward carries out the intent of the data controller and is delegated responsibility for the data. Data custodians are those who are entrusted with the data to store, manage, or secure the data. 175. C. Nicole is a data controller, sometimes called a data owner. She determines the reasons for processing personal information and how it is processed. A data steward carries out the intents of the data controller, data custodians are charged with safeguarding information, and data consumer is not a common data privacy role. 176. D. Kirk has mitigated the risk to his organization by increasing the resources targeted by the DoS attack in an attempt to ensure that the attack will not be successful. Acceptance would involve simply letting the attacks occur knowing they are likely to stop, avoidance might involve finding a way to ensure the attacks cannot occur, and transfer could leverage a third-­party mirror or anti-­DoS hosting service. 177. C. Offboarding processes are conducted to ensure that accounts and access are removed and that materials, computers, and data are all recovered from the staff member when a member of an organization leaves. Exit interviews are an HR process, job rotation helps to prevent an individual from conducting fraudulent activities over time, and governance helps to manage and maintain data by establishing high-­level control over the processes, procedures, and classification of the data an organization uses. Appendix ■ Answers to Review Questions 178. B. Playbooks provide detailed, step-­by-­step instructions for how to address specific topics like denial-­of-­service attacks. Standards describe the settings or requirements that the organization wishes to use. Regulations are law and are not set by the organization, and guidelines provide advice to organizations seeking to comply with the policy and standards. 179. C. Risk trend analysis shows the change in risks over time, allowing senior leadership to quickly and easily understand where risks are being addressed and where they may be increasing or not getting the attention they need. Ad hoc reports are used when risk information is needed in specific areas, typically in response to specific needs. Risk registers list an organization’s risks in detail and are not a quick, visual tool. Risk event reports detail specific events related to risks. 180. B. Third-­party assessments of an organization’s efforts to meet ISO standards is an example of vendor assessment. Internal audit would leverage internal staff to perform an audit, vulnerability scans use technical tools to identify vulnerabilities, and data inventories identify data and its locations and uses. 181. B. Vendors often ask that customers work with them to preschedule the testing so that they are aware of it. They typically do not place limitations on whether customers or third parties conduct the testing, and after-­the-­fact notification instead of prior notification is not a typical requirement. 182. B. The IP address of the recipient is not a common way of identifying phishing emails. The source system, domain, or IP may indicate a malicious sender, however! Phishing often focuses on creating a false sense of urgency, uses encrypted and password-­protected files to bypass filters, and may claim there is a problem with your password. 183. D. Operational security is the practice of educating users on the importance of protecting sensitive information, including security practices, configurations, and other details. Awareness training is a broad term describing all elements of security awareness. Social engineering is used by attackers to leverage human behaviors and practices for their own gain. Insider threats are threats created by those inside the organization. 184. D. An organization operating in the European Union (EU) and selling in multiple countries means that the company needs to assess legal implications on local, national, and global levels. 185. C. Conflicts of interest occur when an organization has a competing interest that could influence their behavior in a way that is not aligned with the best interest of a customer. Insider threats occur because an insider creates a problem or threat, either on purpose or inadvertently. MOU and SOW violations are both contractual violations and could be conflicts of interest but are not limited to that. 186. D. Decentralized governance allows individual business units to manage themselves rather than central organizations doing so. There is no board or committee described in the question. Chapter 5: Domain 5.0: Security Program Management and Oversight 187. A. The Treasury Department is a government entity, making this governance government entity–based. Shareholders and boards may play a role, but not via the Treasury Department. Centralized governance occurs inside the organization, not from an external entity. 188. C. Requesting evidence of internal audits and then assessing that evidence is the best option Sandra has. While a right-­to-­audit clause can be important in contracts, it would only be useful after the contract is signed, not prior to engagement. Supply chain analysis can be useful in specific circumstances, but nothing in the question indicates specific supply chain requirements or concerns. Due diligence is performed, not stated. 189. B. Policy handbooks are used to provide information about high-­level security practices and goals. Audit reports may not be broadly available in an organization, runbooks are detailed how-­to guides for processes or tasks, and user awareness training focuses on security awareness rather than high-­level goals and policies. 190. B. Awareness training remains the best protection against social engineering aimed at individual staff members. While awareness won’t stop all attacks, protecting individuals requires them to be trained on a regular basis. Endpoint detection and response (EDR) and next-­generation firewall (NGFW) are both technical tools that cannot stop social engineering directly, and security policies help the organization establish their approach to security but won’t stop individual responses to social engineering directly. 191. A. Examinations are simpler, typically smaller in scope, and less costly than an audit. Both help provide assurance, but the standards applied are different. 192. D. The first step in developing security training programs is to determine what risks and threats the organization faces. Once those are understood, an appropriate program can be created, including obtaining a budget, determining how training will be presented, and ensuring that regulatory requirements, if any, are met. 193. B. Internal governance committees do not typically include external entities like regulators. Subject matter experts (SMEs), management, and counsel are all commonly members of security governance committees. 194. D. Global, national, and local regulations may impact Dana’s security policy, but corporations do not set regulations. Instead, they will influence the policy through contractual obligations. 195. C. Feedback on policies from staff, integrating new and changed regulations, and validating reports from security tools are all common elements used to update security policies. Nondisclosure agreements (NDAs) seek to keep data secure through contractual obligations and are not a typical element in policy updates. 196. C. A MOA, or memorandum of agreement, is a formal document that outlines the terms and details of an agreement between two organizations, including the roles and responsibilities each will have. A SOW, or statement of work, describes the specific work that will be under a master services agreement for an engagement. Service level agreements (SLAs) are Appendix ■ Answers to Review Questions written contracts that specify the conditions of service that will be provided by the vendor and the remedies available to the customer if the vendor fails to meet the SLA. Business partners agreements (BPAs) are used when organizations agree to do business with each other in a partnership. 197. B. Companies commonly send questionnaires to potential vendors to gather information about security practices prior to acquiring their products or engaging their services. This is a simpler method than requiring audits or penetration tests, and OSINT will not provide organizational answers about practices in most cases. 198. A. External reporting for compliance is most often driven by the need to meet regulations or contractual obligations. Audit assesses compliance rather than driving reporting, board reporting is considered internal, and KPIs are typically internal measures. 199. B. Automated compliance monitoring is a key tool when organizations want to ensure they are consistently meeting compliance targets. Annual audits do not ensure compliance during the year, whether they are internal or external. Compliance KPIs give organizations compliance targets and measures, but without underlying tools they are simply a way to know the state of compliance when they are checked or updated. 200. C. Mistakes like this are classified as unintentional anomalous behavior. Risky and unexpected behaviors are the other two classifications that are part of the Security+ exam outline. Insider attacks or threats are intentional or unintentional malicious activity, which mistyping a password is not an example of. 201. D. NIST no longer recommends requiring password changes on a regular basis, and instead suggests that passwords only be changed when necessary. This helps to prevent password reuse and avoids influencing users to slightly modify passwords. Disabling MFA, reusing passwords, and using passwords hints are all practices that should be avoided. 202. B. Organizations often use multiple formats for awareness training to address learning preferences and styles. Compliance requirements typically do not specify how awareness is accomplished, just that it has occurred and can be validated. Multiple modes of training tend to increase costs rather than decreasing them, and KPIs for security awareness look at impact, not modes. 203. D. Organizations typically establish KPIs (key performance indicators), which may be described in MSAs (master service agreements), SLAs (service level agreements), or SOWs (statements of work). These help to measure and monitor the vendor’s performance. MOUs are used to document how organizations want to work together, not to establish performance measures. Compliance audits and regulatory requirements are only part of performance management. 204. B. Staff should be trained to maintain situational awareness by keeping an eye on their environment and the behaviors of individuals around them. Insider threats are internal actors who undertake malicious actions. Social engineering uses human behaviors to conduct malicious activities, and unintentionally risky behavior is typically accidental threats caused by users. Chapter 5: Domain 5.0: Security Program Management and Oversight 205. C. Data owners are typically the most senior data–related role in an organization and bear broad responsibility for the data, including oversight roles over stewards, controllers, and processors. 206. D. Deploying security cameras is not a common hybrid work environment option. Use of VPNs, secure Wi-­Fi, and appropriate physical security are all common options. 207. C. Contracts, regulations, and licensing all drive external compliance reporting. Reputations may be damaged if organizations are not compliant, but it does not drive reporting. 208. A. Work orders (WO) and statements of work (SOWs) are used to document the specific tasks and deliverables that are performed under an MSA. SLAs, MOUs, and MOAs are not used for this purpose. 209. D. MTBF, or mean time between failure, describes the average time before a device will fail, or the average amount of time between failures of a system. A recovery time objective, or RTO, is set by organizations to describe how long restoring systems or services to normal function after a disruption can take. Mean time to repair, or MTTR, is the average time it takes to repair a system or device. A recovery point objective, or RPO, describes how much data can be lost in the event of an outage or issue. 210. C. ISO 27002 describes controls and helps select and implement controls while also providing guidance on developing information security management guidelines. ISO 27001 establishes control objectives for 14 different categories, including things like HR security, asset management, and operations security. ISO 27701 focuses on managing privacy controls, and ISO 31000 provides guidelines for risk management. 211. A. Physical security standards set requirements for physical security controls like fences, locks, doors, and cameras. Access control policies may be logical or physical control–based, but fence height is not an access control. Business continuity and onboarding don’t impact fence height, nor do they rely on it. 212. C. Boards are typically elected by shareholders. Employees, the CEO, and non-­shareholders typically do not have the ability to elect or name members of the board. 213. B. Until he knows more details, Greg should classify this behavior as unexpected. Sending large volumes of data may be intentional, could be legitimate and thus not risky, and if it is intentional and part of business needs, would not be an insider threat. 214. C. Using existing tools to monitor for changes that would move the organization out of compliance is a common practice to help ensure ongoing compliance. Quarterly audits are point-­in-­time checks and won’t ensure ongoing compliance. Training helps to keep staff aware, but additional actions are required to ensure compliance, and attestation does not provide ongoing compliance, only a statement at a point in time. 215. C. After audits are acknowledged by management, the auditors will attest that the audit is complete and accurate based on their work and knowledge. Compliance and regulatory reporting may or may not happen depending on the reasons for the audit and the organization’s needs. Once an audit is complete, further scans and other work may be conducted by the company but are not guaranteed. Appendix ■ Answers to Review Questions 216. B. The employee at Latisha’s company can be considered an insider threat because they have provided access to a third party. Most organizations will terminate employees who do this due to violations of their acceptable use policy (AUP). The behavior is anomalous, but an insider threat is a better description. No social engineering is evident, nor is a nation-­ state actor described. 217. B. Using threat feeds to block phishing campaign URLs as they enter the feed is a proactive way to quickly respond. Web application firewalls (WAFs) are used to protect applications rather than as border devices to block outbound traffic. Manual blocks are commonly used but are slower to implement than threat feed–based responses. Conducting user awareness training is a best practice but doesn’t directly respond to campaigns. 218. B. Amanda has discovered an insider threat. Insider threats can be difficult to discover, as a malicious administrator or other privileged user will often have the ability to conceal their actions or may actually be the person tasked with hunting for threats like this! This is not a zero-­day—­no vulnerability was mentioned, there was no misconfiguration since this was an intentional action, and encryption is not mentioned or discussed. 219. A. Behavior like this would be considered risky, as clicking on unknown, unexpected links is a common way to succumb to a phishing attack. Unexpected typically describes behavior that isn’t typical for the user, and we do now know if this user typically behaves this way. The Security+ exam outline doesn’t use irresponsible as a category, and the click was intentional. 220. B. Establishing a baseline for security awareness is important so that Ben can determine what, if any, impact a program is having. This will drive KPIs as well as influence which actions and steps are taken to evolve the program. Implementing a security program is recommended by many standards, but they don’t determine initial awareness state. Penetration tests can provide information about where issues lie but don’t provide a broad baseline assessment either. 221. B. Malicious tools like BadUSB can make a USB cable or drive look like a keyboard when they are plugged in. Malicious thumb drives have been used by penetration testers simply by dropping them in a parking lot near their intended target. A Trojan or a worm is a possibility, but the clue involving the keyboard would point to a USB device as the first place Naomi should look. 222. B. A common practice is to report suspicious messages to an internal security team so that they can take action on phishing and other potential security issues. Reporting to third parties will not provide the same visibility, nor will deleting the messages. Asking users to click on messages works against security best practices! 223. A. Establishing security awareness KPIs, including incident rates, training uptake, responses to security awareness surveys, and other measurable indicators, is both the broadest and most useful option listed. Third-­party awareness audits are not a typical method for doing this, and conducting surveys and tracking incident rates are both actions that will be part of common awareness KPIs. Chapter 5: Domain 5.0: Security Program Management and Oversight 224. B. Myles should be concerned about contractual impacts as part of his customer relationships. Noncompliance with regulations is likely to make him unable to fulfill contracts or to be in violation of contractual terms that require his company to be in compliance. Fines, loss of license, and sanctions may also occur, but they are less directly impactful to customers and are not guaranteed. 225. D. An enterprise password manager can help to make it easier to use appropriate passwords without requiring users to memorize them. This results in less reuse, stronger passwords, and the ability to manage them, including preventing password reuse. Biometrics, training, and adopting NIST password complexity and length standards will not have the same broad impact. 226. A. Risk matrices are often used to summarize risk registers for senior management. SLE and ALE reports are not common documents, although ALE and SLE reports are commonly used as part of quantitative risk assessment and reporting. Risk KPIs are used to track progress on risk management, not to provide a summary of a risk register. 227. B. Guidelines provide advice to organizations seeking to comply with policies and standards. Policies outline the principles and rules that guide the execution of security efforts throughout the enterprise. Standards provide mandatory requirements describing how an organization will carry out its information security policies.