The primary advantage of an organization creating and maintaining a vendor risk registry is to:
- A. define the risk assessment methodology.
- B. study a variety of risks and review the threat landscape.
- C. ensure that inventory of potential risk is maintained.
- D. ensure that all assets have low residual risk.
A cloud security architect has been tasked with finding a solution for hardening VMs. The solution must meet the following requirements:
• Data needs to be stored outside of the VMs.
• No unauthorized modifications to the VMs are allowed.
• If a change needs to be done, a new VM needs to be deployed.
Which of the following is the best solution?
- A. Immutable system
- B. Data loss prevention
- C. Storage area network
- D. Baseline template
Which of the following security features do email signatures provide?
- A. Non-repudiation
- B. Body encryption
- C. Code signing
- D. Sender authentication
- E. Chain of custody
company management elects to cancel production. Which of the following risk strategies is the company using in this scenario?
- A. Avoidance
- B. Mitigation
- C. Rejection
- D. Acceptance
A company has a website with a huge database. The company wants to ensure that a DR site could be brought online quickly in the event of a failover, and end users would miss no more than 30 minutes of data. Which of the following should the company do to meet these objectives?
- A. Build a content caching system at the DR site.
- B. Store the nightly full backups at the DR site.
- C. Increase the network bandwidth to the DR site.
- D. Implement real-time replication for the DR site.
A senior cybersecurity engineer is solving a digital certificate issue in which the CA denied certificate issuance due to failed subject identity validation. At which of the following steps within the PKI enrollment process would the denial have occurred?
- A. RA
- B. OCSP
- C. CA
- D. IdP
An organization needs to classify its systems and data in accordance with external requirements. Which of the following roles is best qualified to perform this task?
- A. Systems administrator
- B. Data owner
- C. Data processor
- D. Data custodian
- E. Data steward
A security engineer has learned that terminated employees’ accounts are not being disabled. The termination dates are updated automatically in the human resources information system software by the appropriate human resources staff. Which of the following would best reduce risks to the organization?
- A. Exporting reports from the system on a weekly basis to disable terminated employees’ accounts
- B. Granting permission to human resources staff to mark terminated employees’ accounts as disabled
- C. Configuring allowed login times for all staff to only work during business hours
- D. Automating a process to disable the accounts by integrating Active Directory and human resources information systems
A company has data it would like to aggregate from its PLCs for data visualization and predictive maintenance purposes. Which of the following is the most likely destination for the tag data from the PLCs?
- A. External drive
- B. Cloud storage
- C. System aggregator
- D. Local historian
Company A is merging with Company B. Company A is a small, local company. Company B has a large, global presence. The two companies have a lot of duplication in their IT systems, processes, and procedures. On the new Chief Information Officer’s (CIO’s) first day, a fire breaks out at Company B’s main data center. Which of the following actions should the CIO take first?
- A. Determine whether the incident response plan has been tested at both companies, and use it to respond.
- B. Review the incident response plans, and engage the disaster recovery plan while relying on the IT leaders from both companies.
- C. Ensure hot, warm, and mobile disaster recovery sites are available, and give an update to the companies’ leadership teams.
- D. Initiate Company A’s IT systems processes and procedures, assess the damage, and perform a BIA.