Domain 5: Program Management & Oversight
15 questions · Instant feedback · 20% of the exam
For an upcoming product launch, a company hires a marketing agency whose owner is a close relative of the CEO. Which of the following did the company violate?
Hiring a vendor owned by a close relative of the CEO violates the conflict of interest policy because personal relationships can bias business decisions. Such conflicts undermine transparency, fairness, and trust in the company’s governance.
Which of the following is the best reason to complete an audit in a banking environment?
Audits in banking environments are often driven by regulatory requirements. Compliance with industry standards and regulations, such as PCI DSS or SOX, is essential for banks to maintain trust and avoid penalties.
After a breach at a data processing center, an administrator receives a notification that administrative passwords were leaked online. Which of the following should be used to reduce the risk of this incident in the future?
Password hashing transforms plain‐text passwords into irreversible digests that cannot be used directly if exposed. Proper hashing algorithms with salts ensure that even identical passwords produce unique hashes. By storing only the hashes, the organization prevents attackers from recovering the original credentials, greatly reducing the risk of credential reuse or account takeover.
An organization is required to provide assurance that its controls are properly designed and operating effectively. Which of the following reports will best achieve the objective?
An independent audit is the best way to confirm that controls are designed properly and functioning as intended, as it provides a third-party review.
Which of the following is a directive managerial control?
An Acceptable Use Policy (AUP) sets rules and guidelines for employee behavior. It’s a managerial control because it directs how resources should be used.
Which of the following should an organization focus on the most when making decisions about vulnerability prioritization?
The Common Vulnerability Scoring System (CVSS) provides an objective, standardized severity score for each vulnerability, enabling consistent risk assessment across teams. Relying on CVSS helps ensure that remediation efforts target the most critical weaknesses first.
The board of a company needs to tell the leadership team which activities are too risky to undertake during business operations. Which of the following risk management strategies does the board need to explain?
Risk tolerance defines the level of risk that management is prepared to accept in pursuit of objectives. It guides decisions about which activities are off-limits.
An auditor notices that, before logging into the firewall, an employee opens a document in a shared folder that contains administrative credentials. Which of the following should the auditor recommend implementing?
Password management solutions secure credential storage by encrypting and rotating passwords automatically. They eliminate the need to store admin credentials in plain files. This reduces the risk of unauthorized disclosure and enforces strong password hygiene.
A systems administrator discovers a system that is no longer receiving support from the vendor. However, this system and its environment are critical to running the business, cannot be modified, and must stay online. Which of the following risk treatments is the most appropriate in this situation?
When a system is critical to business operations and cannot be replaced or modified, the most appropriate response is to accept the risk and manage it accordingly.
Which of the following should an analyst consider when performing a business impact analysis? (Select two).
RPO (Recovery Point Objective) and RTO (Recovery Time Objective) are key factors to consider when assessing business impact.
An administrator has configured a quarantine subnet for all guest devices that connect to the network. Which of the following would be best for the security team to configure on the MDM before allowing access to corporate resources?
Compliance attestation ensures that a device meets the organization's security policies (e.g., antivirus, encryption, OS version) before it's granted access to corporate resources. It is typically enforced through MDM solutions.
A company is considering an expansion of access controls for an application that contractors and internal employees use to reduce costs. Which of the following risk elements should the implementation team understand before granting access to the application?
Risk appetite defines how much risk an organization is willing to accept in pursuit of objectives. Understanding appetite guides decisions on the level of access and controls needed. If the risk is above the appetite, more stringent safeguards must be applied.
A new employee accessed an unauthorized website. An investigation found that the employee violated the company's rules. Which of the following did the employee violate?
An AUP (Acceptable Use Policy) outlines the acceptable usage of company resources and prohibits access to unauthorized websites.
A security analyst is reviewing the source code of an application in order to identify vulnerabilities. Which of the following kinds of analysis best describes this review?
Static analysis involves examining the code without executing it. In this case, the security analyst is performing static analysis by reviewing the source code to identify potential vulnerabilities.
For which of the following reasons would a systems administrator leverage a 3DES hash from an installer file that is posted on a vendor's website?
A hash value like 3DES checksum allows the administrator to verify that the downloaded file has not been tampered with. By comparing the published hash to one generated locally, any alteration in transit is detected. This ensures file integrity before installation.
Quiz Complete!
Domain 5: Program Management & Oversight