Domain 5: Program Management & Oversight
15 questions · Instant feedback · 20% of the exam
Which of the following did the vendor provide to the CIO when they detailed that their services meet 17 of 21 compliance objectives?
An attestation of compliance is a formal declaration by the vendor that outlines which regulatory or framework requirements they meet. It’s often accompanied by a signed statement but is not as rigorous as an independent audit.
The Chief Information Officer (CIO) asked a vendor to provide documentation detailing the specific objectives within the compliance framework that the vendor’s services meet. The vendor provided a report and a signed letter stating that the services meet 17 of the 21 objectives. Which of the following did the vendor provide to the CIO?
An attestation of compliance is a formal declaration—often signed—confirming that specific controls or objectives have been met. It provides assurance without the depth of an independent audit. Organizations rely on these for vendor assessments when full third-party audits may not be available.
A systems administrator receives an alert that a company's internal file server is very slow and is only working intermittently. The systems administrator reviews the server management software and finds the following information about the server:\nCPU: 95%\nMemory: 90%\nDisk: 5%\nNetwork: 1%\nWhich of the following indicators most likely triggered this alert?
High CPU and memory usage indicate excessive resource consumption, which can cause performance issues on the server.
The physical security team at a company receives reports that employees are not displaying their badges. The team also observes employees tailgating at controlled entrances. Which of the following topics will the security team most likely emphasize in upcoming security training?
Situational awareness is critical in preventing tailgating and ensuring that employees understand the importance of security procedures.
The board of a company needs to tell the leadership team which activities are too risky to undertake during business operations. Which of the following risk management strategies does the board need to explain?
Risk tolerance defines the level of risk that management is prepared to accept in pursuit of objectives. It guides decisions about which activities are off-limits.
Which of the following is the best way to remove personal data from a social media account that is no longer being used?
The right to be forgotten, as provided by privacy regulations like GDPR, allows individuals to request complete deletion of their personal data from online platforms. Exercising this right ensures all user-generated content, metadata, and archived information are permanently removed. Simply deleting the app or terminating the account may leave residual data on the platform’s servers.
A penetration test identifies that SMBv1 is enabled on multiple servers across an organization. The organization wants to remediate this vulnerability in the most efficient way possible. Which of the following should the organization use for this purpose?
Group Policy Objects allow administrators to disable SMBv1 settings centrally across all Windows servers. This ensures rapid, consistent remediation without manual work on each host.
A systems administrator is creating a script that would save time and prevent human error when performing account creation for a large number of end users. Which of the following would be a good use case for this task?
Orchestration refers to automating tasks and workflows, improving efficiency and consistency. In this case, the script automates account creation, streamlining the process and reducing potential errors associated with manual tasks.
The Chief Information Security Officer (CISO) has determined the company is not compliant with local data privacy regulations. The CISO needs to justify the budget request for more resources. Which of the following should the CISO present to the board as the direct consequence of non-compliance?
Fines are the direct financial consequence of non-compliance with data privacy regulations.
Which of the following explains how to determine the global regulations that data is subject to regardless of the country where the data is stored?
Data sovereignty refers to the concept that data is subject to the laws and regulations of the country in which it is stored.
Which factor should organizations prioritize most when deciding vulnerability remediation order?
The Common Vulnerability Scoring System (CVSS) provides standardized severity ratings to help prioritize remediation.
An organization is implementing a COPE mobile device management policy. Which of the following should the organization include in the COPE policy? (Choose two.)
Remote wiping of the device and data encryption are essential in a COPE (Corporate Owned, Personally Enabled) policy to protect company data on mobile devices.
An administrator at a small business notices an increase in support calls from employees who receive a blocked page message after trying to navigate to a spoofed website. Which of the following should the administrator do?
Security awareness training helps users recognize suspicious websites and phishing attempts, preventing future incidents.
Which of the following is used to calculate the impact to an organization per cybersecurity incident?
Single Loss Expectancy (SLE) estimates the monetary loss from a single security event by multiplying the asset’s value by the exposure factor. This per-event cost metric helps organizations budget and plan risk management efforts.
Which of the following tasks is typically included in the BIA process?
The BIA process includes estimating recovery times to determine how long critical systems can be down before business operations are impacted.
Quiz Complete!
Domain 5: Program Management & Oversight