Domain 5: Program Management & Oversight
15 questions · Instant feedback · 20% of the exam
Which of the following is the MOST effective way to protect against insider threats?
The principle of least privilege minimizes the potential damage from insider threats by limiting access to only what's necessary for job functions.
A U.S.-based cloud-hosting provider wants to expand its data centers to new international locations. Which of the following should the hosting provider consider first?
When expanding data centers internationally, the hosting provider must prioritize compliance with local data protection regulations. Different countries have varying laws regarding data privacy and security, and failing to comply can lead to legal issues and penalties.
A security analyst created a fake account and saved the password in a non-readily accessible directory in a spreadsheet. An alert was also configured to notify the security team if the spreadsheet is opened. Which of the following best describes the deception method being deployed?
A honeyfile is a file that is designed to lure attackers into interacting with it, triggering alerts when accessed.
Which of the following is the best reason to complete an audit in a banking environment?
A regulatory requirement is a mandate imposed by a government or an authority that must be followed by an organization or an individual. In a banking environment, audits are often required by regulators to ensure compliance with laws, standards, and policies related to security, privacy, and financial reporting.
An employee receives a work phone. Instead of starting up with the normal operating system, the phone loads to a gaming platform using administrative credentials. Which of the following issues occurred?
A malicious update used admin privileges to replace the legitimate OS with unauthorized software. This unauthorized firmware change indicates a deliberate attack.
A company recently set up a system for employees to access their files remotely. However, the IT team has noticed that some employees are using personal devices to access the system. Which of the following security techniques could help mitigate the risk of unauthorized connections by personal devices?
Conditional Access Policies allow administrators to define which devices meet corporate compliance standards before granting access. They can enforce device health checks, location restrictions, and managed device requirements. This prevents personal or non‐compliant devices from connecting to sensitive systems.
A security analyst is evaluating a SaaS application that the human resources department would like to implement. The analyst requests a SOC 2 report from the SaaS vendor. Which of the following processes is the analyst most likely conducting?
Requesting a SOC 2 report is part of due diligence on third-party vendors. It helps assess whether the provider meets security and privacy standards.
An administrator notices employees receiving blocked messages after visiting spoofed websites. What should the administrator do?
Security awareness training is the best approach because it teaches employees how to identify and avoid spoofed websites. Technical controls alone cannot stop every phishing attempt, so user education reduces future incidents.
After failing an audit twice, an organization has been ordered by a government regulatory agency to pay fines. Which of the following causes this action?
Non-compliance with regulatory standards is the reason for the fines, as the organization failed to meet the necessary requirements in their audits.
A new security regulation was announced that will take effect in the coming year. A company must comply with it to remain in business. Which of the following activities should the company perform next?
A gap analysis helps identify the difference between current practices and the new regulatory requirements.
A new employee accessed an unauthorized website. An investigation found that the employee violated the company’s rules. Which of the following did the employee violate?
Accessing sites that the company has blocked or not approved breaches its Acceptable Use Policy. This policy defines the boundaries for appropriate internet usage on corporate devices.
An audit reveals that cardholder database logs are exposing account numbers inappropriately. Which of the following mechanisms would help limit the impact of this error?
Masking hides sensitive data, such as account numbers, to prevent unauthorized access or exposure in logs.
A security analyst created a fake account and saved the password in a non-readily accessible directory in a spreadsheet. An alert was also configured to notify the security team if the spreadsheet is opened. Which of the following best describes the deception method being deployed?
A honeytoken is a decoy artifact, such as credentials or fake data, placed to trigger alerts when accessed. Its purpose is to detect unauthorized activity by luring attackers to interact with the planted token.
A client demands at least 99.99% uptime from a service provider's hosted security services. Which of the following documents includes the information the service provider should return to the client?
A service level agreement (SLA) includes the performance metrics, such as uptime guarantees, that the service provider must meet for the client. The SLA specifies penalties or remedies if these standards are not met.
An organization is required to provide assurance that its controls are properly designed and operating effectively. Which of the following reports will best achieve the objective?
An independent audit evaluates controls against recognized standards by a third‐party assessor. It produces formal findings on design effectiveness and operational performance. This level of assurance is often required by regulators and stakeholders.
Quiz Complete!
Domain 5: Program Management & Oversight