Governance, Risk, and Compliance (D486)

Correct Answer

A. Internal

Explanation

Outdated software is an internal risk because it originates within the organization’s infrastructure. It is a security risk that results from an organization’s failure to update and maintain its systems, rather than an external threat like a cyberattack from outside entities. Addressing internal risks involves improving internal security controls, patching vulnerabilities, and ensuring software updates are regularly applied.

Why Other Options Are Wrong

B. Quantitative

Quantitative risk analysis involves assigning numerical values to risks, such as potential financial loss. While outdated software can be analyzed in a quantitative manner, the categorization of risk here is about its origin (internal vs. external), not its measurement.

C. Qualitative

Qualitative risk analysis focuses on descriptive, subjective assessments of risk (e.g., high, medium, low). While outdated software can be assessed qualitatively, the question is about categorization based on source, making "internal" the correct choice.

D. External

External risks come from outside the organization, such as hackers, natural disasters, or regulatory changes. Outdated software is a risk arising from within the company, not an external source.

Correct Answer

D. Smoke detectors

Explanation

A preventive control is a security measure designed to stop an incident before it occurs. Smoke detectors serve as a preventive control because they detect smoke early, allowing for timely action to prevent a fire from spreading. Their purpose is to minimize damage by providing early warnings, thereby preventing major incidents.

Why Other Options Are Wrong

A. Data backups

Data backups are not preventive; they are a corrective control. They help recover lost data after an incident, such as a cyberattack or hardware failure, but they do not prevent the incident from happening.

B. Security camera

A security camera is a detective control rather than a preventive one. It records events for later review but does not actively prevent unauthorized access or incidents from occurring.

C. Door alarm

A door alarm is a detective and deterrent control. It alerts security personnel when a door is accessed without authorization but does not physically stop someone from breaking in.

Correct Answer

C. Nondisclosure agreements signed by employees

Explanation

A nondisclosure agreement (NDA) is a legal contract that prevents employees from sharing confidential information with unauthorized parties. While NDAs help protect trade secrets and sensitive data, they do not actively prevent or minimize security breaches caused by internal employees. Security breaches can still occur if an employee abuses their access privileges, misconfigured security settings, or acts maliciously.

Why Other Options Are Wrong

A. Job rotation

Job rotation limits the chances of fraud and internal security breaches by ensuring that no single employee remains in a position of unchecked power for too long. It also exposes employees to different roles, making it harder for malicious activity to go undetected.

B. Separation of duties

Separation of duties prevents conflicts of interest and reduces the risk of insider threats. By dividing responsibilities, no single employee has complete control over critical systems or sensitive information, making security breaches less likely.

D. Mandatory vacations

Mandatory vacations force employees to take time off, allowing security audits and investigations to uncover any fraudulent or suspicious activity. If an employee is engaged in unauthorized activities, their absence may reveal security breaches.

Correct Answer

C. Sharing of profits and losses and the addition or removal of a partner.

Explanation

A Business Partnership Agreement (BPA) defines the roles, responsibilities, and financial arrangements between business partners. It outlines how profits and losses will be shared, the conditions for adding or removing a partner, and the overall structure of the business relationship. This ensures that all parties involved understand their obligations and rights.

Why Other Options Are Wrong

A. Clear statements detailing the expectation between a customer and a service provider.

This describes a Service Level Agreement (SLA), not a BPA. An SLA defines the expectations and responsibilities between a customer and a service provider, ensuring service quality and availability.

B. The agreement that a specific function or service will be delivered at the agreed-on level of performance.

This also pertains to an SLA, which establishes performance metrics and service quality standards rather than the business relationships outlined in a BPA.

D. Security requirements associated with interconnecting IT systems.

Security requirements for interconnected systems are typically covered in an Interconnection Security Agreement (ISA) or a Memorandum of Understanding (MOU), not a BPA. A BPA focuses on business structure and financial relationships, not IT security specifics.

Correct Answer

D. Availability loss

Explanation

Availability loss refers to a system or service becoming inaccessible due to an incident, such as a denial-of-service attack. In this scenario, the data breach exposed customer information but did not necessarily disrupt system availability. Since the company's incident response process is complete, availability is likely restored, making this the least likely impact.

Why Other Options Are Wrong

A. Identity theft is incorrect because customers’ personally identifiable information (PII) was exposed, making identity theft a possible consequence of the breach.

B. Financial loss is incorrect because data breaches often lead to costs associated with regulatory fines, legal fees, compensation to affected customers, and security improvements.

C. Reputation loss is incorrect because trust in the company may decline due to the breach, potentially leading to customer attrition and a damaged brand image.

Correct Answer

D. Preventive

Explanation

A preventive control is one that stops an incident from happening. A cable lock physically prevents unauthorized access or theft of a laptop, making it a preventive security control. The lock ensures that the laptop remains secure even when the user is not present, reducing the risk of theft.

Why Other Options Are Wrong

A. Administrative

Administrative controls refer to policies, procedures, and guidelines (such as security training or access control policies). Since the cable lock is a physical security measure, it does not fall under administrative controls.

B. Compensating

A compensating control is an alternative security measure used when the primary control is not feasible or available. There is no indication that the cable lock is being used as a backup measure, so it is not compensating.

C. Deterrent

A deterrent control discourages potential attackers but does not physically prevent access. A cable lock actively prevents theft rather than just discouraging it, making it preventive rather than deterrent.

Correct Answer

C. Provide public notification of the breach

Explanation

Most U.S. states have data breach notification laws that require organizations to notify affected individuals and relevant authorities when personally identifiable information (PII), such as Social Security numbers (SSNs), is exposed in a security breach. Public notification ensures that affected individuals can take steps to protect themselves, such as monitoring their credit reports, freezing accounts, or changing passwords. Failure to comply with these laws can result in fines and legal consequences for the organization.

Why Other Options Are Wrong

A. Destroy all Social Security numbers

Destroying SSNs is not a legal requirement after a breach. Instead, organizations are required to protect SSNs using encryption and other security measures to prevent unauthorized access.

B. Reclassify all impacted data

Reclassifying data does not mitigate the impact of a breach. The focus should be on notifying affected individuals and authorities, securing systems, and preventing future breaches.

D. Provide a data minimization plan

While data minimization (limiting the collection and retention of sensitive data) is a best practice, it is not an immediate response requirement after a breach. The primary action required by law is notifying affected individuals.

Correct Answer

C. Due to regulations or laws

Explanation

A privacy notice is a legally required document that informs users about how their personal data is collected, used, stored, and protected. Many jurisdictions, such as the European Union's General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other data privacy laws, require businesses to provide transparent privacy notices to users. Failure to comply with these regulations can lead to fines, penalties, or legal action.

Why Other Options Are Wrong

A. To warn attackers about security measures

Privacy notices are intended for users, not attackers. They describe data handling practices but do not include details about security measures, as revealing security details would create vulnerabilities.

B. To avoid lawsuits

While having a privacy notice can help reduce legal risks, the primary reason for including it is compliance with privacy laws, not simply to avoid lawsuits. A well-crafted privacy notice aligns with regulations and informs users, which indirectly helps in preventing legal issues.

D. None of the above

This option is incorrect because privacy notices are required by law in many countries, making option C the most accurate choice.

Correct Answer

D. The right to anonymity

Explanation

The General Data Protection Regulation (GDPR) grants individuals rights over their personal data, including access, deletion, and portability. However, GDPR does not explicitly provide a "right to anonymity." It focuses on protecting and managing personal data rather than enforcing complete anonymity.

Why Other Options Are Wrong

A. The right to access

GDPR allows individuals to request access to their personal data and understand how it is used.

B. The right to be forgotten

Also known as the right to erasure, individuals can request their data be deleted if no longer needed.

C. The right to data portability

Individuals can request their data in a structured, commonly used format to transfer to another service provider.