Governance, Risk, and Compliance (D486)

Correct Answer

B. Risk acceptance

Explanation

Residual risk is the remaining risk after security controls and mitigation efforts have been implemented. Risk acceptance is the response technique where an organization acknowledges the existence of residual risk and decides to tolerate it rather than taking further action. Categorizing residual risk is crucial for determining whether it is within an acceptable threshold.

Why Other Options Are Wrong

A. Risk mitigation

Risk mitigation involves reducing risk by implementing controls, but it does not focus on accepting residual risk. Instead, it aims to lower risk to an acceptable level.

C. Risk avoidance

Risk avoidance means eliminating the risk entirely by discontinuing the activity that introduces the risk. Since residual risk refers to the risk that remains after mitigation, it is not relevant to risk avoidance.

D. Risk transfer

Risk transfer involves shifting the financial impact of risk to a third party, such as an insurance provider. While residual risk still exists in a risk transfer strategy, categorizing residual risk is more critical for risk acceptance, where the organization decides to live with the remaining risk.

Correct Answer

C. Single point of failure

Explanation

A single point of failure (SPOF) occurs when a critical component in a system has no redundancy, meaning that if it fails, the entire system or service is disrupted. In this scenario, since all internet traffic depends on a single connection, if that connection goes down, the organization loses internet access, making it a single point of failure.

Why Other Options Are Wrong

A. Cloud computing

Cloud computing involves delivering computing resources over the internet. While an organization may rely on the cloud for services, having a single internet connection is not the definition of cloud computing.

B. Load balancing

Load balancing distributes network traffic across multiple servers or connections to improve performance and reliability. Since this scenario describes a single connection without redundancy, load balancing is not in place.

D. Virtualization

Virtualization refers to creating virtual environments (such as virtual machines or networks) on a single physical system. The issue described here is a lack of redundancy in an internet connection, not virtualization.

Correct Answer

C. The CSA's cloud control matrix

Explanation

The Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) is a framework designed to map cloud security controls across various industry standards, including COBIT, FedRAMP, HIPAA, and others. It helps organizations identify common security requirements and streamline compliance efforts for cloud services.

Why Other Options Are Wrong

A. The CSA's reference architecture

While the CSA provides a reference architecture for cloud security, it is primarily focused on guiding cloud service providers in securing their environments. It does not specifically map controls between standards.

B. ISO 27001

ISO 27001 is an international standard for information security management systems (ISMS), but it does not focus specifically on mapping controls across different frameworks like COBIT or HIPAA.

D. ISO 27002

ISO 27002 provides detailed security controls and best practices, but it is not designed to map controls between multiple frameworks like the CSA Cloud Controls Matrix does.

Correct Answer

D. Least privilege

Explanation

The principle of least privilege ensures that users have only the necessary access required to perform their job duties. This minimizes the risk of unauthorized access, accidental modifications, and potential security breaches. Implementing least privilege reduces attack surfaces and enhances security by limiting the actions a compromised account can perform.

Why Other Options Are Wrong

A. Password length is an important factor in security, but it is not the most critical consideration when setting up new accounts. A strong password policy should be in place, but limiting account privileges is a higher priority.

B. Password complexity helps prevent brute-force attacks, but it does not address access control. A highly complex password does not reduce the risks associated with excessive user privileges.

C. Account age is not a primary security concern when creating accounts. While account expiration policies can help with managing inactive accounts, they do not directly impact security at the time of account creation.

Correct Answer

C. Job rotation

Explanation

Job rotation is a security and operational control where employees periodically switch roles to increase knowledge, reduce fraud risk, and ensure no single individual maintains excessive control over critical functions. This practice helps organizations detect irregularities and prevents employees from engaging in fraudulent activities for extended periods. Additionally, job rotation promotes cross-training, ensuring continuity in operations when an employee leaves or is unavailable.

Why Other Options Are Wrong

A. Separation of duties is incorrect because it refers to dividing responsibilities among multiple individuals to prevent fraud or errors. While job rotation may contribute to security, it is distinct from separating duties within a process.

B. Mandatory vacation requires employees to take time off so that irregularities in their work can be detected in their absence. Unlike job rotation, it does not involve regularly switching roles but instead ensures others review the employee’s work.

D. Onboarding refers to the process of integrating a new employee into an organization. It involves training, familiarization with company policies, and job responsibilities, which is unrelated to switching roles periodically.

Correct Answer

B. It increases risk awareness

Explanation

A risk register is a documented list of potential risks, their impact, and mitigation strategies. By maintaining and regularly updating the risk register with input from managers and senior leadership, Jason is helping to increase risk awareness across the organization. This ensures that decision-makers stay informed about current and emerging risks, allowing them to take proactive measures to mitigate threats. The risk register also helps in prioritizing risk management efforts and aligning them with business goals.

Why Other Options Are Wrong

A. It decreases inherent risk

Inherent risk refers to the level of risk present before any controls are applied. Documenting risks does not reduce inherent risk; instead, it helps in identifying and managing them effectively.

C. It decreases residual risk

Residual risk is the risk that remains even after controls are implemented. A risk register does not directly reduce residual risk, but it does help in monitoring and managing it effectively.

D. It increases risk appetite

Risk appetite is the level of risk an organization is willing to accept. Keeping a risk register does not increase risk appetite; instead, it helps in assessing whether risks align with the organization's acceptable risk levels.

Correct Answer

C. Onboarding

Explanation

Onboarding is the process of integrating new employees into an organization by setting up their accounts, providing access to systems, and assigning necessary resources like mobile devices. It ensures they can perform their job duties securely and efficiently.

Why Other Options Are Wrong

A. Offboarding

Offboarding is the opposite process—it involves removing access, deactivating accounts, and collecting company devices when an employee leaves the organization.

B. System owner

A system owner is responsible for managing a specific IT system, including security policies and maintenance, but does not perform onboarding tasks.

D. Executive user

An executive user is a high-level employee with privileged access, but this is not related to the process of creating user accounts for new hires.

Correct Answer:

C. As PII

Explanation:

Personally Identifiable Information (PII) refers to any data that can be used to identify an individual, such as names, addresses, and phone numbers. Since cell phone numbers are unique to individuals and can be used to contact or track them, they fall under PII classification. Organizations handling PII must comply with privacy regulations such as GDPR or CCPA to ensure data protection.

Why other options are wrong:

A. As PHI – Protected Health Information (PHI) refers to health-related data linked to an individual, such as medical history, prescriptions, and treatment details. A cell phone number alone does not meet the criteria for PHI.

B. As financial information – Financial information includes data related to banking, credit cards, and transactions. A cell phone number is not directly related to financial records.

D. As government information – Government information pertains to classified, restricted, or publicly accessible data managed by government entities. A personal phone number does not fit this category.

Correct Answer

D. Preventive

Explanation

A preventive control is one that stops an incident from happening. A cable lock physically prevents unauthorized access or theft of a laptop, making it a preventive security control. The lock ensures that the laptop remains secure even when the user is not present, reducing the risk of theft.

Why Other Options Are Wrong

A. Administrative

Administrative controls refer to policies, procedures, and guidelines (such as security training or access control policies). Since the cable lock is a physical security measure, it does not fall under administrative controls.

B. Compensating

A compensating control is an alternative security measure used when the primary control is not feasible or available. There is no indication that the cable lock is being used as a backup measure, so it is not compensating.

C. Deterrent

A deterrent control discourages potential attackers but does not physically prevent access. A cable lock actively prevents theft rather than just discouraging it, making it preventive rather than deterrent.