Governance, Risk, and Compliance (D486)

Correct Answer

D. Purchase cybersecurity insurance

Explanation

Risk transfer is a risk management strategy where an organization shifts financial responsibility for potential losses to a third party. Cybersecurity insurance is a common method of risk transfer, as it helps cover costs related to data breaches, legal fees, regulatory fines, and business interruptions caused by cyber incidents. By purchasing insurance, an organization can mitigate the financial impact of a breach.

Why Other Options Are Wrong

A. Explain to her management that breaches will occur

Acknowledging that breaches can happen is part of risk assessment, but it does not transfer risk—it only raises awareness. The organization must take action to manage the risk effectively.

B. Blame future breaches on competitors

Shifting blame to competitors is not a valid risk management strategy and does not protect the organization from financial or legal consequences.

C. Sell her organization's data to another organization

Selling data does not transfer security risks; instead, it could result in severe legal consequences for violating data protection regulations like GDPR or CCPA.

Correct Answer

D. All of the above

Explanation

A disaster recovery plan (DRP) is a comprehensive document that outlines an organization’s strategy for handling and recovering from disasters. It includes steps to prepare for, respond to, and recover from disruptions to ensure business continuity.

1. Before the disaster – Organizations assess risks, implement preventive measures, and create recovery plans. This includes setting up backup systems, training employees, and testing response procedures.

2. During the disaster – The DRP provides guidance on how to respond to the crisis in real time, ensuring systems are contained, critical operations are maintained, and damage is minimized.

3. After the disaster – The recovery phase focuses on restoring normal business operations, analyzing the incident, and improving future preparedness based on lessons learned.

Why Other Options Are Wrong

A. What to do before the disaster

While prevention is a crucial aspect of disaster recovery, only focusing on preparation ignores the importance of an immediate response and post-disaster recovery.

B. What to do during the disaster

A DRP must cover more than just the response phase—it must also include prevention and recovery plans to ensure a structured approach.

C. What to do after the disaster

Recovery is a critical phase, but without proper preparation and immediate response measures, damage could be significantly worse. A full DRP must address all phases of disaster handling.

Correct Answer

D. Systems should be restored within four hours with a loss of one day's worth of data at most.

Explanation

An RTO (Recovery Time Objective) of four hours means that systems must be fully restored and operational within four hours of a failure or incident. An RPO (Recovery Point Objective) of one day means that, at worst, the company may lose up to one day's worth of data since the last backup. Together, these metrics define the company's disaster recovery strategy, ensuring minimal downtime while managing data loss risks.

Why Other Options Are Wrong

A. Systems should be restored within one day and should remain operational for at least four hours.

This misinterprets RTO and RPO. The RTO is four hours, meaning systems must be restored in that time, not one day. Additionally, there is no mention of a system needing to be operational for only four hours.

B. Systems should be restored within four hours and no later than one day after the incident.

This incorrectly suggests a range for restoration time, but RTO is a maximum limit of four hours. The system should not take longer than that to be restored.

C. Systems should be restored within one day and, at most, four hours' worth of data.

This confuses RPO and RTO. RPO defines data loss tolerance, not the system recovery time. The correct RPO is one day, not four hours

Correct Answer

B. A set of recommended security configurations to secure Windows 10

Explanation

The CIS (Center for Internet Security) benchmark for Windows 10 provides a set of recommended security configurations to enhance system security. These benchmarks help organizations apply best practices for securing operating systems, reducing vulnerabilities, and maintaining compliance with security standards.

Why Other Options Are Wrong

A. Information on how secure Windows 10 is in its default state

While the CIS benchmarks provide security guidelines, they do not simply evaluate Windows 10 in its default state. Instead, they recommend specific security settings to improve security beyond the default configuration.

C. Performance benchmark tools for Windows 10 systems, including network speed and firewall throughput

CIS benchmarks focus on security hardening, not system performance. Performance benchmarks involve testing speed and efficiency, which is unrelated to the CIS security framework.

D. Vulnerability scan data for Windows 10 systems provided by various manufacturers

The CIS benchmarks do not provide vulnerability scan data. Instead, they offer security configuration recommendations. Vulnerability scans are typically performed using security tools such as Nessus or Qualys, not CIS benchmarks.

Correct Answer

C. Separation of duties

Explanation

Separation of duties (SoD) is a security principle that prevents one person from having complete control over a critical process. By splitting account creation and permission configuration between two employees, the organization reduces the risk of fraud, errors, or misuse.

Why Other Options Are Wrong

A. Background checks

Background checks verify an employee’s history and credibility but do not involve dividing responsibilities.

B. Job rotation

Job rotation involves periodically shifting employees between roles to reduce fraud and increase cross-training, but it does not directly relate to dividing security tasks.

D. Collusion

Collusion is when two or more individuals work together for fraudulent purposes. The scenario describes a security control to prevent fraud, not an example of collusion.

Correct Answer

D. This may violate a nondisclosure agreement.

Explanation

A nondisclosure agreement (NDA) is a legal contract that restricts the sharing of confidential information with unauthorized parties. If Acme Corporation sends proprietary data to a third-party vendor, it could breach its NDA with your company. Before sharing any data, Acme must verify whether the agreement allows for such disclosures and, if necessary, obtain explicit permission.

Why Other Options Are Wrong

A. This data should be encrypted before it is sent to the third-party vendor.

Encrypting data helps protect confidentiality, but encryption alone does not address whether Acme is authorized to share the data. If the NDA prohibits sharing, encryption does not resolve the legal issue.

B. This may constitute unauthorized data sharing.

Unauthorized data sharing is a concern, but the main legal issue stems from violating the NDA. If the NDA permits data sharing with third parties under certain conditions, then it may not necessarily be unauthorized.

C. This may violate the privileged user role-based awareness training.

Privileged user role-based awareness training ensures that employees understand access control and security responsibilities. However, it does not govern external data sharing agreements, which are typically covered by NDAs or service contracts.

Correct Answer

B. A risk register

Explanation

A risk register is a document that organizations use to track and manage risks. It includes details such as risk ratings, potential impact, mitigation strategies, assigned owners, and remediation status. The risk register helps organizations maintain oversight of risks and ensures accountability in risk management.

Why Other Options Are Wrong

A. An SSAE is incorrect because SSAE (Statements on Standards for Attestation Engagements) refers to auditing standards rather than a risk-tracking document.

C. A risk table is incorrect because, while it may refer to a structured way of organizing risks, it is not the widely accepted industry term for a formal risk-tracking document.

D. A DSS is incorrect because DSS (Decision Support System) refers to a system that aids in making business decisions, not a risk management record.

Correct Answer

C. They cannot use interactive logins

Explanation

Service accounts are non-human accounts used by applications, scripts, or automated processes to perform system functions. A key security policy is to prevent these accounts from having interactive logins, as allowing interactive access can pose a security risk by enabling unauthorized access to system resources.

Why Other Options Are Wrong

A. They must be issued only to system administrators is incorrect because service accounts are typically assigned to applications, not individual administrators. Limiting service accounts to administrators would be too restrictive and unnecessary for many automated processes.

B. They must use multifactor authentication is incorrect because service accounts are often used by non-human processes, making MFA impractical or impossible to implement in many cases. Instead, strong password policies and restricted access controls are preferred.

D. All of the above is incorrect because not all the statements are true. While security best practices exist for service accounts, they are not necessarily limited to administrators, nor do they always require MFA.

Correct Answer

C. MTBF (Mean Time Between Failures)

Explanation

MTBF (Mean Time Between Failures) is a metric that measures the average time a hardware component, such as a hard drive, operates before experiencing failure. It is commonly used to estimate hardware reliability and predict maintenance schedules.

Why Other Options Are Wrong

A. MTTR (Mean Time to Repair)

MTTR measures the average time required to repair a failed system and restore it to operational status. It does not indicate how reliable a hard drive is before failure.

B. RPO (Recovery Point Objective)

RPO refers to the maximum acceptable amount of data loss in the event of a failure. It is related to data recovery policies rather than the reliability of a hard drive.

D. ALE (Annualized Loss Expectancy)

ALE calculates the expected annual cost of security incidents based on risk assessments. It is a financial metric, not a measure of hardware reliability.