Governance, Risk, and Compliance (D486)

Correct Answer

C. Antivirus software

Explanation

A corrective control is designed to mitigate the impact of a security incident after it has occurred. Antivirus software is a corrective control because it identifies, quarantines, and removes malware after an infection is detected, thereby reducing damage to the system.

Why Other Options Are Wrong

A. IDS

An Intrusion Detection System (IDS) is a detective control, not a corrective control. It monitors network traffic for suspicious activity but does not actively take action to remediate threats.

B. Audit logs

Audit logs are also detective controls, as they record system activities and help in post-incident analysis rather than correcting security issues in real time.

D. Router

A router primarily serves as a preventive control, as it directs network traffic and can be configured with security measures like access control lists (ACLs) to prevent unauthorized access. It does not actively correct security incidents.

Correct Answer

C. Due to regulations or laws

Explanation

A privacy notice is a legally required document that informs users about how their personal data is collected, used, stored, and protected. Many jurisdictions, such as the European Union's General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other data privacy laws, require businesses to provide transparent privacy notices to users. Failure to comply with these regulations can lead to fines, penalties, or legal action.

Why Other Options Are Wrong

A. To warn attackers about security measures

Privacy notices are intended for users, not attackers. They describe data handling practices but do not include details about security measures, as revealing security details would create vulnerabilities.

B. To avoid lawsuits

While having a privacy notice can help reduce legal risks, the primary reason for including it is compliance with privacy laws, not simply to avoid lawsuits. A well-crafted privacy notice aligns with regulations and informs users, which indirectly helps in preventing legal issues.

D. None of the above

This option is incorrect because privacy notices are required by law in many countries, making option C the most accurate choice.

Correct Answer

C. Physical

Explanation

A lock is a physical security control because it is a tangible mechanism used to restrict access to a location or object. Physical controls help prevent unauthorized access by acting as a barrier to entry. Other examples of physical controls include fences, security guards, and access control doors.

Why Other Options Are Wrong

A. Managerial is incorrect because managerial controls involve policies, procedures, and administrative actions rather than physical security measures.

B. Technical is incorrect because technical controls involve the use of technology, such as firewalls, encryption, and intrusion detection systems, not physical barriers like locks.

D. Corrective is incorrect because corrective controls are implemented after an incident to restore security, such as restoring backups or patching vulnerabilities. A lock is a preventive measure rather than a corrective one.

Correct Answer

C. Proprietary

Explanation

The "Proprietary" label is commonly used for sensitive company information, such as trade secrets, that should be protected from unauthorized disclosure. Proprietary data is confidential and intended for internal use or restricted access within the company. This classification ensures that only authorized personnel can view or modify the information, reducing the risk of data leaks or theft.

Why Other Options Are Wrong

A. High is a general security label but does not specifically indicate that the data belongs to the company as a trade secret. While "high" might indicate importance, it lacks specificity in defining intellectual property protections.

B. Top secret is a classification typically used in government or military settings for national security information. While trade secrets are confidential, they do not typically require the extreme restrictions that "top secret" classification implies.

D. Low would not be an appropriate classification for trade secrets, as it implies minimal security controls and accessibility to a broad audience. Trade secrets require higher protection to prevent unauthorized access or misuse.

Correct Answer

D. Civilian

Explanation

The U.S. government follows a strict classification system to protect sensitive information. The three most common classification levels are Top Secret, Secret, and Confidential, which are used to determine access restrictions based on the potential harm their disclosure could cause to national security. The term "Civilian" is not a recognized classification level within the U.S. government system. Instead, civilian-related information typically falls under unclassified data, which does not require the same security controls as classified information. Since "Civilian" does not fit into this system, it is the correct answer.

Why Other Options Are Wrong

A. Top Secret

Top Secret is the highest level of classification in the U.S. government. Information labeled as Top Secret could cause exceptionally grave damage to national security if disclosed without authorization. Access to Top Secret information is tightly controlled, and individuals must undergo rigorous background checks and security clearances before gaining access. Examples of Top Secret data include military operations, nuclear launch codes, and high-level intelligence reports.

B. Secret

Secret classification applies to information that, if leaked, could cause serious damage to national security but is not as critical as Top Secret. This level is commonly used for military operations, diplomatic communications, and government research that must remain confidential. Secret information still requires proper security protocols and clearance levels for access.

C. Confidential

Confidential classification is the lowest level of classified information in the U.S. government system. While not as sensitive as Secret or Top Secret data, its disclosure could still cause harm to national security. This classification often applies to internal government documents, operational procedures, and law enforcement reports. Confidential information is protected by security controls but does not require the same level of clearance as higher classifications.

Correct Answer

C. PCI-DSS

Explanation

The Payment Card Industry Data Security Standard (PCI-DSS) is a global security standard designed to protect credit card data and transactions. It establishes requirements for secure data handling, encryption, access controls, and monitoring to prevent fraud and breaches in payment processing systems. Compliance with PCI-DSS is mandatory for businesses that store, process, or transmit credit card information.

Why Other Options Are Wrong

A. GDPR

The General Data Protection Regulation (GDPR) is a privacy law that protects personal data for individuals in the European Union. While it includes security measures, it is focused on broader data privacy rather than credit card security specifically.

B. COPPA

The Children's Online Privacy Protection Act (COPPA) is a U.S. law designed to protect the privacy of children under 13 when using online services. It regulates how websites and online platforms collect and handle children's personal information but does not address credit card security.

D. CIS

The Center for Internet Security (CIS) provides security best practices and guidelines to improve cybersecurity, but it is not a compliance standard for credit card transactions. It offers recommendations for securing systems but does not specifically regulate payment card data.

Correct Answer

C. Onboarding

Explanation

Onboarding is the process of integrating new employees into an organization by setting up their accounts, providing access to systems, and assigning necessary resources like mobile devices. It ensures they can perform their job duties securely and efficiently.

Why Other Options Are Wrong

A. Offboarding

Offboarding is the opposite process—it involves removing access, deactivating accounts, and collecting company devices when an employee leaves the organization.

B. System owner

A system owner is responsible for managing a specific IT system, including security policies and maintenance, but does not perform onboarding tasks.

D. Executive user

An executive user is a high-level employee with privileged access, but this is not related to the process of creating user accounts for new hires.

Correct Answer

D. The right to anonymity

Explanation

The General Data Protection Regulation (GDPR) grants individuals rights over their personal data, including access, deletion, and portability. However, GDPR does not explicitly provide a "right to anonymity." It focuses on protecting and managing personal data rather than enforcing complete anonymity.

Why Other Options Are Wrong

A. The right to access

GDPR allows individuals to request access to their personal data and understand how it is used.

B. The right to be forgotten

Also known as the right to erasure, individuals can request their data be deleted if no longer needed.

C. The right to data portability

Individuals can request their data in a structured, commonly used format to transfer to another service provider.

Correct Answer

B. Using a nonadministrative account for activities

Explanation

Using a nonadministrative account limits the permissions available to malware in case of infection. If malware executes within an account that lacks administrative privileges, it is less likely to perform system-level changes, reducing the risk of severe damage. This is a fundamental security best practice for mitigating malware-related risks.

Why Other Options Are Wrong

A. Implement host-based antimalware can detect and remove some malware, but it is not foolproof. Advanced malware can evade detection, and relying solely on antimalware software does not address the risk of malware gaining administrative privileges.

C. Implementing full-disk encryption (FDE) protects data at rest, meaning it secures information when the device is powered off. However, it does not prevent malware from executing or spreading if an account with administrative access is compromised.

D. Making certain the operating systems are patched is crucial for overall security but does not specifically mitigate the risk of malware gaining administrative access. While patches close vulnerabilities, they do not restrict a compromised user’s permissions.