An online retail company has formulated a record retention schedule for customer transactions. Which of the following is a valid reason a customer transaction is kept beyond the retention schedule?

When is security personnel involvement in the Systems Development Life Cycle (SDLC) process MOST beneficial?

Which of the following is a critical factor for implementing a successful data classification program?

During an audit, the auditor finds evidence of potentially illegal activity. Which of the following is the MOST appropriate action to take?

Which of the following provides effective management assurance for a Wireless Local Area Network (WLAN)?

With data labeling, which of the following MUST be the key decision maker?

Refer to the information below to answer the question.
A security practitioner detects client-based attacks on the organization’s network. A plan will be necessary to address these concerns.
What MUST the plan include in order to reduce client-side exploitation?

A security manager has noticed an inconsistent application of server security controls resulting in vulnerabilities on critical systems. What is the MOST likely cause of this issue?

Refer to the information below to answer the question.
A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee’s access.
Which of the following solutions would have MOST likely detected the use of peer-to-peer programs when the computer was connected to the office network?

Which of the following is an example of two-factor authentication?

What is the MOST important reason to configure unique user IDs?

Refer to the information below to answer the question.
An organization has hired an information security officer to lead their security department. The officer has adequate people resources but is lacking the other necessary components to have an effective security program. There are numerous initiatives requiring security involvement.
Which of the following is considered the MOST important priority for the information security officer?

Which of the following is the PRIMARY benefit of a formalized information classification program?

According to best practice, which of the following is required when implementing third party software in a production environment?

Refer to the information below to answer the question.
During the investigation of a security incident, it is determined that an unauthorized individual accessed a system which hosts a database containing financial information.
If the intrusion causes the system processes to hang, which of the following has been affected?

Which of the following is a MAJOR consideration in implementing a Voice over IP (VoIP) network?

Which of the following assures that rules are followed in an identity management architecture?

Refer to the information below to answer the question.
A new employee is given a laptop computer with full administrator access. This employee does not have a personal computer at home and has a child that uses the computer to send and receive e-mail, search the web, and use instant messaging. The organization’s Information Technology (IT) department discovers that a peer-to-peer program has been installed on the computer using the employee’s access.
Which of the following could have MOST likely prevented the Peer-to-Peer (P2P) program from being installed on the computer?

Which of the following BEST describes a Protection Profile (PP)?

Sensitive customer data is going to be added to a database. What is the MOST effective implementation for ensuring data privacy?

While inventorying storage equipment, it is found that there are unlabeled, disconnected, and powered off devices. Which of the following is the correct procedure for handling such equipment?

What is the PRIMARY difference between security policies and security procedures?

Which of the following standards/guidelines requires an Information Security Management System (ISMS) to be defined?

What is the process called when impact values are assigned to the security objectives for information types?

An organization has decided to contract with a cloud-based service provider to leverage their identity as a service offering. They will use Open Authentication (OAuth) 2.0 to authenticate external users to the organization’s services.
As part of the authentication process, which of the following must the end user provide?

If compromised, which of the following would lead to the exploitation of multiple virtual machines?

What is the MOST efficient way to secure a production program and its data?

Which of the following is a recommended alternative to an integrated email encryption system?

Which of the following is the BEST example of weak management commitment to the protection of security assets and resources?

If an identification process using a biometric system detects a 100% match between a presented template and a stored template, what is the interpretation of this result?

Retaining system logs for six months or longer can be valuable for what activities?

Which of the following BEST describes a rogue Access Point (AP)?

Which of the following is the MOST effective method of mitigating data theft from an active user workstation?

Which of the following is the BEST method to assess the effectiveness of an organization’s vulnerability management program?

Which of the following prevents improper aggregation of privileges in Role Based Access Control (RBAC)?

Which of the following explains why record destruction requirements are included in a data retention policy?

Which of the following is the MOST likely cause of a non-malicious data breach when the source of the data breach was an un-marked file cabinet containing sensitive documents?

An organization lacks a data retention policy. Of the following, who is the BEST person to consult for such requirement?

What should happen when an emergency change to a system must be performed?

Which security approach will BEST minimize Personally Identifiable Information (PII) loss from a data breach?