Control Implementation

You are implementing Windows AppLocker. You want to ensure that only signed binaries from your organization are executed. Which configuration should you choose?

To ensure compliance with PCI-DSS for a database, you must implement FDE (Full Disk Encryption). Which tool is appropriate for a Linux-based server?

You are configuring an AWS Security Group for a web server. To allow incoming HTTPS traffic from the internet while restricting all other traffic, which rule should you apply?

You are setting up an IDS/IPS (e.g., Snort). Where should you place the sensor to monitor both internal and external traffic?

You are deploying a PKI solution using Microsoft AD CS. You need to ensure that compromised certificates can be revoked. What must be configured?

You need to enforce MFA on Azure AD (Microsoft Entra ID) users. Which policy type is the most recommended for modern authentication control?

When implementing an 802.1X environment, what is the role of the RADIUS server?

In VMware vSphere, what is the best practice for securing virtual machine consoles?

You are securing a database server. What is the most effective administrative control to minimize the impact of a compromised DBA account?

You are managing an AWS S3 bucket that stores sensitive PII. Which control is the primary mechanism to prevent public access?

What is the physical security control used to prevent piggybacking at an entry point?

A developer needs to access a production server. To maintain the highest level of security, how should you implement this access?

You are configuring a Linux firewall using 'iptables'. Which chain should you use to filter traffic destined for the local host?

When performing vulnerability management, what is the purpose of a 'credentialed scan'?

You are deploying an EDR (Endpoint Detection and Response) solution. Which configuration minimizes false positives while maintaining visibility?

Which administrative control is essential before deploying a new security tool to production?

Which type of control is an alarm system installed in a server room?

You are hardening a web server. You need to ensure that only secure ciphers are used for TLS connections. Where is this typically configured?

Which document is used to standardize the implementation of security controls across an organization?

You are implementing Disk Encryption using BitLocker. You want to ensure that the recovery key is stored securely. Where should it be stored?

Which TWO of the following are examples of physical security controls?

Which TWO of the following represent best practices for password management?

Which TWO of the following are considered 'technical' security controls?

Which TWO of the following are recommended practices for managing firewall rules?

Which TWO of the following are examples of administrative security controls?

Which TWO of the following are critical requirements for implementing an effective patch management program?

Which THREE of the following are steps required to properly decommission a server containing sensitive data?

Which THREE of the following are components of a secure server hardening process?

Which TWO of the following are effective ways to secure endpoints against malware?

Which THREE of the following are elements of a secure incident response control set?

A financial services firm must comply with GLBA Safeguards Rule. The security team is implementing encryption for data at rest on a new PostgreSQL database. Which of the following is the most appropriate control to protect the data if the underlying storage media is physically stolen?

A healthcare organization is implementing controls to comply with HIPAA Security Rule. The security team is configuring audit logging for a new electronic health record (EHR) system. Which two of the following are essential elements to include in the audit log configuration to meet HIPAA's audit control requirements? (Choose two.)

A security administrator at a financial firm is hardening a new Windows Server 2022 domain controller. The administrator must ensure that the server meets the organization's requirement to enforce a minimum password length of 14 characters and account lockout after 5 invalid attempts. Which control type best describes the configuration of these settings?

A retail company is implementing a new point-of-sale (POS) system that must comply with PCI-DSS. The security manager is reviewing the network architecture and wants to ensure that the POS systems are isolated from the corporate network. Which of the following controls best achieves this isolation while allowing necessary communication with the payment processor?

A healthcare organization must protect electronic protected health information (ePHI) in a new cloud-based patient portal. The security team decides to implement a control that renders data unreadable to unauthorized parties even if the storage media is compromised. Which of the following best describes this type of control?

A financial services firm is implementing a new credit-scoring application that processes consumer PII. The CISO mandates that the application must enforce a control that restricts access based on the sensitivity of the data and the user's role, and that the control must be evaluated during the design phase. Which type of control is the CISO requiring?

A financial services firm is implementing a new payment processing system. The security architect must ensure that all changes to the production environment are authorized, tested, and documented before deployment. Which of the following controls best addresses this requirement?

A multinational corporation is implementing a new cloud-based ERP system. The GRC analyst must ensure that the control environment aligns with the organization's risk appetite. The CISO asks for a control that provides reasonable assurance that transactions are authorized and recorded accurately. Which type of control is most appropriate?

A healthcare organization must implement a control to protect electronic protected health information (ePHI) from unauthorized access during transmission over a public network. The security team has decided to use Transport Layer Security (TLS) 1.3. Which statement best describes why TLS 1.3 satisfies the HIPAA Security Rule's transmission security requirement?

A security manager is reviewing the controls for a new web application that processes credit card payments. The manager must ensure that the application complies with PCI DSS requirement 6.5.1, which addresses injection flaws. Which control should be implemented to mitigate SQL injection attacks?

A government agency is implementing a new case management system. The security policy requires that all users be granted only the minimum access necessary to perform their job functions. Which principle is being applied?

A financial institution is implementing a new system to detect and respond to insider threats. The security team wants to monitor user behavior and flag anomalous activities, such as accessing large amounts of data outside normal working hours. Which type of control is being implemented?

A government agency is implementing a new case management system that will store sensitive law enforcement data. The GRC team must ensure that the system meets the requirements of the Criminal Justice Information Services (CJIS) Security Policy. The agency's CIO asks for a control that ensures only authorized personnel can access the system and that their activities are tracked. Which combination of controls should be implemented?

A multinational corporation is deploying a new encryption solution for data at rest across its global data centers. The security team must ensure that encryption keys are managed securely and can be recovered in case of disaster. Which of the following is the most appropriate key management practice?

A retail company is deploying a new point-of-sale (POS) system. The GRC analyst is asked to recommend a control that will reduce the risk of card skimming and tampering. Which type of control is most appropriate?

A retail company is implementing controls to comply with the Payment Card Industry Data Security Standard (PCI DSS). The security manager needs to ensure that cardholder data is protected when stored on backup tapes. Which control should be implemented to meet PCI DSS Requirement 3?

A federal agency is implementing controls to comply with the Federal Information Security Modernization Act (FISMA). The agency uses the NIST Risk Management Framework (RMF). During the control implementation phase, the security team must select controls based on the system's security categorization. Which NIST Special Publication provides the catalog of security and privacy controls?

A multinational corporation is implementing controls to comply with the General Data Protection Regulation (GDPR). The security team must ensure that personal data of EU citizens is protected during processing. Which control best addresses the GDPR principle of data protection by design and by default?

A financial services firm is implementing controls for a new mobile banking application that processes customers' personally identifiable information. The GRC analyst must select a control that provides strong confidentiality for data at rest on the mobile device and allows remote verification that the device has not been rooted or jailbroken. Which control BEST meets these requirements?

A multinational corporation is implementing controls to protect sensitive intellectual property stored in a hybrid cloud environment. The GRC team must ensure that data remains confidential and integrity-protected both at rest and in use within a trusted execution environment (TEE). Which TWO controls are MOST appropriate to achieve these objectives? (Choose two.)

A software development company is implementing controls for its CI/CD pipeline. The GRC analyst must ensure that only approved and unaltered code is deployed to production. Which control BEST achieves this objective?