You are configuring a SIEM (e.g., Splunk) to monitor failed login attempts. What is the most efficient way to reduce noise while maintaining audit integrity?
A multinational corporation is deploying a new cloud-based customer relationship management (CRM) system. The security team must ensure that data stored in the CRM is protected in accordance with the organization's data classification policy. Which two of the following controls are most appropriate to implement for data at rest in the CRM? (Choose two.)
A retail company is deploying a new point-of-sale (POS) system that must comply with PCI DSS. The security team is reviewing logical access controls for the POS environment. Which TWO of the following are appropriate logical access controls to implement? (Choose two.)
A financial services firm is implementing controls to comply with the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule. The security team is evaluating technical controls for protecting customer nonpublic personal information (NPI). Which two of the following are appropriate technical controls to mitigate the risk of unauthorized access to NPI? (Choose two.)
You are implementing Windows AppLocker. You want to ensure that only signed binaries from your organization are executed. Which configuration should you choose?
You are configuring an AWS Security Group for a web server. To allow incoming HTTPS traffic from the internet while restricting all other traffic, which rule should you apply?
A financial services firm must comply with GLBA Safeguards Rule. The security team is implementing encryption for data at rest on a new PostgreSQL database. Which of the following is the most appropriate control to protect the data if the underlying storage media is physically stolen?
A healthcare organization is implementing controls to comply with HIPAA Security Rule. The security team is configuring audit logging for a new electronic health record (EHR) system. Which two of the following are essential elements to include in the audit log configuration to meet HIPAA's audit control requirements? (Choose two.)
A security administrator at a financial firm is hardening a new Windows Server 2022 domain controller. The administrator must ensure that the server meets the organization's requirement to enforce a minimum password length of 14 characters and account lockout after 5 invalid attempts. Which control type best describes the configuration of these settings?
A retail company is implementing a new point-of-sale (POS) system that must comply with PCI-DSS. The security manager is reviewing the network architecture and wants to ensure that the POS systems are isolated from the corporate network. Which of the following controls best achieves this isolation while allowing necessary communication with the payment processor?
A healthcare organization must protect electronic protected health information (ePHI) in a new cloud-based patient portal. The security team decides to implement a control that renders data unreadable to unauthorized parties even if the storage media is compromised. Which of the following best describes this type of control?
A financial services firm is implementing a new credit-scoring application that processes consumer PII. The CISO mandates that the application must enforce a control that restricts access based on the sensitivity of the data and the user's role, and that the control must be evaluated during the design phase. Which type of control is the CISO requiring?
A financial services firm is implementing a new payment processing system. The security architect must ensure that all changes to the production environment are authorized, tested, and documented before deployment. Which of the following controls best addresses this requirement?
A multinational corporation is implementing a new cloud-based ERP system. The GRC analyst must ensure that the control environment aligns with the organization's risk appetite. The CISO asks for a control that provides reasonable assurance that transactions are authorized and recorded accurately. Which type of control is most appropriate?
A healthcare organization must implement a control to protect electronic protected health information (ePHI) from unauthorized access during transmission over a public network. The security team has decided to use Transport Layer Security (TLS) 1.3. Which statement best describes why TLS 1.3 satisfies the HIPAA Security Rule's transmission security requirement?
A security manager is reviewing the controls for a new web application that processes credit card payments. The manager must ensure that the application complies with PCI DSS requirement 6.5.1, which addresses injection flaws. Which control should be implemented to mitigate SQL injection attacks?
A government agency is implementing a new case management system. The security policy requires that all users be granted only the minimum access necessary to perform their job functions. Which principle is being applied?
A financial institution is implementing a new system to detect and respond to insider threats. The security team wants to monitor user behavior and flag anomalous activities, such as accessing large amounts of data outside normal working hours. Which type of control is being implemented?
A government agency is implementing a new case management system that will store sensitive law enforcement data. The GRC team must ensure that the system meets the requirements of the Criminal Justice Information Services (CJIS) Security Policy. The agency's CIO asks for a control that ensures only authorized personnel can access the system and that their activities are tracked. Which combination of controls should be implemented?
A multinational corporation is deploying a new encryption solution for data at rest across its global data centers. The security team must ensure that encryption keys are managed securely and can be recovered in case of disaster. Which of the following is the most appropriate key management practice?
A retail company is deploying a new point-of-sale (POS) system. The GRC analyst is asked to recommend a control that will reduce the risk of card skimming and tampering. Which type of control is most appropriate?
A retail company is implementing controls to comply with the Payment Card Industry Data Security Standard (PCI DSS). The security manager needs to ensure that cardholder data is protected when stored on backup tapes. Which control should be implemented to meet PCI DSS Requirement 3?
A federal agency is implementing controls to comply with the Federal Information Security Modernization Act (FISMA). The agency uses the NIST Risk Management Framework (RMF). During the control implementation phase, the security team must select controls based on the system's security categorization. Which NIST Special Publication provides the catalog of security and privacy controls?
A multinational corporation is implementing controls to comply with the General Data Protection Regulation (GDPR). The security team must ensure that personal data of EU citizens is protected during processing. Which control best addresses the GDPR principle of data protection by design and by default?
A financial services firm is implementing controls for a new mobile banking application that processes customers' personally identifiable information. The GRC analyst must select a control that provides strong confidentiality for data at rest on the mobile device and allows remote verification that the device has not been rooted or jailbroken. Which control BEST meets these requirements?
A multinational corporation is implementing controls to protect sensitive intellectual property stored in a hybrid cloud environment. The GRC team must ensure that data remains confidential and integrity-protected both at rest and in use within a trusted execution environment (TEE). Which TWO controls are MOST appropriate to achieve these objectives? (Choose two.)
A software development company is implementing controls for its CI/CD pipeline. The GRC analyst must ensure that only approved and unaltered code is deployed to production. Which control BEST achieves this objective?