Free CompTIA Security+ Practice Chapter 11

Ref: CompTIA Security Plus Get Certified Get Ahead SY0-701 Study Guide

CompTIA Security+ (SY0-701) – Chapter 11

1 / 145

Which of the following best describes the General Data Protection Regulation (GDPR)?

A. It’s a U.S. regulation that mandates protection of health information.

B. A mandate by the European Union that deals with the protection of privacy data for residents of the EU.

C. It’s a directive by the EU that aims to regulate financial institutions and their handling of consumer information.

D. A regulation that holds executives in a corporation responsible for the accuracy of financial reports.

2 / 145

Why is interviewing witnesses a crucial part of an investigation in an organization?

A. Witnesses can provide alibis for employees

B. Witnesses help establish timelines and provide firsthand accounts of events

C. Witnesses provide secondhand reports of events

D. Witnesses are always willing to share valuable information

3 / 145

What does a Measurement Systems Analysis (MSA) evaluate?

A. The performance expectations of a vendor

B. The common goals between two or more parties

C. The processes and tools used to make measurements

D. The guidance on how to limit access given to vendors

4 / 145

What is the primary function of a Non-Disclosure Agreement (NDA) in a business context?

A. To prohibit employees from distributing proprietary data

B. To legalize the sharing of proprietary data between parties

C. To remind employees of their responsibilities during the offboarding process

D. To facilitate collaboration between two organizations

5 / 145

What is file shredding in the context of data sanitization?

A. The process of physically destroying media.

B. A special process required for the sanitization of solid-state drives.

C. Passing a disk through a magnetic field.

D. The technique of repeatedly overwriting the space where the file is located with 1s and 0s.

6 / 145

What is one of the functionalities of FTK imager as part of the Forensic Toolkit (FTK)?

A. It can duplicate data by using the dd command

B. It can copy hardware devices connected to the system

C. It allows you to view and analyze data within the image

D. It adds command-line utilities from The Sleuth Kit (TSK)

7 / 145

What does the onboarding process in an organization involve according to the text?

A. Granting full access to the organization’s resources

B. Providing the employee with maximum privilege levels

C. Granting individuals access to an organization’s resources

D. Blocking employee access to most computing resources

8 / 145

What does a security incident entail as defined by most organizations?

A. An event leading to negative impact only on data confidentiality

B. A series of events affecting only the integrity of systems

C. Any adverse event or series of events that could negatively impact data and system integrity, confidentiality, or availability

D. Unauthorized access to data only

9 / 145

What is the main purpose of analyzing Event logs during a forensic investigation?

A. To check the latest software updates

B. To identify which applications were running during an event

C. To recreate events leading up to and during an incident

D. To estimate the cost of damage caused by an event

10 / 145

What is the meaning of ’end of life’ (EOL) in the context of supply chain and vendor management?

A. The date when a product will no longer be offered for sale.

B. The date when a vendor ends the support for their product.

C. The date when a vendor stops resolving vulnerabilities for their product.

D. The date when a product is expected to break down and stop functioning.

11 / 145

What is the responsibility of a data custodian/steward in an organization?

A. Determines why and how personal data should be processed

B. Ensures the organization is complying with all relevant laws

C. Handles routine daily tasks such as backing up data

D. Ensures adequate security controls are in place to protect the data

12 / 145

What does the ’Eradication’ phase of the incident response process involve?

A. Taking steps to prevent an incident from recurring

B. Verifying that an incident has occurred

C. Isolating the system and making sure that the problem does not spread

D. Removing all components of an attack, such as uninstalling malware or deleting compromised accounts

13 / 145

What is the primary purpose of the containment phase in an incident response process?

A. To investigate if an event is a security incident

B. To return all affected systems to normal operation

C. To isolate or contain the security incident to protect critical systems

D. To establish and maintain an incident response plan and procedures

14 / 145

According to the U.S government’s data classification, what does the ’Confidential’ classification mean?

A. This data, if disclosed to unauthorized entities, can cause serious damage to national security.

B. This data, if disclosed to unauthorized entities, could cause exceptionally grave damage to national security.

C. This data, if disclosed to unauthorized entities, could cause damage to national security.

D. This data is generally available to anyone.

15 / 145

What are the benefits of implementing a data retention policy?

A. It reduces the amount of resources required to retain the data and minimizes legal liabilities.

B. It ensures that a company retains all of its emails indefinitely.

C. It requires administrators to recover archives or search for specific emails in response to a court order.

D. It obliges companies to provide evidence from previous years in legal investigations.

16 / 145

What’s the primary purpose of implementing digital forensic techniques in organizations?

A. To modify the collected data

B. To use the collected data as evidence in court

C. To isolate the incident

D. To control the crime scene

17 / 145

Within the context of GDPR-related roles, what is the main responsibility of a ’Data Processor’?

A. They determine why and how personal data should be processed.

B. They ensure the organization is complying with all relevant laws and act as an independent advocate for customer data.

C. They are responsible for routine daily tasks such as backing up data, storage of the data, and implementation of business rules.

D. They use and manipulate the data on behalf of the data controller.

18 / 145

What is the primary reason for data masking?

A. To convert fake data into real data

B. To protect sensitive information

C. To create more data

D. To allow unauthorized users access to specific data

19 / 145

What are the responsibilities of a Data Protection Officer according to the General Data Protection Regulation (GDPR)?

A. They are responsible for ensuring adequate security controls are in place to protect the data.

B. They control all employee data and decide what data to release to the data processor.

C. They use and manipulate data on behalf of the data controller.

D. They ensure the organization is complying with all relevant laws and act as an independent advocate for customer data.

20 / 145

What additional risks can be seen when an organization uses cloud resources?

A. All the data is stored within the organization

B. The cloud provider becomes a third-party source providing the service

C. Users lose the ability to access data via the internet

D. The data centers holding the data and cloud-based apps are limited to specific locations

21 / 145

What does the ’Preparation’ phase in an incident response process include?

A. Providing guidance to personnel on how to respond to an incident

B. Isolating or containing an identified incident

C. Removing all malicious components from an attack

D. Analyzing the incident and the response to prevent a future occurrence

22 / 145

What is the main goal of data anonymization within a data set?

A. To remove all medical data

B. To remove all personal identifying information (PII)

C. To make data unsharable

D. To keep the data set small

23 / 145

What is the main objective of offboarding within an organization?

A. Conduct a background check

B. Grant new employees access to resources

C. Remove an employee’s access to resources and collect issued equipment

D. Analyze an individual’s online activity

24 / 145

What does proper procedure in the collection of documentation and evidence support?

A. Exposing the individuals’ involvement

B. Defamation of those involved

C. Allowing individuals to believably deny involvement

D. Ensuring personnel make few mistakes during collection

25 / 145

What are some common contents of a digital forensic analysis report?

A. A list of witnesses and testimonies

B. An executive summary and a list of evidence

C. Personal opinions of the forensic experts

D. A detailed biography of the suspect

26 / 145

What is the key difference between a service level agreement (SLA) and a memorandum of understanding (MOU)?

A. An SLA is less formal than an MOU.

B. An MOU stipulates performance expectations, while an SLA does not.

C. An SLA includes a monetary penalty if expectations are not met, an MOU does not.

D. An MOU includes a monetary penalty if expectations are not met, an SLA does not.

27 / 145

Which of the following laws mandates the use of privacy notices on websites?

A. Health Insurance Portability and Accountability Act (HIPAA)

B. Gramm-Leach Bliley Act (GLBA)

C. Sarbanes-Oxley Act (SOX)

D. General Data Protection Regulation (GDPR)

28 / 145

What is commonly placed on a tag attached to possible evidence in a cybersecurity investigation?

A. The location where the evidence was found

B. The name of the suspect

C. The date, time, and name of the person placing the tag

D. The serial number of the evidence

29 / 145

Which of the following best defines ’Public data’?

A. Information that an organization intends to keep secret among a certain group of people.

B. Data that needs to be protected against unauthorized access.

C. Data that is related to ownership, such as patents or trade secrets.

D. Data is available to anyone. It might be in brochures, press releases, or on websites.

30 / 145

What is data minimization as described in the given passage?

A. It is a method that increases the amount of data collected

B. It is a technique for retaining data indefinitely

C. It is a principle requiring organizations to limit the data they collect and use

D. It is a risk-reduction technique which encourages data proliferation

31 / 145

Which of the following is not a form of data classification used by the U.S. government?

A. Top Secret

B. Proprietary

C. Confidential

D. Secret

32 / 145

Which of the following types of forensic data would likely be most difficult for a non-expert to identify and extract?

A. Logs and data files

B. Web history

C. Recycle bin contents

D. Forensic artifacts

33 / 145

What is the primary security goal of a clean desk space policy?

A. To sanitize desks with antibacterial cleaners

B. To make sure employees are organized

C. To make a positive impression on customers

D. To reduce threats of security incidents by ensuring the protection of sensitive data

34 / 145

What is the underlying principle of ’least privilege’?

A. Granting all users maximum access to ensure everyone can function effectively.

B. Giving only the administrators complete access while limiting the access for all other users.

C. Granting users and processes only the privileges necessary to perform their tasks.

D. Only senior management should have full access, all other users should have minimum privilege.

35 / 145

Which of the following is not a type of data classification used by private companies, according to the text?

A. Public

B. Private

C. Proprietary

D. Financial

36 / 145

What describes the best the term ’Financial information’ as used in data classification for private organizations?

A. It is a type of data that is available to anyone.

B. It is data about monetary transactions of an organisation or individual.

C. It is a type of data kept secret among a certain group of people.

D. It is data related to ownership such as patents or trade secrets.

37 / 145

What forensic artifact contains the content and metadata of deleted files?

A. Web history

B. Recycle bin

C. Windows error reporting

D. Remote desktop protocol (RDP) cache

38 / 145

What is the main purpose of the ’Separation of Duties’ principle in IT and business processes?

A. To reduce the workload of each employee

B. To avoid any single person or entity from controlling all the functions of a critical or sensitive process

C. To guarantee that a single person can handle all the duties

D. To encourage teamwork among employees

39 / 145

Why do Mandatory vacation policies help in detecting fraudulent activities carried by employees?

A. They force the employee to make other arrangements for carrying out the fraud.

B. They force someone else to step in and handle the employee’s duties, potentially exposing any irregularities.

C. They make the employee realize the consequences of their actions.

D. They give the employer time to go through the employee’s personal belongings for evidence.

40 / 145

What does data governance encompass besides ensuring data consistency?

A. The management of a government

B. The process of governing a state

C. The management of availability, usability, integrity, and security of data

D. None of the above

41 / 145

What is the purpose of a phishing simulation in an organization?

A. To identify network vulnerabilities

B. To test employees’ susceptibility to phishing scams

C. To test the effectiveness of the organization’s firewall

D. To train the IT department in handling phishing attacks

42 / 145

Why do organizations implement Job Rotation policies?

A. To ensure that employees don’t get bored of their roles

B. To expose employees to different aspects of the business

C. To prevent or expose fraudulent activities and shortcuts

D. To increase productivity of employees

43 / 145

What purpose do security policies serve within a company’s security plan?

A. They detail the technical aspects of the company’s IT infrastructure

B. They emphasize on the marketing strategies of the company

C. They are administrative controls used to reduce and manage risk

D. They describe the hiring process of the company

44 / 145

Which of the following most accurately describes the term ’Proprietary data’ as used in private companies?

A. Data that is available to anyone

B. Data that needs to be protected against unauthorized access

C. Data that is kept secret among a certain group of people

D. Data related to ownership, such as patents or trade secrets

45 / 145

What is the purpose and function of ’Autopsy’ in the digital forensics as discussed in the CompTIA Security+ SY0-701 material?

A. It is a command-line utility that enables users to capture and extract memory contents and digital artifacts.

B. It edits, analyzes, and recovers data from all types of drives.

C. It is a graphical user interface (GUI) digital forensics platform that allows users to add command-line utilities from The Sleuth Kit (TSK).

D. It creates an image of a disk as a single file or multiple files and saves the image in various formats.

46 / 145

What does Stakeholder Management primarily refer to in the context of Comptia Security+ SY0-701?

A. It refers to the process of acquiring new stakeholders

B. It refers to the process of improving stakeholder’s financial situations

C. It refers to the process of creating and maintaining positive relationships with stakeholders

D. It refers to the process of gauging the stakeholder’s interest

47 / 145

What defines Personally Identifiable Information (PII)?

A. It is any information that can identify an individual.

B. It is only information like full name or birthday.

C. It is information related only to health.

D. It is only information that is involved in data breaches.

48 / 145

Why is it important to follow specific procedures when performing data acquisition for digital forensics?

A. It ensures that the data is not modified

B. It increases the speed of data collection

C. It allows for data to be more easily transferred to other systems

D. It reduces the amount of storage space needed for the data

49 / 145

What is the purpose of using snapshots in forensic analysis?

A. To capture real-time usage of a system

B. To capture data for future analysis

C. To capture screenshots of user activity

D. To capture video feed of users’ actions

50 / 145

Which of the following best describes the Computer-based training (CBT)?

A. It is a kind of training that requires a physical helper

B. A kind of training that occurs through a physical book

C. It is a training a person receives through interacting with an application on a computer

D. It is a one-on-one tutor-led training on a computer

51 / 145

What elements are commonly included in a communication plan as part of a Security Incident Response?

A. First Responders, Internal Communication, Law enforcement, and Reporting Requirements

B. Customers, Internal Communication, Incident Response Team, and Legal Entities

C. Law enforcement, First Responders, External Communication, and Senior Executives

D. First Responders, Internal Communication, Reporting Requirements, External Communication, Law enforcement, and Customer Communication

52 / 145

What is the role of the ’Identification’ phase in the incident response process?

A. It aims to remove all malicious components from an attack.

B. It is when all affected systems are returned to normal operation.

C. It involves verifying if a reported event is a true security incident.

D. It includes a review of the incident and the response to prevent future occurrences.

53 / 145

What is the main difference between a Memorandum of Understanding (MOU) and a Service Level Agreement (SLA)?

A. An MOU is more formal than an SLA

B. An MOU includes monetary penalties, while an SLA does not

C. An MOU and an SLA are both agreements involving monetary penalties

D. An MOU is less formal than an SLA and does not include monetary penalties

54 / 145

What should first responders in an incident response plan do?

A. Immediately contact the media and inform about the incident

B. Keep the information to themselves unless the incident seems serious

C. Report all incidents to increase the chances of early interception

D. Immediate contact the CEO regardless of the severity

55 / 145

What is accurately stated about web metadata as part of electronic discovery?

A. It includes data about when a file was created and modified

B. It includes the sender and recipient information of emails

C. It includes elements in the header of a webpage such as title and character set

D. It includes user location and call history from mobile devices

56 / 145

What is the importance of hashes and checksums in forensic analysis?

A. They act as passwords for protected data

B. They help in tracking the financial transactions in the system

C. They can help provide proof of integrity by ensuring that collected data has not been modified

D. They are used to encrypt sensitive data

57 / 145

What are some of the common elements included in an incident response plan?

A. Definitions of incident types, Incident response team, and Roles and responsibilities

B. Lists of potential threats, Emergency contact information, and Reporting procedures

C. System maintenance schedules, Staff training details, and Budgeting for security measures

D. Disaster recovery strategies, Data classification levels, and Information about critical assets

58 / 145

Which of the following statements about the Health Insurance Portability and Accountability Act (HIPAA) is correct according to the information provided about data governance?

A. HIPAA mandates that organizations protect any information related to the current political state.

B. HIPAA applies exclusively to information held by doctors, hospitals, or any health facilities.

C. HIPAA fines for non-compliance have been as high as $4.3 million.

D. HIPAA primarily concerns the integrity of financial reports.

59 / 145

What is the result if ’Top Secret’ data is disclosed to unauthorized entities according to U.S. government classifications?

A. It could cause a loss of public trust

B. It could result in financial loss to the organization

C. It could cause exceptionally grave damage to national security

D. It would have no significant impact

60 / 145

What changes in regulatory jurisdiction Riffcop would face, when it contracts with a cloud provider to store data, who runs data centers across the US and Canada?

A. ZiffCorp would only have to comply with laws in Virginia Beach, Virginia

B. ZiffCorp would have to comply with Canadian laws as well

C. ZiffCorp would have to comply with laws in San Jose, California

D. ZiffCorp would become exempt from U.S. laws

61 / 145

Which of the following is NOT a method of data sanitization?

A. File shredding

B. Wiping

C. Printing

D. Pulverizing

62 / 145

What is the role of the memdump tool in Kali Linux?

A. It is a forensics tool that can dump any addressable memory space on Linux to a dump file or terminal.

B. It serves as a GUI digital forensics platform that can interface with The Sleuth Kit utilities.

C. It is a Windows-based hexadecimal editor used for evidence gathering.

D. It is part of the Forensic Toolkit sold by AccessData used to capture an image of a disk.

63 / 145

What is the main difference between Data masking, Anonymization, Pseudo-anonymization and Tokenization?

A. Data masking, Anonymization and Pseudo-anonymization replace sensitive data with fake data while Tokenization replaces them with a substitute value

B. Only Data masking replaces sensitive data with fake ones. Anonymization, Pseudo-anonymization and Tokenization replace them with a substitute value

C. Data masking, Anonymization and Pseudo-anonymization replace sensitive data with the same substitute value while Tokenization uses a different one

D. Data masking and Anonymization replace sensitive data with substitute values while Pseudo-anonymization and Tokenization replace them with fake data

64 / 145

What types of information are typically included in a background check?

A. Criminal activity and credit history only

B. Social Media activity and past employment

C. Credit history, criminal activity, and online activity

D. Past employment and education history only

65 / 145

What does data governance refer to in regards to an organization?

A. The process of managing a government

B. The methods an organization uses to manage, process, and protect data

C. The act of storing data consistently in different databases

D. The drive to comply with external laws and regulations

66 / 145

What can the Remote Desktop Protocol (RDP) cache provide during a forensic investigation?

A. History of web pages visited.

B. Information on installed applications.

C. Insight into system crashes.

D. Information about an attacker’s movements.

67 / 145

In a Capture The Flag (CTF) event, what purpose does the ’digital flag’ serve?

A. It is used to identify each individual player

B. It serves as proof that a specific challenge has been solved

C. It is used as a tool to solve the challenges

D. It provides additional points to the holder

68 / 145

What is the main function of a data controller?

A. The entity that determines why and how personal data should be processed

B. Routine tasks such as backing up data

C. Ensuring adequate security controls are implemented

D. Manipulates the data on behalf of the data controller

69 / 145

Why might comparing packet captures taken at different times be useful in a forensic investigation following a data breach?

A. It can indicate when the network was first attacked

B. It can provide a record of the usernames and passwords of users who were logged into the network at the time of the data breach

C. It can provide a list of all the data that was stolen during the data breach

D. It can identify the exact malware that was used in the data breach

70 / 145

What does the term ’end of service life’ (EOSL) refer to in terms of vendor management policies?

A. The date when a product will no longer be offered for sale

B. The moment when support from the vendor is no longer available

C. The timeframe when a vendor is not able to provide a certain service

D. The period when a vendor is no longer creating patches or upgrades to resolve vulnerabilities for the product

71 / 145

What is the purpose of an impact assessment in data security?

A. To determine the value of the organization’s hardware

B. To understand the value of data by considering the impact if it is lost or released to the public

C. To monitor employee productivity

D. To predict future business trends

72 / 145

What are forensic artifacts in the context of digital forensic analysis?

A. They are tools used to capture snapshots of memory.

B. They are pieces of data on a device that regular users are unaware of, but that digital forensic experts can identify and extract.

C. They are procedures adopted to ensure that the evidence is not modified.

D. They are backdoors embedded in the firmware that attackers can exploit.

73 / 145

What purpose do forensic tools serve for a forensic specialist?

A. They help to design new security systems

B. They acquire, preserve and analyze evidence

C. They help in the installation of new software

D. They detect and repair malware attacks

74 / 145

What caused the data breach incident at Pacific Investment Management Co. (PIMCO)?

A. A vulnerability at PIMCO.

B. A vulnerability at SEI Investments Co.

C. A successful ransomware attack on M. J. Brunner, Inc.

D. An unknown cyber assault that has not been mentioned in the text.

75 / 145

How is the tool ’WinHex’ used in the digital forensics process?

A. It is used to capture and extract memory contents and digital artifacts

B. It is utilized for evidence gathering, data analysis, recovery of data, and data removal

C. It is used to create an image of a disk as a single file or multiple files

D. It tools includes both Windows- and Linux-based utilities used in forensics

76 / 145

What type of information is typically included in an incident response plan?

A. Predictions of future incidents

B. Historical data from past incidents

C. Personal data of the employees

D. Definitions of incident types

77 / 145

What is a common example of a security incident?

A. Accidental file deletion

B. Routine system maintenance

C. Data breach due to attacker’s access to the network

D. Software upgrades

78 / 145

Which of the following best describes the purpose of hashing in digital forensics, according to the text?

A. It allows the provenance of data to be proved.

B. It is used to encrypt data.

C. It modifies the data during the capture process.

D. It ensures that the data can be copied multiple times.

79 / 145

Which of the following best describes the purpose of data classifications within an organization?

A. To allow unauthorized access to sensitive data

B. To ensure users understand the value of data and to help protect sensitive data

C. To provide a standard that all private organizations must follow

D. To determine which data is publicly accessible and which data should be kept secret

80 / 145

What purpose does social media analysis serve in personnel security policies?

A. To keep a record of every employee’s social media activity

B. To verify compliance with company’s social media usage policy

C. To track and report employee’s private activities on social media

D. To guide employees on what content to post on social media

81 / 145

What does the Financial Privacy Rule mandate as part of the Gramm-Leach Bliley Act (GLBA)?

A. It mandates data transparency and allows individuals to correct errors in their data

B. It requires health information to be protected by organizations

C. It requires financial institutions to provide consumers with a privacy notice explaining what information they collect and how it is used

D. It requires executives within an organization to take individual responsibility for the accuracy of financial reports

82 / 145

What insight does Windows error reporting often provide in forensics analysis?

A. It shows the installed applications on a system.

B. It reveals the pages visited and searches made on the web.

C. It indicates the programs that were running when the system crashed.

D. It displays metadata of deleted files.

83 / 145

What steps could a SOAR platform take to address detected phishing emails according to the passage?

A. Sending the email back to the sender

B. Quarantining or deleting the email and blocking access to the embedded URLs

C. Sending an automatic reply to the sender

D. Forwarding the email to the administrator

84 / 145

What are the responsibilities of a data owner?

A. They are responsible for ensuring the data is classified correctly and that it is labeled to match the classification.

B. They determine why and how personal data should be processed.

C. They use and manipulate the data on behalf of the data controller.

D. They are responsible for routine daily tasks such as backing up data.

85 / 145

What function does internal communication serve in an incident response plan?

A. To declare the incident to the media.

B. To inform senior personnel of the incident and its severity.

C. To communicate with customers about the incident.

D. To contact law enforcement.

86 / 145

What is meant by ’time offsets’ in terms of log entries while performing security analysis?

A. The time taken for the server to respond

B. The duration of a security incident

C. The difference in timezones and daylight saving adjustments

D. The lag in generation of logs from different servers

87 / 145

Which of the following agreements between a company and a vendor stipulates performance expectations and often includes a monetary penalty if the vendor is unable to meet agreed-upon expectations?

A. Memorandum of Understanding (MOU)

B. Service Level Agreement (SLA)

C. Business Partners Agreement (BPA)

D. Inter-Departmental Agreement

88 / 145

Why is user training an essential part of organizational security?

A. To keep personnel up to date with current technologies and threats

B. To help management communicate better

C. To improve individual employee performance

D. To enforce strict disciplinary actions

89 / 145

What are the reporting requirements in an incident response plan?

A. They dictate who in the organization can speak to the media

B. They outline who needs to be notified when a security incident occurs and in what timeframe

C. They designate who can authorize law enforcement intervention

D. They decide when and to whom customer communications can be made

90 / 145

What happens when a user deletes a file?

A. The file is instantly removed from the system

B. The operating system marks the file for deletion and frees up the space it was using

C. The file gets overwritten immediately

D. The file is moved to a hidden location in the operating system

91 / 145

Where can you find a pagefile or swap file in a computer system?

A. Attached devices such as USB drives

B. System disk drive

C. Cache memory

D. Network servers

92 / 145

Why is it important for anyone involved in a security incident to understand key aspects of digital forensics?

A. To efficiently collect evidence

B. To communicate with forensic experts

C. To effectively use security software

D. Both A and B

93 / 145

What is the purpose of a ’Right to Audit’ clause in a contract with a cloud provider?

A. It allows the customer to control the cloud provider’s security measures.

B. It allows a customer to hire an auditor and review the cloud provider’s records.

C. It guarantees the cloud provider’s compliance with data protection laws.

D. It gives the cloud provider legal right to access the customer’s data.

94 / 145

Why is it recommended to collect data in RAM before powering a computer down in case of a suspected security incident?

A. Because data in RAM is the least volatile and remains on the system

B. Because RAM data can be easily manipulated

C. Because RAM data is lost after powering down a computer

D. Because RAM data is the least important to preserve evidence

95 / 145

Which of the below options is NOT a phase of the incident response process?

A. Preparation

B. Quarantine

C. Eradication

D. Lessons learned

96 / 145

What purposes does an Acceptable Use Policy (AUP) typically serve within an organization?

A. Preventing users from accessing computer systems

B. Enforcing a culture of secrecy

C. Describing the purpose of computer systems and how users can access them and outlining user responsibilities

D. Promoting unrestricted use of organizational resources

97 / 145

Why would it be necessary to convert server log entry timestamps to Coordinated Universal Time (UTC)?

A. To ensure that User Interface is consistent throughout the servers

B. To ensure there is no conflict between servers

C. To maintain consistency when comparing timestamps among servers in different time zones

D. To protect the server from a data breach

98 / 145

What is considered the first step management needs to take after receiving a legal hold order?

A. Start the process for data deletion immediately

B. Direct the data custodians to preserve the data

C. Preserve all the data available to avoid litigation

D. Notify the Securities and Exchange Commission

99 / 145

What are the elements commonly included in a communication plan in an incident response plan?

A. First responders, Internal communication, Reporting requirements, External communication, Law enforcement

B. Customers, Employees, Media, Vendors

C. Communication Plan, Incident Response Plan, Business Continuity Plan

D. Media, Law enforcement, Customers, Competitors

100 / 145

What is the role of runbooks in the context of SOAR platforms within an organization?

A. They dictate the investigative chores for administrators

B. They determine which low-level security events need to be investigated

C. They provide a list of things to check for in case of suspected incidents

D. They implement the guidelines documented in the playbooks using the available tools

101 / 145

Which of the following best describes a Business Partners Agreement (BPA)?

A. An agreement between a company and a vendor that stipulates performance expectations.

B. An understanding between two or more parties indicating their intention to work together toward a common goal.

C. A written agreement that details the relationship between business partners, including their obligations toward the partnership.

D. An agreement that outlines the services a company will provide and its performance standards.

102 / 145

How might an organization handle the risk associated with relationships with third parties according to the CompTIA Security+ SY0-701 guidelines?

A. Ignoring the risks as they are not significant.

B. Managing the risks through developed security policies.

C. Having the third party bear all the risks.

D. Only creating relationships with third parties that present no risk.

103 / 145

What purpose do data policies serve in a company’s data protection strategy?

A. They provide guidelines for data storage

B. They regulate data update frequency

C. They prevent data leakage

D. They outline data recovery processes

104 / 145

What is the purpose of using the ’sha1sum’ command in the context of digital forensics?

A. To encrypt data

B. To compress data

C. To create and compare hashes for data integrity

D. To recover deleted files

105 / 145

What is the primary role of the Data Controller in an organization according to GDPR-related role-based training?

A. Responsible for backing up data and implementing business rules

B. Ensuring the organization is complying with all relevant laws

C. Determines why and how personal data should be processed

D. Uses and manipulates data on behalf of data owners

106 / 145

What does the concept of ’provenance’ refer to in the context of digital forensics?

A. It refers to the process of hashing data multiple times until the desired checksum is achieved

B. It refers to the tracing back of any data or file to its original source

C. It refers to the process of encrypting data to secure it

D. It refers to the tools and methods used in capturing forensics data, such as the dd command and WinHex

107 / 145

What is the role of an Incident Response Team in the Incident Response Plan?

A. To provide physical security to the organization

B. To provide training to all employees of the organization

C. To respond to incidents using their knowledge and skills

D. To determine the incident response policy for the organization

108 / 145

In the context of a computer security incident, which of the following should be collected first based on the order of volatility?

A. Data files on the local disk drive

B. Pagefile on the system disk drive

C. Data in the cache memory

D. Log files stored in remote servers

109 / 145

What is the role of law enforcement in an incident response communication plan?

A. To enforce laws around data breach communication

B. To be on standby for security threats

C. To be authorized to deal with public scrutiny following an incident

D. To provide technical support during an incident

110 / 145

What is the method known as ’wiping’ in data sanitization processes?

A. Physical destruction of the media

B. Overwriting the space where the file is located with 1s and 0s

C. Passing a disk through a degaussing field to render the data unreadable

D. Physically shredding papers

111 / 145

What is the purpose of supply chain policies in relation to vendors?

A. To increase the organization’s dependence on a single vendor

B. To ensure all vendors have full access to internal networks and data

C. To limit damage to the organization if an attacker exploits a vendor

D. To ensure vendors have unlimited system integration

112 / 145

What is one of the appropriate responses when employees discover a data breach within their organization?

A. Ignore the breach and hope it resolves on its own

B. Immediately post the details of the breach on social media

C. Identify the extent of the loss and report it to C-Level personnel

D. Cover up the breach to avoid legal consequences

113 / 145

What are some of the common elements included in an incident response plan?

A. Definitions of incident types and incident response team

B. Detailed roles and responsibilities

C. Analysis tools and technical resources

D. All of the above

114 / 145

What are forensic artifacts and which of the following is NOT an example of them?

A. The content of deleted files and the metadata of deleted files

B. Pages visited and searches in Web history

C. Programs that were running when a system crashed

D. Firewall configuration

115 / 145

Which of the following is not volatile and remains there even after powering a system down?

A. Cache

B. RAM

C. Swap or pagefile

D. Disk

116 / 145

What is the difference between pseudonymization and anonymization in data security?

A. Pseudonymization replaces the original data permanently while anonymization allows for reversal.

B. Anonymization replaces PII with pseudonyms, but pseudonymization does not.

C. Pseudonymization is a process that replaces PII with pseudonyms, allowing for reversal, while anonymization does not allow for reversal.

D. Both pseudonymization and anonymization permanently replace PII with pseudonyms.

117 / 145

What does the ’Lessons learned’ phase involve in an incident response process?

A. Analysis of the incident and taking steps to prevent reoccurrence

B. Identifying a potential incident and verifying it

C. Removing all malicious components from the affected systems

D. Preparing the personnel and equipping them with the necessary tools

118 / 145

What is the purpose of an incident response policy in an organization?

A. To establish a welcome message for intruders

B. To identify and respond to security incidents

C. To ensure every employee reads the NIST SP 800-61

D. To recover from a cyber attack without any further analysis

119 / 145

What is the purpose of the Sarbanes-Oxley Act (SOX) in the context of data governance?

A. It mandates the protection of privacy data for individuals who live in the EU.

B. It requires financial institutions to provide consumers with a privacy notice explaining what information they collect and how it is used.

C. It requires that executives within an organization take individual responsibility for the accuracy of financial reports.

D. It mandates that organizations protect health information.

120 / 145

What is the main purpose of digital forensic strategic intelligence within a cybersecurity context?

A. To prevent the attacker from accessing the system

B. To deceive the attacker with fake information

C. To understand the threats and develop long-term cybersecurity goals

D. To prosecute the attackers using evidence from the incident

121 / 145

Why is the process of chain of custody important in incident response and evidence collection?

A. It provides a record of every person who mishandled the evidence

B. It is a process to tag the evidence for marketing purposes

C. It ensures that evidence presented in a court of law is different from that collected by security professionals

D. It documents who handled the evidence and when they handled it, providing assurances that evidence has been appropriately controlled and properly handled after collection

122 / 145

What proof can be provided by security measures like closed-circuit television (CCTV) in a detective control?

A. Specific code of the software

B. Person’s location and activity

C. Network traffic

D. Analysis of machine learning

123 / 145

Which of the following correctly lists the order of volatility from most volatile to least volatile as described in the text?

A. RAM, Cache, Disk, Swap or pagefile, Attached devices, Network.

B. Cache, RAM, Swap or pagefile, Disk, Attached devices, Network.

C. Network, Attached devices, Disk, Swap or pagefile, RAM, Cache

D. Disk, Swap or pagefile, RAM, Cache, Attached devices, Network

124 / 145

What could happen if ’Secret’ classified data, as identified by U.S. government, was disclosed to unauthorized entities?

A. It could cause exceptionally grave damage to national security

B. It could cause serious damage to national security

C. It could cause damage to national security

D. It could cause no damage to national security

125 / 145

Which tool can be used to dump any addressable memory space to the terminal or redirect the output to a dump file, primarily in a Linux environment?

A. FTK imager

B. Autopsy

C. memdump

D. WinHex

126 / 145

What is the purpose of a playbook, as used in the context of computer security?

A. To document the steps to automatically execute a cyber attack

B. To provide a step-by-step procedural checklist for handling well-known incidents

C. To offer a list of email addresses for sending phishing emails

D. To program a system to autonomously take defensive actions

127 / 145

What key element should an incident response plan include to manage the perception of an incident with the media and public?

A. A social media policy outlining how staff should post about the incident online

B. A communication plan indicating who can talk to the media and direct any external queries

C. A public relations team to manage the media and mitigate damage

D. A press statement prepared in advance for any possible incident

128 / 145

What is the purpose of an attacker launching a phishing campaign?

A. To gain access to secure data

B. To test the user’s understanding of cyber threats

C. To enhance the cybersecurity of the system

D. To promote a new product or service

129 / 145

What is the main purpose of incorporating gamification in user training?

A. To make the courseware difficult

B. To increase user participation and interaction

C. To solely focus on the competition aspect

D. To discourage students with low scores

130 / 145

What does the term ’Terms of Agreement’ refer to in the context of legal documents such as NDAs, SLAs and BPAs?

A. The period for which a contract is valid

B. The collection of responsibilities each party has

C. The monetary value of the agreement

D. The geographical area in which the agreement is valid

131 / 145

According to the U.S. government standards, which classification of data could cause exceptionally grave damage to national security if disclosed to unauthorized entities?

A. Public

B. Proprietary

C. Top secret

D. Sensitive

132 / 145

What type of metadata is typically included from mobile devices during an eDiscovery process?

A. The types of apps installed

B. The device’s operating system version

C. The device’s IP address

D. Users’ location, call and message history, website history

133 / 145

What is generally required by data breach notification laws?

A. Organizations must notify affected personnel and possibly delay the notification if a law enforcement agency determines it would impede an investigation.

B. Organizations are not required to notify anyone unless the breach has been confirmed by a third party.

C. Organizations need only inform sponsors and stakeholders of a data breach.

D. Organizations can choose whether or not they want to notify affected personnel.

134 / 145

What type of information does Email metadata include?

A. The title of the email, the date it was created, and any notes attached to the email

B. The header of the email, who sent it, the recipient, and the sending time

C. The location of the sender, the web page that the email was sent from, and the recipient

D. The history of the sender’s previous emails, the recipient, and the date the email was created

135 / 145

Which of the following correctly lists the order of volatility from most volatile to least volatile?

A. RAM, Cache, Swap or pagefile, Disk, Attached devices, Network

B. Cache, RAM, Swap or pagefile, Disk, Attached devices, Network

C. Attached devices, Disk, Swap or pagefile, RAM, Cache, Network

D. Network, Attached devices, Disk, Swap or pagefile, RAM, Cache

136 / 145

What are some common methods used to destroy data in Solid-State Drives (SSDs)?

A. File shredding and wiping.

B. Physical destruction and degaussing.

C. Shredding and pulping.

D. Erasing and overwriting.

137 / 145

What are the three levels of data classification used by the U.S. government to identify classified information?

A. Public, Private, Proprietary

B. Top Secret, Unclassified, Sensitive

C. Top Secret, Secret, Confidential

D. Public, Confidential, Sensitive

138 / 145

What is the purpose of the recovery phase in the incident response process?

A. It attempts to isolate or contain the incident to protect critical systems.

B. It verifies if a reported event is an actual security incident.

C. It returns all affected systems to normal operation and confirm if they are operating normally.

D. It provides guidance on how to create and maintain an incident response plan.

139 / 145

What is the primary purpose of companies developing personnel policies?

A. To enhance company profits

B. To define and clarify expectations and potential outcomes related to personnel behavior

C. To provide employee benefits

D. To improve productivity and efficiency only

140 / 145

What is the role of the ’sa’ account in Microsoft SQL Server?

A. It is a non-administrative account used for routine database management

B. It is a system administrator account with full administrative privileges

C. It is an account specifically created for Windows Authentication mode

D. It is an account that is disabled by default and only used under certain circumstances

141 / 145

What is the correct order of volatility from most volatile to least volatile?

A. Disk, Network, RAM, Cache

B. Cache, RAM, Swap or pagefile, Disk, Attached devices, Network

C. Network, Attached devices, Disk, Swap or pagefile, RAM, Cache

D. RAM, Cache, Disk, Swap or pagefile, Network

142 / 145

What is Metadata as it relates to electronic discovery or eDiscovery?

A. It is the actual data being collected.

B. It is data about data, providing additional context about the collected data.

C. It is a software used in the process of data collection.

D. It is the procedure of collecting data.

143 / 145

What information does file metadata commonly include in an eDiscovery process?

A. The title and character set of a webpage

B. The location of a mobile device user

C. The sender, recipients, and time of an email

D. Information about the creation, modification, and access of a file

144 / 145

What is the importance of data classification in an organization?

A. It helps in organizing the physical storage of data

B. It streamlines the data entry processes

C. It ensures that users understand the value of data and helps protect sensitive data

D. It makes the data look tidy and presentable

145 / 145

Which is often the first failure in a cyber incident according to digital forensic analysis?

A. A server malfunction

B. An unpatched software vulnerability

C. A user responding inappropriately to a phishing email

D. Inadequate firewall protection

Your score is

Dowload the FREE OFFLINE Version of this Test Bank

Boost your cybersecurity skills! Click to download the CompTIA Security+ Practice Anki deck.

Chapter 11 – Implementing Policies to Mitigate Risks

Boost your IT skills with our free CompTIA Security+ practice test focusing on Chapter 11: Implementing Policies to Mitigate Risks. Whether you’re entering the IT industry or advancing in cyber security, our resources are here to help you succeed in the CompTIA Exam.

Why Choose Our CompTIA Security+ Practice Test?

Skill Enhancement:

Covers essential techniques for implementing policies to mitigate risks crucial for the CompTIA Exam.

Career Advancement:

Passing the CompTIA Security+ exam can open doors to new job opportunities and significant career changes in the IT industry.

Vulnerability Management:

Master the art of risk mitigation, a key skill in cyber security.

Free Anki Deck Download

Download our free Anki Deck, reviewed by industry expert Josh Madakor, who has extensive experience in IT and cyber security, including work with Microsoft and government sectors. Learn more about Anki on the official site.

Get Started with Your IT Career Change Today!

Visit the CompTIA Security+ official site and the CompTIA Network+ official site for more information.

Chapter 11 – Implementing Policies to Mitigate Risks

Dowload the FREE OFFLINE Version of this Test Bank

Chapter 11 – Implementing Policies to Mitigate Risks

Why Choose Our CompTIA Security+ Practice Test?

Skill Enhancement:

Career Advancement:

Vulnerability Management:

Free Anki Deck Download

Explore our other free practice tests:

Related Posts

The Affordable, Hands-On Josh Madakor IT Course that gets Results!

The Affordable, Hands-On Cyber Security that gets Results!

JOIN OUR

NEWSLETTER