CompTIA Security+ Book Practice Test 5

A security administrator is reviewing the company's continuity plan, and it specifies an RTO of four hours and an RPO of one day. Which of the following is the plan describing?

• Systems should be restored within one day and should remain operational for at least four hours.

• Systems should be restored within four hours and no later than one day after the incident.

• Systems should be restored within one day and lose, at most, four hours' worth of data.

• Systems should be restored within four hours with a loss of one day's worth of data at most.

Which of the following statements is true regarding a data retention policy?

• Regulations require financial transactions to be stored for seven years.

• Employees must remove and lock up all sensitive and confidential documents when not in use.

• It describe a formal process of managing configuration changes made to a network.

• It is a legal document that describes a mutual agreement between parties.

What type of information does a control risk apply to?

• Health information

• Personally identifiable information (PII)

• Financial information

• Intellectual property

You are the IT manager and one of your employees asks who assigns data labels. Which of the following assigns data labels?

• Owner

• Custodian

• Privacy officer

• System administrator

As part of the response to a credit card breach, Sally discovers evidence that individuals in her organization were actively working to steal credit card information and personally identifiable information (PII). She calls the police to engage them for the investigation. What has she done?

• Escalated the investigation

• Public notification

• Outsourced the investigation

• Tokenized the data

Which of the following is not a common security policy type?

• Acceptable use policy

• Social media policy

• Password policy

• Parking policy

What law or regulation requires a DPO in organizations?

• FISMA

• COPPA

• PCI-DSS

• GDPR

Which of the following techniques attempts to predict the likelihood a threat will occur and assigns monetary values should a loss occur?

• Change management

• Vulnerability assessment

• Qualitative risk assessment

• Quantitative risk assessment

The website that Brian is using shows part of his Social Security number, not all of it, and replacing the rest of the digits with asterisks, allowing him to verify the last four digits. What technique is in use on the website?

• Tokenization

• Hashing

• Encryption

• Data masking

Nick is following the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) and has completed the prepare and categorize steps. Which step in the risk management framework is next?

• Assessing controls

• Implementing controls

• Monitoring controls

• Selecting controls