A technician is documenting the entities considered to be IT assets. Which of the following should be included in the list? Select three.

A SOC team is puzzled because they are monitoring periodic evidence of a breach but are unable to definitively identify the compromised device. Which of the following best describes what may be happening and/or how it could have been prevented? Select two.

A company replaced a router just before it became an EOL (end-of-life) product. Thus, it would no longer be supported by the manufacturer. Which of the following are costs that were likely NOT incurred during the lifecycle of the asset? Select two.

Your company sells equipment to help secure internal networks. You are asked to submit a proposal electronically to a potential client. The proposal includes information on price, availability, service contract, and additional information. What process is being used to deliver the proposal?

Elema owns a company that provides security services but also sells computers and security equipment such as intrusion detection system, intrusion prevention system, and firewalls. In terms of assets, how is the computer she uses in her office different from the two spare computers they keep in the stockroom for internal use and the computers they sell?Select two.

Gulussa works in the property control department. He is responsible for tagging all incoming networking and security equipment with an internal serial number, as well as keeping a record of their location. What is this process called?

A local municipality is finally getting around to replacing all the hard disk drives (HDDs) in their data storage arrays connected to a storage area network with solid-state drives (SSDs). After transferring the data, destruction of the data on the HDDs needs to meet certain regulatory requirements. Which of the following methods of destroying data should they use?

A senior official of a company was fired for unethical practices and replaced. The new senior official required the immediate implementation of new business processes. Which of the following changes can potentially impact information security in a negative way? Select two.

A network engineer at a large facility gives a technician a configuration file and verbally asks them to update one of the switches. However, the technician accidentally updates the wrong switch. The problem is discovered because members of a particular department are calling the help desk, saying that the internet is down. How could this situation have been prevented?

Which of the following statements are true regarding change management? Select two.

A company has four routers, 24 switches, 500 computers, and a few security appliances in their network infrastructure. Which of the following would be beneficial to help keep track of configuration changes to these assets?

A company that delivers technical consulting services in the information security space loses a major account that provides 25% of their total revenue. What type of threat just became a reality for this company?

An individual with supervisory experience returns to school and earns a degree in network security. The networking lab uses appliances from a specific vendor. Upon graduating, the individual gets a job as an IT manager but also performs a few technical tasks. When buying appliances, the individual insists on devices from the vendor the school uses. What kind of decision-making bias is the individual displaying?

A company is in the middle of identifying and analyzing risks using the risk and control self-assessment (RSCA) methodology. A goal of the methodology is to minimize the effects of human factors when identifying risks. What are some of those factors? Select two.

An engineering firm has a series of servers with proprietary information. They want to perform a risk analysis based on the possibility of a data breach taking place as well as the impact of the breach should it be successful. What type of risk analysis should they perform?

Larissa is including the mean time between failures reported by a manufacturer to help determine the likelihood of a certain risk taking place within a 365-day period. Which of the following is she trying to determine?

IT assets of a large security training center near the coast are worth $2 million. If a severe hurricane hits, 25% of the equipment is likely to be damaged. What is the single-loss expectancy (SLE)?

A small insurance company has decided not to bid on a request to provide flood insurance for the IT assets of a company because the ALE exceeds $100,000. Which of the following statements coincides with the conclusion the insurance company has drawn?

Takeshi is creating a document to help represent some of the risks associated with information security. What type of document is Takeshi creating?

Charlotte is filling out a color-coded tool to list the likelihood of risks and their potential impact. What tool is she using?

Valdis is on a team responsible for assessing the level of risk the company can accept for a given type of threat as well as the total risk the company can bear for a given risk posture. To succeed, which of the following best describes what they need to determine?Select two

Even though the internal policy of a company states they must install all patches, the security team decides to bypass one of the patches because they believe the risk of applying it is greater than not applying it. Instead, they will wait for the next version of the patch. In the meantime, what strategy has the company adopted?Select two.

A company bought and installed a newly released router. A month after installation the vendor issues a notice that a relatively difficult-to-exploit vulnerability has been found and will be patched in 30 days. Peter wants to do nothing and wait 30 days, Paul wants to revert to using the previous router, and Mary wants to buy cybersecurity insurance. Which one of the following statements is NOT true?

A company makes a series of automotive parts for multiple foreign and domestic automobile manufacturers. Their business practices require relationships with a wide variety of other organizations. Which of the following are most likely to pose third-party risks? Select three.

You represent the IT department as a member of the team involved with establishing and maintaining partnerships with a variety of external entities. Which of the following most accurately represents potential third-party risks that need consideration? Select three.

Artemis visits a supplier to participate in a vendor monitoring effort to help reduce the risks associated with third parties. Which of the following are most likely to be included in the agenda? Select three.

An independent contractor offers services providing practical and tangible security training to adults in various organizations. The training program includes a heavy hands-on component and makes provision for applying concepts based on questions presented by attendees. Which of the following statements are true regarding this mode of instruction?

A company wants to implement a security awareness training program that includes sending certain types of emails to help keep track of the extent to which employees are behaving like human firewalls. They also want to rotate the different types of messages based on job description and include links to online games in some of the messages. What type of training should they include?

Which of the following examples, whether it represents a threat, risk, or neither, could or should be included in a security awareness program at an organization? Select two.