Use Data Encryption Techniques

Implement a Least Privilege Solution or Practice

Use of Multifactor Device Authentication

DOMAIN 2: Security Orchestration, Asset Management, and Incident Response (19%)

Maintain and Monitor the Security of Network Assets

Identify and Analyze Security-Related Threats

Implement a Threat and Vulnerability Management (TVM) Process

DOMAIN 3: Security Services, Cloud Computing Security, and Deployment Security Controls (19%)

Implement Cloud Service Controls

Implement Secure Deployment Practices

Implement Data Security and Compliance Controls

DOMAIN 4: Security Controls (20%)

Implement Security Governance and Risk Management

Implement Information Security Management

Use Security-Related Technologies and Tools

DOMAIN 5: Information Classification, Labeling, and Management (28%)

Determine Labeling

Create and Implement a Data Loss Prevention (DLP) Strategy

Manage Asset Life Cycle Management

B. A complex password and a security challenge question.

C. A fingerprint scan and a retinal scan.

D. A standard username and a sixteen-character passphrase.

E. A physical hardware badge and an RFID key fob.

F. A voice recognition scan and a facial geometry scan.

Correct Answer: A

Overall Explanation: Multifactor authentication (MFA) requires the use of at least two different categories of authentication factors: Type 1 (Something you know), Type 2 (Something you have), or Type 3 (Something you are). Using two factors from the same category is considered single-factor authentication, even if multiple steps are involved.

Detailed Option Analysis:

Option B (Incorrect): Both a password and a challenge question fall under Type 1 (Something you know).

Option C (Incorrect): Both a fingerprint and a retinal scan fall under Type 3 (Something you are/Biometrics).

Option D (Incorrect): A username is for identification, and a passphrase is Type 1 (Something you know). This is single-factor.

Option E (Incorrect): Both a badge and a fob fall under Type 2 (Something you have).

Option F (Incorrect): Both voice and facial scans are Type 3 (Something you are).

B. To actively exploit weaknesses to see how far an internal attacker can pivot.

C. To monitor real-time network traffic for active zero-day exploits.

D. To automatically apply patches to the application's source code.

E. To manage the physical life cycle of the underlying servers hosting the application.

F. To establish a baseline for post-incident disaster recovery efforts.

Correct Answer: A

Overall Explanation: A vulnerability assessment is a systematic review of security weaknesses in an information system. It evaluates if the system is susceptible to any known vulnerabilities, assigns severity levels to those vulnerabilities, and recommends remediation or mitigation, if and whenever needed.

Detailed Option Analysis:

Option B (Incorrect): Actively exploiting weaknesses is the definition of a Penetration Test, not a vulnerability assessment.

Option C (Incorrect): Monitoring real-time traffic for active exploits is the function of an Intrusion Detection/Prevention System (IDS/IPS).

Option D (Incorrect): Vulnerability assessments do not automatically apply patches; that falls under patch management and configuration management.

Option E (Incorrect): Managing hardware physical states is an asset management function, not vulnerability management.

Option F (Incorrect): Post-incident baselines are part of Business Continuity and Disaster Recovery (BCDR) planning.

B. Network DLP configured at the corporate perimeter firewall.

C. Cloud DLP monitoring data uploaded to SaaS applications.

D. A strictly enforced physical clear-desk policy in the office.

E. Implementing a robust incident response orchestration playbook.

F. Utilizing an intrusion prevention system (IPS) to block unauthorized egress.

Correct Answer: A

Overall Explanation: Data Loss Prevention (DLP) systems can be deployed at the network level, in the cloud, or at the endpoint. When a device is entirely disconnected from the corporate network and the internet, network and cloud-based controls cannot enforce policies on local data transfers (like copying a file to a USB drive).

Detailed Option Analysis:

Option B (Incorrect): Network DLP only inspects traffic passing through the corporate network perimeter, which an offline laptop does not touch.

Option C (Incorrect): Cloud DLP requires an internet connection to monitor interactions with cloud services.

Option D (Incorrect): A clear-desk policy applies to physical office environments and does not secure digital IP on a remote, offline device.

Option E (Incorrect): Incident response is reactive. DLP is designed to be a preventative technical control.

Option F (Incorrect): An IPS monitors active network traffic, which is irrelevant for an offline endpoint.

You can retake the exams as many times as you want

This is a huge original question bank

You get support from instructors if you have questions

Each question has a detailed explanation

Mobile-compatible with the Udemy app