Explain How Security Technologies and Controls Fit into the Organizations Governance, Risk, and Compliance Program and Overall Risk Management. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company's GRC program requires continuous monitoring of security controls to ensure they remain effective. The security team uses a SIEM and a vulnerability scanner. Which practice best supports continuous monitoring and improvement?

   • ARun the vulnerability scanner quarterly and manually review the results with the security team.
   • BAutomate the vulnerability scanner to run weekly and feed results into the SIEM for correlation with threat intelligence.
   • CReplace the vulnerability scanner with a penetration test performed annually.
   • DUse the SIEM to monitor only security alerts and ignore vulnerability data.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following best describes the role of a risk assessment in the selection of security controls?

   • AIt identifies and evaluates risks, providing a basis for determining which controls are necessary.
   • BIt only applies to new systems, not existing ones.
   • CIt replaces the need for a risk management framework.
   • DIt automatically implements controls based on predefined rules.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A healthcare organization must comply with HIPAA, which requires safeguarding electronic protected health information (ePHI). Which security technology is most directly aligned with this compliance requirement?

   • AA spam filter for email security
   • BA network intrusion detection system (IDS) to monitor traffic
   • CA web application firewall (WAF) to protect the public website
   • DEncryption for data at rest and in transit
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An organization wants to adopt a framework that provides a risk-based approach to establishing, implementing, maintaining, and continually improving an information security management system (ISMS). Which framework should they choose?

   • AISO/IEC 27001
   • BPCI DSS
   • CCIS Controls
   • DNIST SP 800-53
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A retail company's risk assessment identified that a data breach via a compromised point-of-sale (POS) terminal is a high-likelihood, high-impact risk. The company has a moderate risk appetite and a limited budget. Which control selection is most aligned with the risk assessment?

   • ADeploy endpoint detection and response (EDR) on all POS terminals and segment the POS network from the corporate network.
   • BConduct regular security awareness training for store employees.
   • CPurchase cyber insurance to transfer the financial risk of a breach.
   • DImplement a SIEM to monitor all network traffic for signs of compromise.
   Reveal Solution Discussion Select an answer first