SY0-601 Governance, Risk & Compliance 3

Question 1

Which international standard specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS)?

Accepted Answer

ISO/IEC 27001

Answer

ISO/IEC 27001 is the globally recognized standard that defines requirements for an ISMS, providing a systematic approach to managing sensitive information.

Question 2

A company runs criminal background checks on all job applicants who will handle sensitive financial data before making a hiring decision. What type of security control is this?

Accepted Answer

Preventive control

Answer

Background checks are preventive controls because they are designed to prevent potential security incidents before they can occur by screening personnel in advance.

Question 3

What is the primary distinction between a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP)?

Accepted Answer

BCP addresses continuing all critical business operations; DRP focuses on restoring IT systems and data

Answer

A BCP ensures all critical business functions can continue during a disruption, while a DRP specifically focuses on restoring IT systems, data, and infrastructure after a disaster.

Question 4

An organization requires all employees to take a consecutive two-week vacation and prohibits remote access to systems during that time. Which security principle does this policy support?

Accepted Answer

Mandatory vacation

Answer

Mandatory vacation policies help detect fraud or policy violations by requiring employees to step away, allowing others to discover irregularities in their absence.

Question 5

A penetration tester signs a legal agreement promising not to disclose the findings, network diagrams, or vulnerabilities discovered during an engagement to unauthorized parties. What document is this?

Accepted Answer

Non-Disclosure Agreement (NDA)

Answer

An NDA (Non-Disclosure Agreement) legally binds parties to maintain the confidentiality of sensitive information, commonly required before security assessments.

(SY0-601) CompTIA Security+ IT Certification Practice Test

(SY0-601) CompTIA Security+ IT Certification Practice Test

SY0-601 Governance, Risk & Compliance 3