Key cards at a bank are not tied to individuals, but rather to organizational roles. After a break in, it
becomes apparent that extra efforts must be taken to successfully pinpoint who exactly enters secure
areas. Which of the following security measures can be put in place to mitigate the issue until a new key
card system can be installed?

A datacenter requires that staff be able to identify whether or not items have been removed from the
facility. Which of the following controls will allow the organization to provide automated notification of
item removal?

Datacenter access is controlled with proximity badges that record all entries and exits from the
datacenter. The access records are used to identify which staff members accessed the data center in the
event of equipment theft. Which of the following MUST be prevented in order for this policy to be
effective?

Due to issues with building keys being duplicated and distributed, a security administrator wishes to
change to a different security control regarding a restricted area. The goal is to provide access based
upon facial recognition. Which of the following will address this requirement?

A security administrator wants to deploy a physical security control to limit an individual’s access into a
sensitive area. Which of the following should be implemented?

After running into the data center with a vehicle, attackers were able to enter through the hole in the
building and steal several key servers in the ensuing chaos. Which of the following security measures can
be put in place to mitigate the issue from occurring in the future?

A system administrator has concerns regarding their users accessing systems and secured areas using
others’ credentials. Which of the following can BEST address this concern?

Which of the following preventative controls would be appropriate for responding to a directive to
reduce the attack surface of a specific host?

Joe, the system administrator, has been asked to calculate the Annual Loss Expectancy (ALE) for a $5,000
server, which often crashes. In the past year, the server has crashed 10 times, requiring a system reboot
to recover with only 10% loss of data or function. Which of the following is the ALE of this server?

Sara, a security analyst, is trying to prove to management what costs they could incur if their customer
database was breached. This database contains 250 records with PII. Studies show that the cost per
record for a breach is $300. The likelihood that their database would be breached in the next year is only
5%. Which of the following is the ALE that Sara should report to management for a security breach?