A software company has completed a security assessment. The assessment states that the company should
implement fencing and lighting around the property. Additionally, the assessment states that production
releases of their software should be digitally signed. Given the recommendations, the company was deficient in
which of the following core security areas? (Choose two.)

Identifying residual risk is MOST important to which of the following concepts?

A company is preparing to decommission an offline, non-networked root certificate server. Before sending the
server’s drives to be destroyed by a contracted company, the Chief Security Officer (CSO) wants to be certain
that the data will not be accessed. Which of the following, if implemented, would BEST reassure the CSO?
(Choose two.)

An IT security manager is asked to provide the total risk to the business.
Which of the following calculations would he, security manager, choose to determine total risk?

Which of the following risk mitigation strategies will allow Ann, a security analyst, to enforce least privilege
principles?

A security administrator notices that a specific network administrator is making unauthorized changes to the
firewall every Saturday morning. Which of the following would be used to mitigate this issue so that only security
administrators can make changes to the firewall?

One of the system administrators at a company is assigned to maintain a secure computer lab. The
administrator has rights to configure machines, install software, and perform user account maintenance.
However, the administrator cannot add new computers to the domain, because that requires authorization from
the Information Assurance Officer.
Which of the following is this an example of?

Everyone in the accounting department has the ability to print and sign checks. Internal audit has asked that
only one group of employees may print checks while only two other employees may sign the checks. Which of
the following concepts would enforce this process?

A user in the company is in charge of various financial roles but needs to prepare for an upcoming audit. They
use the same account to access each financial system. Which of the following security controls will MOST likely
be implemented within the company?

Separation of duties is often implemented between developers and administrators in order to separate the
following: