A user in the company is in charge of various financial roles but needs to prepare for an upcoming
audit. They use the same account to access each financial system. Which of the following security
controls will MOST likely be implemented within the company?

Everyone in the accounting department has the ability to print and sign checks. Internal audit has
asked that only one group of employees may print checks while only two other employees may
sign the checks. Which of the following concepts would enforce this process?

One of the system administrators at a company is assigned to maintain a secure computer lab.
The administrator has rights to configure machines, install software, and perform user account
maintenance. However, the administrator cannot add new computers to the domain, because that
requires authorization from the Information Assurance Officer. This is an example of which of the
following?

A security administrator notices that a specific network administrator is making unauthorized
changes to the firewall every Saturday morning. Which of the following would be used to mitigate
this issue so that only security administrators can make changes to the firewall?

Which of the following risk mitigation strategies will allow Ann, a security analyst, to enforce least
privilege principles?

An IT security manager is asked to provide the total risk to the business. Which of the following

calculations would he security manager choose to determine total risk?

A company is preparing to decommission an offline, non-networked root certificate server. Before
sending the server’s drives to be destroyed by a contracted company, the Chief Security Officer
(CSO) wants to be certain that the data will not be accessed. Which of the following, if
implemented, would BEST reassure the CSO? (Select TWO).

Identifying residual risk is MOST important to which of the following concepts?

A software company has completed a security assessment. The assessment states that the
company should implement fencing and lighting around the property. Additionally, the assessment
states that production releases of their software should be digitally signed. Given the
recommendations, the company was deficient in which of the following core security areas?
(Select TWO).

DRAG DROP
A Security administrator wants to implement strong security on the company smart phones and
terminal servers located in the data center. Drag and Drop the applicable controls to each asset
type.
Instructions: Controls can be used multiple times and not all placeholders needs to be filled. When

you have completed the simulation, Please select Done to submit.