Conventional network segmentation through switch hubs, VLANs, or firewalls improves network performance and administration.  However, it cannot provide granular and dynamic security enforcement to meet diversified and dynamic business environments. As a security professional, you are concerned with advanced persistent threats (APTs). Which of the following is least likely to mitigate the threat?
A. Employ Zero Trust infrastructure
B. Micro-segment networks to support lateral movement
C. Enforce and demonstrate compliance, e.g., HIPAA, PCI-DSS, or SOX
D. Use separate software environments, e.g., dev, testing, and stagging

Continue reading →

Your company is planning for migrating the on-premise E-Commerce system to a PaaS. As a security professional, which of the following is the least concern for the selection of cloud service providers?
A. The location of data persistence.
B. The elasticity of backend services.
C. The report on security controls at the user entity.
D. Rules of engagement when conducting pentesting.

Continue reading →

To improve operational transparency and achieve legal and regulatory compliance, your company is implementing the information governance (IG) program. After taking the inventory of assets, you are considering asset classification and protection. As a member of the steering committee, which of the following is not an appropriate treatment?
A. Recipes, as trade secrets, should be classified by the management.
B. Patents, as confidential contents, should be classified by the data owner.
C. Personal data, as private information, can be anonymized by the data processor.
D. Forensic evidence and e-discovery shall be handled by qualified staff.

Continue reading →

A life cycle is a collection of predefined stages/phases and processes. The conventional term, SDLC, may refer to the development life cycle of a system or software. Which of the following is not true?
A. An SDLC can be repeated as many times as a project requires.
B. The NIST SDLC is more prescriptive than software-based SDLC.
C. A short iteration as a sprint entails delivering values when an SDLC ends.
D. The acquisition is not a concern of SDLC because development is not procurement.

Continue reading →