After risk assessment, your company plans to equip laptops used by sales representatives with FIPS 140-2 Level 3 compliant self-encrypting drives as a countermeasure to protect around 10% of confidential data stored on hard drives. You are analyzing the residual risk using a quantitative approach in another iteration of risk assessment after the risk treatment. Which of the following is the primary and direct factor subject to change due to the risk treatment? (Wentz QOTD)
A. Asset value
B. Exposure factor
C. Annual loss expectancy
D. Annualized rate of occurrence

An information system needs the official management decision given by a senior organizational official to authorize the operation and to accept the residual risk explicitly. Which of the following provides the final decision? (Wentz QOTD)
A. Risk-based auditing
B. Authoritative accreditation
C. Comprehensive security assessment
D. Third-party security evaluation using objective criteria

An employee reported a sexual harassment case to management. Which of the following should your organization conduct first? (Wentz QOTD)
A. Submit a change request
B. Respond to an E-Discovery request
C. Review the acceptable use policy
D. Initiate administrative investigation

A financial specialist in your company needs a specific version of a spreadsheet that is enlisted in your company’s whitelist of approved software. As a member of the IT support team, which of the following should you do first? (Wentz QOTD)
A. Submit a change request to install the specified software
B. Download the software from the open-source community
C. Ensure the software is the latest version
D. Install the software stored on the company’s distribution points

Which of the following is least subject to licensing requirements? (Wentz QOTD)
A. Use of open source software components
B. Use of a sign which identifies products or services of a particular source from those of others
C. Use of a patented algorithm that belongs to the public domain
D. Use of a copyrighted document with a watermark

Which of the following is least likely to be used to implement authentication? (Wentz QOTD)
A. Public key infrastructure
B. 802.1X
C. XACML
D. HTTP Basic Authentication

Which of the following is not defined in the X.509 standard? (Wentz QOTD)
A. Distinguished encoding rules
B. Subject alternative name
C. Issuer distinguished name
D. Subject distinguished name

A container orchestrator manages the lifecycles of containers, especially in large, dynamic environments. Which of the following is the most crucial enabler for an orchestrator to manage containerized applications? (Wentz QOTD)
A. Change management
B. Continuous integration
C. Continuous testing
D. Configuration management

According to OWASP, injection is an attacker’s attempt to send data to an application in a way that will change the meaning of commands being sent to an interpreter. Which of the following least likely suffers from injection attacks? (Wentz QOTD)
A. File paths
B. LDAP queries
C. Obfuscated binary codes
D. Any program invocation

Which of the following is the most effective technical control to prevent SQL injection attacks? (Wentz QOTD)
A. Front end input validation
B. Security awareness and training
C. Parameterized SQL queries
D. Constrained user interface