CYBERSECURITY ARCHITECTURE AND ENGINEERING ACTUAL EXAM TEST PAPER FULL
QUESTIONS CORRECT RESPONSES
Question:
B - Data retention Data retention defines the timespan for which a company must keep its data.
Retention defines not only the minimum amount of time to keep data but also the maximum (or "no
longer than") timespan. Data classification establishes the necessary controls, such as security
configurations, encryption, access controls, procedures, and physical security required to adequately
protect data. The data owner is the entity held accountable for the protection of the data under their
control. Data destruction describes the legally compliant means by which data is removed and made
inaccessible.
Answer:
A security auditor is conducting a compliance audit for his company. Which audit area would
describe how long the company is required to keep copies of data? A - Data classification B - Data
retention C - Data ownership D - Data destruction
Question:
B - Attestation of compliance (AOC) An attestation of compliance (AOC) describes the set of
policies, contracts, and standards identified as essential in the agreement between two parties. Data
sovereignty identifies the laws governing the country (where the company stores data) and has
control over the data. It describes the legal dynamics of data collection and its use in a global
economy. An integration agreement is not an industry standard, but integration is an industry
concern. Modern organizations depend upon an ever-growing network of vendors, suppliers, and
contractors. A statement of classification is not an industry standard, but data classification
establishes the necessary controls, such as security configurations, encryption, access controls,
procedures, and physical security, required to adequately protect data.
Answer:
A small business owner is reviewing third-party vendors to manage the server environment. The
company provides IT services, so it is important that they define areas such as data protection
requirements, privacy protection requirements, and other concerns. What document should the
business owner draft? A - Data sovereignty B - Attestation of compliance C - Integration agreement
D - Statement of classification
,Question:
D - Switzerland Switzerland would probably be the country of choice due to its uniquely protective
privacy laws. Some organizations establish operations in Switzerland based on their supporting legal
framework. The United States would probably not be the first choice for privacy, as Europe has
much more privacy protection and anonymity coverage. China is one of the least likely places for
people to expect privacy and anonymity. For example, Google was discussing with China to remove
data regarding certain events. Argentina enacted privacy laws to protect personnel, but Switzerland
is considered the gold standard.
Answer:
A motivated technology analyst is starting a company focused on privacy and anonymity. What
country would the technology analyst most likely want to operate from? A - United States B - China
C - Argentina D - Switzerland
Question:
A - APPI Japan's privacy law, the Act on the Protection of Personal Information (APPI), is a
relevant law the owner would want to research before expanding operations. HIPAA is the Health
Insurance Portability and Accountability Act which applies to medical information in the United
States. HIPAA is not applicable outside the U.S., but countries do have parallel standards. The
Personal Data Protection Act (PDPA) is the privacy act that Singapore has enacted. The General
Data Protection Regulation enforces rules for organizations that offer services to entities in the
European Union (EU) or that collect and analyze data on subjects located there.
Answer:
An owner of a small company produces digital manga in the United States, but it has also become
very popular in Japan. Which privacy law should the owner comply with to set up an operation in
Japan? A - APPI B - HIPAA C - PDPA D - GDPR
Question:
C - OLA (Operational level agreement) Operational-level agreements are typically internal
documents established by an organization to define the essential operational needs of an
organization. OLAs meet the performance metrics defined in a Service Level Agreement. An
interconnection security agreement (ISA) occurs between two entities that need to share data via an
interface. Master service agreements (MSAs) are typically "umbrella" contracts that establish an
agreement between two entities to conduct business during a defined term. A Privacy Level
Agreement (PLA) commonly establishes a relationship with a cloud service provider (CSP), going
,beyond the provisions detailed in an SLA to include metrics and measures related to conforming
with specific information privacy and data protection requirements.
Answer:
A system administrator has decided to start a small data center venture for small businesses. What
type of agreement should the sysadmin set up to meet the performance metrics defined in Service
Level Agreements? A - ISA Interconnection security agreement) B - MSA (Master service
agreement) C - OLA (Operational level agreement) D - PLA (Privacy level agreement)
Question:
A - PHI Protected Health Information (PHI) describes data used to identify an individual and
contains information about past, present, or future health, including related payments and data used
in the operation of a healthcare business. Personal Identifiable Financial Information (PIFI)
describes information about a consumer provided to a financial institution and includes information
such as account number, credit/debit card number, personal information, and more. Intellectual
property (IP) describes intangible products of human thought and ingenuity. Various laws protect
intellectual property, such as copyrights, patents, trademarks, and trade secrets. Personally
identifiable information (PII) describes data used to directly or indirectly identify an individual.
Answer:
A consultant is conducting a compliance audit for a hospital. What type of information is the
consultant auditing? A - PHI B - PIFI C - IP D - PII
Question:
C - Continuous Due diligence describes the ongoing and documented effort to continuously evaluate
and improve the mechanisms that protect assets. Prudent would be more akin to due care, which is
the basis of due diligence. Due diligence would be the continued effort of due care. Reasonable is
also more akin to due care, which an ongoing effort of would be due diligence. Due care is
intentionally open-ended as "reasonable and expected" and defined in many different ways,
depending upon circumstances. Patching is just a component of both due care, and by extension, due
diligence. There are several defense in depth layers beyond patching that would also apply.
Answer:
A system engineer is trying to explain due diligence to a group of system administrators. What word
would best describe the idea behind due diligence? A - Prudent B - Reasonable C - Continuous D -
Patching
, Question:
A - Parallel test In a parallel test, the organization isolates the DR site from the primary site,
activating it as though the company is using the DR site. This is the best option to minimize impact.
Any mistakes or issues in a full interruption test can cause a true DR event since the organization is
performing the exercise on live systems and data. A walk-through is not an active test, but it requires
all groups included in the BCDR plan to identify a representative to participate in a meeting to
review the plan. A tabletop exercise is not active but identifies a specific objective and then uses it
to determine whether all parties involved in the response know what to do.
Answer:
A data center lead is preparing an organization for disaster recovery by performing an actual test to
ensure systems can failover but wants to minimize impact to production systems. Which method
should the data center lead use? A - Parallel test B - Full interruption C - Walk-through D - Tabletop
exercise
Question:
A, B, & D; SOX, GLBA & FFIEC The Sarbanes-Oxley (SOX) Act regarding fraudulent accounting
is one example of standards and regulations with descriptions of Business Continuity and Disaster
Recovery (BCDR) capabilities. The Gramm-Leach-Bliley (GLBA) Act regarding personal financial
information is another example of standards and regulations with descriptions of Business
Continuity and Disaster Recovery (BCDR) capabilities. The Federal Financial Institutions
Examination Council (FFIEC) regarding financial institutions is another example of standards and
regulations with descriptions of Business Continuity and Disaster Recovery (BCDR) capabilities.
Disaster Recovery as a Service (DRaaS) uses public cloud services as a DR site. This is not a
standard or regulation but rather a mechanism to achieve it.
Answer:
A security architect is looking for examples of standards and regulations with descriptions of
Business Continuity and Disaster Recovery (BCDR) capabilities. Which of the following are
examples? Select 3 answers. A - SOX B - GLBA C - DRaaS D - FFIEC
Question:
A - DRP Disaster Recovery Plans (DRPs) focus on when events are their most frantic and pressing.
DRPs focus on the tasks required to bring critical systems back online. Business Continuity Plans
(BCPs) have a broad scope and cover the range of activities from the development of a business
continuity policy through the creation of the response plans. Master Service Agreements (MSAs)
are typically "umbrella" contracts that establish an agreement between two entities to conduct
QUESTIONS CORRECT RESPONSES
Question:
B - Data retention Data retention defines the timespan for which a company must keep its data.
Retention defines not only the minimum amount of time to keep data but also the maximum (or "no
longer than") timespan. Data classification establishes the necessary controls, such as security
configurations, encryption, access controls, procedures, and physical security required to adequately
protect data. The data owner is the entity held accountable for the protection of the data under their
control. Data destruction describes the legally compliant means by which data is removed and made
inaccessible.
Answer:
A security auditor is conducting a compliance audit for his company. Which audit area would
describe how long the company is required to keep copies of data? A - Data classification B - Data
retention C - Data ownership D - Data destruction
Question:
B - Attestation of compliance (AOC) An attestation of compliance (AOC) describes the set of
policies, contracts, and standards identified as essential in the agreement between two parties. Data
sovereignty identifies the laws governing the country (where the company stores data) and has
control over the data. It describes the legal dynamics of data collection and its use in a global
economy. An integration agreement is not an industry standard, but integration is an industry
concern. Modern organizations depend upon an ever-growing network of vendors, suppliers, and
contractors. A statement of classification is not an industry standard, but data classification
establishes the necessary controls, such as security configurations, encryption, access controls,
procedures, and physical security, required to adequately protect data.
Answer:
A small business owner is reviewing third-party vendors to manage the server environment. The
company provides IT services, so it is important that they define areas such as data protection
requirements, privacy protection requirements, and other concerns. What document should the
business owner draft? A - Data sovereignty B - Attestation of compliance C - Integration agreement
D - Statement of classification
,Question:
D - Switzerland Switzerland would probably be the country of choice due to its uniquely protective
privacy laws. Some organizations establish operations in Switzerland based on their supporting legal
framework. The United States would probably not be the first choice for privacy, as Europe has
much more privacy protection and anonymity coverage. China is one of the least likely places for
people to expect privacy and anonymity. For example, Google was discussing with China to remove
data regarding certain events. Argentina enacted privacy laws to protect personnel, but Switzerland
is considered the gold standard.
Answer:
A motivated technology analyst is starting a company focused on privacy and anonymity. What
country would the technology analyst most likely want to operate from? A - United States B - China
C - Argentina D - Switzerland
Question:
A - APPI Japan's privacy law, the Act on the Protection of Personal Information (APPI), is a
relevant law the owner would want to research before expanding operations. HIPAA is the Health
Insurance Portability and Accountability Act which applies to medical information in the United
States. HIPAA is not applicable outside the U.S., but countries do have parallel standards. The
Personal Data Protection Act (PDPA) is the privacy act that Singapore has enacted. The General
Data Protection Regulation enforces rules for organizations that offer services to entities in the
European Union (EU) or that collect and analyze data on subjects located there.
Answer:
An owner of a small company produces digital manga in the United States, but it has also become
very popular in Japan. Which privacy law should the owner comply with to set up an operation in
Japan? A - APPI B - HIPAA C - PDPA D - GDPR
Question:
C - OLA (Operational level agreement) Operational-level agreements are typically internal
documents established by an organization to define the essential operational needs of an
organization. OLAs meet the performance metrics defined in a Service Level Agreement. An
interconnection security agreement (ISA) occurs between two entities that need to share data via an
interface. Master service agreements (MSAs) are typically "umbrella" contracts that establish an
agreement between two entities to conduct business during a defined term. A Privacy Level
Agreement (PLA) commonly establishes a relationship with a cloud service provider (CSP), going
,beyond the provisions detailed in an SLA to include metrics and measures related to conforming
with specific information privacy and data protection requirements.
Answer:
A system administrator has decided to start a small data center venture for small businesses. What
type of agreement should the sysadmin set up to meet the performance metrics defined in Service
Level Agreements? A - ISA Interconnection security agreement) B - MSA (Master service
agreement) C - OLA (Operational level agreement) D - PLA (Privacy level agreement)
Question:
A - PHI Protected Health Information (PHI) describes data used to identify an individual and
contains information about past, present, or future health, including related payments and data used
in the operation of a healthcare business. Personal Identifiable Financial Information (PIFI)
describes information about a consumer provided to a financial institution and includes information
such as account number, credit/debit card number, personal information, and more. Intellectual
property (IP) describes intangible products of human thought and ingenuity. Various laws protect
intellectual property, such as copyrights, patents, trademarks, and trade secrets. Personally
identifiable information (PII) describes data used to directly or indirectly identify an individual.
Answer:
A consultant is conducting a compliance audit for a hospital. What type of information is the
consultant auditing? A - PHI B - PIFI C - IP D - PII
Question:
C - Continuous Due diligence describes the ongoing and documented effort to continuously evaluate
and improve the mechanisms that protect assets. Prudent would be more akin to due care, which is
the basis of due diligence. Due diligence would be the continued effort of due care. Reasonable is
also more akin to due care, which an ongoing effort of would be due diligence. Due care is
intentionally open-ended as "reasonable and expected" and defined in many different ways,
depending upon circumstances. Patching is just a component of both due care, and by extension, due
diligence. There are several defense in depth layers beyond patching that would also apply.
Answer:
A system engineer is trying to explain due diligence to a group of system administrators. What word
would best describe the idea behind due diligence? A - Prudent B - Reasonable C - Continuous D -
Patching
, Question:
A - Parallel test In a parallel test, the organization isolates the DR site from the primary site,
activating it as though the company is using the DR site. This is the best option to minimize impact.
Any mistakes or issues in a full interruption test can cause a true DR event since the organization is
performing the exercise on live systems and data. A walk-through is not an active test, but it requires
all groups included in the BCDR plan to identify a representative to participate in a meeting to
review the plan. A tabletop exercise is not active but identifies a specific objective and then uses it
to determine whether all parties involved in the response know what to do.
Answer:
A data center lead is preparing an organization for disaster recovery by performing an actual test to
ensure systems can failover but wants to minimize impact to production systems. Which method
should the data center lead use? A - Parallel test B - Full interruption C - Walk-through D - Tabletop
exercise
Question:
A, B, & D; SOX, GLBA & FFIEC The Sarbanes-Oxley (SOX) Act regarding fraudulent accounting
is one example of standards and regulations with descriptions of Business Continuity and Disaster
Recovery (BCDR) capabilities. The Gramm-Leach-Bliley (GLBA) Act regarding personal financial
information is another example of standards and regulations with descriptions of Business
Continuity and Disaster Recovery (BCDR) capabilities. The Federal Financial Institutions
Examination Council (FFIEC) regarding financial institutions is another example of standards and
regulations with descriptions of Business Continuity and Disaster Recovery (BCDR) capabilities.
Disaster Recovery as a Service (DRaaS) uses public cloud services as a DR site. This is not a
standard or regulation but rather a mechanism to achieve it.
Answer:
A security architect is looking for examples of standards and regulations with descriptions of
Business Continuity and Disaster Recovery (BCDR) capabilities. Which of the following are
examples? Select 3 answers. A - SOX B - GLBA C - DRaaS D - FFIEC
Question:
A - DRP Disaster Recovery Plans (DRPs) focus on when events are their most frantic and pressing.
DRPs focus on the tasks required to bring critical systems back online. Business Continuity Plans
(BCPs) have a broad scope and cover the range of activities from the development of a business
continuity policy through the creation of the response plans. Master Service Agreements (MSAs)
are typically "umbrella" contracts that establish an agreement between two entities to conduct
