Question 1

Who is responsible for the protection of information when it is shared with or provided to other organizations?

Options :

A : Systems owner

B : Authorizing Official (AO)

C : Information owner

D : Security officer

Answer: C

Question 2

The development team has been tasked with collecting data from biometric devices. The application will support a variety of collection data streams. During the testing phase, the team utilizes data from an old production database in a secure testing environment. What principle has the team taken into consideration?

Options :

A : biometric data cannot be changed.

B : Separate biometric data streams require increased security.

C : The biometric devices are unknown.

D : Biometric data must be protected from disclosure.

Answer: A

Question 3

An employee receives a promotion that entities them to access higher-level functions on the company's accounting system, as well as keeping their access to the previous system that is no longer needed or applicable. What is the name of the process that tries to remove this excess privilege?

Options :

A : Access provisioning

B : Segregation of Duties (SoD)

C : Access certification

D : Access aggregation

Answer: B

Question 4

What is the MINIMUM standard for testing a disaster recovery plan (DRP)?

Options :

A : Semi-annually and in alignment with a fiscal half-year business cycle

B : Annually or less frequently depending upon audit department requirements

C : Quarterly or more frequently depending upon the advice of the information security manager

D : As often as necessary depending upon the stability of the environment and business requirements

Answer: D

Question 5

An international medical organization with headquarters in the United States (US) and branches in France

wants to test a drug in both countries. What is the organization allowed to do with the test subject's data?

Options :

A : Aggregate it into one database in the US

B : Process it in the US, but store the information in France

C : Share it with a third party

D : Anonymize it and process it in the US

Answer: B