All practice questions

378 questions

Question 361Question

A satellite communications provider is formalizing its enterprise security oversight framework following a regulatory audit. Security analysts must properly categorize governance artifacts to establish clear organizational hierarchy. Match each security governance document type on the left with its defining operational characteristic on the right.

Click a left item, then click its matching right item

Items

Security Policy
Security Standard
Security Baseline
Security Guideline

Matches

Show answer & explanation

Answer

Security Policy matches the high-level executive directive; Security Standard matches mandatory uniform technical requirements; Security Baseline matches minimum configuration state; Security Guideline matches discretionary recommendations.
In security governance hierarchy, policies dictate high-level executive intent, standards enforce mandatory technical specifications, baselines define minimum technical system configurations, and guidelines provide non-mandatory best practices.

Step-by-Step Solution

1
Identify top-level authority documents.
Map Security Policy to high-level management directives establishing strategic goals.
Policies represent high-level managerial intent and set foundational security scope.
2
Distinguish mandatory requirements from minimum system states.
Map Security Standard to mandatory technical requirements/metrics and Security Baseline to minimum deployment configuration states.
Standards dictate mandatory rules, while baselines set specific platform configuration minimums.
3
Identify non-mandatory governance elements.
Map Security Guideline to discretionary recommendations and operational advice.
Guidelines provide non-binding recommendations where flexibility is permitted.

Key Concept

Hierarchy of Security Governance Documents
Estimated Time:1m 30s
Question 362Question

A newly appointed Chief Information Security Officer (CISO) at a global renewable energy management corporation is restructuring the organization's security documentation hierarchy. Match each security governance document type on the left with its corresponding operational characteristic on the right.

Click a left item, then click its matching right item

Items

Security Policy
Technical Standard
Security Baseline
Security Guideline

Matches

Show answer & explanation

Answer

Security Policy matches the high-level mandatory directive; Technical Standard matches mandatory specific technical specifications; Security Baseline matches the mandatory minimum configuration benchmark; Security Guideline matches discretionary recommendations.
In security governance, documents are categorized by authority and enforcement level. Policies provide high-level mandatory direction from leadership. Standards enforce specific required technologies or specifications. Baselines establish the minimum mandatory configuration build for hardware/software. Guidelines offer optional, flexible recommendations for best practices.

Step-by-Step Solution

1
Analyze the mandatory status and high-level nature of Security Policies.
Identify that a Security Policy represents executive-level directives providing overall organizational security goals and expectations.
Policies sit at the top of the governance hierarchy and apply broadly across the enterprise.
2
Differentiate mandatory technical specifications from minimum system configuration states.
Map Technical Standards to compulsory operational/technical specifications and Security Baselines to the minimum hardening build state required for individual assets.
Standards define mandatory technologies or behaviors, whereas baselines set the minimum threshold configuration.
3
Evaluate discretionary documentation versus mandatory compliance requirements.
Associate Security Guidelines with non-binding recommendations and operational best practices.
Guidelines provide flexibility and advice, unlike policies, standards, and baselines which are strictly mandatory.

Key Concept

Security Governance Policy Hierarchy and Document Roles
Question 363Question

A security analyst is reviewing business continuity and resilience planning metrics following a Business Impact Analysis (BIA) for a critical enterprise application. Match each business continuity metric on the left with its corresponding operational definition on the right.

Click a left item, then click its matching right item

Items

Maximum Tolerable Downtime (MTD)
Recovery Time Objective (RTO)
Recovery Point Objective (RPO)
Work Recovery Time (WRT)

Matches

Show answer & explanation

Answer

Maximum Tolerable Downtime (MTD) matches the overall maximum timeframe an enterprise business process can be offline before incurring irreversible harm; Recovery Time Objective (RTO) matches the target duration of time dedicated to technical restoration of system infrastructure and applications; Recovery Point Objective (RPO) matches the maximum acceptable amount of transactional data loss measured in duration prior to a disruption; Work Recovery Time (WRT) matches the operational phase after technical recovery dedicated to data validation, application testing, and process integration.
Each business continuity metric measures a distinct component of risk and recovery: Maximum Tolerable Downtime defines the fatal operational threshold, Recovery Time Objective specifies technical system recovery speed, Recovery Point Objective establishes acceptable data loss windows, and Work Recovery Time accounts for business validation prior to resuming full operations.

Step-by-Step Solution

1
Identify the data loss boundary metric
Recovery Point Objective (RPO) specifically addresses acceptable data loss age measured backward in time from the disruption event.
RPO determines backup frequency requirements by specifying how much recent data loss is tolerable.
2
Differentiate technical system restoration from total operational business recovery
Recovery Time Objective (RTO) covers technical recovery duration, while Work Recovery Time (WRT) covers post-restoration verification and operational integration.
RTO focuses on technical service availability, whereas WRT focuses on business readiness.
3
Determine the overarching disruption threshold
Maximum Tolerable Downtime (MTD) establishes the non-negotiable ceiling (where MTD must be greater than or equal to RTO + WRT) before irreversible impact occurs.
MTD establishes the absolute upper boundary for overall business continuity planning.

Key Concept

Business Continuity Metrics (MTD, RTO, RPO, WRT)
Question 364Question

Match each social engineering attack vector or influence principle on the left with the enterprise incident scenario on the right that best demonstrates its execution.

Click a left item, then click its matching right item

Items

Whaling
Shoulder Surfing
Diversion Theft
Scarcity (Influence Principle)

Matches

Show answer & explanation

Answer

Whaling pairs with the scenario involving a targeted email sent directly to the CEO. Shoulder Surfing pairs with the scenario involving direct visual observation of credential entry in a cafe. Diversion Theft pairs with the scenario involving redirecting incoming physical shipments of equipment. Scarcity pairs with the scenario leveraging limited remaining trial licenses to trick staff.
Each attack vector or principle matches its operational execution: Whaling targets top executives (CEO), Shoulder Surfing relies on direct visual observation, Diversion Theft intercepts physical transit shipments, and Scarcity exploits psychological urgency built around limited remaining quantities.

Step-by-Step Solution

1
Identify the target profile for Whaling
Recognize that Whaling specifically targets high-ranking executives like C-level leadership, matching the CEO wire transfer scenario.
Whaling is a specialized variant of spear phishing aimed at high-value targets within an organization.
2
Analyze physical observation threat vectors
Identify Shoulder Surfing as the technique where an attacker visually eavesdrops on password or credential entry in public spaces.
Direct visual observation of keyboards and screens falls directly under shoulder surfing risks.
3
Evaluate supply chain physical transport attack methods
Link Diversion Theft to the physical rerouting of incoming hardware packages and logistics couriers.
Diversion theft focuses on intercepting goods in transit by deceiving transportation personnel.
4
Evaluate psychological principles of influence
Associate Scarcity with the tactic of offering limited availability items (such as only five trial licenses) to coerce hasty victim action.
Scarcity relies on the fear of missing out due to restricted availability or strict deadlines.

Key Concept

Social Engineering Vectors and Principles of Influence
Estimated Time:1m 30s
Question 365Question

An enterprise compliance officer is updating the organization's regulatory tracking matrix to align with global legal mandates and industry-specific security requirements. Match each regulatory framework or legal mandate on the left with its corresponding compliance scope or operational requirement on the right.

Click a left item, then click its matching right item

Items

Children's Online Privacy Protection Act (COPPA)
International Traffic in Arms Regulations (ITAR)
Federal Information Security Modernization Act (FISMA)
Digital Operational Resilience Act (DORA)

Matches

Show answer & explanation

Answer

COPPA matches the mandate for verifiable parental consent before collecting data from children under 13; ITAR matches export restrictions on defense-related technical data; FISMA matches US federal agency security control requirements following NIST guidelines; DORA matches EU financial sector digital operational resilience and ICT vendor oversight requirements.
Each regulation is paired accurately with its legal jurisdiction and operational focus: COPPA protects children's online data privacy; ITAR controls defense technical data exports; FISMA enforces US federal agency information security controls via NIST standards; and DORA establishes EU financial sector ICT operational resilience standards.

Step-by-Step Solution

1
Analyze the scope of COPPA
COPPA specifically protects online privacy for children under 13 years old, requiring verifiable parental consent.
Identify the distinct target population and consent mandate associated with child privacy protection.
2
Analyze the scope of ITAR
ITAR controls defense-related technical data and military export restrictions.
Differentiate export control regulations governing defense technology from general commerce or data privacy laws.
3
Analyze the scope of FISMA
FISMA mandates security control implementation (such as NIST SP 800-53) for US federal agencies and contractors.
Recognize federal information system governance standards enforced within US government operations.
4
Analyze the scope of DORA
DORA enforces EU digital operational resilience, ICT threat testing, and third-party risk management for financial institutions.
Distinguish recent regional financial sector cyber resilience regulations from generic privacy laws.

Key Concept

Regulatory Compliance and Legal Requirements Management
Question 366Question

Match each business continuity management artifact or process on the left with its primary operational objective on the right.

Click a left item, then click its matching right item

Items

Business Impact Analysis (BIA)
Business Continuity Plan (BCP)
Disaster Recovery Plan (DRP)
Continuity of Operations Plan (COOP)

Matches

Show answer & explanation

Answer

Business Impact Analysis (BIA) pairs with quantifying operational impacts and establishing RTO/RPO; Business Continuity Plan (BCP) pairs with operational procedures for sustaining business processes; Disaster Recovery Plan (DRP) pairs with technical step-by-step instructions for IT infrastructure restoration; Continuity of Operations Plan (COOP) pairs with sustaining mission-critical leadership and core functions during major disasters.
Each artifact addresses a distinct layer of organizational resilience: BIA analyzes impacts to define metrics, BCP maintains business process workflows, DRP recovers technical systems and data, and COOP preserves essential organizational leadership and core mission execution.

Step-by-Step Solution

1
Analyze the scope of Business Impact Analysis (BIA).
Identify that BIA is an analytical phase prioritizing critical assets, establishing Maximum Tolerable Downtime (MTD), RTO, and RPO.
BIA forms the baseline empirical assessment required before developing continuity strategies.
2
Differentiate Business Continuity Planning (BCP) from Disaster Recovery Planning (DRP).
Recognize BCP handles overall operational processes and business workflow continuity, whereas DRP addresses the technical re-establishment of IT systems.
BCP focuses on business processes and personnel, while DRP focuses on systems, infrastructure, and data restoration.
3
Identify the distinct role of Continuity of Operations Planning (COOP).
Associate COOP with preserving institutional leadership, emergency communications, and essential mission capabilities.
COOP originated in government and public safety frameworks to guarantee leadership survival and command structure continuity.

Key Concept

Distinction between BIA, BCP, DRP, and COOP framework components
Question 367Question

An enterprise risk analyst is auditing international compliance requirements across multiple regional jurisdictions and sector-specific legal mandates. Match each regulatory framework or law on the left with its core scope and applicability on the right.

Click a left item, then click its matching right item

Items

NIS2 Directive
PIPEDA
CMMC
EAR

Matches

Show answer & explanation

Answer

NIS2 Directive matches EU critical infrastructure cybersecurity risk management rules; PIPEDA matches Canadian private-sector commercial privacy laws; CMMC matches US DoD defense contractor cybersecurity verification for CUI; EAR matches US dual-use commercial export control regulations.
The correct pairings accurately map each regulation to its respective domain and scope. The NIS2 Directive enforces cyber resilience for essential entities in the European Union. PIPEDA regulates Canadian commercial privacy obligations. CMMC mandates verified cybersecurity practices for US defense contractors processing Controlled Unclassified Information. EAR governs export control restrictions on dual-use commercial items and technical data.

Step-by-Step Solution

1
Analyze the legal domain and jurisdiction for each mandate on the left.
NIS2 is European critical infrastructure resilience; PIPEDA is Canadian commercial data privacy; CMMC is US defense supply chain security; EAR is US dual-use export control.
Categorizing compliance frameworks by jurisdiction and protected data type is fundamental to regulatory mapping.
2
Match each mandate to its precise scope description on the right.
NIS2 aligns with EU essential entity security; PIPEDA aligns with Canadian commercial personal data; CMMC aligns with DoD contractor CUI assessments; EAR aligns with dual-use tech export restrictions.
Ensures accurate correlation between organizational activities and governing legal requirements.

Key Concept

Mapping regulatory compliance frameworks and legal requirements to organizational scope, geographical jurisdiction, and controlled data types.
Question 368Question

Match each business continuity testing methodology on the left with its corresponding operational description on the right.

Click a left item, then click its matching right item

Items

Tabletop Exercise
Structured Walkthrough
Simulation Test
Full-Interruption Test

Matches

Show answer & explanation

Answer

Tabletop Exercise matches discussion-based scenario review around a table; Structured Walkthrough matches step-by-step module document review; Simulation Test matches role-play execution without failing over live production systems; Full-Interruption Test matches complete shutdown of production systems with activation of alternate facilities.
Each business continuity test type reflects a specific tier of operational risk and validation depth. Tabletop exercises validate high-level decision-making via scenario discussion. Structured walkthroughs ensure written procedures and contact details are accurate. Simulation tests engage responders in functional exercises without disrupting production. Full-interruption tests provide maximum assurance by taking primary production systems offline and cutting over to recovery facilities.

Step-by-Step Solution

1
Differentiate between theoretical plan validation and active operational testing.
Identified discussion-based methods (Tabletop and Structured Walkthrough) versus active execution methods (Simulation and Full-Interruption).
Business continuity plan testing ranges from low-risk documentation reviews to high-risk live system failovers.
2
Map Tabletop Exercise and Structured Walkthrough to their specific review scopes.
Tabletop matches scenario discussions; Structured Walkthrough matches detailed step-by-step document checks.
Tabletops test strategic decision-making in scenarios, whereas walkthroughs focus on line-by-line plan accuracy.
3
Differentiate Simulation Testing from Full-Interruption Testing based on production system impact.
Simulation executes real-time response on secondary systems without production outage, while Full-Interruption forces live system failover to the alternate site.
Full-interruption tests introduce real business operational risk, whereas simulation tests insulate production environments while testing responder actions.

Key Concept

Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) Testing Methodologies
Question 369Question

An enterprise organization is establishing its formal data governance framework to satisfy regulatory compliance requirements. Match each data governance role on the left with its primary operational responsibility on the right.

Click a left item, then click its matching right item

Items

Data Owner
Data Custodian
Data Steward
Data Protection Officer (DPO)

Matches

Show answer & explanation

Answer

Data Owner matches with determining data classification and defining access permissions; Data Custodian matches with configuring access control lists, performing backups, and implementing technical encryption; Data Steward matches with ensuring data quality, metadata tagging, and day-to-day domain governance; Data Protection Officer matches with monitoring privacy compliance, conducting impact assessments, and liaising with regulators.
Each role correctly aligns with its defined responsibility in enterprise governance: the Data Owner defines classification and access policy; the Data Custodian manages technical security implementation and backups; the Data Steward enforces data quality and metadata standards; and the Data Protection Officer oversees privacy compliance and regulatory relations.

Step-by-Step Solution

1
Differentiate governance accountability from operational execution.
Identify Data Owner as the business authority defining classification tiers and access rights, whereas Data Custodian executes technical security controls.
CompTIA Security+ distinguishes between executive accountability (owner) and technical operational maintenance (custodian).
2
Identify domain-level data quality and regulatory oversight responsibilities.
Map Data Steward to operational metadata and data quality maintenance, and Data Protection Officer to independent privacy law compliance and regulatory liaison duties.
Data Stewards focus on operational data integrity and classification accuracy, while DPOs oversee broad regulatory compliance and privacy impact assessments.

Key Concept

Data Governance Roles and Responsibilities
Question 370Question

An enterprise compliance officer is reviewing legal responsibilities for handling sensitive user data and healthcare information across international and regional privacy mandates. Match each regulatory compliance role or entity designation on the left with its corresponding legal definition and operational scope on the right.

Click a left item, then click its matching right item

Items

Data Controller (GDPR)
Data Processor (GDPR)
Covered Entity (HIPAA)
Business Associate (HIPAA)

Matches

Show answer & explanation

Answer

Data Controller corresponds to the entity determining the purposes and means of processing personal data; Data Processor corresponds to the entity processing personal data per controller instructions; Covered Entity corresponds to healthcare organizations directly handling PHI; and Business Associate corresponds to third-party vendors handling PHI on behalf of healthcare organizations.
Under global privacy and compliance frameworks, organizational responsibilities are dictated by legal designations. GDPR defines the Data Controller as the body determining the purposes and methods of processing personal data, while the Data Processor carries out data processing solely on the controller's behalf. Under US healthcare privacy law (HIPAA), a Covered Entity refers to primary healthcare providers, plans, or clearinghouses transmitting PHI, whereas a Business Associate is a third-party service provider that processes or stores PHI on behalf of a Covered Entity.

Step-by-Step Solution

1
Analyze GDPR role definitions
Identify that the Data Controller specifies processing purposes/means, while the Data Processor acts as an agent carrying out processing under instructions.
GDPR cleanly distinguishes between decision-making entities (controllers) and operational service providers (processors).
2
Analyze HIPAA entity definitions
Identify Covered Entities as primary healthcare providers/plans generating PHI, and Business Associates as third-party vendors handling PHI for covered entities.
HIPAA requires Business Associate Agreements (BAAs) to extend PHI privacy and security requirements to third-party contractors.
3
Map each designation to its definition
Complete all four matching pairs based on statutory definitions under GDPR and HIPAA.
Correct mapping ensures regulatory compliance and accurate risk governance.

Key Concept

Regulatory Privacy Roles and Legal Entity Designations
Question 371Question

A municipal public safety agency is establishing continuity metrics for its computer-aided dispatch (CAD) emergency response system following a Business Impact Analysis (BIA). Match each business continuity metric on the left with its corresponding operational definition on the right.

Click a left item, then click its matching right item

Items

Recovery Time Objective (RTO)
Recovery Point Objective (RPO)
Mean Time Between Failures (MTBF)
Maximum Tolerable Downtime (MTD)

Matches

Show answer & explanation

Answer

Recovery Time Objective (RTO) matches the target duration for service restoration; Recovery Point Objective (RPO) matches the maximum acceptable period of data loss; Mean Time Between Failures (MTBF) matches the statistical indicator of system reliability; and Maximum Tolerable Downtime (MTD) matches the total permissible threshold of outage duration.
Each business continuity term directly corresponds to its core BIA metric definition: RTO sets the target timeframe for system restoration, RPO sets the maximum acceptable window of lost data, MTBF calculates hardware/system reliability over time, and MTD sets the maximum overall outage threshold an organization can sustain.

Step-by-Step Solution

1
Differentiate between time-to-restore metrics and data-loss tolerance metrics.
Identify RTO as system restoration target time and RPO as data age/loss limit.
RTO focuses on downtime duration, while RPO focuses on database transaction recovery.
2
Analyze reliability metrics versus absolute interruption caps.
Map MTBF to operational equipment reliability and MTD to the maximum operational outage boundary.
MTBF estimates frequency between failures, while MTD caps overall outage allowance before catastrophic impact.

Key Concept

Business Impact Analysis Metrics and Business Continuity Planning Targets
Question 372Question

An enterprise organization is updating its global data governance standards to comply with privacy regulations. Match each data privacy control on the left with its corresponding operational implementation on the right.

Click a left item, then click its matching right item

Items

Pseudonymization
Data Minimization
Data Sovereignty
Data Masking

Matches

Show answer & explanation

Answer

Pseudonymization matches with replacing direct identifiers with artificial keys while storing a separate key mapping securely; Data Minimization matches with restricting data collection, processing, and retention strictly to what is necessary; Data Sovereignty matches with enforcing compliance policies requiring data storage to abide by local laws; Data Masking matches with concealing sensitive data fields on interface screens using placeholders.
Each data privacy term correctly maps to its foundational CompTIA Security+ operational control definition.

Step-by-Step Solution

1
Identify the operational mechanics of Pseudonymization
Pseudonymization replaces PII fields with unique aliases, keeping the re-identification key in a separate, secure location.
Unlike full anonymization, pseudonymized data can be reversed back to its original form using controlled mapping keys.
2
Determine the rule defining Data Minimization
Data Minimization mandates collecting only the minimum data required to satisfy a specific business function.
This practice limits exposure and regulatory risk by eliminating superfluous sensitive data storage.
3
Define the geographic requirement of Data Sovereignty
Data Sovereignty subjects digital data to the local privacy laws and judicial mandates of the host country.
Organizations must comply with regional storage location rules and cross-border transfer limits.
4
Identify the presentation control used in Data Masking
Data Masking obscures display fields (such as showing only the last 4 digits of a card) to prevent shoulder surfing and unauthorized viewing.
Masking alters how data is shown on screens without necessarily changing the underlying encrypted database structure.

Key Concept

Data Privacy Controls and Implementation Mechanisms
Question 373Question

Match each business continuity and resiliency metric on the left with its corresponding operational impact definition on the right.

Click a left item, then click its matching right item

Items

Recovery Point Objective (RPO)
Recovery Time Objective (RTO)
Mean Time to Repair (MTTR)
Mean Time Between Failures (MTBF)

Matches

Show answer & explanation

Answer

Recovery Point Objective (RPO) matches maximum acceptable data loss; Recovery Time Objective (RTO) matches maximum targeted service restoration time; Mean Time to Repair (MTTR) matches average repair/restoration time; Mean Time Between Failures (MTBF) matches expected operational uptime between failures.
Each continuity metric precisely addresses a different aspect of risk assessment and system availability: RPO establishes data backup requirements, RTO establishes recovery speed goals, MTTR measures repair efficiency, and MTBF measures component reliability.

Step-by-Step Solution

1
Distinguish between data recovery thresholds (RPO) and downtime thresholds (RTO).
Identified RPO as data loss tolerance (time-based data loss) and RTO as operational restoration speed (downtime allowance).
RPO dictates backup frequency requirements, whereas RTO dictates recovery procedure speed.
2
Analyze service restoration metrics vs. hardware reliability metrics.
Associated MTTR with active repair duration and MTBF with system component endurance.
MTTR evaluates maintenance efficiency post-failure, while MTBF measures hardware reliability prior to failure.

Key Concept

Core BIA metrics (RTO, RPO, MTTR, MTBF) define operational impact, backup thresholds, service availability goals, and hardware reliability requirements.
Question 374Question

A global telecommunications provider is updating its data governance framework and enterprise Data Loss Prevention (DLP) policy across cloud and on-premises environments. Match each data classification tier on the left with its corresponding mandatory technical and privacy handling control on the right.

Click a left item, then click its matching right item

Items

Restricted (High Sensitivity / PII & Payment Data)
Confidential / Proprietary (Medium-High Sensitivity / Source Code & IP)
Internal Use Only (Low-Medium Sensitivity / Operations & Directories)
Public (Low Sensitivity / Published Service Catalogs)

Matches

Show answer & explanation

Answer

Restricted matches mandatory AES-256/TLS 1.3 encryption, DLP blocking, and DPIA enforcement; Confidential/Proprietary matches encryption, strict RBAC, watermarking, and NDA validation; Internal Use Only matches enterprise SSO access controls and audit logging; Public matches unrestricted access focused on integrity monitoring.
Each data classification tier dictates specific technical, operational, and legal protection levels. Restricted data demands rigorous privacy and encryption controls due to regulatory obligations (e.g., GDPR, PCI DSS). Confidential data protects business-critical intellectual property using access governance and tracking. Internal data relies on authentication to prevent unauthorized public disclosure. Public data prioritizes availability and integrity over confidentiality.

Step-by-Step Solution

1
Evaluate the sensitivity tier of Restricted data (PII and financial records).
Identify controls targeted at regulatory compliance and maximum privacy impact.
Restricted data requires the highest level of technical controls (AES-256, TLS 1.3, DLP export prevention, and formal DPIAs).
2
Evaluate Intellectual Property and Source Code (Confidential/Proprietary).
Match with trade secret protection controls.
Confidential technical assets demand strict RBAC, encryption, digital watermarking, and legal non-disclosure safeguards.
3
Differentiate Internal Use Only data from Public data.
Internal data requires SSO identity verification, whereas Public data focuses purely on integrity monitoring.
Public data requires no confidentiality protection, while internal operations data must be restricted to authenticated employees.

Key Concept

Data Classification Tiers and Handling Controls
Estimated Time:2m 0s
Question 375Question

Match each Business Impact Analysis (BIA) and business continuity metric on the left with its corresponding operational definition in an enterprise airport operations management system on the right.

Click a left item, then click its matching right item

Items

Recovery Point Objective (RPO)
Recovery Time Objective (RTO)
Maximum Tolerable Downtime (MTD)
Work Recovery Time (WRT)

Matches

Show answer & explanation

Answer

Recovery Point Objective pairs with acceptable data loss age; Recovery Time Objective pairs with technical system restoration deadline; Maximum Tolerable Downtime pairs with overall outage limit; Work Recovery Time pairs with post-technical restoration operational verification.
Each business continuity metric measures a distinct parameter of operational recovery. RPO measures data loss tolerance (data age). RTO specifies the technical infrastructure restoration target. MTD represents the overall maximum disruption window, and WRT measures post-restoration validation and operational setup before full business resume.

Step-by-Step Solution

1
Map the data loss measurement metric.
RPO corresponds to data loss tolerance measured in time.
RPO dictates how far back in time data recovery must reach (data age).
2
Map the technical infrastructure recovery duration metric.
RTO corresponds to technical service restoration targets.
RTO defines how quickly systems must be powered up and functional.
3
Map the absolute ceiling for organizational disruption.
MTD corresponds to total tolerable process outage duration.
MTD is the threshold beyond which the organization suffers fatal financial or operational harm.
4
Map the post-restoration operational validation phase.
WRT corresponds to verification and data reconciliation time.
WRT spans from technical restoration until business processes are fully operational again.

Key Concept

Business Continuity Metrics and Impact Thresholds
Question 376Question

A connected vehicle enterprise is updating its privacy engineering controls across its telemetry ingestion pipeline, billing service, and customer support portal. Match each privacy-enhancing technology on the left with its correct operational implementation on the right.

Click a left item, then click its matching right item

Items

Pseudonymization
Tokenization
Dynamic Data Masking
Anonymization

Matches

Show answer & explanation

Answer

Pseudonymization matches with replacing identifiers using separate secure keys for reversible correlation; Tokenization matches with exchanging payment card data for surrogate vault tokens; Dynamic Data Masking matches with real-time on-screen obfuscation based on user roles; and Anonymization matches with permanently stripping identifiers to prevent re-identification.
Each technology corresponds to a distinct privacy mechanism: Pseudonymization replaces direct identifiers with reversible keys stored in a separate system; Tokenization substitutes sensitive data with non-sensitive surrogate tokens using a secure vault; Dynamic Data Masking alters displayed data at runtime for unauthorized roles while preserving the underlying storage; and Anonymization permanently removes all identifiable traits so re-identification is impossible.

Step-by-Step Solution

1
Analyze Pseudonymization requirements.
Identified that pseudonymization keeps data linked via a separate key, allowing reversible identification under strict access controls.
Pseudonymization protects privacy while maintaining data utility for authorized analysis.
2
Evaluate Tokenization characteristics.
Matched tokenization with substituting sensitive financial identifiers with random non-sensitive tokens managed via a vault.
Tokenization removes credit card numbers from application storage and downstream logging environments.
3
Differentiate Dynamic Data Masking from storage encryption.
Matched masking with real-time presentation obfuscation without altering underlying database values.
Masking enforces role-based view restrictions for personnel who do not need full data access.
4
Verify Anonymization irreversibility.
Matched anonymization with irreversible removal of identifying links across datasets.
Anonymized data is no longer subject to regulatory privacy constraints once re-identification is rendered impossible.

Key Concept

Privacy-Enhancing Technologies and Technical Privacy Controls
Estimated Time:1m 30s
Question 377Question

An enterprise financial platform is establishing privacy-enhancing controls across its data processing pipelines. Match each data protection technology to its correct operational application.

Click a left item, then click its matching right item

Items

Pseudonymization
Data Masking
Tokenization
Anonymization

Matches

Show answer & explanation

Answer

Pseudonymization matches with replacing identifiers with reversible artificial aliases requiring separate keys; Data Masking matches with obfuscating explicit characters during user interface rendering; Tokenization matches with replacing sensitive elements with surrogate tokens in a secure vault; Anonymization matches with irreversibly altering personal data.
Each technology aligns with its specific privacy objective: Pseudonymization provides reversible identifier substitution using separate keys; Data Masking obfuscates characters on screen; Tokenization maps values to non-sensitive tokens in a secure vault; and Anonymization permanently removes all re-identification capability.

Step-by-Step Solution

1
Analyze Pseudonymization requirements
Identify that pseudonymization replaces direct identifiers with pseudonyms while retaining reversibility via separate cryptographic keys or mapping tables.
Regulatory privacy frameworks explicitly define pseudonymization as reversible data de-identification using separate control keys.
2
Analyze Data Masking functionality
Identify that data masking partially redacts or obfuscates characters (e.g., showing **** 1234) for screen output rendering.
Data masking focuses on presentation-layer field obfuscation to protect sensitive values from unauthorized viewers during display.
3
Analyze Tokenization implementation
Identify that tokenization replaces sensitive data with non-sensitive surrogate values resolved through a secure token vault.
Tokenization avoids storing encrypted values in application databases by substituting tokens backed by a centralized lookup vault.
4
Analyze Anonymization properties
Identify that anonymization is an irreversible process that completely removes re-identification capabilities.
Unlike pseudonymization, anonymization permanently strips identity links, removing the dataset from PII compliance scope.

Key Concept

Privacy-enhancing technologies and data protection controls
Question 378Question

A global media streaming service is updating its data governance architecture to comply with international privacy regulations. Match each data governance role on the left with its primary operational responsibility on the right.

Click a left item, then click its matching right item

Items

Data Owner
Data Custodian
Data Protection Officer (DPO)
Data Processor

Matches

Show answer & explanation

Answer

Data Owner pairs with determining classification levels and business accountability; Data Custodian pairs with maintaining database integrity and technical backup procedures; Data Protection Officer (DPO) pairs with monitoring compliance and serving as liaison to supervisory authorities; Data Processor pairs with processing personal data under direct instruction of a data controller.
Each role corresponds strictly to CompTIA Security+ data governance definitions: the Data Owner defines classification and access permissions; the Data Custodian executes technical controls and backup routines; the Data Protection Officer oversees regulatory compliance and privacy assessments; and the Data Processor acts on behalf of an external data controller.

Step-by-Step Solution

1
Differentiate executive data governance policy roles from technical execution roles.
The Data Owner establishes rules and classification, whereas the Data Custodian carries out technical maintenance and access enforcement.
CompTIA Security+ distinguishes business accountability (Data Owner) from operational technology administration (Data Custodian).
2
Differentiate regulatory privacy oversight roles from external processing entities.
The Data Protection Officer provides compliance oversight and authority liaison, while the Data Processor is a vendor executing instructions.
Privacy frameworks mandate independent internal oversight (DPO) while regulating contracted third-party processing activities (Data Processor).

Key Concept

Data Governance Roles and Operational Responsibilities
PreviousPage 19 / 19
All practice questions — CompTIA Security+ | Examkin