CompTIA Security+ Domain 5: Security Program Management & Oversight

A policy is the high-level, mandatory document that communicates management's intent and direction without dictating specific technical implementation details like algorithms.

• AA procedure gives prescriptive step-by-step instructions for a task, which is far more granular than a high-level statement of management intent.
• BA guideline provides discretionary, non-mandatory advice, but the requirement here is explicitly mandatory management intent, so a guideline does not fit.
• DA standard specifies the mandatory technical details such as algorithms and key lengths, which is precisely what this document is meant to omit.

Buying insurance moves the financial consequences of the risk to another party, which is the defining characteristic of the transfer response.

• BAvoidance means eliminating the risky activity entirely; the retailer keeps operating and merely offsets cost, so this is not avoidance.
• CAcceptance means knowingly retaining the risk without further action, but here the retailer takes action by buying coverage rather than absorbing it.
• DMitigation reduces likelihood or impact through technical or administrative controls, whereas insurance does not lower the breach probability itself.

An SLA defines the measurable performance commitments, including uptime percentages and remedies or penalties when the provider misses agreed targets.

• AAn MOU records broad mutual intentions and is typically non-binding, so it cannot enforce measurable uptime targets backed by penalties.
• BA BPA governs the business relationship and responsibilities between partners, not specific measurable service performance levels like guaranteed uptime.
• CAn NDA restricts disclosure of confidential information and says nothing about availability metrics or penalties for missed performance targets.

A processor handles personal data only on the controller's documented instructions, which exactly describes the marketing firm's limited role in this scenario.

• AThe controller decides the purposes and means of processing; that is the bookstore here, not the firm acting on its instructions.
• CThe data subject is the individual the personal data is about, such as the customers, not the company processing the records.
• DThe data owner is an internal accountable role within the controlling organization, not an external third party processing data under contract.

Passive reconnaissance collects information from public sources without interacting with target systems, exactly matching the search-engine and WHOIS gathering described here.

• BActive reconnaissance sends packets to or interacts with the target's systems, but the tester explicitly avoids touching those systems in this scenario.
• CPrivilege escalation occurs after a foothold is gained and raises permissions, which is unrelated to pre-engagement public information gathering.
• DLateral movement happens post-exploitation as the tester pivots across an internal network, not during external open-source information collection.

Reporting the suspicious message through the established channel lets security investigate and warn others, which is the trained response to phishing.

• AReplying engages the potential attacker and may confirm the address is active, while still trusting an unverified channel that could be spoofed.
• BComplying immediately is exactly the outcome a business email compromise scam seeks, causing direct financial loss before any verification occurs.
• DDeleting silently stops this user from acting but denies the security team visibility to protect coworkers who may receive the same attack.

A data custodian performs the hands-on protective tasks such as backups, permissions, and encryption under the owner's direction, which exactly matches the administrator's implementing role described in the scenario.

• AThe data owner is the senior accountable role that classifies the data and sets policy, which the directing business unit holds, not the administrator who merely carries out instructions.
• CA data controller decides why and how data is processed at an organizational level, which is a determining role rather than the technical implementer following the owner's instructions here.
• DA data processor is an external party handling data per a contract, but this administrator is an internal employee enforcing controls, so the processor label does not fit the situation.

Single loss expectancy is asset value times exposure factor, 200,000 times 0.25 equals 50,000; multiplying by the annual rate of two events yields the 100,000 annualized loss expectancy.

• A$50,000 is the single loss expectancy from asset value times exposure factor, but the question asks for the annualized figure, which must also multiply by the annual rate of occurrence.
• B$25,000 wrongly applies only the exposure factor to one share of the value and ignores both the single loss expectancy formula and the annual occurrence rate of two events.
• D$400,000 multiplies the full asset value by the two events and never applies the exposure factor, badly overstating the loss because only a quarter of value is lost per flood.

A right-to-audit clause grants the customer contractual permission to inspect the vendor's controls and demand compliance evidence on an ongoing basis, which is exactly the oversight power the bank wants.

• BA memorandum of understanding records broad, often non-binding intentions between parties and does not by itself grant any enforceable standing right to inspect a vendor's internal security controls.
• CA statement of work defines the specific deliverables, tasks, and timelines for an engagement, but it does not establish a recurring right to audit the vendor's compliance evidence on demand.
• DA nondisclosure agreement restricts how shared confidential information may be disclosed and protects secrecy, yet it provides no mechanism for the bank to inspect or audit the vendor's controls.

The right to be forgotten, or erasure, lets a subject who withdraws consent require the controller to permanently delete their personal data, which exactly matches the customer's demand here.

• AData portability lets a subject receive their data in a usable format to transfer to another provider, but this customer is demanding deletion, not a transferable copy of their records.
• BBreach notification is the controller's duty to inform regulators and subjects after a security incident, which is unrelated to a customer's request to erase their personal data on demand.
• CThe right of access lets a subject obtain confirmation and a copy of data held about them, whereas this customer wants the records removed entirely rather than merely viewing them.

An unknown environment, or black-box, test withholds all internal details so the testers must discover the network from scratch like an outside attacker, exactly as the scenario describes for this engagement.

• AA known environment, or white-box, test gives the testers full documentation, credentials, and architecture details up front, which is the opposite of the no-information conditions described in this engagement.
• CA partially known, or gray-box, test supplies the testers with some limited information such as user-level credentials, but here they are deliberately given absolutely nothing to start from.
• DAn integrated exercise continuously combines offensive and defensive teams throughout operations, which describes a program model rather than the level of prior knowledge given to the testers here.

Off-hours access, bulk downloads outside one's role, and a recent grievance are classic indicators of a potential insider threat that awareness programs train staff to recognize and report promptly.

• APhishing involves a deceptive inbound message luring the user to click or reveal data, but the described pattern is the employee's own unusual activity, not an external social-engineering lure aimed at them.
• BRoutine maintenance is scheduled, authorized work, whereas unannounced 3 a.m. logins and bulk downloads from another department after a grievance are unauthorized indicators rather than legitimate maintenance activity.
• DA removable-media violation involves unauthorized USB or external storage use, but nothing here mentions external media; the real concern is anomalous account behavior signaling a possible insider threat.

A standard defines the mandatory specific technical requirements, such as exact protocol versions and encryption strengths, that support a broader policy and must be uniformly enforced.

• AA policy states high-level management intent and broad direction, but it deliberately avoids naming specific technical values like exact cipher suites or required minimum encryption strengths.
• BA procedure lays out the ordered step-by-step actions someone follows to complete a task, rather than declaring the mandatory technical configuration values that systems must meet.
• CA guideline offers optional recommended best practice that staff may adapt, so it cannot impose the mandatory enforceable technical requirements that this document clearly establishes for servers.

Single loss expectancy of $4,000 multiplied by the annualized rate of occurrence of three incidents per year correctly produces an annualized loss expectancy of twelve thousand dollars.

• AThis figure is only the single loss expectancy for one device, calculated from asset value times exposure factor, and ignores how often the loss happens each year.
• CThis wrongly divides the asset value by the rate of occurrence, inverting the formula; annualized loss expectancy multiplies the per-incident loss by frequency rather than dividing.
• DThis incorrectly adds the asset value and an unrelated figure together; the annualized loss expectancy formula requires multiplying single loss expectancy by the annual occurrence rate.

A memorandum of understanding records the shared intentions and mutual expectations of parties in a non-binding way, exactly fitting a collaboration with no enforceable deliverables or payment terms.

• BA statement of work defines the specific deliverables, timelines, and tasks for a particular engagement, making it far too detailed and binding for a general non-binding declaration of intent.
• CA master service agreement establishes the overarching contractual terms governing future paid engagements between parties, which is binding and transactional rather than a simple statement of shared intent.
• DA business partners agreement defines how two profit-sharing partners run a joint venture and split responsibilities, which exceeds the simple non-binding research collaboration described in the scenario.

Due diligence is the research and investigation conducted before a decision to verify a vendor's trustworthiness, precisely matching reviewing audit reports, finances, and breach history pre-contract.

• ADue care refers to the ongoing reasonable actions an organization takes to protect assets after a decision, not the upfront investigation performed to evaluate a vendor beforehand.
• BSeparation of duties splits a sensitive task among multiple people to prevent fraud, which concerns internal control design and has nothing to do with researching an external vendor.
• DA gap analysis compares current controls against a target framework to find shortfalls, which measures internal compliance posture rather than vetting an outside provider before engagement.

An unknown environment test withholds all internal information so the tester must enumerate everything from scratch, accurately simulating an outside attacker with zero prior knowledge of the target.

• AA known environment test supplies the tester full internal details like architecture diagrams and credentials, which directly contradicts the scenario where absolutely no information is provided beforehand.
• BA partially known environment gives the tester some limited information such as a user account or basic diagrams, but here the tester receives no internal details at all.
• CA bug bounty crowdsources many independent researchers to find flaws for rewards, describing a sourcing model rather than the knowledge level granted to a single contracted tester.

Bulk exfiltration of sensitive data outside one's job duties onto removable personal media is a classic insider-threat indicator that warrants immediate escalation and investigation.

• ANeeding a password reset after extended leave is routine account maintenance expected of returning staff, so it is not a meaningful indicator of malicious insider activity.
• CReporting suspected phishing is exactly the positive security behavior training encourages, demonstrating vigilance rather than signaling any malicious intent that would require escalation as a threat.
• DCompleting mandatory recurring awareness training is normal expected compliance with company policy and reflects good security hygiene, not behavior suggesting a potential malicious insider.

Correct: the party that determines the purposes and means of processing personal data is the controller, regardless of who physically handles or stores the records.

• BIncorrect because the processor only acts on the controller's documented instructions; here the marketing firm, not the retailer, fills that subordinate processing role.
• CIncorrect because a custodian merely implements and maintains technical controls protecting data; it does not decide why personal data is collected or processed.
• DIncorrect because a steward oversees data quality and policy compliance day to day, not the legal purpose-setting authority that defines the controller role.

Correct: RPO specifies the maximum acceptable amount of data loss expressed in time, which directly drives how frequently backups must be taken.

• AIncorrect because RTO defines how quickly a system must be restored after an outage, not the amount of data loss tolerable before the failure.
• BIncorrect because MTTR measures the average time needed to fix a failed component, not the permissible window of lost data measured in time.
• DIncorrect because MTBF estimates average operational time between failures for reliability planning, not the tolerable amount of data loss after an incident.

Correct: an SLA defines measurable performance commitments such as uptime percentages and the specific remedies or credits owed when those metrics are not met.

• AIncorrect because an MOU expresses non-binding intent to cooperate and rarely defines enforceable performance metrics or financial penalties for missed service targets.
• CIncorrect because an NDA governs how confidential information shared between parties is protected, not measurable operational performance or guaranteed uptime levels.
• DIncorrect because an SOW details specific deliverables, tasks, and timelines for a project, not ongoing operational performance thresholds like monthly uptime.

Correct: attestation is a formal signed statement affirming that controls or conditions are accurate and effective, often supplied to support compliance reporting.

• AIncorrect because an acknowledgement merely confirms a person received or read a policy, not a formal signed assertion that controls are operating effectively.
• BIncorrect because due diligence is the investigative effort to assess risk before acting, not the signed affirmation of control effectiveness produced afterward.
• CIncorrect because an internal audit is the independent examination staff perform; the signed assertion of control status is a separate compliance output.

Correct: a purple team integrates offensive and defensive personnel so they continuously share findings, improving detection and response together throughout the exercise.

• AIncorrect because a red team works adversarially and independently to breach defenses, without openly collaborating with defenders while the exercise is underway.
• BIncorrect because the blue team focuses solely on defense and monitoring; this scenario describes joint offensive and defensive collaboration rather than defense alone.
• DIncorrect because the white team referees and coordinates an exercise's rules and scope; it does not perform the combined attack-and-defend tuning described here.

Correct: a phishing campaign sends controlled simulated phishing messages to test and train user recognition, tracking click rates to measure awareness improvement over time.

• AIncorrect because a vulnerability scan probes systems for technical weaknesses automatically, not employees' susceptibility to deceptive emails through controlled social engineering.
• CIncorrect because a security audit formally evaluates controls and compliance against standards, not employees' real-time responses to simulated phishing messages.
• DIncorrect because a tabletop exercise is a discussion-based walkthrough of an incident scenario, not an active test of users clicking simulated emails.