Appendix A. Practice Exams

The practice exam content reviews the core ideas that underpin cybersecurity, starting with identity and access management, privacy, ethics, and governance. It contrasts single-factor and multi-factor authentication, explains non-repudiation and privacy rights, and highlights how regulations, standards, policies, and procedures differ in purpose and authority. It also reinforces professional expectations through the ISC2 Code of Ethics and emphasizes the importance of security awareness, sound policy design, and structured guidance for acceptable use, privacy, and configuration management.

The material then shifts to risk, incident response, and business resilience. It defines risk, vulnerability, and threat-related terms, describes the sequence of risk management, and distinguishes risk avoidance, transference, and mitigation. It also outlines incident response concepts such as preparation, containment, evidence preservation, and proper handling, while explaining the role of business continuity planning, disaster recovery, backup strategies, alternate sites, and documented response plans in maintaining operations after disruption.

The final portion focuses on access controls, physical security, networking, cloud services, data handling, and common attack types. It covers authorization models such as MAC, RBAC, and rule-based controls, along with defense in depth, physical site protections, and biometric authentication. It also reviews network fundamentals, data center considerations, cloud and VPN basics, data classification, sanitization, and destruction, then concludes with common threats and malware, including phishing, spoofing, denial of service, Trojans, side-channel attacks, and advanced persistent threats.

1. The correct answer is A. Single-factor authentication (SFA) is an authentication method that relies on a single factor, such as a password. Multi-factor authentication (MFA), on the other hand, is an authentication method that requires two or more factors to verify a user's identity, such as a combination of something you know (e.g., password), something you have (e.g., physical token), or something you are (e.g., biometrics).
2. The correct answer is D. Using two or more authentication methods provides an additional layer of security and reduces the risk of unauthorized access. This multi-factor authentication approach significantly strengthens the overall authentication process by using multiple authentication factors.
3. The correct answer is A. Non-repudiation is a security concept that ensures that someone cannot deny the authenticity or origin of a communication, transaction or action they have performed. Non-repudiation is often achieved through the use of digital signatures, which provide evidence that can be used to prove the authenticity and integrity of a transaction or communication.
4. The correct answer is B. Non-repudiation is a security principle that ensures that people are held accountable for their transactions. The other options are unrelated to the purpose of non-repudiation. They are security measures to protect data confidentiality, integrity, and compliance with applicable regulations and laws.
5. The correct answer is A. GDPR is a comprehensive data protection regulation that applies to all organizations that process the personal data of individuals residing in the EU, regardless of their location. The regulation aims to protect the fundamental rights and freedoms of individuals by regulating the collection, use, and processing of personal data. Finally, GDPR is a separate regulation from HIPAA.
6. The correct answer is B An invasion of privacy is the unauthorized or unwanted access to or use of a person's personal information. Unlike the other options, a physician discussing patient information without consent is an invasion of privacy.
7. The correct answer is C. Privacy refers to an individual's right to control the collection, use, and disclosure of personal information. In other words, it is the right to choose what personal information to share and with whom.
8. The correct answer is D. If a device is lost or stolen, unauthorized users may have direct access to sensitive data stored on the device. Therefore, the PRIMARY security principle at risk is confidentiality. In some cases, unauthorized users may also attempt to compromise integrity, but this would not be the PRIMARY concern compared to confidentiality. Finally, non-repudiation primarily ensures that a party cannot deny the authenticity of its actions.
9. The correct answer is B. Interpreting global privacy laws is not always a requirement for privacy team members, especially if the organization operates only in a domestic market. All of the remaining options are critical tasks for a data protection team.
10. The correct answer is C. Risk avoidance involves identifying a risk and deciding not to engage in the action or activity that creates that risk, for example, to avoid potential legal or financial risks. On the other hand, risk transfer involves shifting the potential risk to another party, usually through insurance or outsourcing.
11. The correct answer is D. A risk is an event that, if it occurs, could have negative consequences for an organization or system. With respect to the other options, an individual or group is a threat actor and poses a risk only if they have the intent to exploit the vulnerability. A method or tactic only becomes a risk when it is used against a vulnerable system, and finally, a vulnerability can lead to risk, but is not a risk in itself without a threat actor willing to exploit it.
12. The correct answer is A. Risk identification involves understanding the potential threats and vulnerabilities that could affect an organization's information systems and data. Once risks are identified, the next steps are to analyze, assess, and mitigate them.
13. The correct answer is C. A vulnerability is a weakness or flaw in a system, network, or application that a threat actor can exploit to gain unauthorized access, disrupt operations, or perform other malicious activities. The other options are wrong. Individuals or groups are threat actors. A means of gaining access is an exploit. A potential event that can negatively impact the organization is a risk.
14. The correct answer is D. A bug is a flaw or error in a software program or system that causes it to produce an incorrect or unexpected result. The other options are incorrect. Although the bug’s exploitation can lead to a risk, a bug itself is not a risk. A bug is not a means for the threat actor to gain access to systems, but can be exploited for that purpose. Finally, an exploitable vulnerability may be the result of a bug, but not all bugs are exploitable vulnerabilities.
15. The correct answer is A. Detective controls alert us to security problems by constantly monitoring activity and recording information, so as to take immediate action in the event of a security control failure. Therefore, a movement sensor is considered a detective control, and is complementary to physical controls.
16. The correct answer is A. An Intrusion detection system (IDS) is a type of technical security control. Bollards, fences and turnstiles control access to physical facilities, and thus are types of physical security controls.
17. The correct answer is C. A procedure is a detailed, step-by-step guide to a specific task, designed primarily to provide guidance rather than to enforce compliance or impose penalties. Its PRIMARY purpose is instructional, although it may indirectly outline criteria for completing the task.
18. The correct answer is C. ISO 27001 is an international standard that provides a framework for establishing, implementing, maintaining and continually improving an organization's information security management system. None of the other options are standards, but rather a set of rules and a law.
19. The correct answer is C. Regulations are created by governments or industry regulators to enforce specific requirements. Regulations are legally binding and must be followed. The remaining options do not directly answer the question, as they are typically developed internally by an organization and are not legally binding.
20. The correct answer is D. Standards are guidelines or frameworks established by industry organizations to achieve specific outcomes, which may become mandatory when adopted by certain industries or incorporated into legal agreements. Regulations are legally binding rules issued by government agencies that must be complied with to avoid penalties.
21. The correct answer is C. In the code of ethics, we read 'Provide diligent and competent service to principals", and not "Provide active and qualified service to principals."; despite sounding familiar, this option is not correct. All the other options are valid canons of the code of ethics.
22. The correct answer is A. Protect society, the common good, necessary public trust and confidence, and the infrastructure emphasizes a security analyst's duty to avoid harm and uphold public well-being by protecting society, the common good, necessary public trust and confidence, and the infrastructure.
23. The correct answer is B. The ISC2 Code of Ethics is a set of principles designed to ensure that ISC2 members adhere to the highest standards of ethical conduct. The other options are consequences of the ethical principles of the Code of Ethics.
24. The correct answer is C. Retention, which involves preserving and storing data for legal or regulatory purposes, is not a category of the incident response process. Instead, the key phases include preparation, detection and analysis, containment, eradication and recovery, and post-incident activities, depending on the framework used.
25. The correct answer is A. Evidence collection is critical to incident response. It involves collecting and preserving evidence to determine the cause of the incident and support legal proceedings. Forensic analysis involves examining collected evidence to uncover details of the incident. Still, it is not solely focused on evidence collection. "Incident retention" and "incident preservation" are not recognized or describe evidence collection in incident response.
26. The correct answer is C. Incident response encompasses a range of actions to effectively address security incidents, including preparation, detection, containment, remediation, recovery, and post-incident activities. Incident management includes all incident-related activities beyond incident response. "Incident resolution" is not a standard term in cybersecurity. While incident investigation is critical in the detection and analysis phase, it only covers some aspects of proper incident handling.
27. The correct answer is D. Risk in cybersecurity is the potential for loss if a threat exploits a vulnerability. It is determined by the likelihood of threat exploitation and its impact, which guides security control decisions. In contrast to risk, a breach is unauthorized access to secure data, while a zero-day vulnerability is unknown. Vulnerability is a system weakness, not a combination of threat likelihood and potential impact.
28. The correct answer is B. The PRIMARY objective of a Business Continuity Plan (BCP) is to maintain business operations during and after significant disruptions by outlining the necessary procedures. While maintaining information security during recovery, providing alternate workspaces, and identifying dependencies are essential, they're not the PRIMARY focus of a BCP.
29. The correct answer is B. The ISC2 Code of Ethics Canon is a set of professional ethics statements that guide the behavior of cybersecurity professionals. It contains four canons, but the three mentioned in this option are: Protect society (Canon 1), Provide diligent and competent service to principals (Canon 3), and Advance and protect the profession (Canon 4), which includes acting ethically.
30. The correct answer is C. Regularly backing up data to multiple, geographically dispersed locations reduces the risk of data loss by providing redundancy. While beneficial, cyber insurance and employee training are reactive measures that don't directly prevent data loss. Restricting access to business premises helps with security but doesn't address data loss from other sources, such as system failures or cyber-attacks.
31. The correct answer is B. Sales personnel are generally not involved in cybersecurity forensic investigations, which focus on examining digital evidence to combat cybercrime. Cybersecurity analysts and network architects handle incident response, while even receptionists may assist by gathering physical access information. Sales personnel focus primarily on customer relations and do not contribute significantly to the technical aspects of cyber incident response.
32. The correct answer is B. A Business Continuity Plan (BCP) ensures that critical business functions, such as customer service and supply chain management, continue during disruptions and quickly return to normal. In contrast, a Disaster Recovery Plan (DRP) focuses on restoring IT infrastructure and systems to entire operation after a disaster, detailing steps to recover data, restore functionality, and ensure IT service availability.
33. The correct answer is C. A hot site is fully equipped to operate immediately during a disaster, while a warm site has partial resources and may take longer to activate. A cold site has basic facilities but requires more equipment and extensive setup time. Hot sites provide rapid recovery, warm sites provide partial readiness, and cold sites require extensive setup.
34. The correct answer is A. A firewall is a network security control that separates trusted internal networks from untrusted external networks. In contrast, user credentials are used for identification and authentication, and criminal evidence has nothing to do with security control. While valuable for monitoring, an access log is a record-keeping tool, not a network control.
35. The correct answer is C. Access controls grant appropriate access to authorized users and prevent unauthorized access to systems, ensuring data integrity and confidentiality. They don't give everyone the highest level of access, nor do they always need to be implemented in pairs. They do ensure data integrity, but there are other purposes besides that.
36. The correct answer is C. The performance of an access control system is measured by its effectiveness, reliability, scalability, and compatibility. While simplicity and efficiency are essential, they are secondary considerations. Aesthetics are irrelevant to the function of an access control system.
37. The correct answer is C. A site assessment for biometric scanners should prioritize data sensitivity, scanner cost, and operational impact. Popularity, number of doors, and workspace function are less critical considerations.
38. The correct answer is C. The cost of access control should be commensurate with the asset's value. While technology, number of entry points and enforcement time are important, they're secondary considerations.
39. The correct answer is B. Defense in depth uses multiple layers of security to protect information, based on the principle of complexity over single barriers. It involves various measures, not just advanced technology or a single approach.
40. The correct answer is B. Defense in depth, a strategic approach, uses multiple layers of protection to mitigate cyber threats. While it enhances security, it doesn't guarantee immunity from attack or focus solely on adopting advanced measures.
41. The correct answer is C. Logging the attempt and blocking the user is a standard response to unauthorized database access attempts to prevent data breaches. Alternatively, logging the incident and alerting appropriate personnel allows for further review and potential action by cybersecurity best practices.
42. The correct answer is D. The PRIMARY objective of access control is to regulate access to resources in a computing environment, ensuring that only authorized individuals and processes have access. While it helps protect data from insiders and outsiders and restricts access to information systems, these are not its PRIMARY goals.
43. The correct answer is A. Collusion involves individuals working together to circumvent the segregation of duties for fraudulent purposes, thereby increasing the risk of fraud and error. In contrast, a work stoppage or strike and employees performing someone else's work are not examples of collusion but rather other workplace scenarios.
44. The correct answer is b. Physical access controls protect an organization's assets by preventing unauthorized access to facilities through locks, guards, biometric systems, and surveillance. While they track employee movements, that's not their PRIMARY goal, nor are they designed to ensure access for everyone or facilitate efficient entry/exit.
45. The correct answer is C. When choosing a physical access control solution, people's security is paramount. While building, equipment, and network security are essential, they're secondary to people's security. The safety and well-being of employees should always be the PRIMARY consideration.
46. The correct answer is A. Access control systems typically authenticate people by comparing their credentials against a verified database. Comparing clothing or access times is unreliable authentication, and comparing biometrics to others can produce false results.
47. The correct answer is D. Authorization is granting or denying specific rights to users in a system. Roles and group management organize users but don't control access to resources. Logins provide access to the system but don't dictate user actions within the system.
48. The correct answer is D. A voiceprint, which captures unique voice characteristics, is an example of biometric authentication, which relies on biological traits to verify identity. Email addresses and passwords, OTP and PIN combinations, and physical key and password combinations are examples of "something you know" or "something you have," not biometrics.
49. The correct answer is B. Layering physical access controls increases security by requiring multiple levels of verification. Relying solely on employee vigilance or allowing unrestricted access lacks proper authentication, rendering them ineffective.
50. The correct answer is C. Mandatory Access Control (MAC) uses labels to determine resource access based on subject clearance and resource sensitivity. Subject clearance levels are matched to resource sensitivity labels in a military base scenario, and access is granted accordingly. In contrast to MAC, Discretionary Access Control (DAC) gives individual administrators flexibility in their decision-making. Group-based and rule-based access control are not access control models but implementation methods.
51. The correct answer is B. The Bell-LaPadula model aims to prevent unauthorized disclosure of classified information by enforcing access control in government and military applications. It's based on secure states and state transitions, with rules such as "no read, no write" restricting access based on security levels. Unlike securing file ownership, encryption, or virus protection, its focus is preventing unauthorized data disclosure.
52. The correct answer is B. Mandatory access control (MAC) uniformly enforces access policies for all subjects and objects based on classification and clearance labels. It doesn't give individuals total control over access or provide universal access. MAC is also not limited to physical security systems; it works digitally to restrict access to classified information.
53. The correct answer is B. In a Mandatory Access Control (MAC) system, security administrators manage access by labeling subjects and objects and determining access controls based on those labels. Other users, including the CEO, are not authorized to control access, and external auditors review security controls but do not control access within the system.
54. The correct answer is B. Rule-based access control uses criteria such as IP addresses and port numbers to dictate allowed actions, typical of firewall configurations. Discretionary access control (DAC) gives data owners discretion over access, role-based access control (RBAC) assigns rights based on job roles, and mandatory access control (MAC) enforces access based on security classifications and clearance levels.
55. The correct answer is B. Typical physical security requirements for wiring closets include installation in monitored areas, use of door sensors, and periodic inspections. While keeping flammable items away from electronic equipment is advisable, this is not a wiring closet-specific requirement but a general best practice in electronic equipment environments.
56. The correct answer is B. A network is a collection of interconnected computers to share data, resources, or information. Conversely, a single computer or an unconnected group of computers does not meet the criteria for a network because network functionality depends on interconnection and communication among multiple devices.
57. The correct answer is C. Hubs connect devices by forwarding data packets to all connected devices. They do not have the traffic control features found in switches and routers. Their connectivity function facilitates the exchange of information between connected devices.
58. The correct answer is D. The address 12.123.23.23 is a valid public IP address. The other three answers are not valid public IP addresses because 192.168.123.123 and 172.213.123.321 are in the private IP range, and 256.231.342.123 is outside the valid range of IP addresses.
59. The correct answer is A. Endpoints are the endpoints of network connections. They include devices such as desktops, laptops, and smartphones. These devices are critical to network security because they are often the target of security breaches.
60. The correct answer is D. A data breach is not a cybersecurity attack but the result of a successful cybersecurity attack. It occurs when an unauthorized user gains access to confidential or sensitive information, such as customer data, financial records, or intellectual property. The other options are common cybersecurity attacks.
61. The correct answer is C. Denial of Service attacks aim to disrupt network operations. In contrast, brute force, password spray, and rainbow table attacks are used to gain unauthorized access to networks by exploiting vulnerabilities in authentication systems.
62. The correct answer is B. Trojans masquerade as legitimate software to deceive users, while worms, viruses, and spyware have different modes of operation and objectives.
63. The correct answer is D. Packet analysis examines network traffic data to diagnose problems or investigate security incidents. On the other hand, side-channel attacks gather information from the implementation of the physical system using methods such as performance monitoring and timing and fault analysis.
64. The correct answer is C. A side-channel attack extracts information from a system's physical implementation, such as power consumption or electromagnetic leakage. This differs from attacks that target software vulnerabilities, fake system access identities, or malicious URLs.
65. The correct answer is B. Spoofing attacks are designed to deceive by masquerading as legitimate users or devices to access sensitive data or systems. They can redirect users to malicious sites, spread malicious code, and impede system access, but they are not the PRIMARY goal.
66. The correct answer is B. Phishing is a form of social engineering in which attackers pose as trusted entities to trick individuals into revealing sensitive information, often by directing them to fraudulent Web sites. This definition accurately distinguishes phishing from other attacks, such as spoofing, Denial of Service (DoS), or malware injection.
67. The correct answer is B. A flood of incoming connections from multiple global locations indicates a Distributed Denial of Service (DDoS) attack that overwhelms the target system. Unlike worms or viruses, DDoS attacks don't involve self-replicating malware.
68. The correct answer is A. An Advanced Persistent Threat (APT) attack aims to infiltrate a target system and remain undetected for an extended period, often perpetrated by skilled attackers to steal data or disrupt operations. Conversely, on-path attacks focus on intercepting data in transit, program insertion attacks involve injecting malicious code into programs, and denial-of-service (DoS) attacks aim to overwhelm systems with requests, preventing legitimate access.
69. The correct answer is C. The PRIMARY goal of an Advanced Persistent Threat (APT) attack is to gain unauthorized access to sensitive data and establish a prolonged presence within the target network facilitated by skilled hackers. In contrast to APT attacks, denial of service attacks are characterized by the disruption of network services, virus or malware attacks are characterized by the rapid infection of systems, and cybercrime is characterized by the exploitation of web application vulnerabilities for financial gain.
70. The correct answer is A. The main options for a data center are owning or outsourcing. Owning provides complete control over the infrastructure, while outsourcing offers cost savings and the ability to focus on core business. Leasing provides long-term control without ownership and is not commonly used in this context.
71. The correct answer is B. The recommended temperature range for a data center is 18°C to 27°C (64°F to 81°F). This range prevents overheating and hardware failure, optimizing uptime and longevity. Other options, such as 50°F to 70°F (10°C to 21°C) or 72°F to 90°F (23°C to 32°C), are either too cold or too warm, risking energy waste or hardware problems.
72. The correct answer is C. Three sensors should be placed at the top, middle, and bottom of a data center rack to ensure accurate temperature monitoring. This setup provides comprehensive coverage, helping to identify potential problems and prevent hardware failures. Fewer sensors would provide incomplete data while adding more could increase complexity without significant benefits.
73. The correct answer is D. Noise isn't typically associated with airflow issues in a data center because it's often caused by equipment operation. However, cooling, dust buildup, and exposure to toxic fumes are all potential airflow-related problems that can lead to hardware failure if not addressed. These issues highlight the importance of proper airflow management in maintaining optimal data center conditions.
74. The correct answer is D. Integrating smart locks into the building control environment is typically not recommended because they are not essential components for managing the security and operational integrity of the infrastructure. Fire alarms, water or gas leak detectors, and HVAC failure detectors are critical to ensuring the safety and functionality of the building and its infrastructure.
75. The correct answer is A. Mobile Data Management (MDM) oversees the security of mobile devices, enforcing policies and enabling remote management such as wiping and tracking. IPS, IDS, and SIEM focus on network threat detection and response, not mobile device management.
76. The correct answer is A. Cloud computing is a model that provides computing resources as a service. It allows users to access and use resources such as storage and processing power over the Internet on a pay-as-you-go basis, eliminating the need for users to maintain their own physical infrastructure.
77. The correct answer is A. Cloud-based resources are all an organization accesses through cloud computing, including storage, applications, virtual machines, and more. This contrasts with resources accessed through physical servers, local networks, or personal computers, which are not necessarily cloud-based.
78. The correct answer is A. A Virtual Private Network (VPN) is designed to provide secure access to a network by encrypting data transmissions. In contrast, subnetting divides a network into smaller sections for easier management.
79. The correct answer is B. Software as a Service (SaaS) provides consumers access to software applications hosted by a third party over the Internet. This differs from other cloud models such as Infrastructure as a Service (IaaS), which provides access to hardware components; Network as a Service (NaaS), which provides network services; and Security as a Service (SECaaS), which provides security services.
80. The correct answer is A. Sanitization or destruction of sensitive information is required when system elements are replaced or removed to prevent data from falling into the wrong hands. Upgrading software and adding items or new data does not immediately require such action.
81. The correct answer is D. Organizations classify information to restrict access, ensuring only authorized individuals can access sensitive data. This practice enhances information security by protecting confidentiality rather than increasing access or mitigating ransomware attacks.
82. The correct answer is D. While the exact number may vary depending on the organization's specific needs and capabilities, it is generally considered difficult to manage more than four classifications due to the increased complexity and resources required.
83. The correct answer is C. A "low sensitivity" label indicates data with a low potential for disruption that is not critical to operations. "High sensitivity" or "critical" data has severe consequences if compromised, while data with no harm from compromise may not require such classification.
84. The correct answer is D. "Unrestricted public data" is freely available information and cannot be compromised. It contrasts with "highly sensitive" or "confidential" data, which could have significant consequences if compromised, and "internal" data, which could cause minor disruptions but is not public.
85. The correct answer is A. The six components of the data lifecycle are create, store, use, share, archive, and destroy. Terms such as "save," "delete," and "utilize" are not recognized stages in the data lifecycle; instead, they correspond to "store," "destroy," and "use," respectively.
86. The correct answer is D. Overwriting involves writing multiple patterns across all storage media to prevent recovery of the original data. Wiping, purging, and destroying are forms of media sanitization, but they do not involve the specific method of overwriting multiple patterns across all storage media.
87. The correct answer is B. Digital signatures ensure data integrity by providing non-repudiation, making it impossible for the sender to deny sending the message. They are uniquely associated with the sender, providing indisputable proof of identity. In addition, any changes made to the data after the signature is applied invalidate it, ensuring tamper detection.
88. The correct answer is A. Data remanence refers to data that remains on storage media after it has been deleted. Permanently deleted data, data moved to another storage device, and encrypted data are not examples of data remanence. Overwriting encrypted data can eliminate data remanence.
89. The correct answer is A. Based on best practices and regulations, a security baseline establishes minimum security standards for systems/networks. Its PRIMARY goal is to ensure a minimum acceptable level of security, not necessarily to specify every requirement. Enforcing an excessive number of requirements is impractical for most organizations.
90. The correct answer is C. The PRIMARY purpose of security baselines is to establish standard security configurations. They develop clear standards for managing security configurations in systems and applications. While they also aid in threat identification and event monitoring, their PRIMARY focus is establishing security configuration standards, not data protection.
91. The correct answer is B. Configuration management ensures that all system changes are authorized and validated. Implying unauthorized or invalid changes defeats the purpose because configuration management verifies changes to maintain system integrity and security.
92. The correct answer is D. In Change Management, regression is not one of the four components. In fact, Change Management has four key components: Identification, Change Control, Baseline, Verification and Audit.
93. The correct answer is A. The Request for Change initiates the Change Management process by identifying the desired change. Subsequently, Making the Change involves implementation, Approving the Change involves review and acceptance, and Rolling Back the Change is a contingency plan for unforeseen problems that arise during the process.
94. The correct answer is B. A documented incident response plan is critical because it provides a structured approach to handling security incidents. Ignoring or not reporting incidents increases risk, while training complements plans by increasing employee awareness. Documentation doesn't directly affect the frequency of security audits.
95. The correct answer is B. A well-designed security policy's PRIMARY goal is to minimize the potential for security breaches to an acceptable level. It may contribute to efficiency and cost reduction, but those aren't its PRIMARY goals. Similarly, a less complex system is easier to secure, but reducing complexity isn't the PRIMARY goal of a security policy.
96. The correct answer is C. An Acceptable Use Policy (AUP) primarily governs the acceptable use of digital resources, such as data, systems, and Internet use. Access to physical premises is typically outside its scope. However, data access, system access, and Internet use are common elements of AUPs that specify the terms and conditions of data and system access and acceptable Internet activity.
97. The correct answer is C. One challenge of a Bring Your Own Device (BYOD) policy is ensuring secure device configuration due to the lack of organizational control over personal devices. Poor employee morale isn't typically associated with BYOD policies, which often improve morale. While privacy control challenges can arise, they're not unique to BYOD policies. Similarly, while BYOD can increase the complexity of forensic audits, it's not a PRIMARY challenge in implementing such a policy.
98. The correct answer is C. A privacy policy defines PII and outlines its collection, use, and management. While data breach response is critical, it's not the PRIMARY focus of a privacy policy. The storage of personal belongings and employee responsibilities for privacy are not related to the policy's content.
99. The correct answer is A. Regular security awareness training ensures employees are aware of the latest threats and best practices. It helps them understand security measures and technologies to identify and mitigate risks instead of circumventing controls, reducing policy requirements, or avoiding security audits, which are not the goals of such training.
100. The correct answer is B. Vishing is a social engineering tactic that uses a fraudulent interactive voice response system to trick individuals into revealing sensitive information. Other social engineering tactics, such as impersonating an authority figure, tailgating, and asking for passwords in exchange for payment, do not specifically involve using such systems and, therefore, do not constitute vishing.

FAQ