A news organization wants to implement workflows that allow users to request that untruthful data be retraced and scrubbed from online publications to comply with the right to be forgotten Which of the following regulations is the organization most likely trying to address'
Correct Answer:
A
The General Data Protection Regulation (GDPR) is the regulation most likely being addressed by the news organization. GDPR includes provisions for the "right to be forgotten," which allows individuals to request the deletion of personal data that is no longer necessary for the purposes for which it was collected. This regulation aims to protect the privacy and personal data of individuals within the European Union.
References:
✑ CompTIA SecurityX Study Guide: Covers GDPR and its requirements, including the right to be forgotten.
✑ GDPR official documentation: Details the rights of individuals, including data erasure and the right to be forgotten.
✑ "GDPR: A Practical Guide to the General Data Protection Regulation" by IT Governance Privacy Team: Provides a comprehensive overview of GDPR compliance, including workflows for data deletion requests.
Audit findings indicate several user endpoints are not utilizing full disk encryption During me remediation process, a compliance analyst reviews the testing details for the endpoints and notes the endpoint device configuration does not support full disk encryption Which of the following is the most likely reason me device must be replaced'
Correct Answer:
D
The most likely reason the device must be replaced is that the motherboard was not configured with a TPM (Trusted Platform Module) from the OEM (Original Equipment Manufacturer) supplier.
Why TPM is Necessary for Full Disk Encryption:
✑ Hardware-Based Security: TPM provides a hardware-based mechanism to store encryption keys securely, which is essential for full disk encryption.
✑ Compatibility: Full disk encryption solutions, such as BitLocker, require TPM to ensure that the encryption keys are securely stored and managed.
✑ Integrity Checks: TPM enables system integrity checks during boot, ensuring that the device has not been tampered with.
Other options do not directly address the requirement for TPM in supporting full disk encryption:
✑ A. The HSM is outdated: While HSM (Hardware Security Module) is important for
security, it is not typically used for full disk encryption.
✑ B. The vTPM was not properly initialized: vTPM (virtual TPM) is less common and not typically a reason for requiring hardware replacement.
✑ C. The HSM is vulnerable to common exploits: This would require a firmware upgrade, not replacement of the device.
✑ E. The HSM does not support sealing storage: Sealing storage is relevant but not the primary reason for requiring TPM for full disk encryption.
References:
✑ CompTIA SecurityX Study Guide
✑ "Trusted Platform Module (TPM) Overview," Microsoft Documentation
✑ "BitLocker Deployment Guide," Microsoft Documentation
An organization wants to create a threat model to identity vulnerabilities in its infrastructure. Which of the following, should be prioritized first?
Correct Answer:
A
When creating a threat model to identify vulnerabilities in an organization's infrastructure, prioritizing external-facing infrastructure with known exploited vulnerabilities is critical. Here??s why:
✑ Exposure to Attack: External-facing infrastructure is directly exposed to the
internet, making it a primary target for attackers. Any vulnerabilities in this layer pose an immediate risk to the organization's security.
✑ Known Exploited Vulnerabilities: Vulnerabilities that are already known and
exploited in the wild are of higher concern because they are actively being used by attackers. Addressing these vulnerabilities reduces the risk of exploitation significantly.
✑ Risk Mitigation: By prioritizing external-facing infrastructure with known exploited
vulnerabilities, the organization can mitigate the most immediate and impactful threats, thereby improving overall security posture.
✑ References:
