Q1. A company policy mandates that all sensitive customer data stored on employee workstations must be encrypted at rest. A user is requesting a new laptop for their role, which involves handling personally identifiable information (PII). To comply with the policy and protect the data, which core security control should be implemented at the operating system level BEFORE any data is stored?
-
Configure full-disk encryption ✓ Correct
-
Implement a strong password policy
-
Enable remote wipe capabilities
-
Deploy an intrusion detection system
Why: Full-disk encryption (FDE) is the most appropriate control for encrypting all data stored on the laptop's storage media, directly addressing the requirement for data at rest encryption. While a strong password policy and remote wipe capabilities are important security measures, they do not directly encrypt the data itself. An intrusion detection system monitors for malicious activity but does not encrypt stored data.
Q2. A financial services firm needs to ensure that its employees follow a strict process when handling customer financial records to maintain regulatory compliance and data integrity. The process includes logging all access to records, auditing changes, and retaining records for a specific period. Which operational procedure is MOST critical for enforcing this structured handling of sensitive information?
-
Establish and document a data handling policy ✓ Correct
-
Perform regular hardware diagnostics
-
Implement a scheduled defragmentation process
-
Configure a guest wireless network
Why: Establishing and documenting a data handling policy provides the clear guidelines and procedures necessary for employees to follow when managing sensitive financial records, ensuring compliance and integrity. Regular hardware diagnostics and scheduled defragmentation are maintenance tasks and do not relate to data handling procedures. A guest wireless network is unrelated to the secure internal handling of financial records.
Q3. A small business is migrating its on-premises file server to a cloud-based storage solution. To ensure business continuity and minimize downtime during the transition, which operational step should be prioritized to guarantee that critical files are accessible to users with minimal interruption?
-
Perform a phased data migration with thorough testing ✓ Correct
-
Upgrade all employee workstations to the latest OS
-
Install antivirus software on all client machines
-
Replace all network cables with Cat 8
Why: A phased data migration with thorough testing is the most effective operational procedure to ensure minimal downtime and continuity, allowing for verification at each stage. Upgrading operating systems or installing antivirus software are general IT best practices but do not specifically address the continuity of file server access during migration. Replacing network cables, while potentially improving performance, is not the primary step for ensuring continuity during a data migration.
Q4. An IT department is responsible for managing a fleet of laptops used by traveling sales representatives. To ensure that these laptops remain secure and up-to-date, even when the users are outside the corporate network, which proactive operational procedure should be consistently applied?
-
Regularly enforce software updates and security patches ✓ Correct
-
Disable all USB ports on the laptops
-
Remove administrative privileges from user accounts
-
Implement mandatory daily full system backups
Why: Consistently enforcing software updates and security patches is a critical operational procedure for maintaining security on mobile devices like laptops, especially when they are outside the corporate network perimeter. While disabling USB ports or removing administrative privileges can enhance security, they may impede productivity for traveling sales representatives. Mandatory daily full system backups are important but do not directly address the ongoing security vulnerabilities introduced by outdated software.
Q5. A government contractor must ensure that all digital communications containing classified information are handled according to strict protocols, including auditing and access controls, to comply with federal regulations. Which operational procedure is ESSENTIAL for maintaining the integrity and confidentiality of these communications?
-
Implement comprehensive logging and access control mechanisms ✓ Correct
-
Decommission old hardware regularly
-
Optimize network bandwidth utilization
-
Install the latest printer drivers
Why: Comprehensive logging and access control mechanisms are essential for fulfilling regulatory requirements related to classified information, as they provide an auditable trail of who accessed what, when, and ensure only authorized personnel can view or transmit such data. Decommissioning old hardware, optimizing bandwidth, and installing printer drivers are standard IT maintenance and optimization tasks that do not directly address the stringent requirements for handling classified communications.
Q6. A company policy requires that all employee workstations undergo regular vulnerability scanning and remediation to protect against emerging threats. To effectively manage this process across hundreds of devices, which operational tool or technique would be MOST efficient for the IT team?
-
Deploy an automated vulnerability management system ✓ Correct
-
Manually scan each workstation individually
-
Instruct users to run built-in OS security checks
-
Physically inspect the network cabling
Why: Deploying an automated vulnerability management system is the most efficient and scalable operational approach for regularly scanning and remediating vulnerabilities across a large number of workstations. Manually scanning each workstation is time-consuming and prone to errors. Instructing users to run OS security checks relies on user compliance and may not provide the comprehensive reporting needed, while physically inspecting network cabling is unrelated to software vulnerability management.
Q7. A technician is disposing of several old workstations that contained sensitive customer financial records on their spinning hard drives. Company policy requires that the drives be retained physically for potential audit purposes but that all data be rendered permanently unrecoverable. Which method BEST satisfies both requirements?
-
Degaussing the drives with a certified magnetic degausser ✓ Correct
-
Performing a standard quick format on each drive
-
Running a low-level drive-shredding utility that overwrites data with multiple passes
-
Physically shredding the drives in an industrial shredder
Why: Degaussing uses a strong magnetic field to erase data on magnetic (spinning) drives while leaving the physical device intact for retention, satisfying both requirements. A quick format only removes the file table and leaves data fully recoverable, so it fails the destruction requirement. Physical shredding destroys the drive and violates the retention requirement. A multi-pass overwrite works only if the drive is functional and readable, and it is far slower for bulk disposal; degaussing is the standard best-fit for retaining unusable-but-intact magnetic media.
Q8. A help desk technician receives a ticket from a user requesting that their account be granted domain administrator privileges so they can install software 'whenever needed.' The technician's organization follows a formal change and access process. What is the BEST action for the technician to take FIRST?
-
Grant the privileges temporarily and document it afterward
-
Escalate the request through the established change management and approval process ✓ Correct
-
Deny the request outright and close the ticket
-
Install the requested software for the user and grant local admin rights
Why: Access privilege changes—especially elevation to domain admin—must go through the formal change management/approval workflow so the request is reviewed, authorized, and documented per the principle of least privilege. Granting privileges first and documenting later bypasses authorization controls and creates risk. Denying and closing the ticket ignores a legitimate business need without proper review. Installing software and granting local admin makes a unilateral security decision the technician isn't authorized to make; escalation to the proper process is correct.
Q9. A field technician must open a customer's PC to replace a failed power supply in a workshop with carpeted floors. The technician wants to minimize the risk of electrostatic discharge damaging sensitive components during the repair. Which combination of practices BEST addresses this concern?
-
Wear an anti-static wrist strap connected to the chassis and use an anti-static mat ✓ Correct
-
Leave the power supply plugged into the wall to maintain a ground path while working
-
Work quickly and touch the metal chassis once before starting
-
Use a self-grounding technique by handling the board only by its edges
Why: An anti-static wrist strap bonded to the chassis plus an ESD mat provides continuous equalization of potential, which is the most reliable ESD protection especially on a carpeted (static-prone) environment. Leaving the unit plugged in is a serious safety hazard and is not proper ESD grounding practice. Touching the chassis once dissipates charge only momentarily and static rebuilds as you move. Handling boards by the edges is a good supplemental habit but alone does not equalize accumulated body charge; the wrist strap and mat combination is the best-practice control.
Q10. An IT department is drafting an incident response plan and wants to ensure that when a security incident involving a compromised workstation occurs, any evidence collected could hold up if the matter goes to litigation. Which practice is MOST important to include for handling the affected device?
-
Immediately reimage the workstation to restore service quickly
-
Maintain a documented chain of custody for the device and any collected data ✓ Correct
-
Delete the malicious files and note the incident in the ticket
-
Disconnect the workstation and return it to the user after scanning
Why: Chain of custody documentation records who handled evidence, when, and why, preserving its integrity and admissibility for potential legal proceedings. Immediately reimaging destroys the evidence entirely, defeating the purpose of an investigation. Deleting malicious files also eliminates evidence and breaks the forensic trail. Returning the device to the user after only scanning risks contamination and loss of custody tracking; maintaining chain of custody is the essential legal/forensic control here.