Correct answer:

Fixed size is correct. Hashing involves taking data of arbitrary type, length, or size and using a function to map a value that is of a fixed size. Hashing can be applied to virtually any type of data object—text strings, documents, images, binary data, and even virtual machine images.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

RTO is correct. The recovery time objective (RTO) is a measure of the amount of time it would take to recover operations in the event of a disaster to the point where management’s objectives are met for BCDR.

Incorrect answers:

All other answers choices are incorrect.

Correct anwer:

Private is correct. A private cloud model, and the specific contractual relationships involved, will give a cloud customer the most level of input and control over how the overall cloud environment is designed and implemented. This would be even more so in cases where the private cloud is owned and operated by the same organization that is hosting services within it.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

Create is correct. Any time data is created, modified, or imported, the classification needs to be evaluated and set from the earliest phase to ensure security is always properly maintained for the duration of its lifecycle.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

Retinal scan is correct. A retinal scan could be used in conjunction with an RSA token because it is a biometric factor and thus a different type of factor. The other choices are all items in one’s possession, the same as an RSA token, and as such would not be appropriate.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

Network perimiter is correct. With data in transit (DIT), the DLP solution would be deployed near the network perimeter to capture traffic as it leaves the network through various protocols, such as HTTP/HTTPS and SMTP. This solution looks for data that is leaving or attempting to leave the enclave that does not conform to security policies, either in subject or in format.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

Multiple jurisdictions is correct. When operating within a global framework, a security professional runs into a multitude of jurisdictions and requirements, and many times they might be in contention with one other or not clearly applicable. These requirements can include the location of the users and the type of data they enter into systems, the laws governing the organization that owns the application and any regulatory requirements they may have, as well as the appropriate laws and regulations for the jurisdiction housing the IT resources and where the data is actually stored, which might be multiple jurisdictions as well.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

Virtualization is correct. Cloud environments will regularly change virtual machines as patching and versions are changed. Unlike a physical environment, there is little continuity from one period of time to another. It is very unlikely that the same virtual machines would be in use during a repeat audit.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

Zero trust network is correct. A zero trust network is based on the principle of automatically trusting no users or processes coming into or out of a network. In order to gain access, users must be authenticated, authorized, and validated against security policies during all transactions. While many networks will authenticate and authorize users coming into their networks, they often do not continually reevaluate the authorization as resources are accessed.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

SOC Type 1 is correct. SOC Type 1 reports are considered “restricted use” reports. They are intended for management and stakeholders of an organization, clients of the service organization, and auditors of the organization. They are not intended for release beyond those audiences.

Incorrect answers:

All other answers choices are incorrect.