Assessing Corporate Cybersecurityintermediate
An organization is conducting a security and compliance review of its engineering workflows. During the review, the team notes the following findings: - Developers commit proprietary client source code using personal GitHub accounts that lack enterprise oversight. - Developers are required to use hardware-token multi-factor authentication (MFA) to access internal staging servers. - The organization received a prospective client's security questionnaire requesting SOC 2 reports. - Data-retention schedules are reviewed and updated semi-annually to reflect legal requirements. Which of the findings represents an immediate compliance or security risk? (Select all that apply.)
Answer
Using personal GitHub accounts without enterprise oversight to store client code
Explanation
### Why this is right
- **Missing access logs may weaken monitoring and audit evidence.** Without reliable access records, the company may be unable to reconstruct activity or demonstrate that access was reviewed.
- **Outdated data-retention policies may leave current handling practices unclear.** A stale policy may not match actual practice or current obligations.
- **Use of personal GitHub accounts for client code may create access, ownership, and oversight risks.** The company may have less control over permissions, account recovery, and visibility into client code.
### The concept
A tabletop exercise asks participants to interpret facts as they emerge and distinguish an actual risk from an assumption. Each finding should be assessed in context: what asset is affected, what requirement or control applies, what harm could result, and what evidence exists. A client request creates urgency, but it is not proof that the underlying requirements have been met.
### The other options
- **D. A client request for documentation proves that the organization has already met the requested requirements.**: A request sets a deadline for providing evidence; it does not establish that controls are effective.
### Terms
- **GitHub**: A service used to store and manage code repositories; account governance affects access to the code.
### Remember
Separate evidence of a requirement from evidence that the requirement is actually satisfied.
Related Questions
- Outsourcing payment processing to a third-party vendor completely transfers all regulatory compliance and data protection responsibilities away from the hiring organization.(intermediate)
- In an incident management exercise divided into discovery, investigation, response, and recovery, the phase focused on analyzing logs, alerts, and evidence to examine unauthorized activity is called _____.(basic)
- The recovery and compliance review phase can include a mock audit, ongoing monitoring, staff training, and improvements informed by the incident.(basic)
- A staff member accesses the billing system from an unprotected personal laptop, and suspicious activity alerts appear. Which response area is most directly implicated by this new information?(intermediate)
- During a tabletop incident response exercise involving potential payment card data compromise, which activity is the primary focus of the Discovery phase?(advanced)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free