Domain 5 Answers and Explanations

1. B. Any active testing that's done against an organization should only be conducted with advance approval. This includes penetration testing, vulnerability scanning, and social engineering. Open source intelligence involves consulting publicly available information sources and is passive in nature. It does not require any prior approval.
2. C. The responsibility of determining appropriate access to information is the data owner. This data owner may, by the nature of their job, fit into other categories, such as system owner, privileged user, or executive user, but it is the person's assignment to the data owner role that gives them this authority and responsibility.
3. A. Continuing education is an important component of security awareness training. All users should receive some level of awareness training on a recurring basis, but users with privileged access, such as system administrators, should receive more frequent training. This...