A Chief Information Security Officer (CISO) wants to standardize the company's security program so it can be objectively assessed as part of an upcoming audit requested by management. Which of the following would holistically assist in this effort?

Which of the following is the use of tools to simulate the ability for an attacker to gain access to a specified network?

The development team currently consists of three developers who each specialize in a specific programming language:
Developer 1 - C++/C#
Developer 2 - Python
Developer 3 - Assembly
Which of the following SDLC best practices would be challenging to implement with the current available staff?

A security analyst needs to reduce the overall attack surface.
Which of the following infrastructure changes should the analyst recommend?

Which of the following types of policies is used to regulate data storage on the network?