The primary objective of implementing privacy-related controls within an organization is to comply with legal and regulatory requirements that protect the rights and interests of individuals whose personal data are collected, processed, stored, shared or disposed by the organization. Privacy-related controls are based on principles such as lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality and accountability. These principles aim to ensure that personal data are processed in a manner that respects the privacy of individuals and complies with the applicable laws and regulations in different jurisdictions. Preventing confidential data loss, identifying data at rest and data in transit for encryption, and providing options to individuals regarding use of their data are examples of specific privacy-related controls that support the primary objective of compliance. References: Privacy Regulatory Lookup Tool, CDPSE Official Review Manual, 2nd Edition

The scanning will not degrade system performance. This is the most important consideration when establishing vulnerability scanning on critical IT infrastructure, because any degradation of system performance could affect the availability, reliability, and functionality of the IT services that depend on the infrastructure. Scanning during non-peak hours (A) could reduce the impact of scanning on system performance, but it does not guarantee that the scanning will not cause any degradation. Scanning followed by penetration testing (B) could provide more in-depth information about the vulnerabilities and their exploitability, but it does not address the potential impact of scanning on system performance. Scanning cost- effectiveness is a relevant factor for choosing a scanning service or tool, but it is not as important as ensuring that the scanning will not compromise the system performance.
Reference: CISA Vulnerability Scanning, Description.

The greatest risk associated with an incomplete inventory of deployed software in an organization is the inability to deploy updated security patches. Security patches are updates that fix vulnerabilities or bugs in software that could be exploited by attackers. Without an accurate inventory of software versions and configurations, it is difficult to identify and apply the relevant patches in a timely manner, which exposes the organization to increased security risks. Inability to close unused ports on critical servers, inability to identify unused licenses within the organization, and inability to determine the cost of deployed software are not as critical as security risks. References: ISACA CISA Review Manual 27th Edition, page 308

SFTP (Secure File Transfer Protocol)is the most secure option for transferring data over the internet, as it encrypts both commands and data, ensuring confidentiality and integrity.
SFTP (Correct Answer - C)
Uses SSH (Secure Shell) for encryption.
Provides authentication and encryption for secure data transfers.
Example:A company uses SFTP to securely transmit payroll files to a third-party processor.
UDP (Incorrect - A)
Faster but lacks encryption and data integrity checks.
HTTP (Incorrect - B)
Transfers data in plaintext and is vulnerable to interception.
RDP (Incorrect - D)
Used for remote desktop access, not secure file transfers.
References:
ISACA CISA Review Manual
NIST 800-52 (Guidelines for Transport Layer Security)