5.4 Summarize elements of effective security compliance
Objective 5.4 sits in Security Program Management and Oversight, which carries 20% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.
Objective title verbatim from the official objectives. CompTIA exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
During an internal review, an auditor searches for the artifact that records how each security control is implemented so results can support both internal and external reporting. Which artifact is the auditor examining?
The concept
An audit runs on evidence about implementation, not on the security features themselves. Someone has to be able to open one register and read, per requirement, what the organization does to satisfy it, where that is configured, who owns it and when it was last checked. Risk artifacts aggregate exposure rather than coverage. Data protection tools act on individual items. Neither answers a per-requirement question across the whole estate.
Why this answer
The Control Framework is the artifact used to track control implementations and support internal and external reporting.
- Correct. One register mapping each requirement to its implementation.
- BERM aggregates and reports on risk broadly, but it is not the artifact that documents individual control implementations.
- CA trainable classifier identifies content types; it has no role in tracking control implementation status.
- DA sensitivity label protects one item; it does not track control implementation across the enterprise.
- EThis scan previews label impact before policy creation; it does not document control implementation status.
Now you: objective 5.4 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
An administrator only needs to view data classification results, not modify any labels or policies. Following recommended practice, which role assignment should be granted?
Sample question 2 of 3
To comply with a data privacy regulation, a team must locate all documents containing government identification numbers across the tenant, but enforcement policies have not yet been approved. Which combination of capabilities lets them preview matches without applying any policy?
Sample question 3 of 3
A service team requests permission to bypass a required control because a customer contract cannot otherwise be met. Before the exception can be approved, what must the request include?
That’s 3 of the full Security+ bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.
More objectives in Security Program Management and Oversight
- 5.1 5.1 Summarize elements of effective security governance
- 5.2 5.2 Explain elements of the risk management process
- 5.3 5.3 Explain the processes associated with third-party risk assessment and management
- 5.5 5.5 Explain types and purposes of audits and assessments
- 5.6 5.6 Given a scenario, implement security awareness practices