An organization wants to perform a scan of all its systems against best practice security configurations.
Which of the following SCAP standards, when combined, will enable the organization to view each of the configuration checks in a machine-readable checklist format for fill automation? (Choose two.)

• A. ARF
• B. XCCDF
• C. CPE
• D. CVE
• E. CVSS
• F. OVAL

someone is saying AB and someone is saying BF 

You've just deployed a new Cisco router that connects several network segments in your organization. The router is physically located in a server room that requires an ID card to gain access. You've backed up the router configuration to a remote location in an encrypted file. You access the router configuration interface from your notebook computer using a Telnet client with a user name of admin and a password of admin. You have used the MD5 hashing algorithm to protect the password. What should you do to increase the security of the device?

An organization's hunt team thinks a persistent threats exists and already has a foothold in the enterprise network.

Which of the following techniques would be BEST for the hunt team to use to entice the adversary to uncover malicious activity?

Options:

A Deploy a SOAR tool.
B Modify user password history and length requirements.
C Apply new isolation and segmentation schemes.
D Implement decoy files on adjacent hosts.    

NOTE : someone is saying the answer C and other is saying D ... I am confused .. Please help to guide with the correct answer with the justification 

The goal of a Chief information Security Officer (CISO) providing up-to-date metrics to a bank's risk committee is to ensure:

A Budgeting for cybersecurity increases year over year.
B The committee knows how much work is being done.
C Business units are responsible for their own mitigation.
D The bank is aware of the status of cybersecurity risks

NOTE : someone is saying A and other is saying D ... i need the correct answer with clarity