Cybersecurity Principles And Risk

An organization is updating its BCP plan. Which step in the risk assessment process should occur immediately after identifying the critical assets?

During a risk assessment using ISO 27001, you identify an unpatched vulnerability in an edge router. Management refuses to apply the patch due to legacy software dependencies. Which risk treatment option are they exercising?

You are performing STRIDE threat modeling on a new web application. A developer asks how to mitigate a 'Tampering' threat identified during the design phase. Which control is most effective?

You are tasked with ensuring the 'Confidentiality' of sensitive data in transit. Which mechanism best satisfies this security principle?

You are reviewing a cloud architecture against the NIST 800-53 control catalog. Which control family would you reference for incidents involving unauthorized data exfiltration?

An analyst is assessing the 'Availability' of a database. Which scenario represents a threat to availability?

A security analyst is mapping organizational assets to the NIST Cybersecurity Framework. Which category is specifically responsible for maintaining the resilience of critical infrastructure?

Which document outlines the formal commitment of top management to support information security objectives?

What is the primary objective of a 'Business Impact Analysis' (BIA)?

In a FAIR (Factor Analysis of Information Risk) model, what is the 'Loss Event Frequency' composed of?

When designing a defense-in-depth strategy, which layer should be addressed first as the primary boundary between internal and external networks?

Which role is primarily responsible for classifying data based on its value and sensitivity to the organization?

An analyst is setting up a new firewall. The policy dictates that all traffic is blocked unless explicitly permitted. What principle is being followed?

You are implementing ISO 27001 Annex A controls. Which control category would contain requirements for physical access to the server room?

You are performing a quantitative risk assessment. The SLE (Single Loss Expectancy) is $10,000, and the ARO (Annualized Rate of Occurrence) is 0.5. What is the ALE (Annualized Loss Expectancy)?

Which security framework is most commonly used by US federal agencies to manage security controls?

Which TWO of the following are core components of the CIA Triad?

A security analyst is reviewing access logs and notices a user with 'Administrator' rights performing daily data entry. Which principle is being violated?

Which THREE items are typically included in a formal Risk Register?

During threat modeling, you identify that an adversary could impersonate a service account. Which control is most effective against this?

Which type of risk assessment approach uses descriptive scales like 'High', 'Medium', and 'Low'?

You are utilizing the MITRE ATT&CK framework to document an incident. Which object represents the 'what' of the attack, such as the specific software or tool used?

Which TWO elements should be included when performing threat modeling using the STRIDE methodology?

Which THREE factors are commonly used to calculate risk in a basic qualitative model?

Which TWO of the following are primary functions of an Information Security Governance program?

Which TWO of the following are examples of 'Detection' capabilities in the NIST CSF?

Which THREE actions are essential to the 'Identify' function of the NIST CSF?

Which TWO of the following are considered 'Technical' controls?

Which THREE controls are considered effective 'Administrative' controls according to the NIST framework?