An analyst is setting up a new firewall. The policy dictates that all traffic is blocked unless explicitly permitted. What principle is being followed?
A CCOA analyst is reviewing the organization's risk register and notices an entry for a legacy payroll application with a risk rating of 'High' that has remained unchanged for three consecutive quarterly reviews with no treatment plan attached. Which action should the analyst recommend FIRST?
A security operations analyst is reviewing the organization's risk treatment options after a risk assessment identified several high-severity risks. The CISO asks which TWO risk treatment strategies involve reducing the likelihood or impact of a risk rather than transferring or avoiding it. (Choose two.)
During a risk assessment using ISO 27001, you identify an unpatched vulnerability in an edge router. Management refuses to apply the patch due to legacy software dependencies. Which risk treatment option are they exercising?
You are performing STRIDE threat modeling on a new web application. A developer asks how to mitigate a 'Tampering' threat identified during the design phase. Which control is most effective?
You are reviewing a cloud architecture against the NIST 800-53 control catalog. Which control family would you reference for incidents involving unauthorized data exfiltration?
A security analyst is mapping organizational assets to the NIST Cybersecurity Framework. Which category is specifically responsible for maintaining the resilience of critical infrastructure?
You are performing a quantitative risk assessment. The SLE (Single Loss Expectancy) is $10,000, and the ARO (Annualized Rate of Occurrence) is 0.5. What is the ALE (Annualized Loss Expectancy)?
A security analyst is reviewing access logs and notices a user with 'Administrator' rights performing daily data entry. Which principle is being violated?
You are utilizing the MITRE ATT&CK framework to document an incident. Which object represents the 'what' of the attack, such as the specific software or tool used?
A security operations analyst at a hospital is reviewing the risk register. A threat has been identified that could exploit a vulnerability in a legacy MRI machine's embedded OS, but the machine cannot be patched because the vendor no longer supports it. The CIO decides to accept the risk and document it. Which risk response strategy has been applied?
A financial analyst is evaluating a new trading platform. The platform provider claims that their system has a 'high' level of confidentiality, integrity, and availability. The analyst needs to determine the potential impact if the system were compromised. Which term best describes the potential loss or harm that could occur if a threat exploits a vulnerability?
A security operations center (SOC) analyst is reviewing the organization's risk management process. The analyst notes that the organization has a low risk appetite for data breaches involving customer PII. Which risk response is most appropriate when the cost of implementing a control is less than the potential loss?
A security analyst is conducting a risk assessment for a new cloud-based CRM system. The analyst must identify TWO qualitative risk assessment techniques that can be used to prioritize risks based on expert judgment and descriptive scales. (Choose two.)
A security administrator is implementing a new access control system. The administrator wants to ensure that users are granted the minimum level of access necessary to perform their job functions. Which principle is being applied?
A healthcare organization's security operations team is mapping controls to the NIST Cybersecurity Framework. The CISO asks which function is primarily concerned with understanding the organization's assets, business environment, and risk appetite so that security activities can be prioritized. Which NIST CSF function should the analyst identify?
A financial services firm has classified its customer transaction database as 'Restricted'. The CISO wants to ensure that even if the storage array is physically stolen, the data cannot be read. Which control should be implemented to directly satisfy this requirement?
A financial services firm stores customer account data in a database. The security team is asked to ensure that even if the storage media is stolen, the data cannot be read without additional secret material. Which control best satisfies this requirement?
A healthcare organization stores electronic protected health information (ePHI) on a database server. An analyst recommends implementing AES-256 encryption at rest with keys managed by a hardware security module (HSM). Which security objective does this control primarily address?
A healthcare organization must comply with regulations requiring that patient records remain available during a ransomware incident. The CIO asks which principle of the CIA triad is most directly addressed by maintaining immutable offline backups. Which principle applies?
During an internal audit, a CCOA analyst finds that the organization's data classification policy labels customer PII as 'Confidential' and requires AES-256 encryption at rest, but the backup team stores nightly database dumps on unencrypted LTO-9 tapes in a third-party vault. Which risk response strategy is the organization currently exhibiting with respect to the tape backups?
A security analyst is performing a qualitative risk assessment for a new cloud-based customer portal. The CISO wants risk ratings that reflect both the likelihood of a threat event and the severity of its impact, using a consistent descriptive scale. Which TWO techniques should the analyst use to produce these ratings? (Choose two.)
A security analyst is quantifying risk for a new e-commerce platform. The asset value is $500,000, the exposure factor for a successful DDoS attack is 20%, and the annualized rate of occurrence is 3. What is the annualized loss expectancy (ALE)?
A retail bank's security team is classifying a new customer-facing mobile application. The application stores no cardholder data but processes internal marketing statistics. The team must decide whether to apply the same security controls as the core banking platform or a lighter control set. Which activity should occur FIRST to make this decision defensible?
A financial services firm wants to reduce the likelihood that a former employee can use still-valid credentials to access internal systems after termination. Which administrative control should the security team implement FIRST?
A CCOA analyst is building a threat model for a new API gateway that exposes internal microservices to partner organizations. The analyst wants to prioritize threats using a methodology that combines adversary capability, intent, and opportunity against the organization's specific attack surface. Which approach best fits this requirement?
During a risk assessment, an analyst determines that a legacy payroll application has a vulnerability that could allow remote code execution. The vendor no longer issues patches, and the application is required for monthly payroll runs. The CISO accepts the residual risk and documents the decision. Which risk treatment option has the organization chosen?
A multinational retailer must demonstrate to auditors that its security program aligns with a recognized framework for managing cybersecurity risk. The CISO wants a framework that provides a common language for communicating risk to executives and is widely accepted across industries. Which framework best meets this need?
A hospital's risk register lists ransomware against its electronic health record system with a likelihood of 'High' and an impact of 'Critical' on a five-point qualitative scale. The CISO must select a treatment option that reduces the residual risk to an acceptable level while preserving clinical availability. Which treatment approach BEST fits this scenario?
A security analyst is conducting a qualitative risk assessment for a new cloud-based customer relationship management (CRM) system. The team wants to prioritize risks without assigning monetary values. Which TWO factors are most relevant when using a qualitative risk matrix? (Choose two.)
A multinational retailer must comply with a regulation requiring that personal data of European customers not be transferred to countries lacking an adequate level of data protection. The security team is asked to identify the primary principle that governs this restriction. Which principle applies?
A software company operates a continuous integration pipeline where developers can push code directly to production branches. A recent post-incident review found that a single compromised developer credential allowed malicious code to reach customers. Which change to the pipeline's control environment MOST directly reduces this specific risk?
A multinational retailer is expanding into a new country and must comply with that country's data protection law, which requires personal data of citizens to remain within national borders. The security team is asked to recommend an architecture that satisfies this requirement while still allowing the global analytics team to process aggregated, non-personal data. Which approach BEST meets these constraints?
A security operations analyst is reviewing a risk register entry for a web application vulnerability. The entry shows a high likelihood and high impact, but the business owner has decided to accept the risk because the application is scheduled for decommissioning in two months. Which risk treatment strategy is being applied?
A financial services firm is updating its risk management program and wants to strengthen how it treats risks that fall outside its risk appetite. The board has asked which activities are core components of a formal risk treatment process. (Choose two.)
A CCOA analyst is establishing a risk appetite statement for a hospital network that must balance patient safety, regulatory obligations under HIPAA, and operational availability of clinical systems. Which TWO characteristics must the risk appetite statement exhibit to be considered effective by ISACA risk governance principles? (Choose two.)
An organization's risk register shows a customer database risk with an annualized loss expectancy of $240,000. A proposed data loss prevention and encryption program costs $90,000 per year and is expected to reduce annualized loss expectancy to $60,000. The CFO asks whether the investment is justified on a purely quantitative basis. What should the analyst report?
A CCOA analyst is evaluating a third-party SaaS vendor that will process regulated financial data. The vendor's SOC 2 Type II report covers security and availability but excludes confidentiality. The contract includes a right-to-audit clause and a 24-hour breach notification requirement. Which remaining action is MOST important to close the assurance gap?
A CCOA analyst at a healthcare provider is reviewing the risk treatment plan for a legacy on-premises EHR system. The system cannot be patched, and the vendor no longer supports it. The organization decides to purchase cyber insurance to cover potential losses from a breach of this system. Which risk treatment option does this decision represent?
A CCOA analyst is performing a quantitative risk assessment for a new customer-facing API. The asset value is $500,000, the exposure factor is 40%, and the annualized rate of occurrence is 0.2. What is the annualized loss expectancy (ALE)?
A CCOA analyst is reviewing the organization's cybersecurity policy framework. The analyst needs to identify the document that provides high-level direction and states the organization's commitment to cybersecurity, but does not include detailed procedures or technical configurations. Which type of document should the analyst reference?
A CCOA analyst is assessing the risk of a third-party SaaS provider that will process sensitive customer data. The provider's SOC 2 Type II report shows no exceptions, but the provider will not allow on-site audits. Which action should the analyst take to best address the residual risk?
A CCOA analyst is reviewing the organization's risk appetite statement, which states the company will accept no more than $500,000 in annualized loss expectancy (ALE) from any single risk. A newly identified risk has a single loss expectancy (SLE) of $250,000 and an annualized rate of occurrence (ARO) of 4. What is the ALE, and what should the analyst conclude?
A CCOA analyst is conducting a risk assessment for a new cloud-based collaboration platform. The analyst must identify TWO qualitative risk analysis techniques that are appropriate for this assessment. (Choose two.)
A CCOA analyst is mapping an identified risk to the organization's risk response strategy. The risk is a legacy internal payroll application that cannot be patched; the business unit has decided to keep running it because replacement would cost more than the potential loss, and management has signed a formal acceptance memo. Which risk response has been applied?
A CCOA analyst is asked to explain the difference between a vulnerability, a threat, and a risk during a security awareness session. A server is missing a critical patch, a known ransomware group actively targets that flaw, and the server stores regulated data. Which statement correctly describes the relationship?
A CCOA analyst is helping the security team select controls for a new public-facing web application. The team wants to apply the principle of defense in depth, ensuring that no single control failure exposes the application. Which two controls best demonstrate layered, independent protection for this scenario? (Choose two.)
A CCOA analyst is reviewing the organization's residual risk position after implementing a new endpoint detection and response (EDR) tool. The original inherent risk score was 16 (high), and the control effectiveness assessment reduces it to a residual score of 6 (medium). The risk owner asks whether the risk can now be closed in the register. What is the most appropriate response?