CCOA Cybersecurity Principles And Risk Practice Test 2 — 15 Questions

Question 1

In a FAIR (Factor Analysis of Information Risk) model, what is the 'Loss Event Frequency' composed of?

Accepted Answer

Threat Event Frequency and Vulnerability. In FAIR, Loss Event Frequency (LEF) is the probable frequency, within a given timeframe, that a threat agent will inflict harm upon an asset. It is derived from Threat Event Frequency (TEF) — how often threat agents act against the asset — and Vulnerability, which is the probability that a threat event becomes a loss event. This decomposition is the core of FAIR's frequency side of risk.

Answer

Inherent risk and residual risk

Answer

Threat capability and control strength

Answer

Asset value and threat actor motivation

Question 2

When designing a defense-in-depth strategy, which layer should be addressed first as the primary boundary between internal and external networks?

Accepted Answer

Perimeter network (DMZ). The perimeter network (DMZ) is the first line of defense that separates the internal network from untrusted public networks.

Answer

Data encryption

Answer

Host-based security

Answer

Application layer

Question 3

Which role is primarily responsible for classifying data based on its value and sensitivity to the organization?

Accepted Answer

Data Owner. The Data Owner is the individual responsible for determining the classification and appropriate protection levels for data.

Answer

Chief Information Officer

Answer

Data Custodian

Answer

Auditor

Answer

Security Administrator

Question 4

You are implementing ISO 27001 Annex A controls. Which control category would contain requirements for physical access to the server room?

Accepted Answer

Physical and Environmental Security. Physical and Environmental Security is the domain within ISO 27001 that covers physical site security.

Answer

Human Resource Security

Answer

Operations Security

Answer

Access Control

Question 5

You are performing a quantitative risk assessment. The SLE (Single Loss Expectancy) is $10,000, and the ARO (Annualized Rate of Occurrence) is 0.5. What is the ALE (Annualized Loss Expectancy)?

Accepted Answer

$5,000. ALE = SLE * ARO. $10,000 * 0.5 = $5,000.

Answer

$10,000

Answer

$20,000

Answer

$2,500

Question 6

Which security framework is most commonly used by US federal agencies to manage security controls?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is the mandatory security control catalog for US federal information systems.

Answer

ISO 27001

Answer

PCI-DSS

Answer

HIPAA

Question 7

Which TWO of the following are core components of the CIA Triad?

Accepted Answer

Confidentiality. The CIA Triad stands for Confidentiality, Integrity, and Availability.

Answer

Non-repudiation

Answer

Identification

Answer

Authorization

Question 8

A security analyst is reviewing access logs and notices a user with 'Administrator' rights performing daily data entry. Which principle is being violated?

Accepted Answer

Least Privilege. Least Privilege dictates that users receive only the minimum permissions necessary to perform their job functions. An Administrator account performing daily data entry has far more access than the task requires, violating this principle. The excess privileges expand the attack surface and potential blast radius if the account is compromised.

Answer

Accountability

Answer

Separation of Duties

Answer

Need to know

Question 9

Which THREE items are typically included in a formal Risk Register?

Accepted Answer

Mitigation status. A formal Risk Register documents each identified risk along with its Mitigation status (A), which tracks the progress of the chosen risk response (e.g., mitigate, transfer, accept, avoid) and is essential for ongoing risk monitoring and reporting. The Risk description (D) is a core field that captures the nature of the risk, including its cause, event, and potential impact, so that it can be assessed and prioritized. The Asset owner (E) is also a standard register field because it assigns accountability for the affected asset and the associated risk treatment to a specific person or role. By contrast, a Vendor contact list (B) is supplier/contact management data, and a Hardware serial number (C) is an asset-inventory detail; neither is a defining element of a Risk Register, even though both may appear in related asset or vendor records.

Answer

Vendor contact list

Answer

Hardware serial number

Question 10

During threat modeling, you identify that an adversary could impersonate a service account. Which control is most effective against this?

Accepted Answer

Mutual TLS (mTLS). Mutual TLS (mTLS) or strong service-to-service authentication prevents impersonation by verifying the identity of both sides.

Answer

Increasing password complexity

Answer

VLAN isolation

Answer

Firewall rules

Question 11

Which type of risk assessment approach uses descriptive scales like 'High', 'Medium', and 'Low'?

Accepted Answer

Qualitative. Qualitative risk assessment uses subjective, descriptive ratings rather than numerical financial values.

Answer

Probabilistic

Answer

Deterministic

Answer

Quantitative

Question 12

You are utilizing the MITRE ATT&CK framework to document an incident. Which object represents the 'what' of the attack, such as the specific software or tool used?

Accepted Answer

Software. In MITRE ATT&CK, the 'Software' object represents the specific software or tool used by an adversary during an attack. This includes both commercial and open-source tools, as well as malware families. It answers the 'what' of the attack by identifying the concrete artifacts employed, such as Mimikatz, Cobalt Strike, or custom malware. Software is distinct from Tactic (the 'why'), Technique (the 'how'), and Group (the 'who').

Answer

Tactic

Answer

Group

Answer

Technique

Question 13

Which TWO elements should be included when performing threat modeling using the STRIDE methodology?

Accepted Answer

Identify data flows. STRIDE threat modeling requires decomposing the system to understand where threats can occur, and identifying data flows (B) is a core step because it maps how information moves between components, processes, and external entities so each flow can be analyzed against STRIDE categories. Identifying trust boundaries (E) is equally essential because threats such as spoofing, tampering, and elevation of privilege typically arise where data crosses between zones of differing trust, so these boundaries must be explicitly documented. Vulnerability scanning (A) and penetration testing (C) are reactive/validation activities performed after or alongside threat modeling, not elements of the STRIDE modeling process itself. Budget approval (D) is a project management concern and has no role in the technical STRIDE methodology.

Answer

Perform vulnerability scan

Answer

Conduct penetration test

Answer

Budget approval

Question 14

Which THREE factors are commonly used to calculate risk in a basic qualitative model?

Accepted Answer

Impact. In a basic qualitative risk model, risk is typically expressed as a function of the likelihood of a threat exploiting a weakness and the resulting impact on the organization, so option B (Impact) is correct because it captures the severity of harm if an adverse event occurs, and option D (Threat) is correct because it represents the potential source or event that could cause harm. Option E (Vulnerability) is also correct because it is the weakness or gap that a threat can exploit, and combining threat likelihood with vulnerability and impact is the standard qualitative formula (Risk = Threat × Vulnerability × Impact). The unmarked options do not belong: option A (System age) is an asset attribute that might influence likelihood but is not itself a core risk factor in the basic model, and option C (Vendor name) is irrelevant to calculating risk because it identifies a supplier rather than a threat, vulnerability, or impact component.

Answer

System age

Answer

Vendor name

Question 15

Which TWO of the following are primary functions of an Information Security Governance program?

Accepted Answer

Strategic alignment. Strategic alignment (A) is a primary function of Information Security Governance because governance ensures that security initiatives, investments, and controls are aligned with the organization's business objectives, strategy, and regulatory obligations. Risk management (D) is also a core governance function, as governance establishes the frameworks, policies, and oversight processes for identifying, assessing, treating, and monitoring information security risks at an enterprise level. Writing code (B) is a software development or engineering activity, not a governance function. Wiring network cables (C) is a physical infrastructure implementation task. Patching server OS (E) is an operational/technical vulnerability management activity, not a governance-level responsibility.

Answer

Writing code

Answer

Wiring network cables

Answer

Patching server OS