CCOA Cybersecurity Principles And Risk Practice Test 2 — 15 Questions

Question 1

You are performing a quantitative risk assessment. The SLE (Single Loss Expectancy) is $10,000, and the ARO (Annualized Rate of Occurrence) is 0.5. What is the ALE (Annualized Loss Expectancy)?

Accepted Answer

$5,000. ALE = SLE * ARO. $10,000 * 0.5 = $5,000.

Answer

$10,000

Answer

$20,000

Answer

$2,500

Question 2

Which security framework is most commonly used by US federal agencies to manage security controls?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is the mandatory security control catalog for US federal information systems.

Answer

ISO 27001

Answer

PCI-DSS

Answer

HIPAA

Question 3

Which TWO of the following are core components of the CIA Triad?

Accepted Answer

Confidentiality. The CIA Triad stands for Confidentiality, Integrity, and Availability.

Answer

Non-repudiation

Answer

Identification

Answer

Authorization

Question 4

A security analyst is reviewing access logs and notices a user with 'Administrator' rights performing daily data entry. Which principle is being violated?

Accepted Answer

Least Privilege. The principle of Least Privilege dictates that users should only have the minimum level of access required to perform their job functions.

Answer

Accountability

Answer

Separation of Duties

Answer

Need to know

Question 5

Which THREE items are typically included in a formal Risk Register?

Accepted Answer

Mitigation status. A risk register tracks risks, including their probability, impact, and mitigation status.

Answer

Vendor contact list

Answer

Hardware serial number

Question 6

During threat modeling, you identify that an adversary could impersonate a service account. Which control is most effective against this?

Accepted Answer

Mutual TLS (mTLS). Mutual TLS (mTLS) or strong service-to-service authentication prevents impersonation by verifying the identity of both sides.

Answer

Increasing password complexity

Answer

VLAN isolation

Answer

Firewall rules

Question 7

Which type of risk assessment approach uses descriptive scales like 'High', 'Medium', and 'Low'?

Accepted Answer

Qualitative. Qualitative risk assessment uses subjective, descriptive ratings rather than numerical financial values.

Answer

Probabilistic

Answer

Deterministic

Answer

Quantitative

Question 8

You are utilizing the MITRE ATT&CK framework to document an incident. Which object represents the 'what' of the attack, such as the specific software or tool used?

Accepted Answer

Software. The 'Software' object in MITRE ATT&CK describes the tools used by adversaries to perform techniques.

Answer

Tactic

Answer

Group

Answer

Technique

Question 9

Which TWO elements should be included when performing threat modeling using the STRIDE methodology?

Accepted Answer

Identify data flows. STRIDE focuses on identifying threats based on specific categories like Spoofing and Information Disclosure.

Answer

Perform vulnerability scan

Answer

Conduct penetration test

Answer

Budget approval

Question 10

Which THREE factors are commonly used to calculate risk in a basic qualitative model?

Accepted Answer

Impact. Risk is typically defined by the combination of a threat, the vulnerability, and the potential impact.

Answer

System age

Answer

Vendor name

Question 11

Which TWO of the following are primary functions of an Information Security Governance program?

Accepted Answer

Strategic alignment. Governance ensures security aligns with business goals and manages risk effectively.

Answer

Writing code

Answer

Wiring network cables

Answer

Patching server OS

Question 12

Which TWO of the following are examples of 'Detection' capabilities in the NIST CSF?

Accepted Answer

SIEM log analysis. Detection focus on identifying anomalies and security events continuously.

Answer

System hardening

Answer

Backups

Answer

Firewall blocking

Question 13

Which THREE actions are essential to the 'Identify' function of the NIST CSF?

Accepted Answer

Risk management strategy. Identify covers inventory, risk management, and governance.

Answer

Malware scanning

Answer

Incident recovery time analysis

Question 14

Which TWO of the following are considered 'Technical' controls?

Accepted Answer

Firewall configuration. Technical controls (logical controls) are implemented via software, hardware, or firmware.

Answer

Background checks

Answer

Security policy documentation

Answer

Guard patrol

Question 15

Which THREE controls are considered effective 'Administrative' controls according to the NIST framework?

Accepted Answer

Access control policy. Administrative controls are policies, procedures, and management tasks rather than technical or physical hardware.

Answer

Biometric locks

Answer

Encryption