CCOA Cybersecurity Principles And Risk — Timed 20 Questions

Question 1

An organization is updating its BCP plan. Which step in the risk assessment process should occur immediately after identifying the critical assets?

Accepted Answer

Threat identification. After identifying assets, the next logical step is to identify the threats that could impact those specific assets.

Answer

Vulnerability assessment

Answer

Acceptable risk levels

Answer

Risk mitigation strategy

Question 2

An analyst is setting up a new firewall. The policy dictates that all traffic is blocked unless explicitly permitted. What principle is being followed?

Accepted Answer

Default Deny. Default Deny (or Least Privilege) ensures that traffic not specifically allowed is prohibited by default.

Answer

Least Privilege

Answer

Separation of Duties

Answer

Defense-in-depth

Question 3

A company requires that two employees must approve any financial transaction over $10,000. This is an example of which security control concept?

Accepted Answer

Dual Control. Separation of Duties (SoD) prevents fraud by requiring multiple people to complete a sensitive task.

Answer

Job Rotation

Answer

Mandatory Access Control

Answer

Least Privilege

Question 4

Which TWO of the following are examples of 'Detection' capabilities in the NIST CSF?

Accepted Answer

SIEM log analysis. Detection focus on identifying anomalies and security events continuously.

Answer

System hardening

Answer

Backups

Answer

Firewall blocking

Question 5

Which THREE actions are essential to the 'Identify' function of the NIST CSF?

Accepted Answer

Risk management strategy. Identify covers inventory, risk management, and governance.

Answer

Malware scanning

Answer

Incident recovery time analysis

Question 6

A CCOA analyst is reviewing the organization's risk register and notices an entry for a legacy payroll application with a risk rating of 'High' that has remained unchanged for three consecutive quarterly reviews with no treatment plan attached. Which action should the analyst recommend FIRST?

Accepted Answer

Verify that a risk owner is assigned and that a treatment decision is documented. An untreated High risk that survives multiple review cycles signals a governance breakdown. ISACA guidance holds that every risk requires a named owner and an explicit, documented treatment decision mapped to organizational risk appetite. Confirming ownership and the existence of a decision is the necessary precondition before any remediation, transfer, or acceptance action can be recommended.

Answer

Immediately decommission the legacy payroll application

Answer

Lower the risk rating to 'Medium' to reflect the application's age

Answer

Escalate the stale entry to the risk owner for a documented treatment decision

Question 7

A security operations analyst is reviewing the organization's risk treatment options after a risk assessment identified several high-severity risks. The CISO asks which TWO risk treatment strategies involve reducing the likelihood or impact of a risk rather than transferring or avoiding it. (Choose two.)

Accepted Answer

Mitigation. Risk treatment strategies that reduce risk operate on likelihood or impact. Mitigation applies controls to lower one or both, while deterrence discourages adversaries and thereby lowers likelihood. Transfer moves financial impact to a third party, acceptance retains the risk, and avoidance eliminates the activity. The two strategies that reduce rather than shift or eliminate risk are mitigation and deterrence.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 8

During a risk assessment using ISO 27001, you identify an unpatched vulnerability in an edge router. Management refuses to apply the patch due to legacy software dependencies. Which risk treatment option are they exercising?

Accepted Answer

Risk acceptance. Risk acceptance is the decision to accept the risk because the cost of mitigation outweighs the potential impact or because business requirements forbid the change.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk transfer

Question 9

You are performing STRIDE threat modeling on a new web application. A developer asks how to mitigate a 'Tampering' threat identified during the design phase. Which control is most effective?

Accepted Answer

Implement cryptographic hashing/digital signatures. Tampering in STRIDE refers to unauthorized modification of data or code, so the most effective mitigation is cryptographic hashing and digital signatures (C), which let the receiver detect any alteration to data in transit or at rest. If a message or record is modified, the hash or signature verification fails, providing integrity assurance that no other control in the list delivers. This directly addresses the tampering threat at the data-integrity layer.

Answer

Implement TLS encryption

Answer

Implement logging and auditing

Answer

Implement Role-Based Access Control

Question 10

You are tasked with ensuring the 'Confidentiality' of sensitive data in transit. Which mechanism best satisfies this security principle?

Accepted Answer

AES-256 Encryption. Confidentiality ensures that only authorized parties can access data, which is achieved through encryption.

Answer

Two-Factor Authentication

Answer

Hashing Algorithms

Answer

Digital Signatures

Question 11

You are reviewing a cloud architecture against the NIST 800-53 control catalog. Which control family would you reference for incidents involving unauthorized data exfiltration?

Accepted Answer

Incident Response (IR). Incident Response (IR) is the specific NIST 800-53 family governing the response to security incidents.

Answer

Access Control (AC)

Answer

Configuration Management (CM)

Answer

Risk Assessment (RA)

Question 12

An analyst is assessing the 'Availability' of a database. Which scenario represents a threat to availability?

Accepted Answer

Distributed Denial of Service (DDoS) attack. Availability threats target the ability of legitimate users to access a system or its data when needed. A Distributed Denial of Service (DDoS) attack floods a target with traffic from many sources, exhausting bandwidth, connection tables, or application resources so the database becomes unreachable — a direct, textbook availability attack. The CIA triad classifies DDoS squarely under Availability because no data is read, altered, or forged; the service is simply denied.

Answer

Packet sniffing on the wire

Answer

Replay attack

Answer

Unauthorized data modification

Question 13

A security analyst is mapping organizational assets to the NIST Cybersecurity Framework. Which category is specifically responsible for maintaining the resilience of critical infrastructure?

Accepted Answer

Recover. The NIST CSF Core consists of five functions: Identify, Protect, Detect, Respond, and Recover. Recover is the function focused on resilience and restoring capabilities.

Answer

Detect

Answer

Protect

Answer

Identify

Question 14

Which document outlines the formal commitment of top management to support information security objectives?

Accepted Answer

Information Security Policy (ISP). The Information Security Policy (ISP) is the top-level governance document that formally expresses management's commitment to information security objectives, defines the security program's scope, and assigns responsibilities. It is signed by executive leadership and serves as the foundation from which all lower-level standards, procedures, and guidelines derive. This is the canonical answer for demonstrating management support in frameworks like ISO 27001 and NIST.

Answer

System Security Plan (SSP)

Answer

Business Impact Analysis (BIA)

Answer

Standard Operating Procedure (SOP)

Question 15

What is the primary objective of a 'Business Impact Analysis' (BIA)?

Accepted Answer

To determine the criticality of business processes. A Business Impact Analysis (BIA) is the foundational step in business continuity and disaster recovery planning whose primary purpose is to identify and prioritize business processes by their criticality to the organization. It determines which functions are essential, how long they can be disrupted (RTO), and how much data loss is tolerable (RPO), so recovery resources can be allocated accordingly. Vulnerability identification, playbook testing, and patch listing are separate activities that occur after or alongside the BIA, not its objective.

Answer

To identify all system vulnerabilities

Answer

To test incident response playbooks

Answer

To create a list of software patches

Question 16

In a FAIR (Factor Analysis of Information Risk) model, what is the 'Loss Event Frequency' composed of?

Accepted Answer

Threat Event Frequency and Vulnerability. In FAIR, Loss Event Frequency (LEF) is the probable frequency, within a given timeframe, that a threat agent will inflict harm upon an asset. It is derived from Threat Event Frequency (TEF) — how often threat agents act against the asset — and Vulnerability, which is the probability that a threat event becomes a loss event. This decomposition is the core of FAIR's frequency side of risk.

Answer

Inherent risk and residual risk

Answer

Threat capability and control strength

Answer

Asset value and threat actor motivation

Question 17

When designing a defense-in-depth strategy, which layer should be addressed first as the primary boundary between internal and external networks?

Accepted Answer

Perimeter network (DMZ). The perimeter network (DMZ) is the first line of defense that separates the internal network from untrusted public networks.

Answer

Data encryption

Answer

Host-based security

Answer

Application layer

Question 18

Which role is primarily responsible for classifying data based on its value and sensitivity to the organization?

Accepted Answer

Data Owner. The Data Owner is the individual responsible for determining the classification and appropriate protection levels for data.

Answer

Chief Information Officer

Answer

Data Custodian

Answer

Auditor

Answer

Security Administrator

Question 19

You are implementing ISO 27001 Annex A controls. Which control category would contain requirements for physical access to the server room?

Accepted Answer

Physical and Environmental Security. Physical and Environmental Security is the domain within ISO 27001 that covers physical site security.

Answer

Human Resource Security

Answer

Operations Security

Answer

Access Control

Question 20

You are performing a quantitative risk assessment. The SLE (Single Loss Expectancy) is $10,000, and the ARO (Annualized Rate of Occurrence) is 0.5. What is the ALE (Annualized Loss Expectancy)?

Accepted Answer

$5,000. ALE = SLE * ARO. $10,000 * 0.5 = $5,000.

Answer

$10,000

Answer

$20,000

Answer

$2,500