Cybersecurity Principles And Risk

When designing a defense-in-depth strategy, which layer should be addressed first as the primary boundary between internal and external networks?

An analyst is setting up a new firewall. The policy dictates that all traffic is blocked unless explicitly permitted. What principle is being followed?

An analyst is assessing the 'Availability' of a database. Which scenario represents a threat to availability?

Which TWO of the following are considered 'Technical' controls?

Which TWO of the following are core components of the CIA Triad?

You are implementing ISO 27001 Annex A controls. Which control category would contain requirements for physical access to the server room?

Which document outlines the formal commitment of top management to support information security objectives?

You are reviewing a cloud architecture against the NIST 800-53 control catalog. Which control family would you reference for incidents involving unauthorized data exfiltration?

Which TWO of the following are examples of 'Detection' capabilities in the NIST CSF?

Which security framework is most commonly used by US federal agencies to manage security controls?

You are performing STRIDE threat modeling on a new web application. A developer asks how to mitigate a 'Tampering' threat identified during the design phase. Which control is most effective?

You are performing a quantitative risk assessment. The SLE (Single Loss Expectancy) is $10,000, and the ARO (Annualized Rate of Occurrence) is 0.5. What is the ALE (Annualized Loss Expectancy)?

A security analyst is mapping organizational assets to the NIST Cybersecurity Framework. Which category is specifically responsible for maintaining the resilience of critical infrastructure?

Which THREE items are typically included in a formal Risk Register?

Which TWO elements should be included when performing threat modeling using the STRIDE methodology?

You are utilizing the MITRE ATT&CK framework to document an incident. Which object represents the 'what' of the attack, such as the specific software or tool used?

A security analyst is reviewing access logs and notices a user with 'Administrator' rights performing daily data entry. Which principle is being violated?

In a FAIR (Factor Analysis of Information Risk) model, what is the 'Loss Event Frequency' composed of?

What is the primary objective of a 'Business Impact Analysis' (BIA)?

Which TWO of the following are primary functions of an Information Security Governance program?

During threat modeling, you identify that an adversary could impersonate a service account. Which control is most effective against this?

Which role is primarily responsible for classifying data based on its value and sensitivity to the organization?

An organization is updating its BCP plan. Which step in the risk assessment process should occur immediately after identifying the critical assets?

Which THREE controls are considered effective 'Administrative' controls according to the NIST framework?

During a risk assessment using ISO 27001, you identify an unpatched vulnerability in an edge router. Management refuses to apply the patch due to legacy software dependencies. Which risk treatment option are they exercising?

Which THREE actions are essential to the 'Identify' function of the NIST CSF?

Which type of risk assessment approach uses descriptive scales like 'High', 'Medium', and 'Low'?

You are tasked with ensuring the 'Confidentiality' of sensitive data in transit. Which mechanism best satisfies this security principle?

Which THREE factors are commonly used to calculate risk in a basic qualitative model?