29 questions · Cybersecurity Principles And Risk · All types, answers revealed
When designing a defense-in-depth strategy, which layer should be addressed first as the primary boundary between internal and external networks?
The DMZ acts as the initial buffer zone.
Why this answer
The perimeter network (DMZ) is the first line of defense that separates the internal network from untrusted public networks.
An analyst is setting up a new firewall. The policy dictates that all traffic is blocked unless explicitly permitted. What principle is being followed?
Default Deny is the standard for secure firewall configuration.
Why this answer
Default Deny (or Least Privilege) ensures that traffic not specifically allowed is prohibited by default.
An analyst is assessing the 'Availability' of a database. Which scenario represents a threat to availability?
DDoS renders systems unavailable to legitimate users.
Why this answer
Availability ensures systems are up. A Distributed Denial of Service (DDoS) attack explicitly targets uptime.
Which TWO of the following are considered 'Technical' controls?
Software/hardware control.
Why this answer
Technical controls (logical controls) are implemented via software, hardware, or firmware.
Which TWO of the following are core components of the CIA Triad?
One of the three pillars.
Why this answer
The CIA Triad stands for Confidentiality, Integrity, and Availability.
You are implementing ISO 27001 Annex A controls. Which control category would contain requirements for physical access to the server room?
This covers building and hardware security.
Why this answer
Physical and Environmental Security is the domain within ISO 27001 that covers physical site security.
Which document outlines the formal commitment of top management to support information security objectives?
The ISP is the top-level governance document.
Why this answer
The Information Security Policy (ISP) is the foundational document signed by management showing their commitment and authority.
You are reviewing a cloud architecture against the NIST 800-53 control catalog. Which control family would you reference for incidents involving unauthorized data exfiltration?
IR controls specifically address handling security incidents.
Why this answer
Incident Response (IR) is the specific NIST 800-53 family governing the response to security incidents.
Which TWO of the following are examples of 'Detection' capabilities in the NIST CSF?
Monitors and detects events.
Why this answer
Detection focus on identifying anomalies and security events continuously.
Which security framework is most commonly used by US federal agencies to manage security controls?
This is the standard for federal agencies.
Why this answer
NIST SP 800-53 is the mandatory security control catalog for US federal information systems.
You are performing STRIDE threat modeling on a new web application. A developer asks how to mitigate a 'Tampering' threat identified during the design phase. Which control is most effective?
Hashing and signatures ensure data integrity, preventing tampering.
Why this answer
Tampering threats involve unauthorized modification of data. Digital signatures and integrity checks ensure that data has not been altered.
You are performing a quantitative risk assessment. The SLE (Single Loss Expectancy) is $10,000, and the ARO (Annualized Rate of Occurrence) is 0.5. What is the ALE (Annualized Loss Expectancy)?
Calculation is correct.
Why this answer
ALE = SLE * ARO. $10,000 * 0.5 = $5,000.
A security analyst is mapping organizational assets to the NIST Cybersecurity Framework. Which category is specifically responsible for maintaining the resilience of critical infrastructure?
Recover includes recovery planning and resilience improvements.
Why this answer
The NIST CSF Core consists of five functions: Identify, Protect, Detect, Respond, and Recover. Recover is the function focused on resilience and restoring capabilities.
Which THREE items are typically included in a formal Risk Register?
Critical for tracking progress.
Why this answer
A risk register tracks risks, including their probability, impact, and mitigation status.
Which TWO elements should be included when performing threat modeling using the STRIDE methodology?
Necessary to trace attack vectors.
Why this answer
STRIDE focuses on identifying threats based on specific categories like Spoofing and Information Disclosure.
You are utilizing the MITRE ATT&CK framework to document an incident. Which object represents the 'what' of the attack, such as the specific software or tool used?
Software represents the tools or malware used.
Why this answer
The 'Software' object in MITRE ATT&CK describes the tools used by adversaries to perform techniques.
A security analyst is reviewing access logs and notices a user with 'Administrator' rights performing daily data entry. Which principle is being violated?
The user has excessive privileges for their tasks.
Why this answer
The principle of Least Privilege dictates that users should only have the minimum level of access required to perform their job functions.
In a FAIR (Factor Analysis of Information Risk) model, what is the 'Loss Event Frequency' composed of?
FAIR specifically defines this relationship.
Why this answer
FAIR defines Loss Event Frequency as the combination of Threat Event Frequency and Vulnerability (the probability that a threat event results in a loss).
What is the primary objective of a 'Business Impact Analysis' (BIA)?
BIA prioritizes processes based on impact.
Why this answer
The BIA identifies the potential consequences of disruption to business functions and processes.
Which TWO of the following are primary functions of an Information Security Governance program?
Aligns security with business objectives.
Why this answer
Governance ensures security aligns with business goals and manages risk effectively.
During threat modeling, you identify that an adversary could impersonate a service account. Which control is most effective against this?
mTLS ensures both sides of the connection are authenticated.
Why this answer
Mutual TLS (mTLS) or strong service-to-service authentication prevents impersonation by verifying the identity of both sides.
Which role is primarily responsible for classifying data based on its value and sensitivity to the organization?
The Data Owner is accountable for data classification.
Why this answer
The Data Owner is the individual responsible for determining the classification and appropriate protection levels for data.
An organization is updating its BCP plan. Which step in the risk assessment process should occur immediately after identifying the critical assets?
Threats must be identified against the specific assets found.
Why this answer
After identifying assets, the next logical step is to identify the threats that could impact those specific assets.
Which THREE controls are considered effective 'Administrative' controls according to the NIST framework?
A policy document is administrative.
Why this answer
Administrative controls are policies, procedures, and management tasks rather than technical or physical hardware.
During a risk assessment using ISO 27001, you identify an unpatched vulnerability in an edge router. Management refuses to apply the patch due to legacy software dependencies. Which risk treatment option are they exercising?
The organization has acknowledged the risk and chosen not to modify the environment.
Why this answer
Risk acceptance is the decision to accept the risk because the cost of mitigation outweighs the potential impact or because business requirements forbid the change.
Which THREE actions are essential to the 'Identify' function of the NIST CSF?
Strategy is a core part of Identify.
Why this answer
Identify covers inventory, risk management, and governance.
Which type of risk assessment approach uses descriptive scales like 'High', 'Medium', and 'Low'?
Qualitative uses descriptive risk levels.
Why this answer
Qualitative risk assessment uses subjective, descriptive ratings rather than numerical financial values.
You are tasked with ensuring the 'Confidentiality' of sensitive data in transit. Which mechanism best satisfies this security principle?
Encryption makes data unreadable to unauthorized parties.
Why this answer
Confidentiality ensures that only authorized parties can access data, which is achieved through encryption.
Which THREE factors are commonly used to calculate risk in a basic qualitative model?
The harm caused to the organization.
Why this answer
Risk is typically defined by the combination of a threat, the vulnerability, and the potential impact.
Ready to test yourself?
Try a timed practice session using only Cybersecurity Principles And Risk questions.