Scenario practice questions

During a risk assessment, a company discovers that its data backup process is incomplete: backups are performed daily but stored onsite without encryption. The risk owner proposes to accept this risk due to low likelihood of a physical breach. Which of the following is the BEST reason to challenge this acceptance?

Trap 1: The risk owner does not have authority to accept risks

Usually risk owners can accept risks within defined thresholds.

Trap 2: Encryption is not required as the facility is secure

This supports acceptance, not challenges it.

Trap 3: The cost of implementing encrypted offsite backups is minimal

Low cost is a reason to mitigate, but not the best challenge to acceptance.

A
The impact of losing both primary and backup data is unacceptably high
A single event (fire, theft) could destroy both data and backup, leading to catastrophic business impact.
B
The risk owner does not have authority to accept risks
Why wrong: Usually risk owners can accept risks within defined thresholds.
C
Encryption is not required as the facility is secure
Why wrong: This supports acceptance, not challenges it.
D
The cost of implementing encrypted offsite backups is minimal
Why wrong: Low cost is a reason to mitigate, but not the best challenge to acceptance.

Question 2mediummultiple choice

An organization is implementing a defense-in-depth strategy. Which of the following is the BEST example of a compensating control?

Trap 1: Encrypting data at rest using AES-256

This is a preventive/deterrent control, not compensating.

Trap 2: Installing a firewall at the network perimeter

This is a preventive control, not compensating.

Trap 3: Conducting quarterly vulnerability scans

This is a detective control, not compensating.

A
Encrypting data at rest using AES-256
Why wrong: This is a preventive/deterrent control, not compensating.
B
Installing a firewall at the network perimeter
Why wrong: This is a preventive control, not compensating.
C
Requiring multi-factor authentication for remote access where strong passwords are not feasible
Multi-factor authentication compensates for the inability to enforce strong passwords.
D
Conducting quarterly vulnerability scans
Why wrong: This is a detective control, not compensating.

Question 3easymultiple choice

Which type of incident response exercise involves a facilitated discussion of a hypothetical scenario to review plans and procedures?

Trap 1: Full-scale exercise

Full-scale involves actual resources and mobilization, not just discussion.

Trap 2: Simulation

Simulations involve realistic, often technical, environments, not just discussion.

Trap 3: Drill

A drill is a supervised training activity involving specific actions, not just discussion.

A
Full-scale exercise
Why wrong: Full-scale involves actual resources and mobilization, not just discussion.
B
Simulation
Why wrong: Simulations involve realistic, often technical, environments, not just discussion.
C
Drill
Why wrong: A drill is a supervised training activity involving specific actions, not just discussion.
D
Tabletop exercise
Tabletop exercises are discussion-based and used to validate plans and procedures.

Question 4mediummultiple choice

A security analyst detects a series of failed login attempts followed by a successful login from an unusual geographic location. The account is a standard user account. Which incident category best describes this scenario?

Trap 1: Data breach

Data breach involves exfiltration of data; this scenario only shows unauthorized access.

Trap 2: Supply chain attack

Supply chain attack involves compromising a vendor or partner, not directly a user account.

Trap 3: Insider threat

Insider threat involves malicious or unintentional actions by an employee, not external credential use.

A
Data breach
Why wrong: Data breach involves exfiltration of data; this scenario only shows unauthorized access.
B
Supply chain attack
Why wrong: Supply chain attack involves compromising a vendor or partner, not directly a user account.
C
Insider threat
Why wrong: Insider threat involves malicious or unintentional actions by an employee, not external credential use.
D
Account compromise
The pattern of failed logins followed by a success from a new location indicates compromised credentials.

Question 5hardmultiple choice

A security analyst discovers that an employee's credentials were used to access a sensitive database containing customer PII. The analyst immediately disables the account and begins remediation. Which incident category best describes this scenario?

Trap 1: Data breach

Data breach is confirmed only if data is exfiltrated; this is an access incident.

Trap 2: Physical security

There is no physical security element.

Trap 3: Insider threat

The scenario does not indicate the employee is an insider; credentials could be stolen by an external actor.

A
Data breach
Why wrong: Data breach is confirmed only if data is exfiltrated; this is an access incident.
B
Physical security
Why wrong: There is no physical security element.
C
Account compromise
The key action is unauthorized use of credentials, which is account compromise.
D
Insider threat
Why wrong: The scenario does not indicate the employee is an insider; credentials could be stolen by an external actor.

Question 6mediummultiple choice

An organization's security program has been in place for two years, but recently several security incidents occurred due to lack of user awareness. What is the most likely root cause?

Trap 1: Lack of a security awareness program.

The program exists; the issue is it's not effective, not its absence.

Trap 2: Insufficient budget for security tools.

Budget is a resource issue, not the root cause of awareness failures.

Trap 3: Insufficient firewall rules.

A technical control, not directly related to user awareness.

A
The awareness program is not regularly updated or evaluated for effectiveness.
Continuous improvement is needed; without updates, awareness decays.
B
Lack of a security awareness program.
Why wrong: The program exists; the issue is it's not effective, not its absence.
C
Insufficient budget for security tools.
Why wrong: Budget is a resource issue, not the root cause of awareness failures.
D
Insufficient firewall rules.
Why wrong: A technical control, not directly related to user awareness.

Question 7mediummulti select

Which TWO of the following are key components of a risk assessment report according to best practices? (Choose two.)

Trap 1: Vendor security assessment ratings

Vendor ratings may be used but are not a required component of a general risk assessment report.

Trap 2: Detailed results of control testing

Control testing results are typically in a separate audit or control assessment report.

Trap 3: Complete asset inventory

Asset inventory is a prerequisite but not part of the risk assessment report itself.

A
Vendor security assessment ratings
Why wrong: Vendor ratings may be used but are not a required component of a general risk assessment report.
B
Risk scenarios with likelihood and impact ratings
Risk scenarios with assessments are central to a risk assessment report.
C
Detailed results of control testing
Why wrong: Control testing results are typically in a separate audit or control assessment report.
D
Risk treatment recommendations
The report should propose actions to manage identified risks.
E
Complete asset inventory
Why wrong: Asset inventory is a prerequisite but not part of the risk assessment report itself.

Question 8easymultiple choice

An organization is determining the risk treatment for a critical business process that has a high inherent risk. Which of the following is the MOST effective risk treatment strategy when the cost to mitigate exceeds the potential loss?

Trap 1: Risk avoidance

Avoiding the risk entirely may not be practical for a critical business process.

Trap 2: Risk reduction

Reducing risk would require controls that are not cost-justified.

Trap 3: Risk transfer

Transferring risk via insurance may still have premiums that are not cost-effective.

A
Risk avoidance
Why wrong: Avoiding the risk entirely may not be practical for a critical business process.
B
Risk reduction
Why wrong: Reducing risk would require controls that are not cost-justified.
C
Risk acceptance
Accepting the risk is justified when mitigation costs outweigh potential loss.
D
Risk transfer
Why wrong: Transferring risk via insurance may still have premiums that are not cost-effective.

Question 9hardmultiple choice

A multinational financial institution uses a third-party Managed Security Service Provider (MSSP) for 24/7 monitoring of its security infrastructure. During a targeted attack, the MSSP’s analysts detected anomalous activity on a critical server at 2:00 AM. However, due to the service level agreement (SLA) which allows up to 12 hours for notification of lower-priority incidents, the MSSP classified the incident as medium severity and did not notify the internal incident response team until 2:00 PM. By then, the attacker had exfiltrated sensitive customer data. The internal team is conducting a post-incident review. What is the PRIMARY issue that led to the delay?

Trap 1: The MSSP analysts lacked technical skills to recognize the…

The analysts detected the activity but followed SLA rules; skills are not the primary issue.

Trap 2: The incident severity was incorrectly classified as medium

Even if reclassified, the SLA might still cause delay; the main issue is the SLA duration.

Trap 3: The internal incident response team was not available until 2:00 PM

The team could have been called earlier if the SLA permitted.

A
The MSSP analysts lacked technical skills to recognize the incident's true severity
Why wrong: The analysts detected the activity but followed SLA rules; skills are not the primary issue.
B
The incident severity was incorrectly classified as medium
Why wrong: Even if reclassified, the SLA might still cause delay; the main issue is the SLA duration.
C
The internal incident response team was not available until 2:00 PM
Why wrong: The team could have been called earlier if the SLA permitted.
D
The SLA for notification of medium-severity incidents was too long
The SLA allowed a 12-hour delay which was exploited by the attacker.

Question 10hardmultiple choice

Based on the log entries, what is the most likely scenario?

Exhibit

Refer to the exhibit.
Exhibit:
```
2024-11-20T15:23:45Z [SRV-DB01] [sshd] Failed password for root from 192.168.1.105 port 22 ssh2
2024-11-20T15:23:47Z [SRV-DB01] [sshd] Failed password for root from 192.168.1.105 port 22 ssh2
2024-11-20T15:23:49Z [SRV-DB01] [sshd] Failed password for root from 192.168.1.105 port 22 ssh2
2024-11-20T15:23:51Z [SRV-DB01] [sshd] Failed password for root from 192.168.1.105 port 22 ssh2
2024-11-20T15:23:53Z [SRV-DB01] [sshd] Failed password for root from 192.168.1.105 port 22 ssh2
```

Trap 1: A remote code execution attempt

The logs show authentication failures, not signs of code execution.

Trap 2: A legitimate user repeatedly mistyping their password

The rapid 2-second intervals are more consistent with automated guessing than a human error.

Trap 3: A misconfiguration causing duplicate log entries

Duplicate entries would show identical timestamps, not a pattern of repeated attempts.

A
A brute-force attack against the root account
Multiple failed attempts in quick succession for the same account and IP is classic brute-force behavior.
B
A remote code execution attempt
Why wrong: The logs show authentication failures, not signs of code execution.
C
A legitimate user repeatedly mistyping their password
Why wrong: The rapid 2-second intervals are more consistent with automated guessing than a human error.
D
A misconfiguration causing duplicate log entries
Why wrong: Duplicate entries would show identical timestamps, not a pattern of repeated attempts.

Question 11hardmultiple choice

During an internal audit, it is discovered that business units frequently purchase cloud services without involving the IT security department. Which governance deficiency does this scenario most clearly demonstrate?

Trap 1: Inadequate security awareness training

Training might help but does not address the process gap.

Trap 2: Lack of an incident response plan

Incident response is separate from the procurement process.

Trap 3: Weak access control over cloud resources

Access controls may be weak, but the fundamental issue is the governance process.

A
Inadequate security awareness training
Why wrong: Training might help but does not address the process gap.
B
Lack of an incident response plan
Why wrong: Incident response is separate from the procurement process.
C
Absence of a procurement security policy
A procurement policy should require security review before purchasing cloud services.
D
Weak access control over cloud resources
Why wrong: Access controls may be weak, but the fundamental issue is the governance process.

Question 12hardmultiple choice

During a merger, the acquiring company's board insists on integrating the target company's information security governance into its own within 90 days. However, the target has a significantly different risk culture and lacks documented policies. What is the most critical governance risk in this scenario?

Trap 1: The acquiring company's security team may lack the capacity to…

Training is important but not the most critical governance risk at this stage.

Trap 2: The target's employees may resist the new security culture.

Culture is a concern but the most critical risk is accepting unknown risks.

Trap 3: There will be insufficient time to develop new security policies…

Policies can be adapted later; the immediate risk is unknown risks.

A
The acquiring company's security team may lack the capacity to train the target's staff.
Why wrong: Training is important but not the most critical governance risk at this stage.
B
The target's employees may resist the new security culture.
Why wrong: Culture is a concern but the most critical risk is accepting unknown risks.
C
The acquiring company may inadvertently accept unknown high-risk exposures.
Rushing integration without understanding the target's risk posture can lead to severe exposure.
D
There will be insufficient time to develop new security policies for the combined entity.
Why wrong: Policies can be adapted later; the immediate risk is unknown risks.