Scenario practice questions

Based on the exhibit, what is the MOST likely scenario?

Exhibit

Refer to the exhibit.

Exhibit:

Event Log Entry:
Time: 2023-10-05 14:23:17
Event ID: 4625
Source: Security
User: SYSTEM
Logon Type: 3
Account Name: jdoe
Account Domain: CORP
Failure Reason: Unknown user name or bad password.
Workstation Name: WS-001
IP Address: 192.168.1.50

Event Log Entry:
Time: 2023-10-05 14:24:05
Event ID: 4624
Source: Security
User: SYSTEM
Logon Type: 3
Account Name: jdoe
Account Domain: CORP
Workstation Name: WS-001
IP Address: 192.168.1.50

Event Log Entry:
Time: 2023-10-05 14:25:10
Event ID: 4648
Source: Security
User: jdoe
Logon Type: 2
Account Name: jdoe
Account Domain: CORP
Target Server: FILE-SRV-01
Additional Info: A logon was attempted using explicit credentials.
Workstation Name: WS-001
IP Address: 192.168.1.50

Trap 1: A user is performing a scheduled task that requires authentication.

A scheduled task authenticates non-interactively, so it cannot produce the interactive sign-in pattern shown in the exhibit. This option is tempting because scheduled tasks genuinely generate authentication events, and they would be the right answer if the log showed a service account signing in silently at a fixed interval.

Trap 2: A user forgot their password and successfully logged in after…

A forgotten password followed by a successful retry would show repeated failed authentications from one account, then a success — not the exhibit's pattern. This option is tempting because password-reset lockouts are common helpdesk events, and retry-then-success genuinely fits a single-user mistake scenario, but the exhibit's evidence points elsewhere.

Trap 3: A system administrator is testing password policies.

A password-policy test would generate lockout and reset events, not the exhibit's pattern of privileged role assignments followed by resource creation across subscriptions. Policy testing is legitimate when validating complexity, expiry or lockout thresholds in a lab tenant. Here the sequence indicates credential compromise and privilege escalation, not policy validation.

A
A user is performing a scheduled task that requires authentication.
Why it fails: A scheduled task authenticates non-interactively, so it cannot produce the interactive sign-in pattern shown in the exhibit. This option is tempting because scheduled tasks genuinely generate authentication events, and they would be the right answer if the log showed a service account signing in silently at a fixed interval.
B
A user forgot their password and successfully logged in after retrying.
Why it fails: A forgotten password followed by a successful retry would show repeated failed authentications from one account, then a success — not the exhibit's pattern. This option is tempting because password-reset lockouts are common helpdesk events, and retry-then-success genuinely fits a single-user mistake scenario, but the exhibit's evidence points elsewhere.
C
An attacker brute-forced the password and then used the credentials to access a file server.
Repeated failed authentications followed by a successful logon and subsequent file-server access match credential brute forcing: the attacker guesses the password, then uses the valid account to reach data. The sequence links authentication abuse directly to the file access.
D
A system administrator is testing password policies.
Why it fails: A password-policy test would generate lockout and reset events, not the exhibit's pattern of privileged role assignments followed by resource creation across subscriptions. Policy testing is legitimate when validating complexity, expiry or lockout thresholds in a lab tenant. Here the sequence indicates credential compromise and privilege escalation, not policy validation.

Question 2mediummultiple choice

During a risk assessment, a company discovers that its data backup process is incomplete: backups are performed daily but stored onsite without encryption. The risk owner proposes to accept this risk due to low likelihood of a physical breach. Which of the following is the BEST reason to challenge this acceptance?

Trap 1: The risk owner does not have authority to accept risks

Authority is a governance formality, not the substantive reason the acceptance is unsound; the risk owner may well hold delegated authority. It is tempting because risk acceptance must sit with an authorised owner, which would be the correct challenge if the proposal came from someone without that delegation.

Trap 2: Encryption is not required as the facility is secure

A secure facility does not address the incomplete backup process, and asserting encryption is unnecessary contradicts the finding. It is tempting because physical controls can reduce likelihood of theft, which would be the correct argument only if the assessment had already accepted that residual risk with documented compensating controls.

Trap 3: The cost of implementing encrypted offsite backups is minimal

Cost is a financial consideration, not the basis for challenging a risk acceptance; low cost does not itself invalidate the owner's decision. It is tempting because cost-benefit analysis legitimately informs treatment decisions, and minimal cost would be the correct argument when justifying remediation over acceptance.

A
The impact of losing both primary and backup data is unacceptably high
Unencrypted onsite backups create correlated loss: a single physical event destroys primary and backup data together. That catastrophic availability and confidentiality impact outweighs the low likelihood the risk owner cites, so acceptance cannot be justified without encryption or offsite copies.
B
The risk owner does not have authority to accept risks
Why it fails: Authority is a governance formality, not the substantive reason the acceptance is unsound; the risk owner may well hold delegated authority. It is tempting because risk acceptance must sit with an authorised owner, which would be the correct challenge if the proposal came from someone without that delegation.
C
Encryption is not required as the facility is secure
Why it fails: A secure facility does not address the incomplete backup process, and asserting encryption is unnecessary contradicts the finding. It is tempting because physical controls can reduce likelihood of theft, which would be the correct argument only if the assessment had already accepted that residual risk with documented compensating controls.
D
The cost of implementing encrypted offsite backups is minimal
Why it fails: Cost is a financial consideration, not the basis for challenging a risk acceptance; low cost does not itself invalidate the owner's decision. It is tempting because cost-benefit analysis legitimately informs treatment decisions, and minimal cost would be the correct argument when justifying remediation over acceptance.

Question 3hardmulti select

An incident response team is analyzing a phishing email that successfully compromised a user's credentials. Which TWO indicators of compromise (IOCs) should the team prioritize collecting? (Choose two.)

Trap 1: The user's browser history.

Browser history records the user's own web activity, not artefacts left by the phishing message or the credential theft. It would be relevant when investigating browsing behaviour or a suspected malicious website visit, not for extracting sender, header or URL indicators.

Trap 2: The user's personal phone number.

A personal phone number is not an IOC from the phishing email or the credential compromise, and collecting it raises privacy concerns. It would matter only if the attacker used smishing or voice phishing as the initial vector, which the stem does not describe.

Trap 3: The company's public website.

The public website is the organisation's own externally hosted content and carries no evidence of the phishing message or stolen credentials. It would be examined during defacement or web-application compromise investigations, not for harvesting email-borne indicators.

A
The user's browser history.
Why it fails: Browser history records the user's own web activity, not artefacts left by the phishing message or the credential theft. It would be relevant when investigating browsing behaviour or a suspected malicious website visit, not for extracting sender, header or URL indicators.
B
The IP address of the sending server.
The sending server's IP address is a network-based indicator enabling blocking at perimeter controls and correlation with other phishing campaigns. It supports rapid containment, letting the team trace infrastructure used to deliver the credential-harvesting message and identify related inbound threats.
C
The malicious URL or attachment hash.
The malicious URL and attachment hash are directly actionable, enabling blocking at email and web gateways plus threat-intelligence lookups. These artefacts satisfy the prioritisation constraint because they are rapidly shareable and directly tied to the phishing delivery mechanism.
D
The user's personal phone number.
Why it fails: A personal phone number is not an IOC from the phishing email or the credential compromise, and collecting it raises privacy concerns. It would matter only if the attacker used smishing or voice phishing as the initial vector, which the stem does not describe.
E
The company's public website.
Why it fails: The public website is the organisation's own externally hosted content and carries no evidence of the phishing message or stolen credentials. It would be examined during defacement or web-application compromise investigations, not for harvesting email-borne indicators.

Question 4mediummulti select

Which TWO of the following are essential components of an incident response (IR) plan? (Select TWO)

Trap 1: Vendor risk assessment reports

Vendor risk assessments feed third-party risk management, not incident response planning. They are correct when evaluating supplier security posture, but an IR plan needs escalation contacts, roles, and containment and recovery procedures rather than procurement due-diligence artefacts.

Trap 2: Detailed network architecture diagrams

Network diagrams support preparation and impact assessment but are reference material, not an essential IR plan component. They belong in architecture documentation; an IR plan requires defined roles, communication paths, and phased procedures for detection, containment, eradication and recovery.

Trap 3: Playbook for ransomware incidents

A ransomware playbook is a valuable scenario-specific annex, but the question asks for essential components present in every IR plan. Playbooks are the right choice when building response runbooks for named threats; the core plan needs generic phases, roles and communication procedures.

A
Vendor risk assessment reports
Why it fails: Vendor risk assessments feed third-party risk management, not incident response planning. They are correct when evaluating supplier security posture, but an IR plan needs escalation contacts, roles, and containment and recovery procedures rather than procurement due-diligence artefacts.
B
Detailed network architecture diagrams
Why it fails: Network diagrams support preparation and impact assessment but are reference material, not an essential IR plan component. They belong in architecture documentation; an IR plan requires defined roles, communication paths, and phased procedures for detection, containment, eradication and recovery.
C
Communication templates
Pre-approved communication templates let the IR team notify stakeholders, regulators and customers quickly and consistently during a high-pressure incident, satisfying the plan's requirement for defined escalation and messaging procedures rather than improvising statements under time pressure.
D
Playbook for ransomware incidents
Why it fails: A ransomware playbook is a valuable scenario-specific annex, but the question asks for essential components present in every IR plan. Playbooks are the right choice when building response runbooks for named threats; the core plan needs generic phases, roles and communication procedures.
E
IR team roster and contact list
A current IR team roster with contact details ensures the right responders can be reached immediately, satisfying the plan's need for defined roles, escalation paths and 24/7 reachability so containment is not delayed by hunting for names.

Question 5mediummultiple choice

A security analyst detects unusual outbound network traffic from a database server to an unknown IP address. The traffic uses encrypted connections on port 443. Which type of attack is MOST likely occurring?

Trap 1: SQL injection

SQL injection manipulates database queries through application input, so it manifests as malformed SQL in web requests or database errors, not outbound encrypted traffic from the database server itself. It is tempting because the affected asset is a database, but the traffic direction and encryption indicate data exfiltration rather than query injection.

Trap 2: Ransomware

Ransomware encrypts local files and typically demands payment, generating file-system and shadow-copy anomalies rather than persistent outbound TLS sessions to an unknown IP. It is tempting because ransomware may exfiltrate data, but the observed pattern of regular encrypted beaconing points to command-and-control communication, not encryption of local data.

Trap 3: Denial of service

A denial-of-service attack floods a target to exhaust resources, producing inbound saturation or service unavailability, not sustained outbound encrypted sessions to an unknown external host. DoS is tempting because unusual traffic suggests attack, but beaconing to a command-and-control server over port 443 indicates exfiltration or remote control instead.

A
Data exfiltration
Encrypted outbound sessions on port 443 to an unknown external address let attackers tunnel stolen data past inspection that would flag plaintext transfers. This covert channel from a database server is the classic signature of data exfiltration.
B
SQL injection
Why it fails: SQL injection manipulates database queries through application input, so it manifests as malformed SQL in web requests or database errors, not outbound encrypted traffic from the database server itself. It is tempting because the affected asset is a database, but the traffic direction and encryption indicate data exfiltration rather than query injection.
C
Ransomware
Why it fails: Ransomware encrypts local files and typically demands payment, generating file-system and shadow-copy anomalies rather than persistent outbound TLS sessions to an unknown IP. It is tempting because ransomware may exfiltrate data, but the observed pattern of regular encrypted beaconing points to command-and-control communication, not encryption of local data.
D
Denial of service
Why it fails: A denial-of-service attack floods a target to exhaust resources, producing inbound saturation or service unavailability, not sustained outbound encrypted sessions to an unknown external host. DoS is tempting because unusual traffic suggests attack, but beaconing to a command-and-control server over port 443 indicates exfiltration or remote control instead.

Question 6mediummultiple choice

A security analyst detects a series of failed login attempts followed by a successful login from an unusual geographic location. The account is a standard user account. Which incident category best describes this scenario?

Trap 1: Data breach

A data breach requires confirmed unauthorised access to or exfiltration of data; this scenario shows only anomalous authentication, with no evidence any data was accessed. It tempts because compromised credentials often precede a breach, but the incident category here is the intrusion attempt itself, not data loss.

Trap 2: Supply chain attack

Compromised credentials, not supply chain compromise, describes failed logins followed by a successful login from an unusual location. Supply chain attack is tempting because it also involves unauthorised access, and would be correct if a trusted vendor or software update had introduced the compromise.

Trap 3: Insider threat

Insider threat requires a trusted internal actor misusing legitimate access, yet the anomaly here is an external-looking login from an unusual geographic location, which points to compromised credentials rather than an insider. It tempts because a standard user account was abused, but the source and pattern indicate external intrusion.

A
Data breach
Why it fails: A data breach requires confirmed unauthorised access to or exfiltration of data; this scenario shows only anomalous authentication, with no evidence any data was accessed. It tempts because compromised credentials often precede a breach, but the incident category here is the intrusion attempt itself, not data loss.
B
Supply chain attack
Why it fails: Compromised credentials, not supply chain compromise, describes failed logins followed by a successful login from an unusual location. Supply chain attack is tempting because it also involves unauthorised access, and would be correct if a trusted vendor or software update had introduced the compromise.
C
Insider threat
Why it fails: Insider threat requires a trusted internal actor misusing legitimate access, yet the anomaly here is an external-looking login from an unusual geographic location, which points to compromised credentials rather than an insider. It tempts because a standard user account was abused, but the source and pattern indicate external intrusion.
D
Account compromise
Failed logins followed by a successful login from an unusual location indicate credentials were obtained and used by an unauthorised party, which is account compromise. Brute force alone would show only failures; this pattern confirms access succeeded.

Question 7mediummulti select

Which TWO regulations are MOST likely to impact an organization that processes credit card payments and handles personal data of EU residents?

Trap 1: HIPAA

HIPAA governs protected health information held by US healthcare entities, so it does not address card payment data or EU residents' personal data. It is tempting because it is a well-known privacy regulation, but it would be correct only for an organisation handling medical records rather than payments.

Trap 2: SOX

SOX mandates financial reporting controls for US-listed companies, so it does not regulate card payment processing or EU personal data. It is tempting as a recognised compliance framework, but it would be the right answer only where the scenario concerned public-company financial disclosures and audit controls.

Trap 3: CCPA

CCPA grants rights to California residents over their personal information, so it does not cover EU residents or card payment data. It is tempting as a comparable privacy law, but it would be correct only where the organisation handled personal data of California consumers rather than EU data subjects.

A
HIPAA
Why it fails: HIPAA governs protected health information held by US healthcare entities, so it does not address card payment data or EU residents' personal data. It is tempting because it is a well-known privacy regulation, but it would be correct only for an organisation handling medical records rather than payments.
B
SOX
Why it fails: SOX mandates financial reporting controls for US-listed companies, so it does not regulate card payment processing or EU personal data. It is tempting as a recognised compliance framework, but it would be the right answer only where the scenario concerned public-company financial disclosures and audit controls.
C
GDPR
GDPR governs the processing of EU residents' personal data, imposing lawful-basis, breach-notification and data-subject rights obligations. Because the organisation handles such data, GDPR applies directly, satisfying the stem's EU personal-data constraint alongside the separate payment card regime.
D
CCPA
Why it fails: CCPA grants rights to California residents over their personal information, so it does not cover EU residents or card payment data. It is tempting as a comparable privacy law, but it would be correct only where the organisation handled personal data of California consumers rather than EU data subjects.
E
PCI DSS
PCI DSS is mandatory for any entity storing, processing or transmitting cardholder data, so it directly governs the credit card payment processing described. It imposes prescriptive controls — encryption, access restriction, logging — that the organisation must evidence during annual assessments, making it one of the two most likely regulatory impacts.

Question 8hardmultiple choice

After a major security incident, the board of directors requests a review of the information security program. Which of the following metrics would be MOST useful to demonstrate the effectiveness of the program over the past year?

Trap 1: Percentage of employees who completed security awareness training

Training completion counts attendance, not reduced risk behaviour or incident outcomes, so it cannot evidence programme effectiveness. It is useful for tracking awareness campaign reach. Demonstrating effectiveness over a year requires metrics tied to incident frequency, response times or control failures.

Trap 2: Total cost of security investments compared to industry benchmarks

Spend against benchmarks measures investment, not whether controls reduced risk or incident impact, so it cannot evidence programme effectiveness. It is tempting because budgeting comparisons suit board-level reporting, and would be the right metric when justifying security funding or benchmarking spend against peers.

Trap 3: Number of vulnerabilities identified in the latest penetration test

A single penetration test's vulnerability count is a point-in-time technical snapshot, not a year-long measure of programme performance or risk reduction. It is tempting because penetration testing genuinely evidences control weaknesses, and would be correct when validating a specific system's defences before go-live.

A
Percentage of employees who completed security awareness training
Why it fails: Training completion counts attendance, not reduced risk behaviour or incident outcomes, so it cannot evidence programme effectiveness. It is useful for tracking awareness campaign reach. Demonstrating effectiveness over a year requires metrics tied to incident frequency, response times or control failures.
B
Number of security incidents detected and contained within defined SLAs
Tracking incidents detected and contained within defined SLAs demonstrates the programme's operational effectiveness, showing both detection capability and response maturity over the year. This metric directly evidences whether controls and processes function as intended, which is what the board needs to assess programme performance.
C
Total cost of security investments compared to industry benchmarks
Why it fails: Spend against benchmarks measures investment, not whether controls reduced risk or incident impact, so it cannot evidence programme effectiveness. It is tempting because budgeting comparisons suit board-level reporting, and would be the right metric when justifying security funding or benchmarking spend against peers.
D
Number of vulnerabilities identified in the latest penetration test
Why it fails: A single penetration test's vulnerability count is a point-in-time technical snapshot, not a year-long measure of programme performance or risk reduction. It is tempting because penetration testing genuinely evidences control weaknesses, and would be correct when validating a specific system's defences before go-live.

Question 9easymultiple choice

Which type of incident response exercise involves a facilitated discussion of a hypothetical scenario to review plans and procedures?

Trap 1: Full-scale exercise

A full-scale exercise mobilises actual resources and personnel in real time, so it validates operational readiness rather than reviewing plans through facilitated discussion. It is tempting because full-scale exercises provide the strongest assurance of response capability, making them the right choice when the goal is to test execution under realistic conditions.

Trap 2: Simulation

A simulation exercises response actions in a simulated environment, so it tests execution rather than reviewing plans through discussion. It is tempting because simulations validate procedures under realistic conditions, which is the right choice when the objective is to rehearse and assess team performance rather than simply review documentation.

Trap 3: Drill

A drill is a narrow, often unannounced test of one specific response procedure, such as a call-tree activation. A facilitated discussion of a hypothetical scenario reviewing plans and procedures is a tabletop exercise, which is the correct answer.

A
Full-scale exercise
Why it fails: A full-scale exercise mobilises actual resources and personnel in real time, so it validates operational readiness rather than reviewing plans through facilitated discussion. It is tempting because full-scale exercises provide the strongest assurance of response capability, making them the right choice when the goal is to test execution under realistic conditions.
B
Simulation
Why it fails: A simulation exercises response actions in a simulated environment, so it tests execution rather than reviewing plans through discussion. It is tempting because simulations validate procedures under realistic conditions, which is the right choice when the objective is to rehearse and assess team performance rather than simply review documentation.
C
Drill
Why it fails: A drill is a narrow, often unannounced test of one specific response procedure, such as a call-tree activation. A facilitated discussion of a hypothetical scenario reviewing plans and procedures is a tabletop exercise, which is the correct answer.
D
Tabletop exercise
A tabletop exercise gathers stakeholders for a facilitated discussion of a hypothetical scenario, walking through plans and procedures without deploying systems or simulating live traffic. This format directly satisfies the stem's requirement for a discussion-based review, distinguishing it from functional or full-scale exercises that test operational response.

Question 10mediummultiple choice

A security manager is selecting a controls framework for a new organization. Which framework provides the most granular control families and is widely used for US federal agencies?

Trap 1: CIS Controls v8

CIS Controls v8 provides 18 prioritised safeguards, not granular control families, and carries no US federal mandate. It is tempting because its implementation groups give small teams a pragmatic starting sequence, which suits organisations lacking the resources to adopt a full federal catalogue.

Trap 2: ISO 27001 Annex A

ISO 27001 Annex A lists 93 controls in four themes, far fewer and less granular than NIST SP 800-53's control families, and it is an international standard rather than a US federal mandate. It is tempting because certification to it demonstrates a working ISMS, which suits commercial assurance.

Trap 3: COBIT 2019

COBIT 2019 is a governance and management framework for enterprise IT, not a catalogue of granular control families, and it is not the US federal standard. It is tempting because it maps well to audit and board-level oversight, where aligning IT objectives with business goals is the actual requirement.

A
CIS Controls v8
Why it fails: CIS Controls v8 provides 18 prioritised safeguards, not granular control families, and carries no US federal mandate. It is tempting because its implementation groups give small teams a pragmatic starting sequence, which suits organisations lacking the resources to adopt a full federal catalogue.
B
ISO 27001 Annex A
Why it fails: ISO 27001 Annex A lists 93 controls in four themes, far fewer and less granular than NIST SP 800-53's control families, and it is an international standard rather than a US federal mandate. It is tempting because certification to it demonstrates a working ISMS, which suits commercial assurance.
C
NIST SP 800-53
NIST SP 800-53 provides granular control families and is mandated for US federal agencies, satisfying the stem's federal and granularity constraints. Its catalogue spans 20 control families with detailed enhancements, exceeding ISO 27002's breadth and CIS Controls' prioritised subset.
D
COBIT 2019
Why it fails: COBIT 2019 is a governance and management framework for enterprise IT, not a catalogue of granular control families, and it is not the US federal standard. It is tempting because it maps well to audit and board-level oversight, where aligning IT objectives with business goals is the actual requirement.

Question 11easymultiple choice

An organization is determining the risk treatment for a critical business process that has a high inherent risk. Which of the following is the MOST effective risk treatment strategy when the cost to mitigate exceeds the potential loss?

Trap 1: Risk avoidance

Avoidance eliminates the process entirely, which is impractical for a critical business process that must continue operating. It is tempting because avoidance removes the risk outright, and it would be correct for an activity whose loss is tolerable or which can be discontinued without disrupting essential operations.

Trap 2: Risk reduction

Reduction applies controls to lower likelihood or impact, but the stem states mitigation costs exceed the potential loss, so the expenditure is unjustified. It is tempting because reduction is the default treatment for high inherent risk, and it would be correct where control cost is proportionate to the loss being prevented.

Trap 3: Risk transfer

Transferring risk via insurance or contracts leaves the loss exposure with the organization when the loss is not fully indemnified, and the stem asks for treatment of a high inherent risk where mitigation cost exceeds potential loss. Transfer suits low-frequency, high-severity losses that are insurable.

A
Risk avoidance
Why it fails: Avoidance eliminates the process entirely, which is impractical for a critical business process that must continue operating. It is tempting because avoidance removes the risk outright, and it would be correct for an activity whose loss is tolerable or which can be discontinued without disrupting essential operations.
B
Risk reduction
Why it fails: Reduction applies controls to lower likelihood or impact, but the stem states mitigation costs exceed the potential loss, so the expenditure is unjustified. It is tempting because reduction is the default treatment for high inherent risk, and it would be correct where control cost is proportionate to the loss being prevented.
C
Risk acceptance
Risk acceptance is appropriate because the mitigation cost exceeds the potential loss, making further controls economically unjustifiable. The organization formally acknowledges the residual risk and retains it, satisfying the stem's cost-benefit constraint. Senior management must approve this decision, and the risk should be monitored and reviewed periodically in case the inherent risk profile changes.
D
Risk transfer
Why it fails: Transferring risk via insurance or contracts leaves the loss exposure with the organization when the loss is not fully indemnified, and the stem asks for treatment of a high inherent risk where mitigation cost exceeds potential loss. Transfer suits low-frequency, high-severity losses that are insurable.

Question 12hardmultiple choice

You are the CISM for a mid-sized e-commerce company that processes credit card transactions. The company recently experienced a security incident where an attacker exploited a vulnerability in the web application to gain access to the customer database containing payment card information. The incident response team contained the breach, but the root cause analysis revealed that the vulnerability had been identified in a penetration test six months ago but was not remediated due to competing priorities. The company's risk management framework defines risk appetite as 'moderate' for information security risks. The board is concerned and has asked you to recommend improvements to prevent recurrence. The company has a limited budget and cannot implement all possible controls. Current environment: web application developed in-house, hosted on-premises, with a mix of virtual and physical servers. The security team consists of three people responsible for monitoring, incident response, and vulnerability management. The development team follows an agile methodology with bi-weekly sprints. The company has cyber liability insurance that covers breach response costs up to $2 million. Based on this scenario, what is the most effective course of action?

Trap 1: Hire two additional security analysts to improve monitoring and…

Adding analysts expands monitoring capacity but leaves the unremediated-vulnerability workflow unchanged, so the same penetration-test finding could again be deferred. It is tempting because the team of three is stretched, and extra headcount would be the right answer if the root cause had been missed detection rather than ignored remediation.

Trap 2: Increase cyber liability insurance coverage to $5 million to cover…

Higher insurance transfers financial loss after an incident; it does not remediate the vulnerability or reduce recurrence likelihood. It is tempting because the board fears breach costs, and increased cover would be correct if residual risk exceeded the moderate appetite after all reasonable controls were implemented.

Trap 3: Rewrite the web application using a secure development framework to…

Rewriting the application consumes the limited budget and delays remediation for months, while the identified vulnerability needed fixing now. It is tempting because insecure code caused the breach, and a secure development framework would be correct for a new application or major redesign, not for closing a known finding.

A
Hire two additional security analysts to improve monitoring and incident response.
Why it fails: Adding analysts expands monitoring capacity but leaves the unremediated-vulnerability workflow unchanged, so the same penetration-test finding could again be deferred. It is tempting because the team of three is stretched, and extra headcount would be the right answer if the root cause had been missed detection rather than ignored remediation.
B
Implement a formal vulnerability management program with defined remediation SLAs based on risk severity.
Formal vulnerability management with risk-based remediation SLAs directly fixes the root cause: a known penetration-test finding left unremediated. Defined SLAs force prioritisation against competing work, matching the moderate risk appetite and the three-person team's limited capacity.
C
Increase cyber liability insurance coverage to $5 million to cover potential breach costs.
Why it fails: Higher insurance transfers financial loss after an incident; it does not remediate the vulnerability or reduce recurrence likelihood. It is tempting because the board fears breach costs, and increased cover would be correct if residual risk exceeded the moderate appetite after all reasonable controls were implemented.
D
Rewrite the web application using a secure development framework to eliminate vulnerabilities.
Why it fails: Rewriting the application consumes the limited budget and delays remediation for months, while the identified vulnerability needed fixing now. It is tempting because insecure code caused the breach, and a secure development framework would be correct for a new application or major redesign, not for closing a known finding.

Question 13mediummulti select

Which TWO of the following are key components of a risk assessment report according to best practices? (Choose two.)

Trap 1: Vendor security assessment ratings

Vendor security assessment ratings are third-party due diligence artefacts, not a key component of a risk assessment report, which covers scope, methodology, identified risks, likelihood and impact ratings, and treatment recommendations. It is tempting because vendor risk feeds assessments, and would be correct in a third-party risk report.

Trap 2: Detailed results of control testing

Detailed control testing results belong to an assurance or audit report, not a risk assessment report, which presents identified risks with likelihood, impact, and treatment options. It is tempting because testing evidence supports risk ratings, and would be the correct inclusion in an internal audit or control assurance report.

Trap 3: Complete asset inventory

A complete asset inventory is an input to risk assessment, not a component of the report itself, which documents scope, methodology, risk ratings, and treatment recommendations. It is tempting because asset identification underpins risk analysis, and would be correct in an asset management or inventory report.

A
Vendor security assessment ratings
Why it fails: Vendor security assessment ratings are third-party due diligence artefacts, not a key component of a risk assessment report, which covers scope, methodology, identified risks, likelihood and impact ratings, and treatment recommendations. It is tempting because vendor risk feeds assessments, and would be correct in a third-party risk report.
B
Risk scenarios with likelihood and impact ratings
Risk scenarios with likelihood and impact ratings translate identified threats into structured, comparable entries, letting the report rank exposures objectively. This satisfies the best-practise requirement that a risk assessment report quantify and prioritise risk rather than merely list assets or controls.
C
Detailed results of control testing
Why it fails: Detailed control testing results belong to an assurance or audit report, not a risk assessment report, which presents identified risks with likelihood, impact, and treatment options. It is tempting because testing evidence supports risk ratings, and would be the correct inclusion in an internal audit or control assurance report.
D
Risk treatment recommendations
Risk treatment recommendations convert assessed exposures into actionable response options — mitigate, transfer, avoid or accept — with owners and timeframes. This satisfies the best-practise requirement that the report drive decision-making, not simply describe the current risk landscape.
E
Complete asset inventory
Why it fails: A complete asset inventory is an input to risk assessment, not a component of the report itself, which documents scope, methodology, risk ratings, and treatment recommendations. It is tempting because asset identification underpins risk analysis, and would be correct in an asset management or inventory report.

Question 14mediummultiple choice

An organization has implemented a new web application that processes sensitive customer data. The risk assessment identified a high likelihood of SQL injection attacks due to insufficient input validation. Which of the following is the BEST risk treatment strategy?

Trap 1: Transfer the risk by purchasing cyber insurance

Insurance compensates financial loss after an incident but leaves the insufficient input validation unfixed, so the vulnerability and high likelihood persist. Transfer suits low-frequency, high-severity risks where the exposure cannot be reduced directly, not a known exploitable code defect.

Trap 2: Avoid the risk by discontinuing the web application

Discontinuing the application removes the business capability entirely, which is disproportionate when the flaw is a fixable input-validation defect. Avoidance is correct only when no control can bring the risk within tolerance and the activity is genuinely dispensable.

Trap 3: Accept the risk because the likelihood is low after compensating…

Acceptance is invalid because the stem states high likelihood, and acceptance requires the residual risk to sit within tolerance after treatment. Acceptance is the correct strategy when likelihood and impact are both low, or when treatment cost clearly exceeds the potential loss.

A
Transfer the risk by purchasing cyber insurance
Why it fails: Insurance compensates financial loss after an incident but leaves the insufficient input validation unfixed, so the vulnerability and high likelihood persist. Transfer suits low-frequency, high-severity risks where the exposure cannot be reduced directly, not a known exploitable code defect.
B
Avoid the risk by discontinuing the web application
Why it fails: Discontinuing the application removes the business capability entirely, which is disproportionate when the flaw is a fixable input-validation defect. Avoidance is correct only when no control can bring the risk within tolerance and the activity is genuinely dispensable.
C
Remediate the risk by implementing parameterized queries and input validation
Parameterised queries separate SQL code from user-supplied data, and input validation rejects malformed input, eliminating the injection vector itself. This directly addresses the identified insufficient input validation, removing the high-likelihood risk rather than transferring or accepting it.
D
Accept the risk because the likelihood is low after compensating controls
Why it fails: Acceptance is invalid because the stem states high likelihood, and acceptance requires the residual risk to sit within tolerance after treatment. Acceptance is the correct strategy when likelihood and impact are both low, or when treatment cost clearly exceeds the potential loss.