61 Practice Questions & Answers
Which of the following best describes the principle of least privilege in access control?
-
A
Administrators should have unlimited access to all systems at all times
-
B
Access permissions should be reviewed every five years
-
C
Users should have access to all systems to increase productivity
-
D
Users should be granted only the minimum permissions necessary to perform their job functions
✓ Correct
Explanation
Least privilege is a fundamental security principle that restricts user access to only what is necessary for their role, minimizing potential damage from compromised accounts or insider threats.
What is the primary purpose of a Security Information and Event Management (SIEM) system?
-
A
To aggregate, correlate, and analyze security logs and events from multiple sources for threat detection and response
✓ Correct
-
B
To provide physical access control to data centers
-
C
To encrypt all network traffic between servers
-
D
To manage employee password changes across the organization
Explanation
SIEM systems collect and analyze security data from various sources to identify patterns, detect anomalies, and enable rapid incident response by correlating events in real-time.
In the context of cryptography, what is the main advantage of asymmetric encryption over symmetric encryption?
-
A
It is faster and requires fewer computational resources than symmetric encryption
-
B
It uses shorter key lengths that are easier for users to remember
-
C
It provides stronger encryption when used with older hardware systems
-
D
It eliminates the need for secure key distribution and enables secure communication without prior key exchange
✓ Correct
Explanation
Asymmetric encryption solves the key distribution problem by using public-private key pairs, allowing secure communication between parties who have never exchanged keys beforehand.
Which of the following is a characteristic of a zero-trust security model?
-
A
All users and devices inside the corporate network are automatically trusted
-
B
Verify every access request regardless of source, using continuous authentication and authorization
✓ Correct
-
C
Trust is established based on network location rather than user credentials
-
D
Firewalls are eliminated in favor of perimeter-based security only
Explanation
Zero-trust assumes no trust by default and requires continuous verification of all users, devices, and applications, regardless of location, before granting access to resources.
What is the primary objective of a Business Continuity Plan (BCP)?
-
A
To reduce cybersecurity insurance premiums for the organization
-
B
To eliminate all potential risks to the organization's operations
-
C
To provide detailed instructions for employee termination procedures
-
D
To ensure critical business functions can continue or be quickly restored after a disruptive event
✓ Correct
Explanation
A BCP identifies critical functions and establishes procedures to maintain or restore operations during and after disruptions, minimizing downtime and business impact.
In a vulnerability assessment, what is the significance of the CVSS (Common Vulnerability Scoring System) score?
-
A
It provides a standardized numerical rating of vulnerability severity based on technical characteristics and impact
✓ Correct
-
B
It determines the cost of fixing the vulnerability in dollars
-
C
It measures the time required to discover a vulnerability
-
D
It ranks organizations by their overall security posture compared to industry peers
Explanation
CVSS provides a consistent scoring mechanism (typically 0-10) that reflects the severity and exploitability of vulnerabilities, helping organizations prioritize remediation efforts.
Which authentication factor relies on 'something you are'?
-
A
A security token or smart card
-
B
A password or PIN
-
C
A security question about personal information
-
D
Biometric data such as fingerprints or facial recognition
✓ Correct
Explanation
Biometric authentication factors are based on physical or behavioral characteristics unique to an individual, representing the 'something you are' category of multi-factor authentication.
What is the primary function of a Data Loss Prevention (DLP) system?
-
A
To encrypt only data stored on employee personal devices
-
B
To prevent employees from accessing cloud storage services entirely
-
C
To automatically delete all sensitive data from company systems weekly
-
D
To monitor, detect, and prevent unauthorized transmission or storage of sensitive data
✓ Correct
Explanation
DLP systems monitor data in transit and at rest, using policies to identify and block attempts to exfiltrate or improperly handle sensitive information before it leaves the organization.
In security risk assessment, what does the term 'threat' refer to?
-
A
The financial impact of a successful security incident
-
B
The likelihood that an attack will occur in a specific time period
-
C
Any potential agent or action that could exploit a vulnerability and cause harm
✓ Correct
-
D
A weakness in a system that could be exploited
Explanation
A threat is any potential source of danger—whether an attacker, malware, natural disaster, or other force—that could exploit vulnerabilities and cause harm to assets.
Which of the following best describes the concept of 'defense in depth' in cybersecurity?
-
A
Using multiple layers and types of security controls to protect systems and data from various angles
✓ Correct
-
B
Focusing security efforts exclusively on the organization's deepest, most critical networks
-
C
Ensuring that only employees with deep technical knowledge can access security systems
-
D
Implementing a single, highly advanced security solution that addresses all threats
Explanation
Defense in depth employs multiple overlapping security measures—including technical, administrative, and physical controls—so that if one fails, others continue to provide protection.
What is the primary goal of a penetration test?
-
A
To permanently compromise systems and networks for research purposes
-
B
To gather competitive intelligence about industry security standards and practices
-
C
To train employees in defensive cybersecurity techniques without their knowledge
-
D
To identify security vulnerabilities and weaknesses by simulating real-world attacks with authorization
✓ Correct
Explanation
Penetration testing is an authorized security assessment where testers simulate attacks to discover vulnerabilities, weaknesses, and the organization's defensive capabilities before actual attackers exploit them.
In the context of incident response, what is the primary purpose of the 'containment' phase?
-
A
To gather evidence for legal proceedings against the attacker
-
B
To limit the scope and impact of a security incident by isolating affected systems
✓ Correct
-
C
To immediately restore all systems to their original state before the incident occurred
-
D
To provide public statements about the security breach to media outlets
Explanation
Containment aims to stop the attack from spreading further, isolate compromised systems, and prevent additional damage while preserving evidence and enabling investigation and recovery.
Which of the following is a primary characteristic of a rootkit?
-
A
It is a legitimate system administration tool used to manage user accounts
-
B
It is antivirus software that protects against malware infections
-
C
It is a network protocol used for secure data transmission over the internet
-
D
It is malicious software that provides unauthorized administrative access and hides its presence from detection
✓ Correct
Explanation
A rootkit is a sophisticated malware that gains root or administrator privileges, then hides itself and other malicious activity from system monitoring tools, making detection extremely difficult.
What is the primary function of a Web Application Firewall (WAF)?
-
A
To encrypt all web traffic using military-grade encryption standards
-
B
To monitor and filter HTTP/HTTPS traffic, protecting web applications from application-layer attacks
✓ Correct
-
C
To block all internet traffic to prevent any web-based attacks
-
D
To automatically patch vulnerabilities in web servers without administrator intervention
Explanation
A WAF operates at Layer 7 (application layer) to inspect web traffic, detect and block common attacks like SQL injection and cross-site scripting (XSS), while allowing legitimate requests through.
In the context of secure coding practices, what is the primary risk of hardcoding credentials in application source code?
-
A
It increases the application's processing speed and reduces memory usage
-
B
It exposes credentials to anyone with access to the code repository, enabling unauthorized access
✓ Correct
-
C
It makes the application easier to debug during development phases
-
D
It reduces the number of authentication attempts required by legitimate users
Explanation
Hardcoding credentials in source code violates security best practices because credentials become visible to all developers and can be exposed through version control systems, backups, or code repositories.
What is the primary advantage of implementing security awareness training in an organization?
-
A
It prevents all malware from infecting company networks and devices
-
B
It reduces the likelihood of successful social engineering attacks and user-caused security incidents
✓ Correct
-
C
It guarantees that no security breaches will occur within the organization
-
D
It eliminates the need for technical security controls and firewalls
Explanation
Security awareness training educates employees about threats, best practices, and their role in protecting organizational assets, significantly reducing human-error incidents and improving organizational security posture.
Which of the following best describes the difference between authentication and authorization?
-
A
Authorization must occur before authentication in any security system
-
B
Authentication is used only for passwords, while authorization applies only to physical access
-
C
Authentication verifies a user's identity, while authorization determines what resources that user can access
✓ Correct
-
D
Both terms refer to the same security concept and can be used interchangeably
Explanation
Authentication confirms 'who you are' through credentials, while authorization determines 'what you can do' based on verified identity and assigned permissions.
In the OSI model, at which layer do firewalls typically operate to make decisions about allowing or blocking traffic?
-
A
Layer 2 (Data Link Layer) exclusively
-
B
Layer 5 (Session Layer) only
-
C
Layer 1 (Physical Layer) exclusively
-
D
Layer 3 (Network Layer) and Layer 4 (Transport Layer), though modern firewalls may also operate at higher layers
✓ Correct
Explanation
Traditional firewalls operate at Layer 3/4 using IP addresses and ports (network/transport layers), while next-generation firewalls also inspect Layers 5-7 for application-level threats.
What is the primary purpose of key management in cryptography?
-
A
To reduce the computational overhead of encryption operations
-
B
To securely generate, store, distribute, rotate, and retire cryptographic keys throughout their lifecycle
✓ Correct
-
C
To eliminate the need for regular security audits and vulnerability assessments
-
D
To ensure that encryption algorithms remain secret from potential attackers
Explanation
Key management encompasses the complete lifecycle of cryptographic keys—from generation through secure storage, distribution, rotation, and eventual retirement—to maintain cryptographic security.
Which of the following best describes a SQL injection vulnerability?
-
A
A network-based attack that floods servers with excessive traffic to cause denial of service
-
B
A social engineering technique used to trick employees into revealing their passwords
-
C
An attack where malicious SQL code is inserted into input fields, potentially allowing unauthorized database access or data manipulation
✓ Correct
-
D
A type of physical attack where attackers gain access to server hardware
Explanation
SQL injection exploits improper input validation in web applications, allowing attackers to insert malicious SQL commands that execute on the backend database with unintended consequences.
In the context of compliance and regulations, what is the primary objective of the General Data Protection Regulation (GDPR)?
-
A
To protect the privacy and personal data of European Union residents and establish requirements for data handling and breach notification
✓ Correct
-
B
To eliminate all data collection practices used by organizations worldwide
-
C
To establish security standards for American government contractors only
-
D
To mandate the use of specific encryption algorithms in all organizations
Explanation
GDPR is an EU regulation that establishes comprehensive requirements for protecting personal data, including consent, access rights, breach notification, and data protection by design principles.
What is the primary function of a Certificate Authority (CA) in public key infrastructure (PKI)?
-
A
To issue, verify, and manage digital certificates that bind public keys to identities and enable secure communications
✓ Correct
-
B
To monitor internet traffic and report suspicious activities to law enforcement
-
C
To prevent all types of cyberattacks without exception
-
D
To generate encryption algorithms for use across the internet
Explanation
A CA is a trusted entity that issues digital certificates binding public keys to identities, signs these certificates to prove authenticity, and maintains certificate revocation lists.
Which of the following is a primary security concern associated with Internet of Things (IoT) devices?
-
A
They require constant internet connectivity, which eliminates all security risks
-
B
They exclusively use proprietary operating systems that are incompatible with standard security tools
-
C
Many IoT devices have limited processing power, making strong encryption implementation difficult, and are often deployed with weak default credentials and minimal security features
✓ Correct
-
D
They consume excessive electricity and increase utility costs
Explanation
IoT devices often lack security by design, featuring limited computational resources, poor password management, infrequent patches, and minimal user control, creating significant attack surfaces.
In disaster recovery planning, what is the Recovery Time Objective (RTO)?
-
A
The duration of the annual disaster recovery test exercise
-
B
The maximum acceptable time period to restore a system or service after a disruptive event
✓ Correct
-
C
The maximum amount of data loss that an organization can tolerate in a disaster scenario
-
D
The total cost of implementing disaster recovery measures and backup systems
Explanation
RTO defines the acceptable maximum downtime for critical systems—for example, an RTO of 4 hours means systems must be restored within that timeframe to meet business requirements.
What is the primary security benefit of implementing network segmentation?
-
A
It divides the network into isolated zones, limiting lateral movement by attackers and containing the impact of potential breaches
✓ Correct
-
B
It eliminates the need for antivirus software on end-user devices
-
C
It provides encryption for all network traffic without additional configuration
-
D
It prevents employees from accessing external websites and email services
Explanation
Network segmentation creates isolated zones with restricted inter-zone communication, so a breach in one segment cannot easily spread to others, significantly reducing attack impact.
Which of the following best describes the principle of least privilege?
-
A
All users should have equal access to all systems regardless of their role
-
B
Access rights should be granted based on seniority level within the organization
-
C
Administrators should have unlimited access to all organizational resources
-
D
Users should have only the minimum access rights necessary to perform their job functions
✓ Correct
Explanation
Least privilege is a foundational security principle that restricts user access to only what is necessary for their role, reducing the attack surface and potential damage from compromised accounts.
What is the primary purpose of a demilitarized zone (DMZ) in network architecture?
-
A
To increase bandwidth for external users connecting to the organization
-
B
To isolate publicly accessible services from internal network resources
✓ Correct
-
C
To eliminate the need for firewalls in a network infrastructure
-
D
To provide unrestricted access between internal and external networks
Explanation
A DMZ is a network segment that sits between an organization's internal network and untrusted external networks, hosting public-facing services while protecting internal assets from direct exposure.
In the context of authentication, what does multi-factor authentication (MFA) require?
-
A
Only a strong password with uppercase, lowercase, numbers, and special characters
-
B
Multiple forms of identity verification from different categories such as something you know, have, or are
✓ Correct
-
C
Using biometric data exclusively for all authentication scenarios
-
D
Changing passwords every 30 days without exception
Explanation
MFA combines multiple independent authentication factors from different categories (knowledge, possession, inherence, location) to significantly increase security beyond single-factor methods.
Which attack type involves an attacker intercepting and altering communications between two parties without their knowledge?
-
A
Man-in-the-Middle (MITM) attack
✓ Correct
-
B
Brute force attack
-
C
Phishing attack
-
D
Denial of Service attack
Explanation
A Man-in-the-Middle attack positions the attacker between two communicating parties, allowing interception, eavesdropping, and potential modification of data in transit.
What is the primary function of a Web Application Firewall (WAF)?
-
A
To eliminate the need for regular security patches on application servers
-
B
To protect web applications by filtering and monitoring HTTP/HTTPS traffic for malicious requests
✓ Correct
-
C
To encrypt all data transmission between clients and servers automatically
-
D
To monitor and log all user activities on web servers
Explanation
A WAF sits between users and web applications, analyzing requests to detect and block common web-based attacks such as SQL injection, cross-site scripting (XSS), and other application layer threats.
In cybersecurity, what does the term 'vulnerability' specifically refer to?
-
A
The successful exploitation of a security weakness that has caused damage
-
B
A documented security policy that is no longer relevant to current operations
-
C
A weakness or flaw in a system that could be exploited to cause harm or unauthorized access
✓ Correct
-
D
An intentional backdoor created by system administrators for maintenance purposes
Explanation
A vulnerability is a specific weakness in software, hardware, or processes that, if exploited by a threat actor, could result in a security breach or system compromise.
Which cryptographic approach uses two mathematically related keys—one public and one private?
-
A
Symmetric key cryptography
-
B
Asymmetric key cryptography (Public Key Infrastructure)
✓ Correct
-
C
Hash-based cryptography only
-
D
Stream cipher encryption methodology
Explanation
Asymmetric cryptography uses a key pair where the public key encrypts data and the private key decrypts it, enabling secure communication without pre-shared secrets and supporting digital signatures.
What is the primary goal of a penetration test in cybersecurity?
-
A
To permanently disable security systems to identify weaknesses
-
B
To publicly disclose all security flaws found within an organization
-
C
To simulate authorized attacks to identify vulnerabilities before malicious actors do
✓ Correct
-
D
To intentionally introduce malware to test antivirus effectiveness
Explanation
A penetration test is an authorized security assessment where trained professionals attempt to exploit vulnerabilities in a controlled manner to help organizations identify and remediate security gaps.
Which of the following is the best practice for password management in an organization?
-
A
Requiring all employees to write passwords on sticky notes kept in secure locations
-
B
Implementing a single organizational password changed quarterly for all accounts
-
C
Storing passwords in shared spreadsheets for easy team access and updates
-
D
Using a centralized password manager with strong encryption and access controls
✓ Correct
Explanation
A centralized password manager securely stores, encrypts, and controls access to passwords while enabling strong, unique credentials for each account and reducing the risk of credential compromise.
What does the NIST Cybersecurity Framework primarily provide?
-
A
A prescriptive list of tools that must be purchased and implemented
-
B
A voluntary set of guidelines, standards, and best practices to manage cybersecurity risk
✓ Correct
-
C
Legal requirements that all organizations must follow without exception
-
D
Specific hardware requirements for all government contractors
Explanation
The NIST Cybersecurity Framework is a flexible, voluntary guidance document that helps organizations identify, manage, and reduce cybersecurity risks through a structured approach based on industry best practices.
In incident response, what is the primary objective of the 'containment' phase?
-
A
To restore all systems to operation as quickly as possible without investigation
-
B
To assign blame to the individuals responsible for the security breach
-
C
To prevent further damage or lateral movement by isolating affected systems
✓ Correct
-
D
To immediately notify all customers without verifying the extent of the breach
Explanation
Containment focuses on limiting the scope and impact of a security incident by isolating compromised systems, stopping malware propagation, and preventing attackers from accessing additional resources.
What is a 'zero-day' vulnerability in cybersecurity?
-
A
A previously unknown software flaw with no available patch, exploitable from day zero of discovery
✓ Correct
-
B
A type of malware that activates exactly at midnight each day
-
C
A vulnerability that only affects systems with zero security controls implemented
-
D
A vulnerability that has been publicly known for more than one year
Explanation
A zero-day vulnerability is an unknown security flaw that developers have not yet patched, making it particularly dangerous because affected systems have no available defense until a patch is released.
Which security control type is specifically designed to prevent security incidents from occurring?
-
A
Preventive controls that stop unauthorized actions before they occur
✓ Correct
-
B
Corrective controls that repair damage after an incident
-
C
Detective controls that identify unauthorized activities
-
D
Compensating controls that serve as temporary workarounds
Explanation
Preventive controls, such as firewalls, access controls, and encryption, are designed to block or stop security threats and unauthorized activities from happening in the first place.
What is the primary risk associated with using default credentials on network devices?
-
A
Default credentials prevent employees from accessing the devices they need for work
-
B
Using default credentials eliminates the need for backup and disaster recovery planning
-
C
Attackers commonly know or can easily obtain default credentials, providing easy unauthorized access
✓ Correct
-
D
Default credentials are actually more secure than custom passwords and reduce complexity
Explanation
Default credentials are widely documented and known, making them a critical security risk as attackers can easily gain unauthorized access to devices if defaults are not changed during initial configuration.
In data classification, what does 'Confidential' typically mean?
-
A
Information that is freely available to the general public without restrictions
-
B
Information that is only interesting to competitors but not sensitive internally
-
C
Data that has already been breached and is available on the dark web
-
D
Sensitive information whose unauthorized disclosure could cause significant harm to the organization
✓ Correct
Explanation
Confidential data is classified information requiring strict access controls and handling procedures, as its unauthorized disclosure could damage the organization, its customers, or competitive position.
Which of the following best describes 'defense in depth' as a cybersecurity strategy?
-
A
Using only network-based security measures without endpoint protections
-
B
Deploying multiple layers of security controls so that if one is bypassed, others remain to protect assets
✓ Correct
-
C
Focusing all security efforts on protecting the organization's deepest network servers
-
D
Implementing a single, extremely strong security control to protect all assets
Explanation
Defense in depth employs multiple overlapping security measures at different layers (network, application, endpoint, data) so that a single control failure does not result in complete system compromise.
What is the primary purpose of a Security Information and Event Management (SIEM) system?
-
A
To replace the need for all other security tools in an organization
-
B
To automatically patch all vulnerabilities without human intervention
-
C
To collect, correlate, and analyze security logs and events for threat detection and incident response
✓ Correct
-
D
To eliminate the need for security staff by providing fully automated threat mitigation
Explanation
A SIEM aggregates and analyzes security data from multiple sources, enabling organizations to detect suspicious patterns, investigate incidents, and respond to threats more effectively and quickly.
Which attack exploits the trust relationship between a user and a service the user frequents?
-
A
Logic bomb attack
-
B
Watering hole attack that compromises websites visited by target users
✓ Correct
-
C
Brute force password attack
-
D
Ransomware attack
Explanation
A watering hole attack compromises legitimate websites visited by a targeted group, infecting trusted resources that users believe are safe and thereby bypassing initial trust-based defenses.
In cybersecurity, what does 'non-repudiation' specifically ensure?
-
A
That all network connections are monitored for suspicious activity
-
B
That data cannot be read by unauthorized parties during transmission
-
C
That sensitive data is automatically deleted after a set time period
-
D
That a person cannot deny having performed an action they actually performed
✓ Correct
Explanation
Non-repudiation uses digital signatures and audit logs to provide undeniable proof that a specific person performed a specific action, preventing them from later denying their involvement.
What is the main purpose of a business continuity plan (BCP) in cybersecurity?
-
A
To permanently prevent all cyberattacks from ever occurring against an organization
-
B
To eliminate the need for cybersecurity professionals on staff
-
C
To provide legal liability protection for security breaches
-
D
To ensure an organization can maintain critical operations during and after a disruptive incident
✓ Correct
Explanation
A BCP outlines procedures and resources to maintain or quickly restore critical business functions in the event of disruptions, including cyberattacks, natural disasters, or other emergencies.
Which practice involves regularly testing backup systems and restoration procedures?
-
A
Access logging which monitors who retrieves backup data
-
B
Data deduplication which reduces backup storage requirements
-
C
Disaster recovery testing to verify backup integrity and recovery capability
✓ Correct
-
D
Backup auditing which ensures only authorized personnel access backups
Explanation
Disaster recovery testing validates that backups are complete, uncorrupted, and can be successfully restored to recover systems and data, preventing failures discovered only during actual emergencies.
What is the primary risk of social engineering attacks?
-
A
They only affect organizations without firewalls or network security
-
B
They exclusively target financial institutions and government agencies
-
C
They exploit human psychology and trust rather than technical vulnerabilities
✓ Correct
-
D
They can be prevented entirely by installing antivirus software
Explanation
Social engineering attacks manipulate people into divulging sensitive information or performing actions that compromise security, often bypassing technical controls by exploiting human psychology and trust.
In the context of secure software development, what does 'secure coding' practices emphasize?
-
A
Implementing coding standards that prevent common vulnerabilities such as injection attacks and buffer overflows
✓ Correct
-
B
Using only proprietary programming languages not available to potential attackers
-
C
Avoiding the use of external libraries and frameworks to reduce attack surface
-
D
Writing code as quickly as possible without testing or review
Explanation
Secure coding practices include input validation, proper error handling, avoiding hardcoded credentials, and following established guidelines to prevent vulnerabilities from being introduced during development.
Which compliance framework specifically addresses the protection of personal data in the European Union?
-
A
Payment Card Industry Data Security Standard (PCI-DSS)
-
B
Health Insurance Portability and Accountability Act (HIPAA)
-
C
General Data Protection Regulation (GDPR) which establishes strict data protection and privacy requirements
✓ Correct
-
D
Gramm-Leach-Bliley Act (GLBA)
Explanation
GDPR is EU legislation that mandates organizations protect personal data, provide transparency about data use, honor individual rights, and face significant penalties for non-compliance.
What is the most critical step in identifying and managing cybersecurity risks?
-
A
Waiting for a breach to occur before assessing organizational risk
-
B
Conducting a comprehensive risk assessment to identify assets, threats, and vulnerabilities
✓ Correct
-
C
Immediately purchasing the most expensive security tools available
-
D
Assuming all risks are equal and treating them with identical responses
Explanation
A comprehensive risk assessment systematically identifies organizational assets, potential threats, existing vulnerabilities, and their impacts, enabling prioritized and cost-effective security investments.
Which security principle ensures that individuals can be held accountable for their actions within a system?
-
A
Integrity which ensures data has not been altered or corrupted
-
B
Accountability which maintains records proving who performed specific actions
✓ Correct
-
C
Availability which ensures systems remain operational and accessible
-
D
Confidentiality which protects information from unauthorized access
Explanation
Accountability requires maintaining detailed audit logs and records that document who accessed what resources, when they accessed them, and what actions they performed, enabling oversight and investigation.
Which of the following best describes the principle of least privilege in access control?
-
A
Users should be granted only the minimum level of access required to perform their job functions
✓ Correct
-
B
All employees in the same department should have identical access permissions
-
C
Users should have access to all systems to improve efficiency
-
D
Access control should be based primarily on user seniority and tenure
Explanation
Least privilege is a fundamental security principle that limits user access to only what is necessary for their role, reducing the risk of unauthorized access or damage from compromised accounts.
In the context of incident response, what is the primary goal of the containment phase?
-
A
To communicate the incident details to all employees immediately
-
B
To determine which employee caused the security breach
-
C
To restore all systems to their previous operational state
-
D
To identify all affected systems and prevent the incident from spreading to unaffected systems
✓ Correct
Explanation
Containment aims to limit the scope and impact of an incident by isolating affected systems and preventing further compromise, which is critical before recovery efforts begin.
Which security control type is implemented to detect and respond to security incidents after they occur?
-
A
Deterrent control
-
B
Detective control
✓ Correct
-
C
Preventive control
-
D
Compensating control
Explanation
Detective controls identify security incidents and anomalies after they happen, enabling rapid response. Examples include intrusion detection systems, log monitoring, and security audits.
What is the primary purpose of a business continuity plan in cybersecurity?
-
A
To ensure that critical business functions can continue or be rapidly restored following a disruptive event, including cyber incidents
✓ Correct
-
B
To reduce cybersecurity insurance premiums by 50 percent
-
C
To transfer all security responsibilities to a third-party vendor
-
D
To eliminate all possible cyber threats permanently
Explanation
A business continuity plan ensures organizational resilience by outlining procedures to maintain or quickly restore essential operations after disruptions, including those caused by cyberattacks.
Which of the following represents a key distinction between vulnerability scanning and penetration testing?
-
A
Penetration testing is less expensive and requires fewer skilled resources than vulnerability scanning
-
B
Vulnerability scanning is conducted by external attackers, while penetration testing is only performed by internal IT staff
-
C
Vulnerability scanning identifies potential weaknesses in systems and applications, whereas penetration testing simulates actual attacks to exploit vulnerabilities and assess the extent of potential impact
✓ Correct
-
D
Vulnerability scanning requires physical access to systems, while penetration testing does not
Explanation
Vulnerability scanning is an automated process that identifies weaknesses, while penetration testing goes further by attempting to exploit those vulnerabilities to demonstrate real-world risk and business impact.
In cryptography, what does the concept of forward secrecy ensure?
-
A
That encrypted data remains secure even if long-term encryption keys are compromised in the future
✓ Correct
-
B
That encryption algorithms never require updates or replacement
-
C
That all users can easily decrypt messages without needing encryption keys
-
D
That the sender of a message can be identified with 100 percent certainty
Explanation
Forward secrecy ensures that session-specific keys are used so that even if a long-term private key is compromised, past communications remain secure because they were encrypted with different keys.
Which governance framework is specifically designed to provide a comprehensive approach to information security management systems?
-
A
CIS Controls
-
B
ISO/IEC 27001
✓ Correct
-
C
ITIL Service Management
-
D
NIST Cybersecurity Framework
Explanation
ISO/IEC 27001 is an international standard that specifies requirements for establishing, implementing, and maintaining an information security management system (ISMS) with comprehensive controls and processes.
What is the primary risk associated with shadow IT in an organization?
-
A
It ensures that all employees have complete visibility into organizational technology infrastructure
-
B
Unsanctioned applications and systems bypass security controls and governance, creating unmanaged security risks and compliance violations
✓ Correct
-
C
It simplifies the process of implementing multi-factor authentication enterprise-wide
-
D
It reduces the total cost of IT operations and increases efficiency across all departments
Explanation
Shadow IT refers to unauthorized systems and applications used outside official IT channels. These circumvent security policies and controls, making it difficult to manage risks and maintain compliance with regulations.
Which of the following best describes the relationship between authentication and authorization in access control?
-
A
Authentication verifies who a user is, while authorization determines what authenticated users can access and what actions they can perform
✓ Correct
-
B
Authorization is the process of verifying a user's identity, while authentication is granting them access to specific resources based on that identity
-
C
Neither authentication nor authorization is necessary if users have physical access to facilities
-
D
Authentication and authorization are interchangeable terms that mean the same thing in cybersecurity
Explanation
Authentication establishes the identity of a user (typically through credentials), while authorization determines the permissions and resources that authenticated user can access based on their role and privileges.
In risk management, what does the term 'risk acceptance' mean in practice?
-
A
An organization decides to eliminate all identified risks regardless of cost or feasibility
-
B
The organization implements the most expensive security controls available to address every possible risk scenario
-
C
An organization transfers all responsibility for managing risks to insurance companies and vendors without retaining any accountability
-
D
The organization acknowledges a risk exists and consciously decides to accept the potential consequences rather than mitigate or avoid it, typically when mitigation costs exceed potential impact
✓ Correct
Explanation
Risk acceptance is a valid risk management strategy where an organization makes an informed decision to tolerate a specific risk, often because mitigation is not cost-effective or feasible, while understanding and documenting the consequences.