Domain 1 Part 2 quiz

Sarah is enhancing the company's threat assessment process. What category of control is Sarah executing?

• Operational

• Technical

• Corrective

• Managerial

Answer explanation

The answer is Managerial.

The implementation of a threat assessment process falls under the category of Managerial control, as it involves creating and implementing policies, procedures, and guidelines to manage the organization's risk. Managerial controls are those that deal with the management of resources, policies, and procedures and help to ensure that the operations and processes of an organization are efficient and effective.

Sam's company recently suffered a security breach that affected stored credit card data. Sam's primary concern is the fact that the company may face penalties for violating the Payment Card Industry Data Security Standard provisions. What category of risk is of concern to Sam?

• Strategic

• Operational

• Compliance

• Financial

Answer explanation

The answer is Compliance.

Compliance risk refers to the risk of an organization not adhering to laws, regulations, standards, or contractual agreements. In this scenario, Sam is concerned about the company potentially facing penalties for violating the provisions set forth by the Payment Card Industry Data Security Standard, which establishes the requirements for the protection of credit card data.

Max is conducting a SWOT analysis for his company's cybersecurity program. He recently discovered a cybersecurity insurance offering that may allow the company to transfer some financial risk and is considering purchasing a policy. Where would this offering fit in the SWOT analysis?

• Opportunity

• Weakness

• Threat

• Strength

Answer explanation

The answer is Opportunity.

A SWOT (Strengths, Weaknesses, Opportunities, Threats) analysis is a tool used to evaluate the strengths and weaknesses of an organization, as well as any opportunities and threats it faces. An opportunity is a factor that could positively impact the organization, such as a new product, market, or trend. In this scenario, purchasing a cybersecurity insurance policy would be considered an opportunity because it could transfer some financial risk and provide protection for the company in the event of a cyberattack.

Tom is concerned about the risk of an attacker attempting to access his company's database server on-premises. He is searching for a control that would discourage the attacker from trying to gain access. What type of security control is Tom seeking to implement?

• Preventive

• Deterrent

• Physical

• Detective

Answer explanation

The answer is Deterrent.

Deterrent security controls aim to discourage potential attackers from attempting to gain unauthorized access to an organization's assets. They create an obstacle that makes the potential attacker believe that it is not worth the effort to try and gain access, or that the consequences of doing so are too high. In this scenario, Tom is searching for a control that will discourage the attacker from attempting to gain access to the company's database server, making it less likely that the attacker will succeed in a potential attack.

Nick is adjusting his company's intrusion prevention system to prevent false positive alerts. What type of control is Nick implementing?

• Managerial control

• Operational control

• Physical control

• Technical control

Answer explanation

The answer is Technical controls.

Technical controls are security measures that are implemented using technology. An intrusion prevention system (IPS) is a type of technical control that monitors network traffic for signs of intrusion or malicious activity, and can be adjusted or "tuned" to reduce the number of false positive alerts.

Amy is the CISO of a firm and she is leading the creation of a new security operations center (SOC). She bears responsibility for the success of this initiative. In the RACI matrix entry for this initiative, how would Amy best be labeled?

• A

• R

• I

• C

Answer explanation

The answer is R (Responsible).

The RACI matrix is a tool used in project management to assign responsibilities for tasks and deliverables. In the RACI matrix, "R" stands for Responsible, meaning that the person in this role is responsible for completing the task. As the CISO and the person spearheading the development of the new SOC (or leading the creation of the new security operations center), Amy would best be labeled as "R" in the RACI matrix entry for this initiative.

Nate is analyzing the security measures in place to protect his company's file server. He thinks that a potential breach could lead to the exposure of confidential information that could harm the organization's reputation and impact its ability to operate. What type of risk is Nate concerned about?

• Strategic

• Reputational

• Financial

• Operational

Answer explanation

Answer: Reputational Explanation: Reputational risk refers to the risk that an organization's reputation or image may be damaged due to events such as a security breach that leads to the exposure of confidential information. In this scenario, Nate is worried about the negative impact that a file server breach could have on his organization's reputation, which could in turn affect its ability to continue doing business.

Sarah is creating a new objective for her cybersecurity program. Currently, it reads "Acquiring and incorporating a new intrusion prevention system that aims to decrease the number of successful network intrusions by half." Which aspect of the SMART criteria is missing in this objective?

• Specific

• Measurable

• Achievable

• Time-bound

Answer explanation

The answer is Time-bound.

The element of the SMART framework that is lacking from this goal is "Time-bound." The goal does not specify a deadline or time frame for when the objective will be achieved. To make the goal SMART, a target date or a time period within which the objective will be accomplished should be added.

Sara is developing an education program for her company's personnel who are authorized to manage sensitive systems. What classification accurately categorizes the intended recipients of the program?

• Privileged users

• High-risk users

• End users

• Data owners

Answer explanation

Answer: Privileged users Explanation: The users who have administrative access to sensitive systems are known as privileged users, and they are the ones who have access to critical data and systems. By targeting these users, Sara is ensuring that they have a good understanding of cybersecurity awareness and can minimize the risks of a security breach.

Karen recently conducted an assessment of her organization’s security controls and discovered a potential gap: the organization does not use full-disk encryption on laptops. What type of control gap exists in this case?

• Detective

• Corrective

• Deterrent

• Preventive

Answer explanation

The answer is Preventive.

Karen discovered a gap in the preventive security controls of her organization. By not using full-disk encryption on laptops, the organization is leaving sensitive data vulnerable to theft or unauthorized access. This type of control is meant to prevent unauthorized access or unauthorized data modification and by not implementing it, a gap in the preventive controls exists.