26

Question 1

Statement on Standards for Attestation Engagements 18 (SSAE 18) is a standard from the American Institute of Certified Public Accountants (AICPA). The standard defines three types of System and Organization Controls (SOC) audit reports that review different aspects of a company’s operations. A SOC 2 audit report provides detailed information and assurance about a service organization’s security, availability, processing integrity, confidentiality and/or privacy controls, based on their compliance with the AICPA’s TSC (Trust Services Criteria). Furthermore, a SOC 2 Type I audit provides a snapshot of the organization’s control landscape in a specific point in time, SOC 2 Type II audit evaluates the effectiveness of controls over a period of time of at least six consecutive calendar months (in simple terms, “SOC” defines the scope of the audit, “Type” defines the time covered during the audit).

Answer 1

True

Question 2

Which of the following answers refers to a nonprofit organization promoting best security practices related to cloud computing environments?

Answer 2

** CSA **

Cloud Security Alliance

Question 3

Which of the following answers refers to a cybersecurity control framework for cloud computing?

Answer 3

** CCM **

The CSA Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing

Question 4

A type of document stipulating rules of behavior to be followed by users of computers, networks, and associated resources is referred to as:

Answer 4

** AUP **

An acceptable use policy (AUP) is a document stipulating constraints and practices that a user must agree to for access to a corporate network, the internet or other resources

Question 5

From the security standpoint, the job rotation policy enables detection of fraudulent activity within the company/organization.

Answer 5

True

Question 6

One of the goals behind the mandatory vacations policy is to mitigate the occurrence of fraudulent activity within the company/organization.

Answer 6

True

Question 7

Which of the answers listed below refers to a concept of having more than one person required to complete a given task?

Answer 7

Separation of duties

Question 8

A sticky note with a password kept on sight in user’s cubicle would be a violation of which of the following policies?

Answer 8

Clean desk policy

Question 9

A legal contract between the holder of confidential information and another person to whom that information is disclosed prohibiting that other person from disclosing the confidential information to any other party is known as:

Answer 9

** NDA **

A non-disclosure agreement is a legal document which sets rules and principles for the confidentiality of the information to be exchanged.

Question 10

An agreement between a service provider and users defining the nature, availability, quality, and scope of the service to be provided is known as:

Answer 10

** SLA **

A service-level agreement (SLA) is a contract between a service provider and its customers that documents what services the provider will furnish and defines the service standards the provider is obligated to meet.

Question 11

Which of the following terms refers to an agreement that specifies performance requirements for a vendor?

Answer 11

** SLA **

A service-level agreement (SLA) is a contract between a service provider and its customers that documents what services the provider will furnish and defines the service standards the provider is obligated to meet.

Question 12

Which of the following answers refer to a general document established between two or more parties to define their respective responsibilities and expectations in accomplishing a particular goal or mission? (Select 2 answers)

Answer 12

• MOU (Memorandum of Understanding)
• MOA (Memorandum of Agreement)

Question 13

A type of agreement that specifies generic terms to simplify the negotiation of future contracts between the signing parties is called:

Answer 13

** MSA **

In business and legal contexts, MSA often stands for Master Services Agreement. It is a contract that establishes the overarching terms and conditions between a service provider and a client.

Question 14

Which of the following answers refers to a key document governing the relationship between two business organizations?

Answer 14

** BPA **

Business partnership agreements (BPA) are legal agreements between partners.

Question 15

Which of the terms listed below refer to a product/service that no longer receives continuing support? (Select 2 answers)

Answer 15

EOL (End of Life)

EOSL (End of Service Life)

Question 16

The “Run as administrator” option in MS Windows allows users with lower-level permissions to perform tasks reserved for system administrators. This feature requires providing Administrator account credentials and temporarily elevates the current user’s privileges to perform a given task. A Linux command that temporarily modifies security privileges to allow an execution of a single command that requires root access permissions is called sudo.

Answer 16

True

Question 17

Which of the following terms relates closely to the concept of residual risk?

Answer 17

** Risk acceptance **

Risk acceptance is a risk management strategy in which an organization acknowledges the existence of a risk but chooses not to take any specific action to mitigate or transfer it. Instead, the organization is willing to accept the consequences if the risk materializes. This approach is typically chosen when the cost or effort of risk mitigation outweighs the potential impact of the risk, or when the organization has a high tolerance for the risk. Risk acceptance should be a conscious and well-documented decision in a risk management plan.

Question 18

Disabling certain system functions or shutting down the system when risks are identified is an example of:

Answer 18

** Risk avoidance **

Risk avoidance is a risk management strategy in which an organization takes actions to eliminate or entirely avoid certain risks. This approach involves making decisions and implementing measures to prevent specific activities or situations that could lead to adverse consequences or harm.

Question 19

Contracting out a specialized technical component when the company’s employees lack the necessary skills is an example of:

Answer 19

** Risk transference **

Risk transference is a risk management strategy in which an organization shifts the responsibility for managing a specific risk to another party. This is typically done through contractual agreements, insurance policies, or other arrangements. When an organization transfers risk, it essentially transfers some or all of the financial or operational consequences of a risk to another entity. like Insurance

Question 20

Cybersecurity insurance is an example of which risk management strategy?

Answer 20

** Risk transference **

Risk transference is a risk management strategy in which an organization shifts the responsibility for managing a specific risk to another party. This is typically done through contractual agreements, insurance policies, or other arrangements. When an organization transfers risk, it essentially transfers some or all of the financial or operational consequences of a risk to another entity. like Insurance

Question 21

Which of the following is an example of a risk mitigation strategy?

Answer 21

Implementation of security controls

Question 22

Which of the following answers refers to a document containing detailed information on potential cybersecurity risks?

Answer 22

** Risk register **

A risk register is a document or tool used in risk management to systematically identify, assess, track, and manage risks within an organization or a specific project. It serves as a central repository for all relevant information about risks and their potential impact on an organization’s objectives.

Question 23

Which of the following answers refer to an assessment tool used for prioritizing the severity of different risks? (Select 2 answers)

Answer 23

• Risk heat map
• Risk matrix

A risk heat map and a risk matrix are commonly used tools in risk management to visually represent and prioritize risks based on their severity or impact and likelihood or probability. These tools help organizations make informed decisions about which risks to address first and how to allocate resources for risk mitigation.

Question 24

Which of the following statements are not true with regards to Risk? (Select 2 answers)

Answer 24

• Inherent risk is the remaining risk after implementing controls
• Residual risk is the original level of risk that exist before implementing any controls

Question 25

Assessment of risk probability and its impact based on subjective judgment falls into the category of:

Answer 25

** Qualitative risk assessment **

Assessment of risk probability and its impact based on subjective judgment falls into the category of “Qualitative risk assessment.”

Qualitative risk assessment relies on expert judgment and qualitative data to evaluate risks. It typically uses scales or categories (e.g., low, medium, high) to assess the likelihood and impact of risks subjectively.

Question 26

A calculation of the Single Loss Expectancy (SLE) is an example of

Answer 26

** Qualitative risk assessment **

Assessment of risk probability and its impact based on subjective judgment falls into the category of “Qualitative risk assessment.”

Qualitative risk assessment relies on expert judgment and qualitative data to evaluate risks. It typically uses scales or categories (e.g., low, medium, high) to assess the likelihood and impact of risks subjectively.

Question 27

In quantitative risk assessment, this term is used for estimating the likelihood of occurrence of a future threat.

Answer 27

** ARO **

In quantitative risk assessment, the term used for estimating the likelihood of occurrence of a future threat is “ARO,” which stands for “Annualized Rate of Occurrence.” The ARO represents the probability or frequency of a specific risk event happening within a given year. It is a key component in calculating the Annualized Loss Expectancy (ALE) and is used to quantify the risk associated with that event.

Question 28

Which term describes the predicted loss of value to an asset based on a single security incident?

Answer 28

** SLE **

Single Loss Expectancy (SLE) tells us what kind of monetary loss we can expect if an asset is compromised because of a risk

Question 29

Which of the acronyms listed below refers to a risk assessment formula defining probable financial loss due to a risk over a one-year period?

Answer 29

** ALE **

The Annualized Loss Expectancy (ALE) is the expected monetary loss that can be expected for an asset due to a risk over a one year period. It is defined as: ALE = SLE * ARO.

Question 30

Which of the following answers refers to the correct formula for calculating probable financial loss due to a risk over a one-year period?

Answer 30

ALE = ARO * SLE

The Annualized Loss Expectancy (ALE) is the expected monetary loss that can be expected for an asset due to a risk over a one year period. It is defined as: ALE = SLE * ARO.

Question 31

An estimate based on the historical data of how often a threat would be successful in exploiting a vulnerability is known as:

Answer 31

** ARO **

Annualized Rate of Occurrence, also known as ARO, refers to the expected frequency with which a risk or a threat is expected to occur

Question 32

Which of the acronyms listed below refers to a maximum tolerable period of time required for restoring business functions after a failure or disaster?

Answer 32

** RTO **

The recovery time objective (RTO) is the maximum tolerable length of time that a computer, system, network or application can be down after a failure or disaster occurs.

Question 33

In Business Continuity Planning (BCP), the maximum tolerable point in time to which systems and data must be recovered after an outage is called

Answer 33

** RPO **

Recovery point objective (RPO) generally refers to calculating how much data loss a company can experience within a period most relevant to its business before significant harm occurs, from the point of a disruptive event to the last data backup.

Question 34

Which of the following terms is used to describe an average time required to repair a failed component or device?

Answer 34

** MTTR **

MTTR (mean time to respond) is the average time it takes to recover from a product or system failure from the time when you are first alerted to that failure.

Question 35

High MTBF value indicates that a component or system provides low reliability and is more likely to fail.

Answer 35

False

Question 36

Which of the solutions listed below add(s) redundancy in areas identified as single points of failure? (Select all that apply)

Answer 36

• RAID
• Dual-power supply
• Failover clustering
• Load balancing

Question 37

Which of the following acronyms refers to any type of information pertaining to an individual that can be used to uniquely identify that person?

Answer 37

** PII **

Personally identifiable information (PII) is any data that could potentially identify a specific individual. Any information that can be used to distinguish one person from another and can be used to deanonymize previously anonymous data is considered PII.

Question 38

The US Health Insurance Portability and Accountability Act (HIPAA) provides privacy protection for: (Select best answer)

Answer 38

** PHI **

Protected health information (PHI) is the past, present and future of physical and mental health data and the condition of an individual created, received, stored or transmitted by HIPAA-covered entities and their business associates.

Question 39

In the context of IT security, the term “Data minimization” refers to the process of removing all unnecessary characters from the source code to make it less intelligible for humans and faster to process by machines.

Answer 39

** False **

In the context of IT security, “Data minimization” does not refer to removing unnecessary characters from source code.

Question 40

Replacing password characters in a password field with a series of asterisks is an example of:

Answer 40

** Data masking **

Replacing password characters in a password field with a series of asterisks is an example of “Data masking.” Data masking is a security technique used to hide or obfuscate sensitive data, such as passwords or credit card numbers, by replacing it with fictional or masked characters. This helps protect the confidentiality of the data and prevents unauthorized access to sensitive information.

Question 41

Which of the following privacy-enhancing technologies replaces actual data with a substitute that holds a reference to it but by itself does not represent any valuable information that could be used by an attacker?

Answer 41

** Tokenization **

The privacy-enhancing technology that replaces actual data with a substitute that holds a reference to it but by itself does not represent any valuable information that could be used by an attacker is “Tokenization.”

Question 42

The term “Anonymized data” refers to data that is made anonymous in such a way that the original subject or person described by the data can no longer be identified. This type of privacy-enhancing technology is used for example during mass population surveys to protect the identity of participants. Pseudo-anonymization (a.k.a. pseudonymization) replaces personal data with artificial identifiers (a.k.a. pseudonyms). The main difference between anonymization and pseudo-anonymization is that in case of the latter the original data can be restored to its original state with the use of additional reference information enabling the identification of the original subject or person the data pertains to.

Answer 42

True