CTS 1120 – Final
Comprehensive Resource To Help You Ace 2026-2027 Exams
Includes Frequently Tested Questions With Elaborated 100%
Correct Complete Solutions
Guaranteed Pass First Attempt!! Current Update!!
1. What is a key principle of risk management programs?
A. Eliminate all risk regardless of cost
B. Transfer every risk to an insurer
C. Don’t spend more to protect an asset than it is worth
D. Protect only the most expensive assets
Rationale: Controls must be cost-justified relative to the value of what they
protect.
2. Adam believes a code issue lets an attacker perform SQL injection against a
web server before it goes live. What term describes the issue?
A. Threat
B. Vulnerability
C. Incident
D. Countermeasure
Rationale: A vulnerability is a weakness that could be exploited. No attack has
happened yet.
3. Hackers exploited an SQL injection flaw and stole data from the database.
What term describes this activity?
A. Vulnerability
B. Risk
C. Incident
D. Control
Rationale: An incident is an event where a security weakness is actually exploited.
,4. Joe administers industrial control systems for a power plant. What type of
environment is this?
A. Enterprise resource planning (ERP)
B. Public key infrastructure (PKI)
C. Supervisory Control and Data Acquisition (SCADA)
D. Software-defined network
Rationale: SCADA systems monitor and control physical industrial processes.
5. Beth wants to assess the impact of an incident on her company’s reputation.
Which type of risk assessment fits best?
A. Quantitative
B. Qualitative
C. Statistical
D. Technical scan
Rationale: Reputation is hard to express in dollars, so a qualitative (descriptive,
rating-based) assessment suits it.
6. A fire has a 1% yearly chance and would cause $2 million damage to a $10
million facility. What is the exposure factor?
A. 1%
B. 2%
C. 20%
D. 100%
Rationale: EF = loss ÷ asset value = $2M ÷ $10M = 20%.
7. Using the same scenario, what is the single loss expectancy (SLE)?
A. $20,000
B. $100,000
C. $2,000,000
D. $10,000,000
Rationale: SLE = asset value × EF = $10M × 0.20 = $2M.
,8. Using the same scenario, what is the annualized loss expectancy (ALE)?
A. $2,000,000
B. $20,000
C. $200,000
D. $100,000
Rationale: ALE = SLE × annual rate of occurrence = $2M × 0.01 = $20,000.
9. Purchasing an insurance policy is an example of which risk strategy?
A. Avoid
B. Accept
C. Transfer
D. Reduce
Rationale: Insurance shifts the financial impact of a loss to a third party.
10. After several lost mobile devices exposed data, Alan implements full disk
encryption on all devices. What risk response is this?
A. Accept
B. Transfer
C. Avoid
D. Reduce
Rationale: Encryption lowers the impact of a theft, which is risk reduction
(mitigation).
11. What term describes the risk remaining after all planned countermeasures
and controls are in place?
A. Inherent risk
B. Residual risk
C. Transferred risk
D. Acceptable loss
Rationale: Residual risk is what is left after controls are applied.
12. Violet deploys an intrusion prevention system (IPS). What type of control is
this?
, A. Detective
B. Corrective
C. Preventive
D. Recovery
Rationale: An IPS actively blocks malicious traffic before it causes harm.
13. Brian needs a control that prevents piggybacking by allowing only one
person into a facility at a time. Which control fits?
A. Security cameras
B. Badge readers
C. Mantraps
D. Motion detectors
Rationale: A mantrap is a double-door vestibule that admits one person at a time.
14. What is the longest period a business can survive without a critical system?
A. Recovery time objective (RTO)
B. Maximum tolerable downtime (MTD)
C. Recovery point objective (RPO)
D. Mean time to repair
Rationale: MTD is the absolute limit before the business suffers unacceptable
damage.
15. Which of the following is NOT a fault tolerance technique?
A. RAID storage
B. Redundant power supplies
C. Server clustering
D. Warm site
Rationale: A warm site is a recovery option used after an outage, not a way to
avoid downtime in the first place.
16. Nancy takes a full backup Sunday 1 A.M. and differentials Monday-Friday at
1 A.M. Her server fails Wednesday 9 A.M. How many backups must she restore?
A. 1
Comprehensive Resource To Help You Ace 2026-2027 Exams
Includes Frequently Tested Questions With Elaborated 100%
Correct Complete Solutions
Guaranteed Pass First Attempt!! Current Update!!
1. What is a key principle of risk management programs?
A. Eliminate all risk regardless of cost
B. Transfer every risk to an insurer
C. Don’t spend more to protect an asset than it is worth
D. Protect only the most expensive assets
Rationale: Controls must be cost-justified relative to the value of what they
protect.
2. Adam believes a code issue lets an attacker perform SQL injection against a
web server before it goes live. What term describes the issue?
A. Threat
B. Vulnerability
C. Incident
D. Countermeasure
Rationale: A vulnerability is a weakness that could be exploited. No attack has
happened yet.
3. Hackers exploited an SQL injection flaw and stole data from the database.
What term describes this activity?
A. Vulnerability
B. Risk
C. Incident
D. Control
Rationale: An incident is an event where a security weakness is actually exploited.
,4. Joe administers industrial control systems for a power plant. What type of
environment is this?
A. Enterprise resource planning (ERP)
B. Public key infrastructure (PKI)
C. Supervisory Control and Data Acquisition (SCADA)
D. Software-defined network
Rationale: SCADA systems monitor and control physical industrial processes.
5. Beth wants to assess the impact of an incident on her company’s reputation.
Which type of risk assessment fits best?
A. Quantitative
B. Qualitative
C. Statistical
D. Technical scan
Rationale: Reputation is hard to express in dollars, so a qualitative (descriptive,
rating-based) assessment suits it.
6. A fire has a 1% yearly chance and would cause $2 million damage to a $10
million facility. What is the exposure factor?
A. 1%
B. 2%
C. 20%
D. 100%
Rationale: EF = loss ÷ asset value = $2M ÷ $10M = 20%.
7. Using the same scenario, what is the single loss expectancy (SLE)?
A. $20,000
B. $100,000
C. $2,000,000
D. $10,000,000
Rationale: SLE = asset value × EF = $10M × 0.20 = $2M.
,8. Using the same scenario, what is the annualized loss expectancy (ALE)?
A. $2,000,000
B. $20,000
C. $200,000
D. $100,000
Rationale: ALE = SLE × annual rate of occurrence = $2M × 0.01 = $20,000.
9. Purchasing an insurance policy is an example of which risk strategy?
A. Avoid
B. Accept
C. Transfer
D. Reduce
Rationale: Insurance shifts the financial impact of a loss to a third party.
10. After several lost mobile devices exposed data, Alan implements full disk
encryption on all devices. What risk response is this?
A. Accept
B. Transfer
C. Avoid
D. Reduce
Rationale: Encryption lowers the impact of a theft, which is risk reduction
(mitigation).
11. What term describes the risk remaining after all planned countermeasures
and controls are in place?
A. Inherent risk
B. Residual risk
C. Transferred risk
D. Acceptable loss
Rationale: Residual risk is what is left after controls are applied.
12. Violet deploys an intrusion prevention system (IPS). What type of control is
this?
, A. Detective
B. Corrective
C. Preventive
D. Recovery
Rationale: An IPS actively blocks malicious traffic before it causes harm.
13. Brian needs a control that prevents piggybacking by allowing only one
person into a facility at a time. Which control fits?
A. Security cameras
B. Badge readers
C. Mantraps
D. Motion detectors
Rationale: A mantrap is a double-door vestibule that admits one person at a time.
14. What is the longest period a business can survive without a critical system?
A. Recovery time objective (RTO)
B. Maximum tolerable downtime (MTD)
C. Recovery point objective (RPO)
D. Mean time to repair
Rationale: MTD is the absolute limit before the business suffers unacceptable
damage.
15. Which of the following is NOT a fault tolerance technique?
A. RAID storage
B. Redundant power supplies
C. Server clustering
D. Warm site
Rationale: A warm site is a recovery option used after an outage, not a way to
avoid downtime in the first place.
16. Nancy takes a full backup Sunday 1 A.M. and differentials Monday-Friday at
1 A.M. Her server fails Wednesday 9 A.M. How many backups must she restore?
A. 1
