CYBR 3123 UPDATED EXAM QUESTIONS AND CORRECT ANSWERS
WITH GUARANTEED PASS (LATEST 2026-2027)
1. What are the three main principles of the CIA triad?
Confidentiality, Integrity, and Availability. Confidentiality ensures information is
accessible only to authorized individuals, Integrity ensures data accuracy and
trustworthiness, and Availability ensures systems and data are accessible when
needed.
2. What is the difference between a threat and a vulnerability?
A threat is a potential danger that could exploit a vulnerability, while a
vulnerability is a weakness in a system that could be exploited. A threat is external,
whereas a vulnerability is internal to the system.
3. Define risk in the context of information security.
Risk is the potential for loss or damage when a threat exploits a vulnerability. It is
typically calculated as: Risk = Threat × Vulnerability × Impact.
4. What is defense in depth?
Defense in depth is a security strategy that employs multiple layers of security
controls throughout an IT system. If one layer fails, others still provide protection,
creating redundancy in security measures.
5. What is the principle of least privilege?
The principle of least privilege means granting users only the minimum access
rights necessary to perform their job functions, reducing the potential damage from
accidents or malicious actions.
6. What is separation of duties?
,Separation of duties is a security principle where critical tasks are divided among
multiple people to prevent fraud and errors. No single person should have complete
control over a critical function.
7. What is the difference between authentication and authorization?
Authentication is the process of verifying a user's identity (who you are), while
authorization determines what resources a user can access after authentication
(what you can do).
8. What is non-repudiation?
Non-repudiation ensures that a person cannot deny having performed a specific
action. It is typically achieved through digital signatures and audit logs.
9. What is the AAA framework in security?
AAA stands for Authentication, Authorization, and Accounting. It is a framework
for controlling access to computer resources, enforcing policies, and auditing
usage.
10.What is the difference between qualitative and quantitative risk
assessment?
Qualitative risk assessment uses descriptive categories (high, medium, low) to
evaluate risk, while quantitative risk assessment uses numerical values and
calculations to measure risk in monetary terms.
11.What is security awareness training?
Security awareness training educates users about security policies, procedures, and
best practices to help them recognize and respond appropriately to security threats.
12.What is a security policy?
A security policy is a formal document that defines an organization's security
requirements, objectives, and the rules for protecting assets. It provides guidance
for decision-making and establishes accountability.
13.What is the difference between physical and logical security controls?
Physical security controls protect physical assets (locks, cameras, guards), while
logical security controls protect digital assets (passwords, encryption, firewalls).
, 14.What is due diligence in information security?
Due diligence is the process of investigating and understanding security risks
before making decisions. It involves assessing threats, vulnerabilities, and potential
impacts.
15.What is due care?
Due care means taking reasonable steps to protect assets based on known risks. It
involves implementing appropriate security measures and following best practices.
16.What is a security baseline?
A security baseline is a minimum level of security controls that must be
implemented for a system or organization. It serves as a starting point for security
configuration.
17.What is change management in security?
Change management is a formal process for making changes to IT systems while
minimizing security risks. It includes documenting, testing, approving, and
implementing changes systematically.
18.What is configuration management?
Configuration management is the process of maintaining systems in a desired,
consistent state by tracking and controlling changes to hardware and software
configurations.
19.What is patch management?
Patch management is the process of identifying, testing, and deploying software
updates (patches) to fix vulnerabilities and bugs in a timely and controlled manner.
20.What is an acceptable use policy (AUP)?
An AUP is a document that outlines the permitted uses of an organization's IT
resources and the consequences of misuse. It helps protect the organization from
legal liability.
21.What is the purpose of security auditing?
Security auditing involves systematic evaluation of an organization's information
systems to ensure compliance with policies and regulations, identify
vulnerabilities, and verify the effectiveness of security controls.
, 22.What is a data classification policy?
A data classification policy defines categories for data based on sensitivity and
value (e.g., public, confidential, secret) and specifies appropriate handling and
protection measures for each category.
23.What is the difference between privacy and security?
Privacy focuses on controlling who has access to personal information and how it's
used, while security focuses on protecting information from unauthorized access,
use, disclosure, or destruction.
24.What is a security incident?
A security incident is an event that threatens the confidentiality, integrity, or
availability of information or systems. It includes breaches, malware infections,
and unauthorized access attempts.
25.What is incident response?
Incident response is a structured approach to handling security incidents, including
preparation, detection, analysis, containment, eradication, recovery, and lessons
learned.
26.What is business continuity planning (BCP)?
BCP is the process of creating systems of prevention and recovery to deal with
potential threats to an organization, ensuring continued business operations during
and after a disruption.
27.What is disaster recovery planning (DRP)?
DRP focuses on restoring IT systems and data after a disaster. It's a subset of BCP
that specifically addresses technology recovery procedures.
28.What is the Recovery Time Objective (RTO)?
RTO is the maximum acceptable time that a system can be down after a disaster
before the organization suffers unacceptable consequences.
29.What is the Recovery Point Objective (RPO)?
RPO is the maximum acceptable amount of data loss measured in time. It
determines how frequently backups must be performed.
WITH GUARANTEED PASS (LATEST 2026-2027)
1. What are the three main principles of the CIA triad?
Confidentiality, Integrity, and Availability. Confidentiality ensures information is
accessible only to authorized individuals, Integrity ensures data accuracy and
trustworthiness, and Availability ensures systems and data are accessible when
needed.
2. What is the difference between a threat and a vulnerability?
A threat is a potential danger that could exploit a vulnerability, while a
vulnerability is a weakness in a system that could be exploited. A threat is external,
whereas a vulnerability is internal to the system.
3. Define risk in the context of information security.
Risk is the potential for loss or damage when a threat exploits a vulnerability. It is
typically calculated as: Risk = Threat × Vulnerability × Impact.
4. What is defense in depth?
Defense in depth is a security strategy that employs multiple layers of security
controls throughout an IT system. If one layer fails, others still provide protection,
creating redundancy in security measures.
5. What is the principle of least privilege?
The principle of least privilege means granting users only the minimum access
rights necessary to perform their job functions, reducing the potential damage from
accidents or malicious actions.
6. What is separation of duties?
,Separation of duties is a security principle where critical tasks are divided among
multiple people to prevent fraud and errors. No single person should have complete
control over a critical function.
7. What is the difference between authentication and authorization?
Authentication is the process of verifying a user's identity (who you are), while
authorization determines what resources a user can access after authentication
(what you can do).
8. What is non-repudiation?
Non-repudiation ensures that a person cannot deny having performed a specific
action. It is typically achieved through digital signatures and audit logs.
9. What is the AAA framework in security?
AAA stands for Authentication, Authorization, and Accounting. It is a framework
for controlling access to computer resources, enforcing policies, and auditing
usage.
10.What is the difference between qualitative and quantitative risk
assessment?
Qualitative risk assessment uses descriptive categories (high, medium, low) to
evaluate risk, while quantitative risk assessment uses numerical values and
calculations to measure risk in monetary terms.
11.What is security awareness training?
Security awareness training educates users about security policies, procedures, and
best practices to help them recognize and respond appropriately to security threats.
12.What is a security policy?
A security policy is a formal document that defines an organization's security
requirements, objectives, and the rules for protecting assets. It provides guidance
for decision-making and establishes accountability.
13.What is the difference between physical and logical security controls?
Physical security controls protect physical assets (locks, cameras, guards), while
logical security controls protect digital assets (passwords, encryption, firewalls).
, 14.What is due diligence in information security?
Due diligence is the process of investigating and understanding security risks
before making decisions. It involves assessing threats, vulnerabilities, and potential
impacts.
15.What is due care?
Due care means taking reasonable steps to protect assets based on known risks. It
involves implementing appropriate security measures and following best practices.
16.What is a security baseline?
A security baseline is a minimum level of security controls that must be
implemented for a system or organization. It serves as a starting point for security
configuration.
17.What is change management in security?
Change management is a formal process for making changes to IT systems while
minimizing security risks. It includes documenting, testing, approving, and
implementing changes systematically.
18.What is configuration management?
Configuration management is the process of maintaining systems in a desired,
consistent state by tracking and controlling changes to hardware and software
configurations.
19.What is patch management?
Patch management is the process of identifying, testing, and deploying software
updates (patches) to fix vulnerabilities and bugs in a timely and controlled manner.
20.What is an acceptable use policy (AUP)?
An AUP is a document that outlines the permitted uses of an organization's IT
resources and the consequences of misuse. It helps protect the organization from
legal liability.
21.What is the purpose of security auditing?
Security auditing involves systematic evaluation of an organization's information
systems to ensure compliance with policies and regulations, identify
vulnerabilities, and verify the effectiveness of security controls.
, 22.What is a data classification policy?
A data classification policy defines categories for data based on sensitivity and
value (e.g., public, confidential, secret) and specifies appropriate handling and
protection measures for each category.
23.What is the difference between privacy and security?
Privacy focuses on controlling who has access to personal information and how it's
used, while security focuses on protecting information from unauthorized access,
use, disclosure, or destruction.
24.What is a security incident?
A security incident is an event that threatens the confidentiality, integrity, or
availability of information or systems. It includes breaches, malware infections,
and unauthorized access attempts.
25.What is incident response?
Incident response is a structured approach to handling security incidents, including
preparation, detection, analysis, containment, eradication, recovery, and lessons
learned.
26.What is business continuity planning (BCP)?
BCP is the process of creating systems of prevention and recovery to deal with
potential threats to an organization, ensuring continued business operations during
and after a disruption.
27.What is disaster recovery planning (DRP)?
DRP focuses on restoring IT systems and data after a disaster. It's a subset of BCP
that specifically addresses technology recovery procedures.
28.What is the Recovery Time Objective (RTO)?
RTO is the maximum acceptable time that a system can be down after a disaster
before the organization suffers unacceptable consequences.
29.What is the Recovery Point Objective (RPO)?
RPO is the maximum acceptable amount of data loss measured in time. It
determines how frequently backups must be performed.
