Lamar University MISY 5325: Cybersecurity Management — Final Exam ||
Most Recent Exam 2026|2027 Actual Complete Real Exam Questions
And Correct Answers (Verified Answers) Already Graded A+ |
Guaranteed Success! Newest Exam | Just Released!!
A company determines that a cybersecurity risk exceeds its
established acceptable level. What should management generally do?
A. Ignore the risk until an incident occurs
B. Increase the organization's exposure to the risk
C. Select an appropriate risk treatment strategy
D. Remove the risk from the risk register
Answer: C
Rationale: When risk exceeds an organization's acceptable or defined
tolerance, management should determine an appropriate treatment,
such as mitigation, transfer, avoidance, or—in some circumstances—
acceptance with appropriate authorization.
Which risk response involves implementing safeguards to reduce either
the likelihood or impact of a risk?
A. Risk mitigation
B. Risk avoidance
C. Risk acceptance
D. Risk termination
Answer: A
,Rationale: Risk mitigation involves reducing risk through controls or
other measures. Examples include patching vulnerable systems,
implementing access controls, and deploying monitoring technologies.
Which security objective is concerned with preventing unauthorized
modification of information?
A. Confidentiality
B. Integrity
C. Availability
D. Accountability
Answer: B
Rationale: Integrity ensures that information remains accurate,
complete, and protected from unauthorized alteration or destruction.
Which security objective ensures that authorized users can access
systems and information when needed?
A. Confidentiality
B. Integrity
C. Availability
D. Nonrepudiation
Answer: C
Rationale: Availability focuses on ensuring that authorized users can
access systems, applications, and information when required.
,Which activity is most closely associated with asset management?
A. Identifying and maintaining an inventory of organizational assets
B. Removing all organizational assets from the network
C. Encrypting every file regardless of sensitivity
D. Eliminating cybersecurity policies
Answer: A
Rationale: Effective asset management requires an organization to
know what assets it owns or relies upon, where they are located, their
importance, and how they should be protected.
Which of the following best describes the primary purpose of
cybersecurity risk management?
A. Eliminating every possible security threat
B. Identifying, assessing, and managing risks to organizational
information and systems
C. Increasing the number of security technologies used by an
organization
D. Preventing employees from accessing organizational systems
Answer: B
Rationale: Cybersecurity risk management is a structured process for
identifying threats and vulnerabilities, assessing their potential impact
and likelihood, and selecting appropriate responses. It is not possible
or economically practical to eliminate every risk.
, An organization identifies a vulnerability in a critical database but
determines that exploiting it would have minimal business impact.
Which risk-assessment factor is being considered?
A. Likelihood only
B. Impact
C. Authentication
D. Encryption strength
Answer: B
Rationale: Impact refers to the magnitude of harm that could result if
a risk materializes. Risk assessment generally considers both the
likelihood of an event and its potential consequences.
Which statement best distinguishes a threat from a vulnerability?
A. A threat is a weakness, whereas a vulnerability is an attack
B. A threat is a potential cause of harm, whereas a vulnerability is a
weakness that can be exploited
C. A threat is always intentional, whereas a vulnerability is always
accidental D. A threat and vulnerability are interchangeable terms
Answer: B
Rationale: A threat represents a potential source or cause of harm,
while a vulnerability is a weakness that could be exploited by a threat.
Understanding this distinction is fundamental to risk analysis.
Most Recent Exam 2026|2027 Actual Complete Real Exam Questions
And Correct Answers (Verified Answers) Already Graded A+ |
Guaranteed Success! Newest Exam | Just Released!!
A company determines that a cybersecurity risk exceeds its
established acceptable level. What should management generally do?
A. Ignore the risk until an incident occurs
B. Increase the organization's exposure to the risk
C. Select an appropriate risk treatment strategy
D. Remove the risk from the risk register
Answer: C
Rationale: When risk exceeds an organization's acceptable or defined
tolerance, management should determine an appropriate treatment,
such as mitigation, transfer, avoidance, or—in some circumstances—
acceptance with appropriate authorization.
Which risk response involves implementing safeguards to reduce either
the likelihood or impact of a risk?
A. Risk mitigation
B. Risk avoidance
C. Risk acceptance
D. Risk termination
Answer: A
,Rationale: Risk mitigation involves reducing risk through controls or
other measures. Examples include patching vulnerable systems,
implementing access controls, and deploying monitoring technologies.
Which security objective is concerned with preventing unauthorized
modification of information?
A. Confidentiality
B. Integrity
C. Availability
D. Accountability
Answer: B
Rationale: Integrity ensures that information remains accurate,
complete, and protected from unauthorized alteration or destruction.
Which security objective ensures that authorized users can access
systems and information when needed?
A. Confidentiality
B. Integrity
C. Availability
D. Nonrepudiation
Answer: C
Rationale: Availability focuses on ensuring that authorized users can
access systems, applications, and information when required.
,Which activity is most closely associated with asset management?
A. Identifying and maintaining an inventory of organizational assets
B. Removing all organizational assets from the network
C. Encrypting every file regardless of sensitivity
D. Eliminating cybersecurity policies
Answer: A
Rationale: Effective asset management requires an organization to
know what assets it owns or relies upon, where they are located, their
importance, and how they should be protected.
Which of the following best describes the primary purpose of
cybersecurity risk management?
A. Eliminating every possible security threat
B. Identifying, assessing, and managing risks to organizational
information and systems
C. Increasing the number of security technologies used by an
organization
D. Preventing employees from accessing organizational systems
Answer: B
Rationale: Cybersecurity risk management is a structured process for
identifying threats and vulnerabilities, assessing their potential impact
and likelihood, and selecting appropriate responses. It is not possible
or economically practical to eliminate every risk.
, An organization identifies a vulnerability in a critical database but
determines that exploiting it would have minimal business impact.
Which risk-assessment factor is being considered?
A. Likelihood only
B. Impact
C. Authentication
D. Encryption strength
Answer: B
Rationale: Impact refers to the magnitude of harm that could result if
a risk materializes. Risk assessment generally considers both the
likelihood of an event and its potential consequences.
Which statement best distinguishes a threat from a vulnerability?
A. A threat is a weakness, whereas a vulnerability is an attack
B. A threat is a potential cause of harm, whereas a vulnerability is a
weakness that can be exploited
C. A threat is always intentional, whereas a vulnerability is always
accidental D. A threat and vulnerability are interchangeable terms
Answer: B
Rationale: A threat represents a potential source or cause of harm,
while a vulnerability is a weakness that could be exploited by a threat.
Understanding this distinction is fundamental to risk analysis.
