CTS 1120 - Final Exam Questions With
Correct Answers
What a key principle of risk management programs? - CORRECT
| | | | | | | | | |
ANSWER✔✔-Don't spend more to protect an asset than it is worth. | | | | | | | | | |
Adam is evaluating the security of a web server before it goes live. He
| | | | | | | | | | | | | |
believes that an issue in the code allows an SQL injection attack against
| | | | | | | | | | | | |
the server. What term describes the issue that Adam discovered? -
| | | | | | | | | | |
CORRECT ANSWER✔✔-Vulnerability |
Adam's company recently suffered an attack where hackers exploited an
| | | | | | | | |
SQL injection issue on their web server and stole sensitive information
| | | | | | | | | | | |
from a database. What term describes this activity? - CORRECT
| | | | | | | | | |
ANSWER✔✔-Incident
Joe is responsible for the security of the industrial control systems for a
| | | | | | | | | | | | |
power plant. What type of environment does Joe administer? -
| | | | | | | | | |
CORRECT ANSWER✔✔-Supervisory Control and Data Acquisition
| | | | | |
(SCADA)
,Beth is conducting a risk assessment. She is trying to determine the
| | | | | | | | | | | |
impact a security incident will have on the reputation of her company.
| | | | | | | | | | | |
What type of risk assessment is best suited to this type of analysis? -
| | | | | | | | | | | | | |
CORRECT ANSWER✔✔-Qualitative |
Kim is the risk manager for a large organization. She is evaluating
| | | | | | | | | | | |
whether the organization should purchase a fire suppression system.
| | | | | | | | |
She consulted a variety of subject matter experts and determined that
| | | | | | | | | | |
there is a 1 percent chance that a fire will occur in a given year. If a fire
| | | | | | | | | | | | | | | | | |
occurred, it would likely cause $2 million in damage to the facility, which
| | | | | | | | | | | |
|has a $10 million value. Given this scenario, what is the exposure
| | | | | | | | | | | |
factor? - CORRECT ANSWER✔✔-20 percent
| | | |
Kim is the risk manager for a large organization. She is evaluating
| | | | | | | | | | | |
whether the organization should purchase a fire suppression system.
| | | | | | | | |
She consulted a variety of subject matter experts and determined that
| | | | | | | | | | |
there is a 1 percent chance that a fire will occur in a given year. If a fire
| | | | | | | | | | | | | | | | | |
occurred, it would likely cause $2 million in damage to the facility, which
| | | | | | | | | | | |
has a $10 million value. Given this scenario, what is the single loss
| | | | | | | | | | | | | |
expectancy (SLE)? - CORRECT ANSWER✔✔-$2,000,000
| | | |
Kim is the risk manager for a large organization. She is evaluating
| | | | | | | | | | | |
whether the organization should purchase a fire suppression system.
| | | | | | | | |
She consulted a variety of subject matter experts and determined that
| | | | | | | | | | |
there is a 1 percent chance that a fire will occur in a given year. If a fire
| | | | | | | | | | | | | | | | | |
occurred, it would likely cause $2 million in damage to the facility, which
| | | | | | | | | | | |
, has a $10 million value. Given this scenario, what is the annualized loss
| | | | | | | | | | | | | |
expectancy (ALE)? - CORRECT ANSWER✔✔-$20,000| | | |
Purchasing an insurance policy is an example of the ____________ risk
| | | | | | | | | | |
management strategy. - CORRECT ANSWER✔✔-transfer | | | |
Alan is the security manager for a mid-sized business. The company has
| | | | | | | | | | | |
suffered several serious data losses when mobile devices were stolen.
| | | | | | | | | |
Alan decides to implement full disk encryption on all mobile devices.
| | | | | | | | | | |
What risk response did Alan take? - CORRECT ANSWER✔✔-Reduce
| | | | | | | |
What term describes the risk that exists after an organization has
| | | | | | | | | | |
performed all planned countermeasures and controls? - CORRECT
| | | | | | | |
ANSWER✔✔-Residual risk |
Violet deploys an intrusion prevention system (IPS) on her network as a
| | | | | | | | | | | |
security control. What type of control has Violet deployed? - CORRECT
| | | | | | | | | | |
ANSWER✔✔-Preventive
Brian needs to design a control that prevents piggybacking, only
| | | | | | | | | |
allowing one person to enter a facility at a time. What type of control
| | | | | | | | | | | | | |
would best meet this need? - CORRECT ANSWER✔✔-Mantraps
| | | | | | |
Correct Answers
What a key principle of risk management programs? - CORRECT
| | | | | | | | | |
ANSWER✔✔-Don't spend more to protect an asset than it is worth. | | | | | | | | | |
Adam is evaluating the security of a web server before it goes live. He
| | | | | | | | | | | | | |
believes that an issue in the code allows an SQL injection attack against
| | | | | | | | | | | | |
the server. What term describes the issue that Adam discovered? -
| | | | | | | | | | |
CORRECT ANSWER✔✔-Vulnerability |
Adam's company recently suffered an attack where hackers exploited an
| | | | | | | | |
SQL injection issue on their web server and stole sensitive information
| | | | | | | | | | | |
from a database. What term describes this activity? - CORRECT
| | | | | | | | | |
ANSWER✔✔-Incident
Joe is responsible for the security of the industrial control systems for a
| | | | | | | | | | | | |
power plant. What type of environment does Joe administer? -
| | | | | | | | | |
CORRECT ANSWER✔✔-Supervisory Control and Data Acquisition
| | | | | |
(SCADA)
,Beth is conducting a risk assessment. She is trying to determine the
| | | | | | | | | | | |
impact a security incident will have on the reputation of her company.
| | | | | | | | | | | |
What type of risk assessment is best suited to this type of analysis? -
| | | | | | | | | | | | | |
CORRECT ANSWER✔✔-Qualitative |
Kim is the risk manager for a large organization. She is evaluating
| | | | | | | | | | | |
whether the organization should purchase a fire suppression system.
| | | | | | | | |
She consulted a variety of subject matter experts and determined that
| | | | | | | | | | |
there is a 1 percent chance that a fire will occur in a given year. If a fire
| | | | | | | | | | | | | | | | | |
occurred, it would likely cause $2 million in damage to the facility, which
| | | | | | | | | | | |
|has a $10 million value. Given this scenario, what is the exposure
| | | | | | | | | | | |
factor? - CORRECT ANSWER✔✔-20 percent
| | | |
Kim is the risk manager for a large organization. She is evaluating
| | | | | | | | | | | |
whether the organization should purchase a fire suppression system.
| | | | | | | | |
She consulted a variety of subject matter experts and determined that
| | | | | | | | | | |
there is a 1 percent chance that a fire will occur in a given year. If a fire
| | | | | | | | | | | | | | | | | |
occurred, it would likely cause $2 million in damage to the facility, which
| | | | | | | | | | | |
has a $10 million value. Given this scenario, what is the single loss
| | | | | | | | | | | | | |
expectancy (SLE)? - CORRECT ANSWER✔✔-$2,000,000
| | | |
Kim is the risk manager for a large organization. She is evaluating
| | | | | | | | | | | |
whether the organization should purchase a fire suppression system.
| | | | | | | | |
She consulted a variety of subject matter experts and determined that
| | | | | | | | | | |
there is a 1 percent chance that a fire will occur in a given year. If a fire
| | | | | | | | | | | | | | | | | |
occurred, it would likely cause $2 million in damage to the facility, which
| | | | | | | | | | | |
, has a $10 million value. Given this scenario, what is the annualized loss
| | | | | | | | | | | | | |
expectancy (ALE)? - CORRECT ANSWER✔✔-$20,000| | | |
Purchasing an insurance policy is an example of the ____________ risk
| | | | | | | | | | |
management strategy. - CORRECT ANSWER✔✔-transfer | | | |
Alan is the security manager for a mid-sized business. The company has
| | | | | | | | | | | |
suffered several serious data losses when mobile devices were stolen.
| | | | | | | | | |
Alan decides to implement full disk encryption on all mobile devices.
| | | | | | | | | | |
What risk response did Alan take? - CORRECT ANSWER✔✔-Reduce
| | | | | | | |
What term describes the risk that exists after an organization has
| | | | | | | | | | |
performed all planned countermeasures and controls? - CORRECT
| | | | | | | |
ANSWER✔✔-Residual risk |
Violet deploys an intrusion prevention system (IPS) on her network as a
| | | | | | | | | | | |
security control. What type of control has Violet deployed? - CORRECT
| | | | | | | | | | |
ANSWER✔✔-Preventive
Brian needs to design a control that prevents piggybacking, only
| | | | | | | | | |
allowing one person to enter a facility at a time. What type of control
| | | | | | | | | | | | | |
would best meet this need? - CORRECT ANSWER✔✔-Mantraps
| | | | | | |
