CTS 1120 FINAL EXAM (MULTIPLE CHOICE) EXPECTED
QUESTIONS WITH VERIFIED ANSWERS
Question 1.
What a key principle of risk management programs?
ANSWER
Don't spend more to protect an asset than it is worth.
Question 2.
Adam is evaluating the security of a web server before it goes live. He believes that an issue in the
code allows an SQL injection attack against the server. What term describes the issue that Adam
discovered?
ANSWER
Vulnerability
Question 3.
Adam's company recently suffered an attack where hackers exploited an SQL injection issue on their
web server and stole sensitive information from a database. What term describes this activity?
ANSWER
Incident
Question 4.
Joe is responsible for the security of the industrial control systems for a power plant. What type of
environment does Joe administer?
ANSWER
Supervisory Control and Data Acquisition (SCADA)
,Question 5.
Beth is conducting a risk assessment. She is trying to determine the impact a security incident will
have on the reputation of her company. What type of risk assessment is best suited to this type of
analysis?
ANSWER
Qualitative
Question 6.
Kim is the risk manager for a large organization. She is evaluating whether the organization should
purchase a fire suppression system. She consulted a variety of subject matter experts and determined
that there is a 1 percent chance that a fire will occur in a given year. If a fire occurred, it would likely
cause $2 million in damage to the facility, which has a $10 million value. Given this scenario, what is
the exposure factor?
ANSWER
20 percent
Question 7.
Kim is the risk manager for a large organization. She is evaluating whether the organization should
purchase a fire suppression system. She consulted a variety of subject matter experts and determined
that there is a 1 percent chance that a fire will occur in a given year. If a fire occurred, it would likely
cause $2 million in damage to the facility, which has a $10 million value. Given this scenario, what is
the single loss expectancy (SLE)?
ANSWER
$2,000,000
Question 8.
Kim is the risk manager for a large organization. She is evaluating whether the organization should
purchase a fire suppression system. She consulted a variety of subject matter experts and determined
that there is a 1 percent chance that a fire will occur in a given year. If a fire occurred, it would likely
cause $2 million in damage to the facility, which has a $10 million value. Given this scenario, what is
the annualized loss expectancy (ALE)?
ANSWER
$20,000
,Question 9.
Purchasing an insurance policy is an example of the ____________ risk management strategy.
ANSWER
transfer
Question 10.
Alan is the security manager for a mid-sized business. The company has suffered several serious data
loss- es when mobile devices were stolen. Alan decides to implement full disk encryption on all mobile
devices. What risk response did Alan take?
ANSWER
Reduce
Question 11.
What term describes the risk that exists after an organization has performed all planned
countermeasures and controls?
ANSWER
Residual risk
Question 12.
Violet deploys an intrusion prevention system (IPS) on her network as a security control. What type of
control has Violet deployed?
ANSWER
Preventive
Question 13.
Brian needs to design a control that prevents piggybacking, only allowing one person to enter a
facility at a time. What type of control would best meet this need?
ANSWER
Mantraps
, Question 14.
What term describes the longest period of time that a business can survive without a particular critical
system?
ANSWER
Maximum tolerable downtime (MTD)
Question 15.
Which control is NOT an example of a fault tolerance technique designed to avoid interruptions that
would cause downtime?
ANSWER
Warm site
Question 16.
Nancy performs a full backup of her server every Sunday at 1 A.M. and differential backups on
Mondays through Fridays at 1 A.M. Her server fails at 9 A.M. Wednesday. How many backups does
Nancy need to restore?
ANSWER
2
Question 17.
Which data source comes first in the order of volatility when conducting a forensic investigation?
ANSWER
RAM
Question 18.
Which recovery site option provides readiness in minutes to hours?
ANSWER
Hot site
QUESTIONS WITH VERIFIED ANSWERS
Question 1.
What a key principle of risk management programs?
ANSWER
Don't spend more to protect an asset than it is worth.
Question 2.
Adam is evaluating the security of a web server before it goes live. He believes that an issue in the
code allows an SQL injection attack against the server. What term describes the issue that Adam
discovered?
ANSWER
Vulnerability
Question 3.
Adam's company recently suffered an attack where hackers exploited an SQL injection issue on their
web server and stole sensitive information from a database. What term describes this activity?
ANSWER
Incident
Question 4.
Joe is responsible for the security of the industrial control systems for a power plant. What type of
environment does Joe administer?
ANSWER
Supervisory Control and Data Acquisition (SCADA)
,Question 5.
Beth is conducting a risk assessment. She is trying to determine the impact a security incident will
have on the reputation of her company. What type of risk assessment is best suited to this type of
analysis?
ANSWER
Qualitative
Question 6.
Kim is the risk manager for a large organization. She is evaluating whether the organization should
purchase a fire suppression system. She consulted a variety of subject matter experts and determined
that there is a 1 percent chance that a fire will occur in a given year. If a fire occurred, it would likely
cause $2 million in damage to the facility, which has a $10 million value. Given this scenario, what is
the exposure factor?
ANSWER
20 percent
Question 7.
Kim is the risk manager for a large organization. She is evaluating whether the organization should
purchase a fire suppression system. She consulted a variety of subject matter experts and determined
that there is a 1 percent chance that a fire will occur in a given year. If a fire occurred, it would likely
cause $2 million in damage to the facility, which has a $10 million value. Given this scenario, what is
the single loss expectancy (SLE)?
ANSWER
$2,000,000
Question 8.
Kim is the risk manager for a large organization. She is evaluating whether the organization should
purchase a fire suppression system. She consulted a variety of subject matter experts and determined
that there is a 1 percent chance that a fire will occur in a given year. If a fire occurred, it would likely
cause $2 million in damage to the facility, which has a $10 million value. Given this scenario, what is
the annualized loss expectancy (ALE)?
ANSWER
$20,000
,Question 9.
Purchasing an insurance policy is an example of the ____________ risk management strategy.
ANSWER
transfer
Question 10.
Alan is the security manager for a mid-sized business. The company has suffered several serious data
loss- es when mobile devices were stolen. Alan decides to implement full disk encryption on all mobile
devices. What risk response did Alan take?
ANSWER
Reduce
Question 11.
What term describes the risk that exists after an organization has performed all planned
countermeasures and controls?
ANSWER
Residual risk
Question 12.
Violet deploys an intrusion prevention system (IPS) on her network as a security control. What type of
control has Violet deployed?
ANSWER
Preventive
Question 13.
Brian needs to design a control that prevents piggybacking, only allowing one person to enter a
facility at a time. What type of control would best meet this need?
ANSWER
Mantraps
, Question 14.
What term describes the longest period of time that a business can survive without a particular critical
system?
ANSWER
Maximum tolerable downtime (MTD)
Question 15.
Which control is NOT an example of a fault tolerance technique designed to avoid interruptions that
would cause downtime?
ANSWER
Warm site
Question 16.
Nancy performs a full backup of her server every Sunday at 1 A.M. and differential backups on
Mondays through Fridays at 1 A.M. Her server fails at 9 A.M. Wednesday. How many backups does
Nancy need to restore?
ANSWER
2
Question 17.
Which data source comes first in the order of volatility when conducting a forensic investigation?
ANSWER
RAM
Question 18.
Which recovery site option provides readiness in minutes to hours?
ANSWER
Hot site
