Top Mark Questions and Correct Verified Answers
C795- Cybersecurity Management II
(Tactical) Questions and Correct
Verified Answers
What is a vulnerability?
✓ a weakness in an information system, system security procedures, internal
controls, or implementation that could be exploited or triggered by a threat
source.
What is a penetration test?
✓ a simulated cyber attack against your systems or company
What are the typical steps for a vulnerability test?
✓ Identify asset classification list, identify vulnerabilities, test assets against
vulnerabilities, and recommend solutions to either eliminate or mitigate
vulnerabilities
What is the first thing an organization should do before defining security requirements?
✓ To define security requirements, first an organization must define its risk
appetite.
What is defense in depth?
Top Mark !!!
, Top Mark Questions and Correct Verified Answers
✓ defense-in-depth principle; it is by adding relevant layer of controls (e.g., access
control, encryption, and monitoring) that the expected level of protection is
achieved.
What are COTS applications?
✓ Applications developed by vendors and installed on the organization's
information systems. These applications are usually purchased outright by
organizations with usage based on licensing agreements.
What are SaaS applications?
✓ Applications developed by service providers or vendors and installed on the
provider or vendor information system. Organizations typically have an on-
demand or pay-per-usage metrics.
What is the goal of a security test?
✓ Verify that a control is functioning properly.
What is a security assessment?
✓ A comprehensive reviews of the security of a system, application, or other
tested environment
What is the NIST SP 800-53A?
Top Mark !!!
, Top Mark Questions and Correct Verified Answers
✓ The National Institute for Standards and Technology (NIST) offers a special
publication that describes best practices in conducting security and privacy
assessments.
What is COBIT?
✓ the Control Objectives for Information and related Technologies describes the
common requirements that organizations should have in place surrounding their
information systems.
What does ISO 27001 describe?
✓ A standard approach for setting up an information security management system
What does ISO 27002 describe?
✓ It details specifics of information security controls
What does a vulnerability scan do?
✓ automatically probe systems, applications, and networks, looking for
weaknesses that may be exploited by an attacker.
What are the four main categories of vulnerability scans?
✓ Network discovery scans, network vulnerability scans, web application
vulnerability scans, and database vulnerability scans
Top Mark !!!
, Top Mark Questions and Correct Verified Answers
What is NMAP?
✓ The most common tool used for network discovery scanning
What does a network vulnerability scanner do?
✓ Probe a targeted system or network for the presence of known vulnerabilities.
What is a false positive?
✓ The scanner may not have enough information to conclusively determine that a
vulnerability exists and it reports a vulnerability when there really is no problem.
What is a false negative?
✓ When the vulnerability scanner misses a vulnerability and fails to alert the
administrator to the presence of it
T/F - By default, network vulnerability scanners run unauthenticated scans.
✓ True
One way to improve the accuracy of the scanning and reduce false positive and false
negative reports is to perform what kind of scans?
✓ authenticated scans
Top Mark !!!
C795- Cybersecurity Management II
(Tactical) Questions and Correct
Verified Answers
What is a vulnerability?
✓ a weakness in an information system, system security procedures, internal
controls, or implementation that could be exploited or triggered by a threat
source.
What is a penetration test?
✓ a simulated cyber attack against your systems or company
What are the typical steps for a vulnerability test?
✓ Identify asset classification list, identify vulnerabilities, test assets against
vulnerabilities, and recommend solutions to either eliminate or mitigate
vulnerabilities
What is the first thing an organization should do before defining security requirements?
✓ To define security requirements, first an organization must define its risk
appetite.
What is defense in depth?
Top Mark !!!
, Top Mark Questions and Correct Verified Answers
✓ defense-in-depth principle; it is by adding relevant layer of controls (e.g., access
control, encryption, and monitoring) that the expected level of protection is
achieved.
What are COTS applications?
✓ Applications developed by vendors and installed on the organization's
information systems. These applications are usually purchased outright by
organizations with usage based on licensing agreements.
What are SaaS applications?
✓ Applications developed by service providers or vendors and installed on the
provider or vendor information system. Organizations typically have an on-
demand or pay-per-usage metrics.
What is the goal of a security test?
✓ Verify that a control is functioning properly.
What is a security assessment?
✓ A comprehensive reviews of the security of a system, application, or other
tested environment
What is the NIST SP 800-53A?
Top Mark !!!
, Top Mark Questions and Correct Verified Answers
✓ The National Institute for Standards and Technology (NIST) offers a special
publication that describes best practices in conducting security and privacy
assessments.
What is COBIT?
✓ the Control Objectives for Information and related Technologies describes the
common requirements that organizations should have in place surrounding their
information systems.
What does ISO 27001 describe?
✓ A standard approach for setting up an information security management system
What does ISO 27002 describe?
✓ It details specifics of information security controls
What does a vulnerability scan do?
✓ automatically probe systems, applications, and networks, looking for
weaknesses that may be exploited by an attacker.
What are the four main categories of vulnerability scans?
✓ Network discovery scans, network vulnerability scans, web application
vulnerability scans, and database vulnerability scans
Top Mark !!!
, Top Mark Questions and Correct Verified Answers
What is NMAP?
✓ The most common tool used for network discovery scanning
What does a network vulnerability scanner do?
✓ Probe a targeted system or network for the presence of known vulnerabilities.
What is a false positive?
✓ The scanner may not have enough information to conclusively determine that a
vulnerability exists and it reports a vulnerability when there really is no problem.
What is a false negative?
✓ When the vulnerability scanner misses a vulnerability and fails to alert the
administrator to the presence of it
T/F - By default, network vulnerability scanners run unauthenticated scans.
✓ True
One way to improve the accuracy of the scanning and reduce false positive and false
negative reports is to perform what kind of scans?
✓ authenticated scans
Top Mark !!!
