SBOLC Security Fundamentals exam with correct answers 2026 (graded a)

SBOLC Security Fundamentals
NIST - CORRECT ANSWER-National Institute of Standards and Technology

What is the NIST Risk Management Framework (RMF)? - CORRECT ANSWER--
Overall framework for the U.S. federal government to manage
organizational risk throughout the system development life cycle
-Focuses on security control selection, deployment, and auditing
using a seven-step model
-Includes certification and accreditation

Clean Desk Policy - CORRECT ANSWER-Secure sensitive items when not in use

Principle of least privilege management - CORRECT ANSWER-Just what you
need to do your job

Mandatory vacations - CORRECT ANSWER--best way to uncover fraud
-part of onboarding procedures

Job Rotation (rotation of duties) - CORRECT ANSWER--Identify or uncover fraud
-Cross training / Experience for employees

Separation of Duties - CORRECT ANSWER-Partitions responsibilities to minimize
abuse or fraud

Hiring and Termination Policy Elements - CORRECT ANSWER--Background
checks
-Social media analysis
-Onboarding procedures (NDA/AUP/Sign for equipment)
-Offboarding procedures (NDA/Return of equipment)
-Exit interview
-Non-disclosure Agreement (NDA)

AUP - CORRECT ANSWER-Acceptable Use Policy

EOL - CORRECT ANSWER-End of Life

EOS - CORRECT ANSWER-End of Service

MOA - CORRECT ANSWER-Memorandum of Agreement

-A legally binding written document between multiple parties on a
project detailing how they will work together to achieve
agreed-upon goals and objectives.

,MOU - CORRECT ANSWER-Memorandum of Understanding

-A less formal agreement of mutual goals between two or more
organizations with a focus on partitioning of responsibilities

BPA - CORRECT ANSWER-Business Partners Agreement

-A written agreement defining the general relationship between
business partners with a focus on financial matters

Information Lifecycle Model - CORRECT ANSWER--Creation
-Processing
-Dissemination
-Usage
-Storage
-Disposal

Generic Information Classifications - CORRECT ANSWER--Low
-Medium
-High

Military Information Classifications - CORRECT ANSWER--Unclassified
-Confidential
-Secret
-Top Secret

Business Information Classifications - CORRECT ANSWER--Public
-Private
-Proprietary
-Confidential

Types of Protected Information - CORRECT ANSWER--Personally Identifiable
Information (PII)
-Personal/Protected Health Information (PHI)
-Financial Information
-Government Data
-Customer Data

Risk Management - CORRECT ANSWER-The process of identifying, monitoring,
and reducing risk to an acceptable level.

Risk Analysis - CORRECT ANSWER--Threat (the potential to cause harm to an
asset)

-Vulnerability (a flaw or hole in the security posture)

,-Exploit (a method or technique used to manipulate a faw)

-Safeguard (a mitigation security control)

Risk Management Strategies - CORRECT ANSWER--Acceptance: Have an
established plan of action

-Avoidance: Removing the activity that creates risk

-Transference: Offloading the risk to an external party

-Mitigation: Reducing risk by installing security control, safeguard, or
countermeasures

Types of RIsk - CORRECT ANSWER--Externally-Derived Risk
-Internally-Derived Risk
-Legacy Systems
-Multiparty Involvement
-Intellectual Property Theft
-Software Compliance/Licensing Issues
-Inherent Risk
-Residual Risk

Qualitative Risk Assessment - CORRECT ANSWER-Based on human opinion or
judgment derived from interviews, surveys, benchmarking, scenario-based
exercise, lessons learned analysis, or cross-function workshops

Advantages of Qualitative Risk Assessment - CORRECT ANSWER--Impact is
easily understood
-Can provide rich information beyond financial impacts, such as impact on
perceived safety, health, or reputation

Disadvantages of Qualitative Risk Assessment - CORRECT ANSWER--Prone to
inaccuracy or exaggeration
-Limited usefulness towards cost-benefit analysis

Quantitative Risk Assessment - CORRECT ANSWER--Requires numerical values
or both impact and likelihood using data from a variety of sources
-Can be used to support cost-benefit analysis calculations

Advantages to Quantitative Risk Assessment - CORRECT ANSWER--Supports
cost-benefit analysis of risk response options
-Allows computation of necessary capital to achieve a business goal

, Disadvantages to Quantitative RIsk Assessment - CORRECT ANSWER--Use of
numbers may imply greater precision than what truly exists
-Requires concrete units of measure that may cause obscure, or infrequent risk
from being recognized

Single Loss Expectancy (SLE) - CORRECT ANSWER-SLE = Asset Value (AV) x
Exposure Factor (EF%)

Annualized Loss Expectancy (ALE) - CORRECT ANSWER-ALE = SLE x Annual
Rate of Occurrence (ARO)

Scenario: a building is worth $1,000,000, and a fire breaks out, consuming 70% of
the building. A fire occurs about once every 7 years in this geographical area.
What is the SLE, and what is the ALE? - CORRECT ANSWER--SLE = 1,000,000 x
70% =700,000

-ALE = 700,000 x 1/7 = 700,000/7 = 100,000

Mitigating Operational Risk - CORRECT ANSWER--Identify risk due to ongoing
business operations (risk control self-assessment/assessment)

-Assess the risk created due to business operations (likelihood and impact)

-Identify appropriate controls to mitigate the risk (control risk)

-Assessment of controls (identify control gaps)

Business Continuity Planning (BCP) - CORRECT ANSWER--The preventative and
proactive strategic plan to mitigate disruptive incidents to business operations
-Focuses on anticipating business operation disruptions

What does BCP identify - CORRECT ANSWER--Mission-essential functions
-Critical systems
-Single points of failure

Business Impact Analysis (BIA) - CORRECT ANSWER--A management tool that
helps determine the financial impact of business of organizational changes

Impact Considerations of BIA - CORRECT ANSWER--Safety
-Reputation
-Revenue
-Property

What are the different Common Site Implementations? - CORRECT ANSWER--
Cold site - empty facility with established power, HVAC, and network connectivity
to the building