ITM 207 CERTIFICATION SCRIPT 2026
QUESTIONS WITH SOLUTIONS GRADED A+
◍ Port 21.
Answer: FTP file transfer protocol
◍ Cons of qualitative RA –.
Answer: Subjective, ratings can differ by person, harder to do detailed
cost-benefit analysis
◍ NIST –.
Answer: A U.S. standards body that publishes frameworks and guidelines
for security and risk management (for example, NIST RMF, NIST
Cybersecurity Framework).
◍ Cost (in risk) –.
Answer: The money, effort, and resources required to implement controls;
you compare this cost to the expected loss to decide if a control is worth it.
◍ Milestones –.
Answer: Key points or events in a project timeline that mark major progress,
deliverables, or decision points.
◍ Port 22.
Answer: SSH secure remote login
◍ Phishing.
Answer: Malicious email designed to trick users into revealing credentials or
clicking malicious links
◍ Cons of quantitative RA –.
Answer: Data can be hard to get, calculations more complex, can give a
false sense of precision
, ◍ Brute Force Attack.
Answer: Repeated attempts to guess a password using many combinations
◍ Purpose of a SIEM.
Answer: Centralize logs, detect threats, correlate events, and generate
security alerts
◍ DNS.
Answer: Domain Name System that translates domain names into IP
addresses
◍ Port 53.
Answer: DNS domain name resolution
◍ HTTP Logs.
Answer: Logs that show web requests, responses, and downloads
◍ Port 636.
Answer: LDAPS secure LDAP
◍ Qualitative RA –.
Answer: Uses categories (low, medium, high) and expert judgment to rate
likelihood and impact; easier and faster but less precise.
◍ Threat-likelihood matrix –.
Answer: A chart that shows how likely a risk event is and how big the
impact would be, helping you prioritize which risks to handle first.
◍ Rate Limiting.
Answer: Limiting how many API requests a client can make within a
specific time period
◍ Asset valuation –.
Answer: Determining the importance and value of assets (data, systems,
facilities) in terms of purpose, criticality, and cost to replace or lose.
◍ HTTP 401.
Answer: Unauthorized request (authentication required)
QUESTIONS WITH SOLUTIONS GRADED A+
◍ Port 21.
Answer: FTP file transfer protocol
◍ Cons of qualitative RA –.
Answer: Subjective, ratings can differ by person, harder to do detailed
cost-benefit analysis
◍ NIST –.
Answer: A U.S. standards body that publishes frameworks and guidelines
for security and risk management (for example, NIST RMF, NIST
Cybersecurity Framework).
◍ Cost (in risk) –.
Answer: The money, effort, and resources required to implement controls;
you compare this cost to the expected loss to decide if a control is worth it.
◍ Milestones –.
Answer: Key points or events in a project timeline that mark major progress,
deliverables, or decision points.
◍ Port 22.
Answer: SSH secure remote login
◍ Phishing.
Answer: Malicious email designed to trick users into revealing credentials or
clicking malicious links
◍ Cons of quantitative RA –.
Answer: Data can be hard to get, calculations more complex, can give a
false sense of precision
, ◍ Brute Force Attack.
Answer: Repeated attempts to guess a password using many combinations
◍ Purpose of a SIEM.
Answer: Centralize logs, detect threats, correlate events, and generate
security alerts
◍ DNS.
Answer: Domain Name System that translates domain names into IP
addresses
◍ Port 53.
Answer: DNS domain name resolution
◍ HTTP Logs.
Answer: Logs that show web requests, responses, and downloads
◍ Port 636.
Answer: LDAPS secure LDAP
◍ Qualitative RA –.
Answer: Uses categories (low, medium, high) and expert judgment to rate
likelihood and impact; easier and faster but less precise.
◍ Threat-likelihood matrix –.
Answer: A chart that shows how likely a risk event is and how big the
impact would be, helping you prioritize which risks to handle first.
◍ Rate Limiting.
Answer: Limiting how many API requests a client can make within a
specific time period
◍ Asset valuation –.
Answer: Determining the importance and value of assets (data, systems,
facilities) in terms of purpose, criticality, and cost to replace or lose.
◍ HTTP 401.
Answer: Unauthorized request (authentication required)
