1 $Which of the following equations accurately describes the relationship between Risk, Threat, and Vulnerability?$

A.

B.

C.

D.

2 $A company decides to purchase cyber insurance to cover the potential financial loss of a data breach. Which risk management strategy is this?$

A.

Risk Avoidance

B.

Risk Mitigation

C.

Risk Transference

D.

Risk Acceptance

3 $If the Single Loss Expectancy (SLE) is and the Annualized Rate of Occurrence (ARO) is $0.5$, what is the Annualized Loss Expectancy (ALE)?$

A.

B.

C.

D.

4 $Which document formally defines the level of service a vendor is expected to provide, including uptime guarantees and penalties for non-compliance?$

A.

NDA (Non-Disclosure Agreement)

B.

SLA (Service Level Agreement)

C.

MOU (Memorandum of Understanding)

D.

ISA (Interconnection Security Agreement)

5 $What is Residual Risk ?$

A.

The risk that exists before any controls are applied

B.

The risk remaining after security controls have been implemented

C.

The total financial risk of an organization

D.

The risk associated with vendor bankruptcy

6 $Which personnel policy is designed specifically to detect fraud or malicious activities by forcing an employee to take time off, allowing others to review their work?$

A.

Separation of Duties

B.

Least Privilege

C.

Mandatory Vacation

D.

Job Rotation

7 $In the context of data classification, which role is typically responsible for implementing the technical controls to protect data (e.g., backups, encryption) based on its classification?$

A.

Data Owner

B.

Data Custodian

C.

Data User

D.

Chief Information Security Officer (CISO)

8 $Which compliance standard is mandatory for any organization that handles credit card transactions?$

A.

HIPAA

B.

GDPR

C.

PCI-DSS

D.

FISMA

9 $What is the primary difference between Qualitative and Quantitative risk assessment?$

A.

Qualitative uses numeric data; Quantitative uses subjective judgement

B.

Qualitative relies on subjective terms (Low, Medium, High); Quantitative relies on numerical financial data

C.

Qualitative is for financial audits; Quantitative is for IT audits

D.

There is no difference

10 $Under GDPR, the 'Right to be Forgotten' allows individuals to:$

A.

Request a copy of all their data

B.

Request the deletion of their personal data

C.

Sue the company for data breaches

D.

Encrypt their own data on the company server

11 $Which type of audit is conducted by a third-party organization to provide an unbiased verification of compliance?$

A.

Internal Audit

B.

External Audit

C.

Self-Assessment

D.

Gap Analysis

12 $Which vendor management concept refers to the process of evaluating a supplier's security posture before signing a contract?$

A.

Off-boarding

B.

Incident Response

C.

Due Diligence

D.

Risk Acceptance

13 $In a Zero Trust architecture, which of the following is a core principle?$

A.

Trust but verify

B.

Never trust, always verify

C.

Trust internal network traffic implicitly

D.

Perimeter firewalls are sufficient

14 $Which term describes the concept of granting users only the permissions necessary to perform their job functions?$

A.

Defense in Depth

B.

Principle of Least Privilege

C.

Separation of Duties

D.

Security by Obscurity

15 $Which report type is best suited for providing detailed security controls testing results to a business partner or auditor (e.g., SOC 2)?$

A.

Type I Report

B.

Type II Report

C.

Attestation of Compliance

D.

Gap Analysis Report

16 $What is the primary purpose of a Gap Analysis ?$

A.

To punish employees for non-compliance

B.

To compare current security posture against a desired standard to identify missing controls

C.

To calculate the exact financial cost of a breach

D.

To configure a firewall

17 $Which of the following data types would likely require the highest level of security classification?$

A.

Marketing brochures on the public website

B.

Internal cafeteria menu

C.

Employee Personally Identifiable Information (PII) and payroll data

D.

Standard operating procedure manuals

18 $What is Supply Chain Risk Management (SCRM) focused on?$

A.

Managing the logistics of shipping products

B.

Identifying and mitigating risks associated with third-party vendors, software, and hardware suppliers

C.

Ensuring employees arrive at work on time

D.

Managing the internal network cables

19 $A Risk Register is used to:$

A.

Log every user who logs into the system

B.

Record identified risks, their severity, and planned mitigation strategies

C.

Register new employees for benefits

D.

List all hardware assets in the server room

20 $Which US regulation specifically governs the security and privacy of healthcare data?$

A.

SOX

B.

HIPAA

C.

GLBA

D.

FERPA

21 $What is the Separation of Duties principle?$

A.

One person performs all critical steps of a process to ensure speed

B.

Dividing critical tasks among multiple people to prevent fraud and error

C.

Separating the IT department from the HR department

D.

Ensuring servers are in different physical locations

22 $Which document outlines the rules for employee use of company technology assets, internet, and email?$

A.

SLA (Service Level Agreement)

B.

AUP (Acceptable Use Policy)

C.

NDA (Non-Disclosure Agreement)

D.

MOU (Memorandum of Understanding)

23 $Risk Avoidance involves:$

A.

Implementing a firewall to block an attack

B.

Buying insurance

C.

Discontinuing the activity or technology that generates the risk

D.

Monitoring the risk without taking action

24 $Which recent trend refers to embedding privacy considerations into the design specifications of technologies from the very beginning?$

A.

Privacy by Chance

B.

Privacy by Design

C.

Reactive Privacy

D.

Obfuscation

25 $When calculating risk quantitatively, what does AV stand for?$

A.

Annual Velocity

B.

Asset Value

C.

Attack Vector

D.

Assessment Verification

26 $What is a Fourth-Party Risk ?$

A.

Risk from internal employees

B.

Risk from the government

C.

Risk posed by your vendor's vendors

D.

Risk from customers

27 $Which term describes a clause in a vendor contract that allows the customer to review the vendor’s compliance and security controls?$

A.

Right to Audit

B.

Right to Refuse

C.

Indemnification

D.

Limitation of Liability

28 $What is Data Sovereignty ?$

A.

The concept that data is subject to the laws of the country in which it is physically located

B.

The right of the CEO to own all company data

C.

The ability to move data freely across all borders

D.

Encryption of data at rest

29 $During the Onboarding process, which step is crucial for security?$

A.

Assigning a parking spot

B.

Conducting background checks and signing NDAs

C.

Showing the location of the coffee machine

D.

Providing branded merchandise

30 $What is the formula for Single Loss Expectancy (SLE)?$

A.

B.

C.

D.

31 $Which of the following best describes Inherent Risk ?$

A.

The risk remaining after controls

B.

The baseline risk level before any controls or mitigations are applied

C.

The risk transferred to insurance

D.

The risk of natural disasters only

32 $Which data sanitization method is most secure for magnetic hard drives that will be discarded?$

A.

Standard Formatting

B.

Degaussing or Physical Destruction

C.

Deleting the partition table

D.

Reinstalling the OS

33 $What is the primary goal of an Exit Interview regarding security?$

A.

To ask for feedback on the cafeteria

B.

To retrieve assets (laptops, keys) and remind the employee of continuing NDA obligations

C.

To convince the employee to stay

D.

To plan the farewell party

34 $Which recent governance trend involves using AI and automation to ensure continuous adherence to regulations?$

A.

Manual Auditing

B.

Automated Compliance / RegTech

C.

Paper-based Governance

D.

Annual Checkups

35 $What is the definition of Risk Appetite ?$

A.

The total amount of risk an organization can bear before collapsing

B.

The amount and type of risk an organization is willing to pursue or retain

C.

The cost of insurance premiums

D.

The speed at which a risk impacts the organization

36 $Which control type is intended to discourage a potential attacker?$

A.

Preventive

B.

Corrective

C.

Deterrent

D.

Detective

37 $In the context of Risk Management, what is Control Risk ?$

A.

The risk that a control will fail to prevent or detect a security issue

B.

The risk of controlling too much

C.

The risk of an audit

D.

The risk of data loss

38 $What is the distinction between a Vulnerability Assessment and a Penetration Test ?$

A.

Vulnerability assessments exploit flaws; Pen tests only list them

B.

Vulnerability assessments identify and list potential flaws; Pen tests attempt to exploit them

C.

They are exactly the same

D.

Pen tests are automated; Vulnerability assessments are manual

39 $Which of the following is NOT a category of security controls?$

A.

Administrative (Managerial)

B.

Technical (Logical)

C.

Physical

D.

Financial

40 $The CMMC (Cybersecurity Maturity Model Certification) is a recent compliance requirement primarily for:$

A.

Hospitals

B.

Retail stores

C.

Contractors in the US Defense Industrial Base (DIB)

D.

European banks

41 $What is the purpose of Data Retention Policies ?$

A.

To keep all data forever

B.

To define how long specific data must be kept and when it should be destroyed

C.

To increase storage costs

D.

To slow down the database

42 $If a risk has a high impact but a very low probability of occurrence, how is it usually managed?$

A.

Ignored completely

B.

Transferred (Insurance) or Mitigated via disaster recovery plans

C.

Mitigated with expensive daily controls

D.

Accepted as a daily cost of business

43 $What does the term Vendor Lock-in refer to?$

A.

Locking the vendor's office

B.

Dependency on a vendor that makes it difficult or expensive to switch to a competitor

C.

Securing vendor data with encryption

D.

Signing a long-term NDA

44 $Which is an example of a Technical control?$

A.

Security Awareness Training

B.

Background Checks

C.

Firewall ACL (Access Control List)

D.

Security Guard

45 $Which privacy regulation applies to the personal data of residents in California?$

A.

CCPA (California Consumer Privacy Act)

B.

GDPR

C.

HIPAA

D.

FISMA

46 $What is the role of the Data Owner ?$

A.

To perform the daily backups

B.

To maintain the server hardware

C.

To bear ultimate responsibility for the data and define its classification and access rules

D.

To write the code for the application

47 $Which of the following is a key component of an Incident Response Plan regarding personnel?$

A.

Call trees and contact lists

B.

Payroll information

C.

Employee birthdays

D.

Cafeteria schedules

48 $What is Job Rotation primarily used for in security?$

A.

To prevent boredom

B.

To ensure multiple people know how to perform a task and to reduce the risk of undetected fraud

C.

To increase salary costs

D.

To confuse attackers

49 $In quantitative risk analysis, if a server costs (AV) and a fire would destroy of it (EF), what is the SLE?$

A.

B.

C.

D.

50 $Which concept ensures that an organization can survive and recover from significant disruptions?$

A.

Business Continuity Planning (BCP)

B.

Penetration Testing

C.

Data Classification

D.

Least Privilege

Unit 6 - Practice Quiz

Send Feedback

Thank You!