Intro to Cyber Security Mock Exam 01-+

Your organisation processes a lot of personally identifiable information (PII) as part of their day-to-day function. There is a significant data breach that compromises several company databases. What is the most likely form of impact to the business?
1. Financial
2. Regulatory
3. Motivational
4. Operational
Which network device is used to direct traffic to individual endpoints in a LAN using MAC addresses?
1. Hub
2. Switch
3. Router
4. Bridge
What is the most important thing to consider when determining if an information asset should be protected?
1. Effort needed to provide security
2. Cost of protection
3. Legal compliance
4. If you have been attacked before
Which of the following presents a risk relating to analysing future trends?
1. Can lead to a false sense of security if the trends are misinterpreted
2. Decreased staff motivation due to changing policies
3. Adds additional work to the cyber team who are already too busy
4. Doesn’t provide enough benefits given the time involved in undertaking the task
Which category of defence does CCTV fall under?
1. Physical preventative
2. Physical deterrent
3. Physical administrative
4. Physical directive
What is the best definition of an information asset?
1. Any data or device that supports business processes or operations
2. A technical subject matter expert
3. An organisation's central database server
4. All hardware and software owned by an organisation
What is the primary reason for obtaining Cyber Essentials certification?
1. Reduce cyber threat
2. To put a logo on the company website
3. To give staff confidence in the company’s organisation skills
4. Ensuring the system is 100% secure
Which source of threat is the most common problem for SME businesses?
1. Insiders
2. Nation state
3. Criminal groups
4. Script kiddies
What is the main security concern regarding storage of personal data in multiple locations across the globe?
1. The staff in the locations may not fully understand the data being stored as it is in a different language
2. It may be difficult to maintain access to data distributed across the world
3. Data held in other countries may be at greater risk of breach
4. There may be legal ramifications and issues resulting from data protection legislation in the country of origin
What is the main concern resulting from poor software maintenance practices?
1. Increased maintenance costs
2. Subsequent poor performance of the product
3. User experience declines
4. Resultant exposure to vulnerabilities
Security requirements for a new product or system are GENERALLY driven by which of the following?
1. Security solutions.
2. Security objectives.
3. Security functions.
4. Security guidelines
Outsourcing equipment maintenance falls under which category of risk treatment?
1. Accept
2. Avoid
3. Reduce
4. Transfer
Which of the following is the best description of extrinsic assurance?
1. Confidence in the process used by the supplier during development by following a recognised standard
2. Designing and implementing to a recognised standard
3. Independent verification using external evaluation
4. Operating and maintaining to a recognised standard
In penetration testing, which team would be responsible for defending the system?
1. Red Team
2. Blue Team
3. Purple Team
4. White Team
What is the primary limitation of security testing as an extrinsic assurance method?
1. Systems are tested against known vulnerabilities only
2. It follows an outdated standard
3. Tests cannot be automated
4. It provides paper-based testing and does not flag real-world issues
Which of the following standards would be most suitable to refer to when attempting to improve information security in a business?
1. ISO 22301
2. PCI-DSS
3. ISO 27001
4. ISATAP
When migrating from an on-premises solution to a cloud solution, what should you ensure is provided to ensure users are always able to access the data?
1. Security groups
2. Availability zones
3. Elasticity
4. Offline Backups
Which model allows relative prioritisation of security objectives?
1. SMART
2. ISO 22301
3. IASME Governance
4. MoSCoW
In cyber assurance, which of the following actions would result in a system being considered “trusted”?
1. PKI digital certificates are used to provide proof of origin
2. The software developer follows the trustworthy software framework in developing the application
3. A well-known company produces a website using secure coding techniques
4. The system has bene developed to comply with ISO27001 requirements
What is the best description of a XSS attack?
1. A threat actor inserts data, such as a malicious script, into content from trusted websites which is then included with dynamic content delivered to a victim's browser
2. A type of website exploit carried out by issuing unauthorized commands from a trusted website user, exploiting the websites trust for the user’s browser
3. A threat actor exploits weak web-based protocols to insert themselves between entities in a communication channel to steal data
4. An attempt to issue commands to a database via a website interface
Which of the following is true regarding thin clients
1. They perform most of the processing on the client
2. They have higher hardware specifications than standard user devices
3. They provide more streamlined operating systems than thick clients, requiring less processing power
4. Most of the processing occurs on the server
Which type of malware is uses an action or other function as a trigger to begin the attack?
1. Worm
2. Trojan
3. Logic bomb
4. Ransomware
A member of the IT department is fired. Before leaving, the staff member changes the administrator password and doesn’t tell anyone. What type of insider threat does this represent?
1. Negligent insider
2. Malicious insider
3. Inadequately trained employee
4. Unmanaged 3rd party staff
Which of the following factors independently contributes the most to creating a positive security culture?
1. Regular training and awareness sessions
2. Lack of procedures for whistleblowing
3. A robust disciplinary policy
4. Departmental managers monitoring staff actions
What are the primary components of a threat?
1. Attack technique, motive and opportunity
2. Attack technique, motivation and money
3. Motivation, opportunity and objective
4. Technical ability, determination and finances
Which of the following is true regarding environmental hazards such as fire and flood?
1. They cause less damage than an external attack
2. These hazards can result in the same impact as an attack
3. They are only the result of negligence
4. These are considered less important that external attacks
What is meant by “defending assets and related systems is asymmetric”?
1. Organisations spend less money on providing security than attackers spend on breaching it
2. Every risk needs treating but attackers only need to exploit one
3. It requires more technical knowledge to defend systems than to attack them
4. There are more people trying to breach security systems than there are trying to protect them
Which of the following does NOT provide a detective control?
1. Inventory checks
2. IDS
3. SIEM
4. Patching
Which of the following is NOT a benefit of using the MITRE Att&ck Model?
1. It provides a path for assessing the value of information, the definition of targets and prioritising actions
2. It can be used to build behavioural analytics for detecting the behaviour of the adversary
3. It removes the need for a fully independent cyber security department
4. It can be used to assess monitoring and mitigation tools for defences already deployed within an enterprise
Which set of regulations specifies the requirements for securing data in payment card systems?
1. Cyber Essentials
2. ISO 27001
3. NIST Cybersecurity Framework
4. PCI-DSS
Which of the following would NOT be considered a breach of criminal law?
1. Accessing a company database which you are not authorised to access
2. Selling customer details to a competitor
3. Failing to meet designated SLA’s when supporting external customers
4. Failing to provide appropriate security for staff data
Which GDPR principle dictates that organisations must protect personal data?
1. Lawfulness, fairness and transparency
2. Data minimisation
3. Accountability
4. Security and integrity principle
Which of the following is a US copyright law that criminalises the production and dissemination of technologies, devices or services intended to circumvent access control measures on copyrighted works?
1. EU-US Privacy Shield
2. Digital Millennium Act
3. Patriot Act
4. ITAR
Which of the following are NOT likely to mandatory actions for all staff to assist in maintaining organisational security?
1. Comply with the acceptable use policy
2. Obtain basic cyber security certification
3. Participate in training and awareness measures
4. Follow the company security procedures
Membership of a cyber security professional body such as ISACA requires you to adhere to what?
1. Prescribed cryptographic tools for emails exchange
2. Choice of cyber security tools
3. Code of professional ethics
4. Approved suppliers of managed services
What is the primary security concern relating to increased usage of IoT devices?
1. Increased monitoring requirements
2. Compatibility across multiple vendors
3. Compatibility with existing security provisions
4. Increased attack surface
Which term refers to providing proof of origin, authenticity, and integrity of data?
1. Confidentiality
2. Integrity
3. Authentication
4. Non-repudiation
In Cyber Security, what is the relationship between risk, threat and vulnerability?
1. Vulnerability is the destruction or damage to an asset after a risk calculation has been taken to mitigate against such a threat
2. Threat is the potential for loss, damage or destruction of an asset as a result of a vulnerability exploiting a risk
3. Risk is the potential for loss, damage or destruction of an asset as a result of a threat exploiting a vulnerability
4. Risk is the potential for loss, damage or destruction of an asset as a result of
  a vulnerability exploiting a threat
What is the Delphi method?
1. An executive coaching method using a four-step framework to help individuals and groups to solve problems
2. Four-step problem-solving iterative technique used to improve business processes
3. A forecasting process based on the results of multiple rounds of questionnaires sent to a panel of experts
4. A continuous development process ensuring development of the security posture of enterprise organisations
How is risk calculated?
1. Likelihood x impact
2. Impact x damage done
3. Risk factor x enumeration
4. Probability x importance