Cybersecurity & Risk Management Flashcards

A tobacco retailer discovers an unknown USB drive in the parking lot. The safest action is to:

Answer: Turn it over to IT security or destroy it without plugging it in

Found USB drives are a common attack vector; plugging them into any company device risks malware infection.

What is a 'vulnerability assessment' in the context of a retail tobacco store's risk management plan?

Answer: A systematic review identifying weaknesses in security systems and processes

A vulnerability assessment identifies gaps in security posture before attackers can exploit them.

A CRT candidate is reviewing incident response planning. Which element is MOST critical to include?

Answer: Clear roles, responsibilities, and communication steps during a security incident

An effective incident response plan defines who does what and how to communicate, enabling faster and less damaging responses.

Encryption of customer data at rest means that data is scrambled when:

Answer: Stored on a device or server, even when not in transit

Encryption at rest protects stored data so it is unreadable to unauthorized parties even if the storage device is stolen.

Which of the following is the BEST description of a 'social engineering' attack?

Answer: Manipulating people into revealing confidential information or performing actions

Social engineering exploits human psychology rather than technical vulnerabilities to gain unauthorized access or information.

A tobacco retailer's business continuity plan should PRIMARILY ensure:

Answer: Critical business operations can continue or quickly resume after a disruption

Business continuity planning minimizes operational downtime by establishing procedures to maintain essential functions during disruptions.

An employee who leaves a tobacco company should have system access:

Answer: Removed immediately upon departure

Immediate access revocation prevents former employees from accessing systems with potentially malicious intent.