Cybersecurity & Risk Management Flashcards

What is the purpose of a firewall in a tobacco retail store's network security?

Answer: To monitor and control incoming and outgoing network traffic based on security rules

Firewalls act as gatekeepers that filter network traffic, blocking unauthorized access while allowing legitimate communication.

During a risk assessment, the term 'risk appetite' refers to:

Answer: The amount of risk an organization is willing to accept in pursuit of its objectives

Risk appetite defines how much uncertainty and potential loss a business is willing to tolerate when making strategic decisions.

A tobacco shop notices unusual after-hours login attempts on its inventory system. This is best described as:

Answer: An indicator of compromise (IOC) suggesting unauthorized access attempts

Anomalous login activity outside business hours is a classic indicator that an attacker may be attempting to gain access.

Which backup strategy provides the BEST protection for a tobacco retailer's sales data?

Answer: Following the 3-2-1 rule: 3 copies, 2 media types, 1 offsite

The 3-2-1 backup strategy ensures redundancy and geographic separation, protecting against hardware failure, theft, or disaster.

What is 'patch management' and why is it important for a tobacco retail POS system?

Answer: Regularly updating software to fix security vulnerabilities before attackers exploit them

Unpatched software contains known vulnerabilities that cybercriminals actively exploit, making timely updates essential.

A phishing email successfully tricks a tobacco store employee into entering their POS credentials on a fake website. What type of attack occurred?

Answer: Credential harvesting via phishing

Credential harvesting phishing creates convincing fake sites to steal usernames and passwords entered by deceived users.

Under a risk transfer strategy, a tobacco retailer would typically:

Answer: Purchase cyber liability insurance to shift financial risk to an insurer

Risk transfer moves the financial consequences of a risk event to a third party, typically through insurance policies.