CRT Cybersecurity & Risk Management 2

Question 1

A retail tobacconist store experiences a ransomware attack that encrypts all customer purchase records. What is the FIRST step the owner should take?

Accepted Answer

Disconnect affected systems from the network

Answer

Isolating infected systems from the network prevents ransomware from spreading to other devices or backups.

Question 2

Which type of authentication provides the strongest protection for a tobacco retail POS system login?

Accepted Answer

Multi-factor authentication (MFA)

Answer

MFA requires multiple verification factors, making unauthorized access significantly harder even if one credential is compromised.

Question 3

A tobacco retailer collects customer birthdate data for age verification. Under risk management best practices, this data should be:

Accepted Answer

Retained only as long as legally required, then securely deleted

Answer

Data minimization and retention limits reduce liability and comply with privacy regulations by not holding data longer than necessary.

Question 4

An employee receives an email claiming to be from a tobacco supplier asking for urgent wire payment. This is most likely a:

Accepted Answer

Business email compromise (BEC) scam

Answer

Business email compromise scams impersonate trusted contacts to trick businesses into fraudulent wire transfers.

Question 5

What does the term 'least privilege' mean in a retail cybersecurity context?

Accepted Answer

Each employee only has system access needed for their specific job role

Answer

Least privilege limits each user's access to only what they need, reducing the damage potential of compromised accounts.

(CRT) Certified Retail Tobacconist Practice Test