CSCU Security 3

Question 1

What is a security incident response plan?

Accepted Answer

A documented set of procedures for detecting, containing, eradicating, and recovering from security incidents

Answer

A list of all security software installed on a computer

Answer

A plan for purchasing new security equipment

Answer

A schedule for changing passwords

Question 2

What is the difference between a vulnerability and an exploit?

Accepted Answer

A vulnerability is a weakness in a system that could be taken advantage of, while an exploit is the actual method or code used to take advantage of that weakness

Answer

They are the same thing

Answer

A vulnerability is more dangerous than an exploit

Answer

An exploit is a theoretical risk while a vulnerability is a real attack

Question 3

What is defense in depth as a security strategy?

Accepted Answer

Implementing multiple layers of overlapping security controls so that if one layer fails, others still provide protection

Answer

Installing the most expensive security product available

Answer

Focusing all security resources on a single strong perimeter

Answer

Hiring more security guards for physical protection

Question 4

What is phishing and what are its common characteristics?

Accepted Answer

A deceptive attack that uses fraudulent communications disguised as trustworthy sources to steal sensitive information

Answer

A legitimate marketing technique used by businesses

Answer

A method for securely sharing files online

Answer

A type of network diagnostic tool

Question 5

What is the purpose of a security policy in an organization?

Accepted Answer

To establish formal rules, guidelines, and procedures that define how the organization protects its information assets and manages security risks

Answer

To restrict employees from using computers

Answer

To document the organization's IT budget

Answer

To list all software installed on company computers

Question 6

What is risk assessment in cybersecurity?

Accepted Answer

A systematic process of identifying, analyzing, and evaluating potential threats and vulnerabilities to determine the level of risk to organizational assets

Answer

Calculating the cost of cybersecurity insurance

Answer

A test to measure employee technical skills

Answer

An annual financial review of IT spending