CSCU Security 3

Question 1

What is a security incident response plan?

Accepted Answer

A documented set of procedures for detecting, containing, eradicating, and recovering from security incidents

Answer

An incident response plan provides structured procedures for handling security breaches and attacks through defined phases: preparation, identification, containment, eradication, recovery, and lessons learned.

Question 2

What is the difference between a vulnerability and an exploit?

Accepted Answer

A vulnerability is a weakness in a system that could be taken advantage of, while an exploit is the actual method or code used to take advantage of that weakness

Answer

A vulnerability is a flaw or weakness in a system, while an exploit is the specific technique, tool, or code that leverages that vulnerability to perform an unauthorized action.

Question 3

What is defense in depth as a security strategy?

Accepted Answer

Implementing multiple layers of overlapping security controls so that if one layer fails, others still provide protection

Answer

Defense in depth deploys multiple, redundant security layers (physical, technical, administrative) so that the failure of any single control does not compromise overall security.

Question 4

What is phishing and what are its common characteristics?

Accepted Answer

A deceptive attack that uses fraudulent communications disguised as trustworthy sources to steal sensitive information

Answer

Phishing is a social engineering attack using fraudulent emails, websites, or messages that impersonate trusted entities to trick victims into revealing passwords, financial information, or other sensitive data.

Question 5

What is the purpose of a security policy in an organization?

Accepted Answer

To establish formal rules, guidelines, and procedures that define how the organization protects its information assets and manages security risks

Answer

A security policy provides the formal framework of rules, guidelines, and responsibilities governing how an organization protects its information assets, manages risks, and ensures regulatory compliance.

CSCU - Certified Secure Computer User Practice Test

CSCU - Certified Secure Computer User Practice Test

CSCU Security 3