CTP CTP Security & Risk Management 2 — Questions and Answers
Question 1: Which network security control inspects traffic at the application layer (Layer 7) to detect and block sophisticated attacks?
- Web Application Firewall (WAF) (Correct answer)
- Stateless packet filter
- MAC address filtering
- VLAN segmentation only
Correct answer: Web Application Firewall (WAF)
A WAF operates at Layer 7, inspecting HTTP/S traffic to detect and block application-layer attacks such as SQL injection and XSS.
Question 2: What is the difference between vulnerability scanning and vulnerability assessment?
- Scanning identifies potential vulnerabilities automatically; assessment includes manual analysis and business context (Correct answer)
- Vulnerability scanning requires human analysts; assessment is fully automated
- They are identical processes with different vendor naming conventions
- Assessment only applies to physical security; scanning applies to software
Correct answer: Scanning identifies potential vulnerabilities automatically; assessment includes manual analysis and business context
Scanning uses automated tools to detect known vulnerabilities, while a full assessment adds manual validation, risk context, and remediation recommendations.
Question 3: In the context of risk management frameworks, what does NIST SP 800-30 provide?
- A guide for conducting risk assessments of federal information systems (Correct answer)
- A framework for encrypting data in transit using TLS standards
- Guidelines for implementing multi-factor authentication
- A compliance checklist for PCI DSS certification
Correct answer: A guide for conducting risk assessments of federal information systems
NIST SP 800-30 provides a structured methodology for conducting information security risk assessments for federal and enterprise systems.
Question 4: What security control does multi-factor authentication (MFA) primarily address?
- It reduces the risk of unauthorized access due to compromised credentials (Correct answer)
- It encrypts data at rest using hardware security modules
- It prevents SQL injection attacks on web applications
- It monitors network traffic for distributed denial-of-service attacks
Correct answer: It reduces the risk of unauthorized access due to compromised credentials
MFA requires multiple verification factors, so stolen passwords alone are insufficient for attackers to gain unauthorized system access.
Question 5: What is the purpose of a Security Information and Event Management (SIEM) system?
- To aggregate, correlate, and analyze security logs from multiple sources for threat detection (Correct answer)
- To automatically patch vulnerabilities across all endpoints
- To enforce network segmentation through firewall rule management
- To generate compliance reports for regulatory audits only
Correct answer: To aggregate, correlate, and analyze security logs from multiple sources for threat detection
A SIEM collects and correlates security events from across the environment in real time, enabling rapid detection of and response to security incidents.
Question 6: Which risk treatment strategy involves transferring the financial impact of a risk to a third party?
- Risk transfer (e.g., purchasing cyber insurance) (Correct answer)
- Risk avoidance
- Risk acceptance
- Risk mitigation through technical controls
Correct answer: Risk transfer (e.g., purchasing cyber insurance)
Risk transfer shifts the financial consequences of a risk event to another party, most commonly through insurance or contractual agreements.
CTP CTP Security & Risk Management 2
Which network security control inspects traffic at the application layer (Layer 7) to detect and block sophisticated attacks?