CTP CTP Security & Risk Management 1 — Questions and Answers
Question 1: Which security principle dictates that users and systems should only be granted the minimum level of access required to perform their job functions?
- Principle of least privilege (Correct answer)
- Defense in depth
- Security by obscurity
- Zero trust escalation
Correct answer: Principle of least privilege
The principle of least privilege minimizes the attack surface by restricting access rights to only those necessary for legitimate work.
Question 2: In risk management, what does the formula Risk = Likelihood × Impact represent?
- A qualitative method to prioritize risks by combining their probability and consequence (Correct answer)
- A formula for calculating the monetary cost of a security breach only
- A compliance requirement from NIST for federal agencies
- A method to calculate software defect density
Correct answer: A qualitative method to prioritize risks by combining their probability and consequence
Multiplying likelihood by impact produces a risk score that allows teams to rank and prioritize risks for mitigation efforts.
Question 3: What is the purpose of a penetration test in a technical security program?
- To simulate real-world attacks to identify exploitable vulnerabilities before malicious actors do (Correct answer)
- To monitor network traffic for anomalies on a continuous basis
- To encrypt all data at rest using industry-standard algorithms
- To automate patch deployment across all managed systems
Correct answer: To simulate real-world attacks to identify exploitable vulnerabilities before malicious actors do
Penetration testing proactively identifies security weaknesses by simulating attacker techniques in a controlled, authorized environment.
Question 4: Which cryptographic concept ensures that a sender cannot later deny having sent a message?
- Non-repudiation (Correct answer)
- Confidentiality
- Availability
- Integrity
Correct answer: Non-repudiation
Non-repudiation, typically achieved through digital signatures, provides proof of origin so senders cannot deny having sent a message.
Question 5: A CTP professional is implementing a disaster recovery plan. What does RTO (Recovery Time Objective) define?
- The maximum acceptable time to restore a system after a failure (Correct answer)
- The maximum acceptable data loss measured in time
- The total cost of downtime per hour for the business
- The redundancy level required for critical servers
Correct answer: The maximum acceptable time to restore a system after a failure
RTO defines how quickly a system must be restored and operational after an outage to meet business continuity requirements.
Question 6: What is a threat model, and how is it used in secure system design?
- A structured analysis of potential threats, attack surfaces, and mitigations for a system (Correct answer)
- A list of known malware signatures updated by antivirus vendors
- A compliance checklist required for SOC 2 audits
- A network diagram showing firewall placement
Correct answer: A structured analysis of potential threats, attack surfaces, and mitigations for a system
Threat modeling systematically identifies assets, threats, and countermeasures during design to proactively reduce security risks before deployment.
CTP CTP Security & Risk Management 1
Which security principle dictates that users and systems should only be granted the minimum level of access required to perform their job functions?