Cyber Security Jobs Organizational Cyber Security 3 — Questions and Answers
Question 1: An incident response plan typically defines phases. Which sequence is correct?
- Preparation, Detection, Containment, Eradication, Recovery, Lessons Learned (Correct answer)
- Recovery, Detection, Preparation, Containment
- Containment, Lessons Learned, Detection, Preparation
- Detection, Recovery, Preparation, Eradication
Correct answer: Preparation, Detection, Containment, Eradication, Recovery, Lessons Learned
The standard IR lifecycle runs preparation, detection, containment, eradication, recovery, and lessons learned.
Question 2: What is the purpose of a Business Continuity Plan (BCP)?
- Keep critical operations running during a disruption (Correct answer)
- Encrypt all email traffic
- Audit financial statements
- Train new sales staff
Correct answer: Keep critical operations running during a disruption
A BCP ensures essential business functions continue during and after a disruption.
Question 3: RTO (Recovery Time Objective) measures:
- How quickly a system must be restored after an outage (Correct answer)
- How many users a server supports
- The strength of a password
- The number of firewall rules
Correct answer: How quickly a system must be restored after an outage
RTO defines the target time to restore a system or process after disruption.
Question 4: A risk assessment determines that a threat is likely and impactful. The organization buys cyber insurance. This is an example of:
- Risk transfer (Correct answer)
- Risk acceptance
- Risk avoidance
- Risk elimination
Correct answer: Risk transfer
Buying insurance shifts the financial impact to a third party, which is risk transfer.
Question 5: Which control type is a security camera that records activity for later review?
- Detective control (Correct answer)
- Preventive control
- Corrective control
- Compensating control
Correct answer: Detective control
A camera detects and records events but does not stop them, making it a detective control.
Question 6: What is the primary purpose of an access control review (recertification)?
- Confirm users still need their current access rights (Correct answer)
- Speed up the network
- Update antivirus signatures
- Replace expired SSL certificates
Correct answer: Confirm users still need their current access rights
Periodic recertification verifies that access rights still match each user's job needs.
Question 7: An employee leaves the company. Which offboarding step is most critical for security?
- Promptly revoking all system access (Correct answer)
- Returning their parking pass
- Scheduling an exit lunch
- Updating the org chart
Correct answer: Promptly revoking all system access
Immediately revoking access prevents former employees from misusing accounts.
Cyber Security Jobs Organizational Cyber Security 3
An incident response plan typically defines phases.
Which sequence is correct?