SFPC - Security Fundamentals Professional Information Security Fundamentals Questions and Answers

Question 1

A security analyst is reviewing access logs for a sensitive database server. The analyst is primarily concerned with ensuring that the data has not been altered or deleted by unauthorized individuals. Which principle of the CIA triad is the analyst's main focus?

Accepted Answer

Integrity

Answer

Integrity is the principle that ensures data is trustworthy and has not been subject to unauthorized modification or destruction. The analyst's focus on preventing alteration or deletion directly relates to maintaining the integrity of the data.

Question 2

A small company has developed a new proprietary manufacturing process. They are concerned about competitors stealing their trade secrets. Which of the following is the BEST control to mitigate this risk?

Accepted Answer

Requiring all employees with access to the process documents to sign non-disclosure agreements (NDAs).

Answer

While technical controls like firewalls and passwords are important, the most direct control to protect trade secrets from being shared by authorized individuals (insiders) is a legal control like a non-disclosure agreement (NDA). It legally binds employees to protect the company's confidential information.

Question 3

Which of the following describes the 'Availability' component of the CIA triad?

Accepted Answer

The assurance that authorized users can access information and systems when required.

Answer

Availability ensures that systems, applications, and data are accessible to authorized users when they need them. It involves protecting against downtime caused by hardware failures, software bugs, or malicious attacks like Denial of Service (DoS).

Question 4

An organization is implementing a risk management program. After identifying potential threats and vulnerabilities, what is the logical next step in the risk management process?

Accepted Answer

Conduct a risk analysis.

Answer

The standard risk management process involves identifying assets, threats, and vulnerabilities, and then analyzing the risk. Risk analysis involves evaluating the likelihood of a threat exploiting a vulnerability and the potential impact it would have on the organization. This analysis is crucial before deciding which controls to implement.

Question 5

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. This is an example of what type of attack?

Accepted Answer

Phishing

Answer

Phishing is a type of social engineering attack where an attacker sends fraudulent communications that appear to come from a reputable source, usually a financial institution or other service provider. The goal is to deceive the recipient into revealing sensitive information such as login credentials or credit card numbers.

SFPC - Security Fundamentals Professional Certification Practice Test

SFPC - Security Fundamentals Professional Certification Practice Test

SFPC - Security Fundamentals Professional Information Security Fundamentals Questions and Answers