Information Security Fundamentals Flashcards
6 cards from real SFPC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Information Security Fundamentals flashcards as text
A security analyst is reviewing access logs for a sensitive database server. The analyst is primarily concerned with ensuring that the data has not been altered or deleted by unauthorized individuals. Which principle of the CIA triad is the analyst's main focus?
Answer: Integrity
Integrity is the principle that ensures data is trustworthy and has not been subject to unauthorized modification or destruction. The analyst's focus on preventing alteration or deletion directly relates to maintaining the integrity of the data.
A small company has developed a new proprietary manufacturing process. They are concerned about competitors stealing their trade secrets. Which of the following is the BEST control to mitigate this risk?
Answer: Requiring all employees with access to the process documents to sign non-disclosure agreements (NDAs).
While technical controls like firewalls and passwords are important, the most direct control to protect trade secrets from being shared by authorized individuals (insiders) is a legal control like a non-disclosure agreement (NDA). It legally binds employees to protect the company's confidential information.
Which of the following describes the 'Availability' component of the CIA triad?
Answer: The assurance that authorized users can access information and systems when required.
Availability ensures that systems, applications, and data are accessible to authorized users when they need them. It involves protecting against downtime caused by hardware failures, software bugs, or malicious attacks like Denial of Service (DoS).
An organization is implementing a risk management program. After identifying potential threats and vulnerabilities, what is the logical next step in the risk management process?
Answer: Conduct a risk analysis.
The standard risk management process involves identifying assets, threats, and vulnerabilities, and then analyzing the risk. Risk analysis involves evaluating the likelihood of a threat exploiting a vulnerability and the potential impact it would have on the organization. This analysis is crucial before deciding which controls to implement.
A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. This is an example of what type of attack?
Answer: Phishing
Phishing is a type of social engineering attack where an attacker sends fraudulent communications that appear to come from a reputable source, usually a financial institution or other service provider. The goal is to deceive the recipient into revealing sensitive information such as login credentials or credit card numbers.
According to the principle of least privilege, how should access to information and resources be granted?
Answer: Users should be granted the minimum level of access and permissions necessary to perform their job functions.
The principle of least privilege is a fundamental concept in information security that states a user should only have the minimum set of permissions required to perform their specific job responsibilities, and nothing more. This helps to limit the damage that can be caused by an accident, error, or a compromised user account.