60 questions / 10 random questions
Random questions, instant feedback, and review for missed questions.
View recommended Information Security Management resources →
Among the three elements of information security, which describes confidentiality?
Answer: Only authorized parties can access the information
Confidentiality means only authorized parties have access; integrity is accuracy and availability is usability.
Which event threatens integrity among the three security elements?
Answer: Data is altered without authorization
Integrity means information is accurate and untampered; unauthorized alteration threatens it.
Which measure improves availability among the three security elements?
Answer: Add redundancy so the system keeps running during failures
Availability means usable when needed; redundancy and backups improve continuity during failures.
Which best describes risk assessment?
Answer: Identifying, analyzing, and evaluating risks
Risk assessment comprises identification, analysis, and evaluation, forming the basis for prioritizing responses.
Which is an example of risk transfer among risk responses?
Answer: Buying cyber insurance to shift the financial loss
Risk transfer shifts loss to a third party via insurance or outsourcing, distinct from avoidance, reduction, and acceptance.
Which term refers to a framework for continuously managing information security in an organization?
Answer: ISMS (Information Security Management System)
An ISMS, based on ISO/IEC 27001, maintains and improves information security continuously using the PDCA cycle.
Which is the document hierarchy defining an organization basic policy and rules for information security?
Answer: An information security policy
An information security policy comprises basic policy, standards, and procedures, forming the basis of the organization efforts.
Which are the three elements of the fraud triangle that make internal fraud more likely?
Answer: Motive, opportunity, and rationalization
The fraud triangle holds that fraud is likely when motive, opportunity, and rationalization are all present.
Which is a dedicated team set up in an organization to respond to security incidents?
Answer: CSIRT
A CSIRT detects, responds to, and helps prevent incidents, aiming to minimize damage and recover.
Which practice involves clearing documents and locking the screen when leaving a desk?
Answer: Clear desk and clear screen
Clear desk and clear screen prevent information from being seen or taken when a desk is unattended.
Which malware encrypts files to make them unusable and demands payment for decryption?
Answer: Ransomware
Ransomware encrypts data and demands a ransom for the decryption key; backups are an effective countermeasure.
Which malware self-replicates and spreads over a network without attaching to other programs?
Answer: Worm
A worm self-replicates independently and spreads automatically across networks.
Which malware disguises itself as legitimate software and performs malicious actions covertly?
Answer: Trojan horse
A Trojan horse poses as useful software but steals information or installs backdoors once run.
Which attack targets a specific organization, using emails that impersonate business contacts to gain entry?
Answer: Targeted attack
A targeted attack focuses on a specific organization, using crafted business-like emails to intrude in stages.
Which technique extracts information by exploiting human psychology rather than technical means?
Answer: Social engineering
Social engineering tricks people via phone calls, impersonation, or shoulder-surfing to obtain information.
Which attack exploits insufficient input validation to manipulate a database?
Answer: SQL injection
SQL injection inserts malicious SQL through input fields to steal or alter data; input validation and placeholders prevent it.
Which attack tries every possible password to break authentication?
Answer: Brute-force attack
A brute-force attack tries passwords exhaustively; account lockout and long, complex credentials mitigate it.
Which attack floods a service with requests to make it unavailable?
Answer: DoS / DDoS attack
DoS/DDoS overwhelms a service to deny availability; DDoS originates from many distributed devices.
Which is a challenge of symmetric-key cryptography?
Answer: Keys must be securely shared and managed with each correspondent
Symmetric-key cryptography is fast but faces the key-distribution problem of sharing keys securely per correspondent.
In public-key cryptography, which key encrypts a message intended for a recipient?
Answer: The recipient public key
With public-key encryption, the recipient public key encrypts and only the recipient private key can decrypt.
What can a digital signature confirm?
Answer: The signer authenticity and that the content is unaltered
A digital signature provides signer authenticity, content integrity, and non-repudiation.
Which framework uses certificates to guarantee that a public key truly belongs to its owner?
Answer: PKI (public key infrastructure) with a CA
In PKI, a certificate authority (CA) issues digital certificates that vouch for the rightful owner of a public key.
Which authentication uses multiple distinct factors such as knowledge, possession, and biometrics?
Answer: Multi-factor authentication
Multi-factor authentication combines different factor types so a single leaked factor is not enough to break in.
Which principle grants users only the minimum permissions needed for their work?
Answer: The principle of least privilege
Least privilege grants only necessary permissions, limiting damage from leaks or mistakes.
Which network zone isolates publicly exposed servers from the internal network?
Answer: DMZ (demilitarized zone)
A DMZ is a buffer zone separating public servers from the internal network, limiting damage spreading inward.
Which system detects signs of unauthorized intrusion into a network or host?
Answer: IDS (intrusion detection system)
An IDS detects and alerts on intrusion signs; an IPS additionally blocks the traffic.
Which encryption standard is currently recommended to protect wireless LAN communication?
Answer: WPA2 / WPA3
WPA2/WPA3 is recommended for wireless LAN; WEP is weak and easily cracked, so it should not be used.
Which law prohibits logging in using another person's ID and password without authorization?
Answer: The unauthorized computer access law
The unauthorized access law prohibits using others' credentials without permission and exploiting security holes to intrude.
Which register identifies information assets and clarifies their importance, location, and owner?
Answer: Information asset register
An information asset register tracks assets to protect and manages classification, owner, location, importance, and related details.
Before allowing an external contractor to handle confidential information, which action is most important?
Answer: Check the contractor's controls and specify confidentiality and subcontracting terms in the contract
Supplier security management reduces leakage risk through assessment, contract terms, confidentiality, subcontracting control, and periodic review.
When a security incident occurs, which initial action is important for evidence preservation and damage containment?
Answer: Notify stakeholders according to procedure and preserve logs and device state
Incident response follows procedures for notification, triage, evidence preservation, containment, recovery, and prevention.
Which metric indicates the target time by which operations should be restored after a failure?
Answer: RTO
RTO is the recovery time objective, while RPO is the recovery point objective for acceptable data loss.
Which attack impersonates an executive or business partner by email to request money transfer or confidential information?
Answer: Business email compromise (BEC)
BEC impersonates trusted parties to trick victims into transfers or disclosure. Verification procedures and multi-approval help reduce risk.
Which backup measure is especially important for preparing against ransomware damage?
Answer: Keep versioned backups in a location attackers cannot easily modify or delete
Ransomware resilience improves with versioned, offline or immutable backups and tested restoration procedures.
Which mechanism continuously monitors suspicious behavior on PCs and servers and helps investigation and containment after compromise?
Answer: EDR
EDR monitors endpoint behavior and supports detection, investigation, and isolation, including activity not easily covered by traditional antivirus.
Which basic measure reduces the risk of exploitation of known vulnerabilities?
Answer: Apply patches and continuously monitor vulnerability information
Vulnerability management continuously identifies assets, gathers vulnerability information, checks impact, and applies patches or mitigations.
Which concept controls access by verifying users, devices, and context each time instead of relying only on an internal/external boundary?
Answer: Zero trust
Zero trust assumes no implicit trust inside or outside the network and controls access using authentication, authorization, and device posture.
Which system collects logs from multiple devices and correlates them to detect suspicious signs?
Answer: SIEM
SIEM collects logs and events, correlates them, and generates alerts to support early incident detection.
Which mechanism detects and blocks attacks against web applications such as SQL injection and cross-site scripting?
Answer: WAF
A WAF monitors HTTP/HTTPS traffic to web applications and detects or blocks common attack patterns.
Which law requires large information distribution platforms to address rights-infringing content and improve transparency?
Answer: Information Distribution Platform Act
The Information Distribution Platform Act requires specified large platforms to improve response to takedown requests and operational transparency.
You need different protection for customer data, internal documents, and public materials. What should be done first?
Answer: Classify information assets and define handling rules and owners for each class
Asset classification and handling rules enable consistent access, encryption, transfer, and disposal controls based on sensitivity.
A legacy business system is rated high risk but cannot be upgraded immediately. What is the appropriate response?
Answer: Define compensating controls, an owner, and a deadline; approve residual risk and track the upgrade plan
Risk that cannot be removed immediately should receive compensating controls such as segmentation and monitoring, formal residual-risk approval, and a tracked deadline.
When adopting a cloud service that handles personal data, which supplier checks are most important?
Answer: Check responsibility boundaries, data location, subcontracting, incident notification, and deletion or return terms
Before cloud adoption, verify provider and customer responsibilities, the data lifecycle, subprocessors, and incident response terms.
A ransomware exercise reveals poor coordination among executives, legal, communications, and IT. What should happen next?
Answer: Record gaps, owners, and deadlines; update the response and communication plans and exercise again
Exercises should drive improvement. Update roles, decision criteria, and communication paths, then verify corrective actions in another exercise.
A critical process has a four-hour RTO. What is the best way to validate the recovery procedure?
Answer: Run a recovery exercise and measure time to resume operations and missing resources
An RTO is the target time to resume business. An end-to-end exercise covering restoration, failover, validation, and communication proves feasibility.
Internal audits repeatedly find undeleted former-employee accounts. What is the appropriate corrective action?
Answer: Link HR offboarding to account disablement and verify effectiveness through records and periodic reviews
Recurring nonconformity requires root-cause removal plus linked processes, ownership, evidence, and periodic review of corrective-action effectiveness.
Many users retain access to a former department's confidential folders after transfer. Which control is appropriate?
Answer: Link transfers to access changes and perform periodic owner access reviews
Joiner-mover-leaver controls and periodic access certification remove unnecessary rights after role changes and preserve least privilege.
An email claiming to be from a partner's president urgently requests a bank-account change. What is the best response?
Answer: Verify through a previously registered channel and follow dual-approval procedures
BEC defenses require independent verification, controlled payment-change procedures, separation of duties, and resistance to manufactured urgency.
A QR code in a mailed notice leads to a fake timekeeping site where credentials are entered. What attack is this?
Answer: QR phishing (quishing)
QR phishing hides a malicious URL in a QR code and directs mobile users to a fake site. URL verification and phishing-resistant authentication help.
Customer files become publicly readable because of an incorrect cloud-storage setting. What is the primary cause category?
Answer: Security misconfiguration
Incorrect cloud exposure, permissions, or encryption settings are common breach causes. Secure defaults, policy checks, and change review reduce the risk.
An employee who is leaving downloads a large customer list unrelated to current duties. What is the best initial response?
Answer: Validate the activity and authorization, then restrict access, preserve evidence, and coordinate relevant teams as needed
Suspected insider activity requires checking authorization and business need, containing risk, preserving evidence, and coordinating HR, legal, and the CSIRT.
Which authentication method avoids storing passwords on the server and is resistant to credential theft by fake sites?
Answer: A FIDO2/WebAuthn passkey
Passkeys use a device-held private key and service-specific public key, avoiding shared passwords and adding phishing resistance through origin binding.
Which mechanism publishes a policy for receivers to reject spoofed mail using SPF and DKIM results?
Answer: DMARC
DMARC evaluates SPF or DKIM with From-domain alignment and publishes failure policy and aggregate reporting destinations in DNS.
Backup jobs succeed daily, but recoverability during an outage is unknown. What control is needed?
Answer: Regular restore tests with recorded recovery results
A backup is useful only if it can be restored. Restore testing verifies integrity, procedures, timing, and dependencies.
Which method securely manages encryption keys for a customer database?
Answer: Separate keys from data in a KMS and control access, rotation, and usage logging
Keys should be separated from protected data and managed through least privilege, rotation, audit logging, backup, and lifecycle controls.
Which capability continuously detects public storage and excessive permissions across many cloud accounts?
Answer: CSPM configuration assessment and policy-violation detection
CSPM continuously assesses cloud configuration and identifies baseline violations in exposure, encryption, permissions, and logging.
Which management capability should be in place before a company smartphone is lost to protect business data?
Answer: Use MDM to enforce screen lock, encryption, and remote lock or wipe
MDM centrally manages device settings, compliance, and remote response. Device inventory and prompt loss reporting are also necessary.
Which technology prevents unmanaged devices from joining the corporate LAN and limits access according to device posture?
Answer: NAC
NAC evaluates user and device identity and compliance, then grants, quarantines, or restricts network access.
What is the basic rule when personal information would be handled beyond the scope needed for the stated purpose?
Answer: Except where law provides otherwise, confirm a lawful basis such as the person's consent
Personal information should be handled within the specified and communicated purpose; use beyond it requires a lawful exception or basis such as consent.
What basic control is expected when a company outsources processing of personal data?
Answer: Select an appropriate processor and ensure security through contracts and necessary supervision
The controller should assess processor safeguards and provide necessary supervision through contracts, handling oversight, and subprocessor controls.