C795- Cybersecurity Management II (Tactical)| 166 questions| with complete solutions

What is a vulnerability? CORRECT ANSWERS: a weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. What is a penetration test? CORRECT ANSWERS: a simulated cyber attack against your systems or company What are the typical steps for a vulnerability test? CORRECT ANSWERS: Identify asset classification list, identify vulnerabilities, test assets against vulnerabilities, and recommend solutions to either eliminate or mitigate vulnerabilities What is the first thing an organization should do before defining security requirements? CORRECT ANSWERS: To define security requirements, first an organization must define its risk appetite. What is defense in depth? CORRECT ANSWERS: defense-in-depth principle; it is by adding relevant layer of controls (e.g., access control, encryption, and monitoring) that the expected level of protection is achieved. What are COTS applications? CORRECT ANSWERS: Applications developed by vendors and installed on the organization's information systems. These applications are usually purchased outright by organizations with usage based on licensing agreements. What are SaaS applications? CORRECT ANSWERS: Applications developed by service providers or vendors and installed on the provider or vendor information system. Organizations typically have an on-demand or pay-per-usage metrics. What is the goal of a security test? CORRECT ANSWERS: Verify that a control is functioning properly. What is a security assessment? CORRECT ANSWERS: A comprehensive reviews of the security of a system, application, or other tested environment What is the NIST SP 800-53A? CORRECT ANSWERS: The National Institute for Standards and Technology (NIST) offers a special publication that describes best practices in conducting security and privacy assessments. What is COBIT? CORRECT ANSWERS: the Control Objectives for Information and related Technologies describes the common requirements that organizations should have in place surrounding their information systems.