Cybersecurity Concepts and Vulnerabilities Quiz

False (B)

Educating users about phishing attacks

<p>Insider</p> Signup and view all the answers

<p>Malware = Software designed to disrupt or damage systems Phishing = Tricking individuals into giving up personal information DDoS = Overwhelming a system making it unavailable MitM Attacks = Intercepting communications between two parties</p> Signup and view all the answers

<p>Software Vulnerabilities (C)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>To identify, evaluate, and prioritize risks (D)</p> Signup and view all the answers

<p>Training staff on security procedures</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>network</p> Signup and view all the answers

<p>Ensuring system reliability (A)</p> Signup and view all the answers

<p>Provides precise and objective risk analysis.</p> Signup and view all the answers

<p>low</p> Signup and view all the answers

<p>Qualitative = Subjective evaluation of risks Quantitative = Objective analysis using numerical data NIST RMF = Structured governmental framework ISO/IEC 27005 = Internationally recognized standard</p> Signup and view all the answers

<p>It requires both qualitative and quantitative data (A)</p> Signup and view all the answers

<p>True (A)</p> Signup and view all the answers

<p>Proactive risk management</p> Signup and view all the answers

<p>monetary values</p> Signup and view all the answers

<p>ISO/IEC 27005 (C)</p> Signup and view all the answers

<p>Profitability (D)</p> Signup and view all the answers

<p>True (A)</p> Signup and view all the answers

<p>Maintaining the accuracy and completeness of data.</p> Signup and view all the answers

<p>authentication</p> Signup and view all the answers

<p>Confidentiality = Ensuring that sensitive information is only accessible by authorized individuals. Integrity = Maintaining the accuracy and completeness of data. Availability = Ensuring that information and systems are available to users when needed. Non-repudiation = Ensuring that actions cannot be denied after they have occurred.</p> Signup and view all the answers

<p>Mitigating cyber risks (A)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>Redundancy</p> Signup and view all the answers

<p>compliance</p> Signup and view all the answers

<p>Secure Software Development = Incorporating security into the software development lifecycle. Network Security = Using firewalls and intrusion detection systems. Access Control = Implementing role-based access mechanisms. Incident Response Planning = Preparing to effectively respond to security incidents.</p> Signup and view all the answers

<p>Confidentiality (B)</p> Signup and view all the answers

<p>True (A)</p> Signup and view all the answers

<p>Firewall</p> Signup and view all the answers

<p>risk</p> Signup and view all the answers

A weakness in a system or software that can be exploited by attackers.

The potential for a vulnerability to be exploited by an attacker.

The likelihood that a threat will exploit a vulnerability and the potential impact of that exploitation.

Software intentionally designed to harm a computer system, steal data, or gain unauthorized access.

Tricking users into revealing personal information or credentials.

An attack that aims to overwhelm a system or network, making it unavailable to users.

A type of DoS attack where multiple compromised systems are used to overwhelm a target.

An attacker intercepts communications between two parties without their knowledge.

A threat from an individual inside an organization who has access to sensitive information.

Sophisticated and targeted cyber attacks conducted by skilled adversaries.

A systematic process of identifying, analyzing, and prioritizing risks to information systems. Helps organizations allocate resources and implement security controls.

A subjective approach using expert judgment to evaluate risks based on their severity and likelihood.

An objective approach using numerical data and statistical methods to quantify risks.

Combines elements of both qualitative and quantitative methods.

A structured approach developed by NIST for managing risks to information systems.

An ISO standard that provides guidelines for information security risk management.

Identifies potential risks, develops mitigation strategies, and regularly reviews findings.

Proactively managing risks, allocating resources effectively, ensuring compliance, and strengthening security measures.

Each methodology has its strengths and weaknesses, choose the one that best suits your needs and resources.

A document that explores various risk assessment methodologies and their applications in practice.

The practice of applying engineering principles to the design and implementation of secure systems.

Ensuring sensitive information is accessible only to authorized individuals. Measures include encryption, access control, and data masking.

Maintaining the accuracy and completeness of data. Measures include checksums, digital signatures, and version control.

Ensuring information and systems are available to authorized users when needed. Measures include redundancy, load balancing, and disaster recovery planning.

Verifying the identity of users and systems. Methods include passwords, biometrics, and multi-factor authentication.

Granting or denying access to resources based on user roles and permissions. Mechanisms include access control lists (ACLs) and role-based access control (RBAC).

Ensuring that actions or transactions cannot be denied after they have occurred. Achieved through the use of digital signatures and audit logs.

Protecting sensitive information, such as personal data, financial records, and intellectual property, from unauthorized access and disclosure.

Identifying and mitigating cyber risks, reducing the likelihood of security breaches and minimizing their impact.

Complying with regulatory requirements that mandate specific security measures for various industries.

Gaining trust from customers, partners, and stakeholders by implementing strong security measures.

Ensuring systems remain operational and available even in the face of security incidents, supporting business continuity.

Incorporating security into the software development lifecycle (SDLC) to ensure applications are built with security in mind.

Designing and implementing secure network architectures using firewalls, intrusion detection/prevention systems (IDS/IPS), and virtual private networks (VPNs).

Implementing strong access control mechanisms to ensure users have the appropriate level of access based on their roles.