Under the NIST Cybersecurity Framework 2.0 (released February 2024), which function was newly added to the original five Core Functions to emphasize organizational oversight of cybersecurity risk?
Cybersecurity Risk Management
Question · Easy
AWS or YOU?
Short
A business analyst is documenting a risk register for a new payment platform. Which formula best represents quantitative risk?
Which risk treatment option is being applied when an organization purchases a cyber insurance policy to cover potential ransomware payouts?
Business Exam Prep Podcast
Listen on Spotify
Podcast
Which element of the CIA triad is MOST directly compromised when an attacker performs a ransomware attack that encrypts production databases?
ISO/IEC 27001:2022 reorganized Annex A controls into how many controls grouped under four themes?
Question · Medium
New hire access: Expectation vs Reality
An organization's risk register lists a residual risk that remains after controls are applied. What is residual risk?
Within NIST CSF 2.0, the IDENTIFY function is concerned with which type of activity?
A BA is performing a Business Impact Analysis for a critical SaaS application. Which two metrics are MOST important to capture for continuity planning?
Which qualitative risk assessment technique uses ratings such as Low/Medium/High/Critical on impact and likelihood axes?
An organization implements segregation of duties so that the developer who writes code cannot deploy it to production. This control is BEST classified as which type?
Under STRIDE threat modeling, an attacker who pretends to be a legitimate user by stealing credentials is performing which threat category?
Threat Assessment
MITRE ATT&CK Enterprise organizes adversary behavior into 14 tactics. Which tactic represents an attacker's actions to maintain access across reboots and credential changes?
Which threat modeling methodology is risk-centric and incorporates business impact, asset valuation, and attack analysis across seven stages?
A vulnerability has a CVSS v3.1 base score of 9.8. According to the CVSS specification, this corresponds to which qualitative severity rating?
Which threat intelligence concept describes observable artifacts (file hashes, IPs, domains) that suggest a system has been compromised?
Which authentication factor category does a fingerprint scan represent?
Security Solutions
A BA is documenting access requirements for a multi-tenant SaaS application. Which access control model assigns permissions based on attributes like department, clearance, time of day, and resource sensitivity?
Which protocol is MOST commonly used for federated single sign-on between an enterprise identity provider and a SaaS application?
A development team needs an authorization framework that lets a user grant a third-party app limited access to their resources without sharing the password. Which standard is MOST appropriate?
Which encryption algorithm is symmetric and uses 128-, 192-, or 256-bit keys, and is recommended by NIST for data-at-rest protection?
Which property does a cryptographic hash function MUST provide to be suitable for password storage and integrity verification?
Which TLS feature ensures that the compromise of a server's long-term private key does NOT allow decryption of previously captured TLS traffic?
Question · Hard
Which network device inspects traffic at OSI Layers 3-7 and can block exploits based on signatures, anomalies, and protocol decoding?
Which Zero Trust principle is BEST described by the phrase 'never trust, always verify'?
Which security tool centralizes log collection, correlation, and alerting across firewalls, endpoints, and applications?
An organization wants to detect and respond to threats on laptops including process tree visibility, behavioral analytics, and remote isolation. Which capability does this describe?
In cloud security terminology, which tool continuously monitors cloud configurations against best practices and compliance frameworks (CIS, PCI DSS, HIPAA)?
Which technique segments a flat network into smaller zones to limit east-west lateral movement after a breach?
Which IAM concept grants a privileged user time-bounded, just-in-time elevated rights with approval workflow and session recording?
Which EU regulation requires organizations to notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it (where feasible)?
Compliance And Regulation
Under GDPR, which lawful basis allows processing necessary for the legitimate interests of the controller, balanced against the rights of data subjects?
PCI DSS v4.0 became the only mandatory version on which date, after PCI DSS v3.2.1 was retired?
Which US regulation establishes Security and Privacy Rules to protect Protected Health Information (PHI) handled by covered entities and business associates?
Which NIST publication defines security and privacy controls for federal information systems and is widely used as the comprehensive control catalog (over 1,000 controls and enhancements in Revision 5)?
Which framework specifically protects Controlled Unclassified Information (CUI) on nonfederal systems and is referenced by DFARS clause 252.204-7012?
A BA is eliciting security requirements for a new mobile banking app. Which technique BEST surfaces security needs by considering how an actor could deliberately misuse the system?
Cybersecurity For Ba Practice
When writing security-related user stories, what is a recommended format that ties security requirements to a measurable outcome?
Which BABOK Guide knowledge area MOST directly aligns with documenting security non-functional requirements such as authentication strength, encryption in transit, and audit logging?
A BA discovers during elicitation that a requested feature would cause the product to violate GDPR by collecting unnecessary personal data. What is the MOST appropriate next step?
Which artifact is MOST helpful when a BA needs to communicate security requirements traceability from a regulation to a control to a user story?
Which document type sits at the TOP of the standard policy hierarchy, expressing management intent and high-level direction?
Governance And Ethics
Which data classification level is typically reserved for information whose unauthorized disclosure could cause severe damage to the organization or to individuals?
Privacy by Design (PbD), formalized by Ann Cavoukian, includes seven foundational principles. Which principle requires that privacy be the default setting in any system or business practice?
Which ethical obligation is CENTRAL to the IIBA Code of Ethical Conduct and Professional Standards when a BA discovers conflicting interests between two stakeholders?
An organization is establishing security awareness training. Which control type does training MOST directly represent?
Loading more…