Objective 3.5 Identify and Mitigate Safety and Security Risks CERTIFIED-ETHICAL-EMERGING-TECHNOLOGIST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which systematic method involves creating a structured representation of an application's architecture and data flows to identify potential threats and attack vectors?

   • AThreat modeling
   • BPenetration testing
   • CRisk assessment
   • DVulnerability scanning
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A city is planning to deploy an AI-powered traffic management system that adjusts signal timings based on real-time data. The system will be connected to the internet for remote monitoring. The city's risk team wants to identify potential safety risks before deployment. Which approach is the most comprehensive for this purpose?

   • AReview the SIEM logs from the existing traffic system to look for past security incidents.
   • BPerform a vulnerability scan on the traffic management servers to identify known software weaknesses.
   • CConduct a threat model that considers malicious attacks, system failures, human error, and environmental factors.
   • DImplement a defense-in-depth strategy by adding firewalls and intrusion detection systems to the network.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A security team wants to identify known vulnerabilities in their network devices and servers by comparing system configurations and software versions against a database of known weaknesses. Which method should they use?

   • AVulnerability scanning
   • BThreat modeling
   • CRisk assessment
   • DPenetration testing
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A financial services firm is developing a new customer-facing chatbot that will access account balances and transaction history. The development team wants to apply Security-by-Design principles from the start. Which practice best aligns with the least privilege principle in this context?

   • AUse a shared service account with administrative privileges to simplify integration with the backend systems.
   • BGrant the chatbot service account read-only access only to the specific data fields required for each user query.
   • CProvide the chatbot with full read/write access to the customer database to handle all possible future features.
   • DEmbed the database credentials directly in the chatbot's source code for faster deployment.
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A city is deploying an AI-based traffic management system that adjusts signal timings. The system relies on data from cameras and sensors. The city's risk team has identified that a cyberattack could cause the system to malfunction and create traffic hazards. Which mitigation is most directly aligned with this identified risk?

   • ARequire all traffic operators to undergo additional training on system operation.
   • BConduct a risk assessment to evaluate the likelihood of a cyberattack.
   • CImplement network segmentation and intrusion detection to prevent unauthorized access to the traffic system.
   • DAdd redundant cameras and sensors to improve data accuracy.
   Reveal Solution Discussion Select an answer first