1.4 Compare Security Concepts 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A small e-commerce company has identified a critical vulnerability in its payment processing system. The cost to fix the vulnerability is estimated at $50,000. The potential financial loss from a breach is estimated at $2 million. The company's security team recommends fixing the vulnerability. Which risk treatment strategy does this recommendation represent?

   • ARisk avoidance, because the company is avoiding the risk by not using the payment system.
   • BRisk acceptance, because the company is accepting the risk of a breach.
   • CRisk transfer, because the company could transfer the risk to an insurance provider.
   • DRisk mitigation, because the company is taking action to reduce the likelihood or impact of a breach.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is an exploit in cybersecurity?

   • AA weakness in a system that could be attacked
   • BThe impact of a successful attack
   • CA person who attempts to break into systems
   • DA piece of code or technique that takes advantage of a vulnerability
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is reviewing logs and finds that an attacker used a known exploit against a vulnerability in a web server's plugin. The exploit allowed the attacker to upload a web shell. What is the exploit in this scenario?

   • AThe web shell uploaded by the attacker
   • BThe known exploit code used against the plugin vulnerability
   • CThe attacker's motivation
   • DThe vulnerability in the web server plugin
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team is prioritizing risks for a financial institution. They have identified three risks: Risk A has a likelihood score of 9 and an impact score of 3. Risk B has a likelihood score of 6 and an impact score of 6. Risk C has a likelihood score of 3 and an impact score of 9. The team uses a weighted scoring model where impact is weighted twice as much as likelihood. Which risk should be addressed first?

   • AAll risks should be addressed simultaneously
   • BRisk C
   • CRisk B
   • DRisk A
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is evaluating how to handle a risk associated with a legacy system that stores sensitive customer data. The system is scheduled for decommissioning in 12 months. The risk is that the system could be compromised, leading to a data breach. The company has the following options: (A) invest $200,000 to patch and harden the system, (B) purchase a cyber insurance policy for $50,000 per year, (C) accept the risk and monitor the system, or (D) migrate the data to a new system immediately at a cost of $500,000. The company's risk tolerance is moderate. Which option is the most cost-effective and appropriate given the system's remaining lifespan?

   • APurchase a cyber insurance policy, because it transfers the risk at a lower cost than mitigation.
   • BAccept the risk, because the system is being decommissioned soon.
   • CMigrate the data to a new system immediately, because it eliminates the risk.
   • DInvest $200,000 to patch and harden the system, because it reduces the risk.
   Reveal Solution Discussion Select an answer first