A small business recently suffered a ransomware attack that encrypted all files on a shared drive. The investigation found that an employee clicked a link in a phishing email, which downloaded the malware. Which combination of threat, vulnerability, and control best describes this incident?

Threat: social engineering; vulnerability: unpatched software; control: patch management

Threat: malware; vulnerability: lack of email filtering; control: antivirus software

Threat: ransomware; vulnerability: lack of security awareness; control: security awareness training

Threat: phishing; vulnerability: weak passwords; control: multi-factor authentication

Which of the following is a common topic covered in security awareness training?

How to recognize phishing emails

How to perform penetration testing

EC-CouncilCertified Security Specialist

Domain 3Objective 1

Information Security Fundamentals ECSS Practice Questions (Page 7)

Part of the Ethical Hacking Fundamentals and Core Attacks domain, which makes up ~17% of our current practice bank.

50questions here

10free pages

10concepts

10 Concepts in This Objective

Confidentiality, Integrity, and Availability (CIA) Triad
Authentication, Authorization, and Accounting (AAA)
Non-repudiation
Information Security Threats and Vulnerabilities
Risk Management Fundamentals
Security Controls (Preventive, Detective, Corrective)
Security Policies, Standards, and Procedures
Data Classification and Handling
Security Awareness and Training
Incident Response Fundamentals

Questions 31–35

31application · medium
A government agency classifies a document as 'Secret'. According to the agency's data handling policy, Secret documents must be encrypted at rest, stored in a controlled access room, and only accessible to personnel with a specific clearance. An employee accidentally sends this document to an external partner without encryption. Which security goal has been most directly violated?
Select an answer first
32foundation · easy
An organization's security team creates a document that specifies the exact encryption algorithms and key lengths that must be used for all data at rest. This document is best classified as a:
Select an answer first
33foundation · easy
Which of the following documents defines the mandatory rules and expectations for acceptable use of an organization's IT resources?
Select an answer first
34application · medium
A small business recently suffered a ransomware attack that encrypted all files on a shared drive. The investigation found that an employee clicked a link in a phishing email, which downloaded the malware. Which combination of threat, vulnerability, and control best describes this incident?
Select an answer first
35foundation · easy
Which of the following is a common topic covered in security awareness training?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Information Security Fundamentals ECSS Practice Questions (Page 7)

Questions 31–35

An organization's security team creates a document that specifies the exact encryption algorithms and key lengths that must be used for all data at rest. This document is best classified as a:

Which of the following documents defines the mandatory rules and expectations for acceptable use of an organization's IT resources?

A small business recently suffered a ransomware attack that encrypted all files on a shared drive. The investigation found that an employee clicked a link in a phishing email, which downloaded the malware. Which combination of threat, vulnerability, and control best describes this incident?

Which of the following is a common topic covered in security awareness training?

Keep studying — Ethical Hacking Fundamentals and Core Attacks