Overview of Information Security and Defense Strategies EHE Practice Questions (Page 1)

Questions 1–5

1. 1expert · medium

   A company is implementing a new security policy that requires all employees to use a password manager and MFA. The policy also requires that employees not share passwords. However, some employees are resistant because they find the password manager difficult to use. What is the best way to ensure the policy is effective?

   • AAllow employees to opt out of the password manager if they sign a waiver accepting the risk.
   • BEnforce the policy by automatically blocking access to any account that does not use MFA.
   • CProvide training and support to help employees use the password manager effectively.
   • DDelay the policy implementation until a better password manager is found.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has identified two risks: Risk A has a 10% likelihood and a $1 million impact. Risk B has a 90% likelihood and a $10,000 impact. The company has a limited budget and can only address one risk. Which risk should the company prioritize?

   • ARisk A because it has a higher expected loss.
   • BNeither risk because the likelihoods are uncertain.
   • CRisk B because it has a higher likelihood of occurring.
   • DBoth risks equally because all risks are important.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary role of an ethical hacker?

   • ATo identify and mitigate security weaknesses in systems with authorization
   • BTo monitor network traffic for suspicious activity
   • CTo exploit vulnerabilities for personal gain
   • DTo develop malware for testing purposes
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is considering hiring an ethical hacker to test its new payment system. The system handles sensitive customer data and is subject to regulatory compliance. What is the most important factor to ensure the ethical hacking engagement is legal and effective?

   • AUsing the same tools that malicious hackers use.
   • BTesting only during off-peak hours to avoid disruption.
   • CKeeping the test results confidential from the company.
   • DObtaining written authorization and defining the scope of the test.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company has limited security budget and must choose between fixing a critical vulnerability in an internet-facing web server and implementing a new firewall rule that blocks a low-risk port. According to risk management principles, which action should the company prioritize?

   • ADefer both actions until a full risk assessment is completed.
   • BDo both simultaneously because all risks must be mitigated equally.
   • CFix the critical vulnerability first because it has higher likelihood and impact.
   • DImplement the firewall rule first because it is a preventive control.
   Reveal Solution Discussion Select an answer first