Overview of Information Security and Defense Strategies EHE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the first step in the risk management process?

   • ARisk monitoring
   • BRisk mitigation
   • CRisk identification
   • DRisk assessment
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   After a security breach, an organization restores systems from backups and applies patches to close the exploited vulnerability. Which category of security control does this represent?

   • ACorrective
   • BDetective
   • CPreventive
   • DDeterrent
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of a defense-in-depth strategy?

   • ATo rely on a single strong control to stop all attacks
   • BTo focus only on technical controls and ignore physical and administrative controls
   • CTo create multiple layers of security controls so that if one fails, others still provide protection
   • DTo eliminate all threats to the organization
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has a web server that is vulnerable to SQL injection. The company has implemented a web application firewall (WAF) that blocks many SQL injection attempts. However, the WAF is not foolproof, and the company wants to reduce the risk further. Which action would be most effective?

   • AFix the application code to use parameterized queries.
   • BIncrease the server's logging level.
   • CDisable the web server's error messages.
   • DAdd a second WAF in series.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A hospital's patient portal stores sensitive health records. A recent vulnerability scan revealed that the web application is susceptible to SQL injection, and the IT team has not yet applied the vendor's security patch. Which combination of controls best reduces the immediate risk while the patch is being tested?

   • ADeploy a web application firewall (WAF) rule to filter malicious SQL payloads and restrict database account privileges to least privilege.
   • BIncrease the logging level on the web server and review logs weekly for any signs of SQL injection attempts.
   • CDisable the database service during business hours to prevent any SQL injection attempts until the patch is applied.
   • DSend an email to all patients advising them to change their passwords immediately.
   Reveal Solution Discussion Select an answer first