Threats, Threat Sources, and Vulnerabilities EHE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In information security, what is a vulnerability?

   • AA potential danger that could cause harm to an organization
   • BThe actual loss or damage resulting from a security incident
   • CThe likelihood that a threat will exploit a weakness
   • DA weakness in a system that could be exploited by a threat
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is assessing the risk of a data breach. They identify that their employees use weak passwords, and that the company stores sensitive customer data on a server with a known vulnerability. Which combination of threat source and vulnerability category is most relevant to this risk?

   • AInsider threat; configuration vulnerability (weak passwords)
   • BNatural disaster; physical vulnerability (server location)
   • CExternal hacker; human-factor vulnerability (weak passwords) and technical vulnerability (server flaw)
   • DMalware; technical vulnerability (weak passwords)
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security audit reveals that a database server has default credentials enabled and is missing critical security patches. Which vulnerability categories are present?

   • AConfiguration and technical
   • BHuman factor and physical
   • CConfiguration and human factor
   • DTechnical and human factor
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An attacker uses a USB drop attack, leaving infected USB drives in the parking lot. An employee plugs one in, and malware installs. Which threat type and vulnerability category are involved?

   • ASocial engineering; human factor
   • BMalware; technical vulnerability
   • CPhysical threat; configuration vulnerability
   • DInsider threat; human factor
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is deciding between two security investments: (1) advanced endpoint protection to stop malware, and (2) a security awareness training program to reduce phishing. The company has seen both malware infections and successful phishing attacks. Which approach is most balanced?

   • AInvest in both, because they address different threat types and vulnerabilities.
   • BInvest in neither, because threats are always changing.
   • CInvest only in endpoint protection, because malware is the bigger threat.
   • DInvest only in training, because human error is the root cause.
   Reveal Solution Discussion Select an answer first