Foundations of Cybersecurity GISF Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is designing a new system that will store sensitive customer data. The system must ensure that data is not altered during transmission and that only authorized users can access it. Which combination of security goals does this requirement represent?

   • AIntegrity and confidentiality
   • BIntegrity and availability
   • CAvailability and integrity
   • DConfidentiality and availability
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A university's IT department is configuring a new research database that contains sensitive human subject data. The university's policy requires that the data be protected from unauthorized access and that any breach be detected quickly. Which combination of controls best meets these requirements?

   • AEncrypt the database and implement an intrusion detection system (IDS) that alerts on suspicious access patterns.
   • BUse a firewall and a virtual private network (VPN) for remote access.
   • CPerform daily backups and store them offsite.
   • DRequire multi-factor authentication for all database administrators.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A regional bank is deploying a new online loan application. The compliance team requires that customer financial data be encrypted in transit and at rest, while the operations team needs the application to remain available during peak hours. The security team is asked to select controls that address these requirements. Which combination of controls best satisfies the stated requirements?

   • AEnable verbose logging on all application servers and retain logs for one year.
   • BImplement TLS for all external connections and database encryption, and deploy a load balancer with health checks.
   • CPurchase additional hardware for the database and place it in a separate rack.
   • DDeploy a web application firewall and require multi-factor authentication for all users.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is performing a risk assessment and has identified that a legacy server has a known unpatched vulnerability. The server is not critical to operations, and the cost to replace it is high. The company decides to accept the risk. Which step in the risk management process does this decision represent?

   • ARisk analysis
   • BRisk response
   • CRisk monitoring
   • DRisk identification
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A mid-sized company is choosing a security framework to guide its program. They have a small security team, limited budget, and need to comply with a customer requirement to demonstrate due care. They are considering ISO/IEC 27001, NIST Cybersecurity Framework (CSF), and PCI DSS (since they accept credit cards). Which approach is most appropriate?

   • AImplement only PCI DSS because the company accepts credit cards.
   • BSkip formal frameworks and rely on a commercial security product suite.
   • CImplement only ISO/IEC 27001 because it is the most comprehensive standard.
   • DUse NIST CSF as the overarching framework and implement PCI DSS controls for the cardholder data environment.
   Reveal Solution Discussion Select an answer first