Use Common Methodologies for Risk and Detection Prioritization. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is the primary goal of a vulnerability assessment?

   • ATo identify and quantify weaknesses in systems and applications
   • BTo simulate a real-world attack to test detection capabilities
   • CTo validate the effectiveness of security controls
   • DTo exploit vulnerabilities to demonstrate impact
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why is periodic review of detection priorities important?

   • ATo eliminate false positives
   • BTo satisfy compliance requirements only
   • CTo ensure that detection priorities remain aligned with the evolving threat landscape and business needs
   • DTo reduce the number of detection rules
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which formula is commonly used to calculate a risk score?

   • ARisk = Asset Value × Threat
   • BRisk = Likelihood × Impact
   • CRisk = Threat × Vulnerability
   • DRisk = Vulnerability × Impact
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team has implemented a risk-based detection program. After a major merger, the company's attack surface has expanded significantly, and new threats have emerged. The team is struggling to keep detection priorities up to date. What is the most effective way to ensure continuous alignment?

   • ASchedule a quarterly review of risk assessments and detection use cases.
   • BWait for the next major incident to trigger a review.
   • CFreeze the current detection set to maintain stability.
   • DRely on real-time threat intelligence feeds to automatically adjust detections.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is conducting a vulnerability assessment and has identified a critical vulnerability in a legacy system that is no longer supported by the vendor. The system is isolated from the internet but is accessible from the internal network. The team has a limited window for remediation. Which action should they take to best reduce risk?

   • AAccept the risk because the system is not internet-facing.
   • BDecommission the system immediately to eliminate the risk.
   • CApply a virtual patch via the intrusion prevention system (IPS) to mitigate the vulnerability.
   • DUpgrade the system to a newer version, even though the vendor no longer supports it.
   Reveal Solution Discussion Select an answer first