Domain 1 — General Security Concepts (12%) Domain 2 — Threats, Vulnerabilities & Mitigations (22%)

Q1. A healthcare provider is dealing with a situation where AAA is relevant.

Which control would BEST reduce risk in this scenario?

A. Network segmentation

B. Least privilege C. Security awareness training D. TLS

Answer

Q2. A mid-sized company is dealing with a situation where CIA triad is relevant.

Which option BEST describes what is happening?

A. Misconfiguration

B. Phishing C. Vishing D. Credential stuffing

Answer

Q3. A financial services firm is dealing with a situation where threat modeling is relevant.

Which option BEST describes what is happening?

A. CSRF

B. Supply chain attack C. SQL injection D. Misconfiguration

Answer

Q4. A SaaS startup is dealing with a situation where AAA is relevant.

Which option BEST describes what is happening?

A. Password spraying

B. MITM C. Spear phishing D. Misconfiguration

Answer

Q5. An organization is dealing with a situation where separation of duties is relevant.

Which control would BEST reduce risk in this scenario?

A. Regular, tested backups

B. SIEM C. Network segmentation D. Separation of duties

Answer

Q6. A mid-sized company is dealing with a situation where separation of duties is relevant.

What should the team do FIRST?

A. Eradicate the threat immediately

B. Validate the alert and gather context (logs, user, device, time) C. Restore systems from backup D. Notify external regulators immediately