Tüm alıştırma soruları

A cloud-hosted video rendering cluster maintained by a media organization has an estimated Asset Value ($AV$) of $\$1,500,000$. Operational metrics show that ransomware incidents targeting the rendering nodes have an Annualized Rate of Occurrence ($ARO$) of $0.20$ and an unmitigated Exposure Factor ($EF$) of $0.50$. The organization deploys an automated immutable backup solution costing $\$25,000$ annually. With this safeguard in place, the Exposure Factor ($EF$) for ransomware attacks drops to $0.10$, while the $ARO$ remains unchanged at $0.20$. What is the net annual financial benefit (in USD) realized by implementing this security control?

A regional hospital network is evaluating a software provider to host patient portal data in a public cloud deployment. The hospital's compliance policy mandates independent verification that the cloud vendor's security, confidentiality, and availability controls operate effectively over a continuous 12-month monitoring period. Which of the following attestation reports should the hospital request from the vendor?

An international cloud technology enterprise processes user telemetry and account details for customers residing in the European Union. To comply with privacy laws governing large-scale handling of personal information, the enterprise must appoint an individual responsible for monitoring regulatory compliance, conducting privacy impact assessments, and serving as the primary liaison to supervisory authorities. Which of the following governance roles is specifically designated for these statutory duties?

A cloud SaaS provider is evaluating a quantitative risk mitigation strategy for its primary customer invoicing repository, which has an Asset Value ($AV$) of $\$400,000$. Security assessment data indicates an unmitigated ransomware threat has an Exposure Factor ($EF$) of $25\%$ and an Annual Rate of Occurrence ($ARO$) of $0.5$. The organization is considering deploying an automated threat prevention platform costing $\$15,000$ per year, which is expected to reduce the $EF$ to $5\%$ and the $ARO$ to $0.1$. What is the net annual financial benefit of implementing this security control?

An enterprise security operations team is establishing mandatory operational controls to ensure all newly deployed Linux virtual machines meet a uniform minimum level of system hardening before entering production. The documentation must specify exact mandatory technical configurations, such as disabled vulnerable protocols, default account lockouts, and required kernel parameters. Which type of security governance document should the team implement to fulfill this requirement?

A security administrator is managing the remediation of a critical zero-day vulnerability affecting enterprise database servers. To ensure business continuity and adhere to organizational risk management policies, the administrator must execute the patch management lifecycle in a structured sequence. Arrange the operational steps below in the correct order from first to last.

Match each security evaluation term on the left with its primary operational purpose or definition on the right.

An enterprise organization is updating its continuity plan for a web server. The management team defines a requirement stating that, following an outage, data restored from backup must not be older than two hours. Which of the following business continuity parameters defines this maximum acceptable data loss timeframe?

A governance team at an online retail company is reviewing its security documentation hierarchy to ensure operational compliance across all engineering units. Which of the following governance document types establish mandatory requirements that all employees and system configurations must follow? (Select TWO).

A security operations team is triaging high-priority alerts generated by a Network Intrusion Detection System (NIDS) placed between an enterprise web tier and an internal database subnet. The NIDS logs show multiple HTTP requests containing payload strings such as `UNION SELECT username, password_hash FROM user_credentials--`. Which of the following statements correctly interpret this network security monitoring alert and identify an appropriate remediation control? (Select TWO.)

A multinational biomedical company operating in the United States and the European Union processes continuous telemetry from connected medical devices. During a compliance audit, the enterprise privacy team notes a structural conflict between HIPAA administrative audit logging mandates, which require immutable retention of user access records for six years, and GDPR data subject rights, which grant individuals the right to erasure of personal data. Which technical implementation best satisfies both legal mandates without violating regulatory compliance?

An organization is preparing for an independent external audit to verify that its operational security controls have functioned effectively throughout the previous fiscal year. The Lead Auditor requires evidence and reports that demonstrate control performance over this extended timeframe rather than at a single point in time. Which of the following evidence sources or attestation types satisfy the auditor's requirement? (Select TWO.)

An organization requires an independent, formal evaluation performed by an accredited third-party organization to verify that its information security controls conform to established compliance standards. Which of the following processes best satisfies this requirement?

Match each security audit, assessment, or attestation type on the left with its primary operational purpose or defining characteristic on the right.

An enterprise logistics company maintains an on-premises automated warehouse control system. A recent quantitative risk assessment revealed that a ransomware attack against the system's unpatched legacy operational technology (OT) controllers presents a Single Loss Expectancy ($SLE$) of $\$600,000$ with an Annual Rate of Occurrence ($ARO$) of $0.25$, yielding an inherent Annual Loss Expectancy ($ALE$) of $\$150,000$. Because vendor patches do not exist for the legacy OT controllers, complete system decommissioning is commercially unviable. The Chief Information Security Officer (CISO) approves a multi-part risk response: purchasing a targeted cyber insurance policy with a $\$20,000$ annual premium that covers up to $\$500,000$ of operational interruption losses per event, while deploying compensating network microsegmentation and passive anomaly detection at an annual cost of $\$15,000$. If the technical compensating controls successfully reduce the $ARO$ to $0.05$, which of the following statements correctly evaluates the financial impact and risk response strategies implemented by the organization?

An organization's finance clerk receives an urgent email appearing to originate from the Chief Executive Officer, requesting an immediate wire transfer to close a confidential vendor contract. Shortly after receiving the email, the clerk receives a phone call from an individual claiming to be the CEO, urging them to bypass standard dual-authorization procedures due to extreme time constraints. Subsequent investigation reveals the attacker created a false narrative and spoofed the internal caller ID.

Which of the following social engineering attack vectors and techniques are directly demonstrated in this scenario? (Select TWO).

Match each social engineering incident scenario on the left with the specific social engineering attack vector utilized on the right.

Match each Business Impact Analysis (BIA) and business continuity metric on the left to its corresponding operational definition on the right.

An enterprise online payment gateway has established a Maximum Tolerable Downtime (MTD) of $4$ hours and a Recovery Point Objective (RPO) of $15$ minutes for its transactional core. During a disaster recovery test following a simulated primary facility outage, engineers observe that data replication occurs at $10$-minute intervals, secondary virtual infrastructure deployment requires $2$ hours, and database state restoration and integrity verification require an additional $2.5$ hours before operations can resume. Which of the following statements accurately evaluates the organization's current business continuity posture?

An enterprise logistics organization is updating its security governance documentation framework following an audit review. As part of this initiative, the information security team publishes a document outlining recommended best practices for securing remote home-office wireless routers. The document offers advisory tips for optimizing router posture but explicitly leaves compliance to the discretion of individual employees. Which of the following document types within the security governance hierarchy best categorizes this publication?