Y11 EC Cybersecurity Wk5

Multiple Choice

Why is it important to understand risk-management strategies when dealing with cyber threats?

• To comply with regulations

• To reduce the likelihood and impact of breaches

• To increase company profits

• To avoid using technology

Open Ended

Describe how a risk matrix helps organisations prioritise and manage cyber risks.

Multiple Choice

Which combination of likelihood and severity results in an 'Extreme' risk rating according to the Risk Assessment Matrix?

• Improbable and Intolerable

• Possible and High

• Possible and Extreme

• Probable and Extreme

Open Ended

Explain how internal and external vulnerabilities can impact an organization's risk assessment process.

Multiple Choice

Which of the following are considered sources of threats in the threat landscape?

• Hacktivists

• Unpatched software

• Financial losses

• Operational disruptions

Open Ended

What factors should be considered when evaluating the likelihood of exploitation for a risk?

Multiple Choice

Match the following terms to their definitions: Risk, Threat, Vulnerabilities, Likelihood.

• Risk: Probability and impact of harm; Threat: Potential danger exploiting vulnerabilities; Vulnerabilities: Weaknesses in system; Likelihood: Chance threat exploits vulnerability

• Risk: Weaknesses in system; Threat: Probability and impact of harm; Vulnerabilities: Potential danger exploiting vulnerabilities; Likelihood: Chance threat exploits vulnerability

• Risk: Chance threat exploits vulnerability; Threat: Weaknesses in system; Vulnerabilities: Probability and impact of harm; Likelihood: Potential danger exploiting vulnerabilities

• Risk: Potential danger exploiting vulnerabilities; Threat: Probability and impact of harm; Vulnerabilities: Chance threat exploits vulnerability; Likelihood: Weaknesses in system

Open Ended

Explain how the impact of a security incident can be evaluated in terms of loss of confidentiality, integrity, and availability.

Multiple Choice

Which of the following is NOT a consequence of a security incident as described in the slide?

• Financial loss

• Confidentiality breach

• System disruption

• Increase in data integrity

Open Ended

Describe the difference between risk assessment and risk management.

Multiple Choice

Which steps are involved in conducting a cybersecurity risk assessment according to the guide referenced in the slide?

• Risk identification, asset identification, risk analysis, determine likelihood, determine impact, risk evaluation, prioritise risk

• Risk management, asset identification, risk analysis, determine likelihood, determine impact, risk evaluation, prioritise risk

• Risk identification, asset identification, risk analysis, determine likelihood, determine impact, risk evaluation, ignore risk

• Risk identification, asset identification, risk analysis, determine likelihood, determine impact, risk evaluation, transfer risk

Multiple Choice

What is the main vulnerability being exploited in the USB drop scenario described in the slides?

• Technical flaws in USB devices

• Human curiosity

• Weak network security

• Outdated antivirus software

Multiple Choice

Which of the following is a possible consequence of inserting an unknown USB drive into an organisation’s computer?

• Malware infection

• Improved system performance

• Automatic software updates

• Enhanced network security

Multiple Select

Which of the following emotions are commonly exploited by social engineers in their attacks? Select all that apply.

• Fear

• Curiosity

• Trust

• Greed

Open Ended

Explain how social engineers use emotions to manipulate their targets in USB drop scenarios.

Open Ended

Describe how an organisation can protect against removable media vulnerability and similar social engineering attacks.

Multiple Select

Which of the following are key components of a resilient cybersecurity posture according to a well-rounded cyber risk management strategy?

• Regular risk assessments

• Ongoing training

• Ignoring emerging threats

• Reactive-only measures

Open Ended

Explain why ongoing training is important for employees in the context of cybersecurity.

Multiple Choice

Which of the following is a key component of effective cyber risk management strategy?

• Regular software updates

• Strategy development

• Incident response plan

• Patch management

Multiple Select

Which activities are part of risk assessment in identifying and managing vulnerabilities?

• Vulnerability scanning

• Penetration testing

• Patch management

• Vulnerability management

Multiple Select

What are two measures an organisation can take to control damage and limit further losses during and after a breach?

• Mitigation measures

• Communication

• Ignoring software updates

• Weak passwords

Open Ended

Discuss how the Defence in Depth mindset, as explained by the Swiss cheese model for cybersecurity, helps organisations protect against threats.

Multiple Choice

Which of the following approaches can help change the security behaviour of individuals or organisations according to the discussion on human error in cybersecurity?

• Making users aware of how the underlying technology works

• Using peer learning and social influence

• Using risk-assessment mindsets

• All of the above

Open Ended

Reflecting on today's lesson, how would you use a risk matrix to assess cyber risk in a real-world scenario?