Module 15 (Fundamentals of Cybersecurity

Which of the following is NOT a component of a risk?

• Asset

• Threat

• Vulnerability

• Insurance

Answer explanation

Insurance is NOT a component of a risk because it is a risk management tool to mitigate the impact of risks, not a component of the risk itself.

Which type of control is designed to discourage attackers?

• Preventative

• Detective

• Corrective

• Deterrent

Answer explanation

Deterrent controls are specifically designed to discourage attackers from attempting to breach security measures.

Which agreement defines the level of service a vendor is expected to provide?

• BPA

• MOU

• SLA

• NDA

Answer explanation

The correct agreement that defines the level of service a vendor is expected to provide is SLA (Service Level Agreement). SLAs outline the specific services, performance metrics, and responsibilities of both parties.

Risk is simply the presents of a threat

• True

• False

Answer explanation

The statement is incorrect as risk involves both the presence of a threat and the potential impact or harm. Therefore, the correct answer is False.

Internal risks originate from outside an organization.

• True

• False

Answer explanation

Internal risks do not originate from outside an organization, so the statement is false. Internal risks come from within the organization.

Internal risks originate from inside an organization.

• True

• False

Answer explanation

Internal risks originate from inside an organization, making the statement true.

The Annual Loss Expectancy (ALE) is the estimated financial loss from a single risk event.

• True

• False

Answer explanation

The statement is false because the Annual Loss Expectancy (ALE) is the estimated financial loss from a risk event over a year, not just a single event.

The Single Loss Expectancy (SLE) is the estimated financial loss from a single risk event.

• True

• False

Answer explanation

The statement is true because the Single Loss Expectancy (SLE) indeed represents the estimated financial loss from a single risk event.

Data Wiping is a method of physical data destruction.

• True

• False

Answer explanation

Data wiping is a method of logical data destruction, not physical data destruction. Therefore, the statement is False.

The three elements of risk are assets, threats, and _______________.

Answer explanation

vulnerabilities