Gap Analysis, Zero Trust, Non-Repudiation, AAA, & CIA

Which of the following is the first step in conducting a Gap Analysis?

• Create an action plan

• Define the target state

• Assess the current state

• Identify risks

A company conducts a Gap Analysis and finds that its password policies are not aligned with industry standards. What should be the next step?

• Patch outdated software

• Conduct a vulnerability scan

• Update the password policy

• Remove all administrator accounts

Which of the following would most likely be revealed by a Gap Analysis?

• Phishing attacks

• Lack of Multi-Factor Authentication (MFA)

• Increased network traffic

• Insider threats

Why is monitoring and reviewing the effectiveness of solutions important after completing a Gap Analysis?

• To identify potential internal threats

• To ensure gaps do not reoccur

• To prevent data breaches

• To lower the cost of compliance

Which of the following security frameworks would most likely serve as a benchmark for Gap Analysis?

• ISO/IEC 27001

• COBIT

• ITIL

• NIST

How does Gap Analysis contribute to risk management?

• It reduces the need for encryption

• It ensures data is always available

• It identifies vulnerabilities and compliance issues

• It automatically patches security flaws

When conducting a Gap Analysis, what type of tool would be most useful in assessing the current security posture?

• Vulnerability scanner

• Firewall

• Antivirus software

• SIEM

The core principle of the Zero Trust model is:

• Trust but verify

• Implicit trust of internal networks

• Never trust, always verify

• Minimal encryption

Zero Trust applies to which of the following areas of cybersecurity?

• Network security only

• User identity only

• All areas: users, devices, networks, applications, and data

• Physical security only

In Zero Trust, micro-segmentation primarily protects which control plane?

• Device

• Application/Workload

• User/Identity

• Data