Cybersecurity Awareness - Risk Management

During a company meeting, Emilie mentioned that

some information is sensitive but not considered critical.

What classification should this information be given?

• Public

• Confidential

• Internal

• Restricted

Answer explanation

The information is sensitive but not critical, which aligns with the 'Internal' classification. This category is for information that should be protected but is not essential for the company's operations.

Zak is working on a project that involves handling sensitive company data.

What classification should this information be given to ensure it is protected?

• Confidential

• Internal

• Restricted

• Public

Answer explanation

The sensitive company data should be classified as 'Restricted' to ensure it is adequately protected. This classification limits access to authorized personnel only, safeguarding against unauthorized disclosure.

Emilie is setting up a small business network.

Which classification of data requires

basic security measures such as

firewalls and antivirus software?

• Internal

• Restricted

• Confidential

• Public

Answer explanation

Internal data requires basic security measures like firewalls and antivirus software to protect against unauthorized access, making it essential for Emilie's small business network.

Emilie is considering a job that allows her to

have a flexible work location using telecommunications technology.

This type of work arrangement called Telework can be defined as ...

• Working exclusively from an office location.

• Working from a location outside of the traditional office location using telecommunications technology.

• Attending in-person meetings and conferences and using telecommunications technology.

• Travelling frequently to perform a job.

Answer explanation

Telework is defined as working from a location outside of the traditional office using telecommunications technology, allowing flexibility in work location, which aligns with Emilie's job consideration.

Cie and Emilie are employees at a tech company.

Which term describes their practice of using best practices

to minimise threats as they go about their duties?

• Cyber practice

• Teleworking

• Incident reporting

• Cyber hygiene

Answer explanation

The term 'cyber hygiene' refers to the practices that Cie and Emilie use to maintain security and minimize threats in their work. It encompasses best practices for safe online behavior.

During a cybersecurity class, Toby is learning about intrusion detection systems.

What do these systems do?

• Monitor network traffic for signs of malicious activity.

• Block threats as they are encountered.

• Remove malicious code from software.

• Sets an alarm when a threat actor is detected.

Answer explanation

Intrusion detection systems primarily monitor network traffic for signs of malicious activity, helping to identify potential threats. While they may alert or log incidents, they do not block or remove threats directly.

Ed is tasked with developing a cybersecurity strategy for his company.

What is the purpose of this strategy?

• To assess the relative importance of cyber risks.

• To identify, assess and mitigate cyber risks.

• To classify data based on its sensitivity.

• To produce an audit trail for those investigating cybercrime.

Answer explanation

The purpose of Ed's cybersecurity strategy is to identify, assess, and mitigate cyber risks, ensuring the company is prepared to handle potential threats effectively.

Luke is working on a cybersecurity project and needs to

determine which of the following refers to the extent of a breach,

including which systems and data are affected?

• Impact of the breach

• Scope of the breach

• Legal obligations

• Effectiveness of response

Answer explanation

The 'scope of the breach' refers to the extent of a cybersecurity incident, detailing which systems and data have been compromised. This is crucial for understanding the overall impact and necessary response.

During a cybersecurity workshop, Ed and Emilie are discussing

various aspects of security management.

Implementing revised security controls is least likely to be part of:

• Implementing a cybersecurity strategy.

• Identifying and managing vulnerabilities.

• Assessing the impact of a breach.

• Controlling damage and loss.

Answer explanation

Assessing the impact of a breach focuses on understanding consequences rather than implementing controls. In contrast, the other options involve active measures to enhance security management.

After a data breach at a local company,

Zak is tasked with minimising harm caused by the breach.

This task is most likely part of:

• Implementing a cybersecurity strategy.

• Identifying and managing vulnerabilities.

• Assessing the impact of a breach.

• Controlling damage and loss.

Answer explanation

Zak's task of minimizing harm from the data breach aligns with 'Controlling damage and loss,' as it focuses on mitigating the effects of the breach rather than just assessing or managing vulnerabilities.