Risk Management N10-009

Chapter 10 Risk Management 1. Hackers are individuals who gain unauthorized access to systems or networks with or without malicious intent.

• True

• False

Answer explanation

The statement is true because hackers can access systems without permission, and their intent can vary from malicious to benign. Therefore, the definition provided is accurate.

Which group of hackers follows their own code of ethics and is vulnerable to legal prosecution, often going to great lengths to remain anonymous and to assist and educate?

• black hat hacker

• white hat hacker

• gray hat hackers

• red hat hackers

Answer explanation

Gray hat hackers operate between ethical boundaries, often helping organizations by identifying vulnerabilities while still risking legal consequences. They adhere to their own code of ethics, unlike black hats who exploit systems for malicious intent.

Which groups or individuals use their skills to bypass security systems with the intent to cause damage, steal data, or compromise privacy? Some of these hackers and groups are also available for hire to serve someone else's agenda.

• black hat hacker

• white hat hacker

• gray hat hackers

• red hat hackers

Answer explanation

Black hat hackers exploit security systems to cause harm, steal data, or invade privacy. Unlike white hat hackers who protect systems, black hats often work for personal gain or to fulfill someone else's malicious agenda.

What is the term for a vulnerability in a system, process, or architecture that could result in compromised information or unauthorized access, or more broadly, the term for anything that can cause harm? Choose all that apply.

• exploit

• vulnerability

• risk

• threat

Answer explanation

A 'vulnerability' is a weakness that can be exploited, while a 'threat' is anything that can cause harm. Both terms apply to the potential for compromised information or unauthorized access.

What is the term for the act of taking advantage of a known vulnerability in cybersecurity, and what is the other, more broadly used term for the likelihood that a vulnerability will be exploited? Choose all that apply.

• exploit

• vulnerability

• risk

• threat

Answer explanation

The term 'exploit' refers to taking advantage of a known vulnerability in cybersecurity. 'Risk' is the broader term that describes the likelihood of that vulnerability being exploited.

What is the term used to describe the technique of deception that a person uses to follow an authorized employee into a restricted area?

• tailgating

• piggybacking

• shoulder surfing

Answer explanation

The term 'tailgating' refers to the technique where an unauthorized person follows an authorized employee into a restricted area, often without the employee's knowledge. This is a common security breach tactic.

What is the term used to describe this technique?

• tailgating

• piggybacking

• shoulder surfing

• quid pro quo

Answer explanation

The correct term is 'piggybacking', which refers to the practice of gaining unauthorized access to a restricted area by following someone who has legitimate access. This technique is often used in security breaches.

Adel uses the default preview screen when he is in his email, so when he single-clicks on a message, it shows in the preview below the message pane. Recently, he received a notice from his bank about a large withdrawal from his account. He was supposed to open the email and click on the button to review the transaction. However, he didn't do any of those things, yet malware was still able to access his computer. Why was that able to happen?

• It was a new type of malware that attacks systems on delivery.

• Anti-malware software was not set up to check email.

• Viewing in preview is equivalent to opening email.

• Anti-virus software was out of date.

Answer explanation

Viewing an email in the preview pane can execute scripts or load content, making it equivalent to opening the email. This allowed the malware to access Adel's computer without him clicking on the email.

An employee is only given access and privileges to do their jobs and nothing else. What this principle called?

• principle of loss prevention

• principle of least access

• principle of least privilege

• principle of most restriction

Answer explanation

The principle of least privilege ensures that employees have only the access necessary to perform their jobs, minimizing potential security risks. This is correctly identified as the 'principle of least privilege'.

When there is sensitive data on the network that needs protection from unauthorized access, what solution can be deployed to safeguard it?

• data loss prevention

• data retention solution

• data failure prevention

• data loss exclusion

Answer explanation

Data loss prevention (DLP) solutions are specifically designed to protect sensitive data from unauthorized access and breaches, making it the correct choice for safeguarding sensitive information on the network.