3.12_Risk_&_Vulnerability_Management

Which of the following items are prerequisites for risk to exist? (Choose three.)

• A vulnerability

• A Threat

• A person

• An asset

Which of the following can be vulnerabilities? (Choose three.)

• The location of a building

• Misconfigured systems

• Unpatched systems

• Disgruntled former employees

Which of the following controls protects data in motion?

• File system permissions

• Full disk encryption

• Protocol encryption

• Process isolation

Which two inputs does qualitative risk analysis use? (Choose two.)

• Asset value

• Likelihood

• Exposure factor

• Impact

Which steps are generally conducted in preparation for vulnerability assessments? (Choose two.)

• Applying remediations

• Prioritization of assets

• Discovery of the devices on our networks

• Verification that remediations are working properly

Which of the following are examples of detective controls? (Choose two.)

• Security camera

• Firewall

• IDS

• Disk encryption

Which two components are multiplied in quantitative risk analysis? (Choose two.)

• Likelihood

• Single loss expectancy (SLE)

• Impact

• Annualized rate of occurrence (ARO)

Which of the following items can be considered assets? (Choose all that apply.)

• Intellectual property

• Brand and reputation

• Employees

• Supporting IT infrastructure

You schedule your vulnerability scanner to run at 11 p.m. each day to ensure that employees aren’t affected by its significant network utilization. What type of scanner are you using?

• Generation 1

• Generation 2

• Active

• Passive

Which of the following options are examples of threats? (Choose two.)

• Natural disaster

• Ransomware gang

• Lack of input validation

• Unencrypted network traffic