Application of IT Security

Which of the following are examples of assets in an organization?

• Buildings

• Data

• Attackers

• Recipes

• Vulnerabilities

Which of the following statements about vulnerabilities are true? (Select all that apply)

• Vulnerabilities are weaknesses or absences of countermeasures.

• Vulnerabilities can be found in personnel.

• Unrestricted access to a folder on a computer is an example of a vulnerability.

• Vulnerabilities always lead to immediate threats.

• Vulnerability assessments are used to identify vulnerabilities.

Regarding threats and threat agents, which statements are correct? (Select all that apply)

• A threat happens only when a vulnerability is exploited.

• A threat agent can be an attacker who exploits a vulnerability.

• Not all threat agents will exploit vulnerabilities.

• A threat agent is the same as a vulnerability.

• Threat agents carry out threats but cannot discover vulnerabilities.

According to NIST SP 800-30, which of the following are common information-gathering techniques used in risk analysis?

• Automated risk assessment tools

• Interviews

• Social media monitoring

• Questionnaires

• Policy document reviews

Multiple sources should be used to determine the risks to a single asset during risk analysis.

• True

• False

What two factors combine to determine risk in the risk management process?

• Threat and asset value

• Likelihood and impact

• Vulnerability and threat agent

• Asset value and vulnerability

Hackers typically hack for which of the following reasons?

• Financial gain

• Disruption

• Geopolitical change

• Notoriety

• Environmental protection

Which of the following best describes the primary motivation of organized crime groups according to the FBI?

• Disrupting critical infrastructure

• Pilfering intellectual property

• Threatening the financial services sector and expanding attacks

• Influencing geopolitical policies

State sponsors, as identified by the FBI, are primarily interested in:

• Pilfering intellectual property

• Disrupting critical infrastructure

• Stealing research and development data

• Financial gain through online fraud

What is the main goal of terrorist groups as threat actors?

• Stealing financial data

• Disrupting or damaging critical infrastructure to harm a country’s way of life

• Pilfering government secrets for economic advantage

• Expanding criminal enterprises