Modelling Cyber Threats and Risk Mitigation Module 1

In the 2022 Optus data breach, sensitive customer information like names, birthdates, and passport numbers was exposed. Which fundamental principle of the CIA security model was most significantly compromised?

• Confidentiality

• Authentication

• Integrity

• Availability

An employee writes their complex network password on a sticky note and leaves it on their monitor. This action creates which primary type of security threat?

• A technical threat

• A logical threat

• A social threat

• A physical threat

What is the process of verifying a user's identity before granting them access to a system called?

• Configuration

• Authorisation

• Mitigation

• Authentication

A company requires all staff to complete an annual training course on how to identify suspicious emails and the dangers of sharing account details. This is an example of a mitigation strategy for what kind of threat?

• Social threats

• Physical threats

• Supply chain threats

• Technical threats

In the Grokker Soccer Club scenario, an intruder broke into the clubhouse and found the password. This method of gaining access is best described as what type of threat?

• A technical threat

• A phishing threat

• A denial-of-service threat

• A physical threat

A hospital's electronic health record system is hit by a ransomware attack, encrypting all files and making them inaccessible to doctors and nurses. Which aspect of the CIA triad is most immediately impacted?

• Confidentiality

• Privacy

• Integrity

• Availability

A hacker gains access to a government database and subtly changes figures in a public census report before it is published. This action directly compromises the data's:

• Security

• Integrity

• Availability

• Confidentiality

Which of the following is the best example of a 'logical asset' in an information system?

• A server computer in a locked data centre

• An empoyees security swipe card

• The networking cables connecting the office computers

• The company's list of customer email addresses

An attacker exploits a known but unpatched software vulnerability in a web server to gain unauthorised access. What category of threat does this fall into?

• Technical threat

• Social threat

• Administrative threat

• Physical threat