Which term describes an action that can damage or compromise an asset?

Aditya is the security manager for a mid-sized business. The company has suffered several serious data losses when laptops were stolen. Aditya decides to implement full disk encryption on all laptops. What risk response did Aditya take?

Residual Risk describes the risk that exists after an organization has performed all planned countermeasures and controls?

Violet deploys an intrusion prevention system (IPS) on her network as a security control. What type of control has Violet deployed?

What is an example of an alteration threat?

What type of attack against a web application uses a newly discovered vulnerability that is not patchable?

Which type of attack involves eavesdropping on transmissions and redirecting them for unauthorized use?

A hacker has stolen logon IDs and passwords. The hacker is now attempting to gain unauthorized access to a public-facing web application by using the stolen credentials one by one. What type of attack is taking place?

Which attack is typically used specifically against password files that contain cryptographic hashes?

Brian notices an attack taking place on his network. When he digs deeper, he realizes that the attacker has a physical presence on the local network and is forging Media Access Control (MAC) addresses. Which type of attack is most likely taking place?

In which type of attack does the attacker attempt to take over an existing connection between two systems?

Which type of attack involves capturing data packets from a network and retransmitting them to produce an unauthorized effect? The receipt of duplicate, authenticated Internet Protocol (IP) packets may disrupt service or produce another undesired consequence.

An attacker attempting to break into a facility pulls the fire alarm to distract the security guard manning an entry point. Which type of social engineering attack is the attacker using?

Barry discovers that an attacker is running an access point in a building adjacent to his company. The access point is broadcasting the security set identifier (SSID) of an open network owned by the coffee shop in his lobby. Which type of attack is likely taking place?

True or False? Not all risks are inherently bad; some risks can lead to positive results.

True or False? Impact refers to the amount of risk or harm caused by a threat or vulnerability that is exploited by a perpetrator.

True or False? Safeguards address gaps or weaknesses in the controls that could otherwise lead to a realized threat.

True or False? Corrective controls are implemented to address a threat in place that does not have a straightforward risk-mitigating solution.

True or False? Preventive controls merely attempt to suggest that a subject not take a specific action, whereas corrective controls do not allow the action to occur.

When servers need operating system upgrades or patches, administrators take them offline intentionally so they can perform the necessary work without risking malicious attacks.

Theft of intellectual property and its release to competitors or to the public can nullify an organization's competitive advantage.

An alteration threat violates information integrity.

Transmitting private or sensitive data unencrypted is a risk in both the Local Area Network (LAN) and Wide Area Network (WAN) Domains of a typical IT infrastructure.

In a browser or uniform resource locator (URL) hijacking attack, users are directed to websites other than what they requested, usually to fake pages that attackers have created.

Anti-malware programs and firewalls cannot detect most phishing scams because the scams do not contain suspect code.

A phishing email is a fake or bogus email intended to trick the recipient into clicking on an embedded link or opening an email attachment.

In a masquerade attack, one user or computer pretends to be another user or computer.

A man-in-the-middle attack takes advantage of the multihop process used by many types of networks.

A phishing attack "poisons" a domain name on a domain name server (DNS).

A smishing attack is a type of phishing attack involving voice communication.

A social engineering consensus tactic relies on the position that "everyone else has been doing it" as proof that it is okay or acceptable to do.

Bluejacking is an attack in which wireless traffic is sniffed between Bluetooth devices.

In a watering-hole attack, a targeted user is lured to a commonly visited website on which malicious code has been planted.