A company implements automatic patch updates for its systems every week. What type of control is this?

After a phishing attack compromises user accounts, the security team restores affected systems from clean backups. What type of control is this?

Due to high cost, a company decides not to use a fingerprint scanner and instead implements multi-factor authentication. What kind of control is MFA in this context?

Which control type involves creating policies and oversight for how security measures are developed and managed?

A cybersecurity analyst detects unusual outbound traffic from a workstation and uses log analysis to investigate. What control type is being used?

Which of the following best describes the purpose of passive discovery?

An organization maps out all possible ways a threat actor might infiltrate its systems. What is this process called?

Which control type is designed to stop a threat before it causes harm?

A server is scanned by an unknown external IP. The security team follows a documented checklist to analyze the event. What type of control is being applied?

Your company cannot patch a known vulnerability due to compatibility issues. A temporary access control is put in place instead. What type of control is this?

Before applying a security patch to a production environment, a team ensures the update won't impact operations. What step of the patch management process is this?

A critical patch is applied during scheduled downtime. Post-deployment, systems begin to crash. What should the administrator do next?

Which control type is most concerned with creating policies and aligning security objectives with business goals?

What risk management strategy is being applied when an organization purchases cyber insurance to cover potential breaches?

A development team is coding a web application and wants to prevent XSS and SQL injection attacks. Which practice should they prioritize?

What is the main purpose of governance in patch and configuration management?

What does a bug bounty program encourage?

A third-party library used by your application has a critical vulnerability, but no patch has been released. Your team applies firewall rules and limits access to reduce risk. What strategy is this?

Which of the following steps comes before deploying a patch to production environments?

Employees in your organization unknowingly install malware from a trusted vendor's update server that was compromised. What type of attack is this?

A threat actor uses custom tools to remain undetected for months while targeting a government database. What type of actor is most likely responsible?

An analyst maps out a cyber intrusion by focusing on the adversary, infrastructure, capability, and victim. Which analytical model is being used?

Which framework is specifically used to track attacker behaviors by documenting tactics, techniques, and procedures (TTPs)?

A junior analyst detects brute-force login attempts and references the MITRE ATT&CK database to determine tactics used. What is she doing?

Which of the following best describes 'TTPs' used in cyber threat intelligence?

Which framework breaks a cyberattack into steps like reconnaissance, delivery, exploitation, and actions on objectives?

A user bypasses monitoring controls to send sensitive data outside the organization using a software flaw. What type of insider threat is this?

Which intelligence source usually requires a paid subscription or vendor relationship to access?

Which of the following traits determine the quality of threat intelligence?