A company installs redundant power supplies to ensure services are always available. Which part of the CIA triad is addressed?

An organization implements encryption for email communication. Which primary security objective is achieved?

The IT manager mandates strong passwords and multifactor authentication. Which security control type does this represent?

An internal audit finds that employees are not following the security policy. What should management do first?

A government agency uses ISO/IEC 27001 to guide its security program. What does this represent?

A university installs CCTV cameras around its server room. This measure primarily addresses:

A company uses ITIL to align IT services with business needs. Which best describes this?

The CIO demands quarterly reports on security status and incidents. This request relates to:

An online retailer requires systems to be operational 24/7 during holiday sales. Which security requirement is most critical?

A startup documents rules on data handling and acceptable use of IT systems. What is being developed?

A company introduces role-based access controls so employees can only access resources relevant to their job. Which concept applies?

After a ransomware attack, the board asks for a structured recovery approach. Which management process is most relevant?

A hospital encrypts patient data and restricts access to authorized doctors. Which law compliance aspect does this address?

A company locks its server racks to prevent unauthorized access. What type of control is this?

Management ensures backups are stored offsite for disaster recovery. This practice supports:

A financial institution regularly audits security controls to ensure compliance with regulations. This activity represents:

A software company enforces code reviews before software release to detect vulnerabilities. This ensures:

An IT department deploys intrusion detection systems across the network. This is an example of:

The CEO requires IT security strategies to align with company growth plans. This represents:

A law firm loses sensitive client files due to poor backup practices. Which key principle of information security was violated?

A hospital is fined for unauthorized access to patient data. This highlights the importance of:

An e-commerce site suffers from altered product prices by attackers. Which principle is compromised?

A company uses cloud-based services but ensures encryption keys remain internal. This action emphasizes:

An airline's booking system crashes, preventing customers from purchasing tickets. Which impact does this show?

A breach reveals trade secrets of a manufacturing firm. What's the most significant consequence?

A retail company mandates secure handling of credit card data to comply with PCI-DSS. Why is this important?

Employees are trained to identify phishing emails. This action emphasizes:

A government agency faces a ransomware attack. What's the most important reason to invest in security beforehand?

A school secures student records to prevent identity theft. This measure supports:

An IT service provider implements a disaster recovery site to resume operations quickly. This is important for:

A software company faces reputational damage after a data breach. What does this highlight?

A financial institution ensures tamper-proof logging for transactions. This highlights:

An airline encrypts customer passports stored in its database. Which principle is prioritized?

A hospital ensures that lab results are accurate and not modified by unauthorized users. Which principle applies?

A logistics company deploys backup internet connections to prevent service downtime. This highlights the importance of:

A company loses customer trust after repeated breaches. Why is security important in this case?

A university invests in cybersecurity insurance. This reflects:

A multinational enforces strict access control on R&D data. The importance of security here is:

A cloud provider guarantees data availability via SLA agreements. Which aspect of importance does this demonstrate?

A hacker exploits a weak password to gain access to a company's database. What is the weak password considered?

An employee accidentally sends sensitive files to the wrong client. This incident is best classified as:

A company identifies that outdated software could be exploited by malware. Which term describes this situation?

A DDoS attack overwhelms an e-commerce site, causing downtime. This represents:

An attacker sends fake invoices to finance staff, tricking them into paying. What type of threat is this?

An organization stores critical data on a server with no backup. The absence of a backup represents:

A disgruntled employee installs spyware on company laptops. This is an example of:

An IT auditor notes that employees share their login credentials. What does this practice create?

A security analyst discovers that a mobile app stores passwords in plain text. This is an example of:

An attacker floods a web server with traffic from multiple compromised systems. This type of attack is:

A security analyst discovers that a mobile app stores passwords in plain text. This is an example of:

A company hosts data on a third-party cloud service. The risk here is mainly due to:

A virus infects an employee's laptop after opening a malicious email attachment. The virus is a:

An airport Wi-Fi network does not require encryption. What is this called?

A business keeps critical customer data in a single server with no redundancy. Which risk is most likely?

A company allows USB devices to connect without restrictions. Which type of weakness is this?

Hackers exploit a software flaw in a web app to steal customer data. The flaw is considered:

A cybercriminal creates fake login pages to steal credentials. This is an example of:

A security team identifies that weak encryption was used in data storage. This weakness is:

A company detects unusual outbound traffic from its server. What does this indicate?

An organization determines that if a server fails, it will cause financial loss. What term describes this?

A bank evaluates the potential impact if its ATM system fails. This activity is part of:

A hospital estimates the damage cost if patient data is leaked. Which risk assessment step is this?

An IT team lists all critical assets and classifies them by importance. Which stage of risk assessment is this?

A company calculates the likelihood and potential loss of a ransomware attack. What is this process called?

During an audit, a financial firm identifies insider threats as high probability but low impact. This classification refers to:

A retail store ranks risks from highest to lowest based on likelihood and impact. What technique is used?

A bank assigns numerical values to estimate potential yearly loss from cyber fraud. This is called:

A company uses heat maps to show risk levels visually. Which risk assessment method is this?

A manager asks, "What is the chance this system will be attacked, and what is the potential damage?" This refers to:

A company performs penetration testing to identify weak spots. This helps in:

A hospital assesses if an outdated firewall could allow intrusions. Which factor is analyzed?

A cloud provider evaluates how service downtime would affect customers. This is an example of:

A company finds its online payment system vulnerable but unlikely to be exploited. How should this be classified?

A government agency calculates annualized loss expectancy (ALE) from data breaches. Which assessment method is used?

A school rates the risk of ransomware as "high" without exact numbers. This is:

A company measures how long it can continue operations during a disaster. Which concept applies?

A bank uses past incident data to estimate future risks. This approach is:

A retail company identifies credit card fraud as its top risk. What comes next in risk assessment?

An audit reveals that even after applying controls, some risk remains. This is called:

A hospital compares risks against its tolerance levels. This is defining:

A company installs firewalls and IDS to reduce cyber-attack chances. This strategy is:

A bank moves its data to a third-party insured cloud provider. This represents:

A business discontinues an insecure online service to avoid attacks. This is:

A startup accepts minor risks because mitigation costs are higher than potential loss. Which strategy is this?

A hospital uses insurance to cover financial losses from data breaches. This is an example of:

A company installs UPS and backup generators to reduce downtime. Which strategy is applied?

A firm decommissions an old server that poses security risks. Which strategy is this?

A bank decides not to patch a minor software bug since the impact is negligible. This is:

A government agency outsources security operations to a managed service provider. This is:

A company invests in staff training to prevent phishing attacks. Which strategy is applied?

An online retailer uses redundant servers across multiple regions. This demonstrates:

A business uses cyber insurance but also implements firewalls. Which approach is used?

A manufacturing company stops using outdated software with known flaws. Which risk strategy is applied?

A retailer accepts the risk of small-scale fraud as part of operations. This is an example of:

A firm encrypts data to reduce damage if intercepted. Which risk strategy is this?

A university disables a vulnerable online portal permanently. This is:

A company outsources its payroll system to a secure third-party vendor. This represents:

A small business buys insurance but also accepts minimal risks for cost savings. This is:

A hospital prioritizes investing in backup power over cosmetic website updates. This shows: