Confidentiality, a core security principle, is primarily ensured using which two methods?

Integrity is ensured via which of the following?

Network Security in the Digital Era is described as foundational to all network operations and digital transformation, and it extends beyond traditional networks to which areas?

Which of the following is an example of a sophisticated threat mentioned in the document?

Vulnerability weaknesses caused by human error, social engineering, or malicious insiders fall under which vulnerability category?

What is described as an emerging threat vector caused by improper cloud service settings?

What contemporary threat involves stealthy, continuous computer hacking processes?

An attack targeting third-party vendors and software dependencies is known as a(n):

Malicious software that encrypts data and demands payment for restoration is defined as:

Which security model requires verification for every access request, regardless of its source?

Integrating security practices into the DevOps pipeline for continuous security is the definition of:

What is an automated tool used for detecting and remediating cloud misconfigurations?

What cloud-native architecture combines network and security services?

What control within Identity & Access Management (IAM) is specifically used for controlling and monitoring privileged account access?

What is the latest protocol mentioned for securing internet communications?

Physical devices that securely manage digital keys are known as:

Cloud Access Security Brokers (CASB) function as security policy enforcement points between which two parties?

Providing secure remote access based on user identity and context is the goal of:

What tool continuously monitors and responds to threats on endpoints?

The continuous process of identifying and remediating security weaknesses is referred to as:

What systematic approach uses models like STRIDE and DREAD to identify and prioritize potential threats?

What are independently deployable services that make up modern applications?

Real-time analysis of security alerts is performed by which security operation tool?

What platform provides cross-layer detection and response?

What tool is designed for automating security operations and response workflows?

The process of understanding the financial and operational consequences of security incidents is called:

Focusing resources on the most likely and damaging attack scenarios is known as:

What emerging requirement is defined as a formal record containing details and relationships of software components?

Preparing for future quantum computing threats to current encryption is categorized as:

1. Statement 1: Network Security in the Digital Era is foundational to all digital transformation. Statement 2: Integrity is primarily ensured by redundancy and disaster recovery.

Statement 1: The CIA Triad stands for Confidentiality, Integrity, and Availability. Statement 2: Confidentiality is protected via encryption, access controls, and data classification.

Statement 1: Availability ensures systems and data are accessible when needed. Statement 2: Integrity prevents unauthorized modification of data using digital signatures.

Statement 1: Network security extends only to traditional on-premise networks. Statement 2: Sophisticated threats include Nation-state attacks and Ransomware.

Statement 1: Technical Flaws are security weaknesses caused by human error or malicious insiders. Statement 2: Supply Chain Compromises are attacks targeting third-party vendors and software dependencies.

Cloud Misconfigurations are security gaps caused by improper cloud service settings. API Security Weaknesses are a type of human vulnerability.

Ransomware is malicious software that demands payment for data restoration. Business Email Compromise (BEC) targets systems through exploiting technical flaws.

8. Statement 1: Advanced Persistent Threats (APTs) are defined as stealthy, continuous computer hacking processes. Statement 2: Critical Assets include Cloud Workloads and Microservices.

Zero Trust Architecture requires verification for every access request, regardless of source. Zero Trust Network Access (ZTNA) is a non-identity-centric approach to remote access security.

Statement 1: DevSecOps focuses on integrating security practices into the DevOps pipeline. Statement 2: Cloud Security Posture Management (CSPM) is used to manually detect cloud misconfigurations.

Statement 1: Threat Modeling is a systematic approach to identify and prioritize potential threats. Statement 2: SASE is a cloud-native architecture that combines network and security services.

Statement 1: Multi-Factor Authentication (MFA) requires only one verification method for access. Statement 2: Privileged Access Management (PAM) controls and monitors privileged account access.

TLS 1.3 is the latest protocol mentioned for securing internet communications. Hardware Security Modules (HSM) are physical devices that securely manage digital keys.

Cloud Access Security Brokers (CASB) enforce security policy between cloud users and providers. CASB is categorized under Endpoint Protection controls.

Statement 1: Endpoint Detection & Response (EDR) tools continuously monitor and respond to endpoint threats. Statement 2: EDR is considered a Network Security control.

Statement 1: ZTNA (Zero Trust Network Access) is an identity-centric approach to remote access security. Statement 2: SASE (Secure Access Service Edge) is a security model used for DevSecOps.

SIEM provides real-time analysis of security alerts. XDR is a tool used for automating security operations and response workflows.

Statement 1: XDR (Extended Detection & Response) is a cross-layer detection and response platform. Statement 2: SIEM is an acronym for Security Information & Event Management.

Statement 1: SOAR stands for Security Orchestration & Response. Statement 2: SOAR is used to manually respond to security incidents.

Risk Assessment is the process of identifying, analyzing, and evaluating security risks. Threat Prioritization focuses resources on the least likely attack scenarios.

Statement 1: Business Impact Analysis determines the technical cause of a security incident.
Statement 2: Risk Management in the Modern Context includes Business Impact Analysis.

Vulnerability Management is a continuous process of identifying and remediating security weaknesses. "MFA Everywhere" is listed as a Must-Implement Control.

AI Security Governance is an emerging requirement that manages risks associated with AI systems. Quantum-Readiness prepares for the threat of quantum computing to current encryption.

24. Statement 1: A Software Bill of Materials (SBOM) is an emerging requirement. Statement 2: An SBOM is a formal record of hardware components.

The STRIDE and DREAD methodologies are used in Threat Modeling. Microservices are defined as virtual machines running in cloud environments.

26. Statement 1: ZTNA is an evolution of traditional VPNs for remote access. Statement 2: CASB and CSPM are both classified under Cloud Security controls.

27. Statement 1: The purpose of cryptographic hashing is to ensure data confidentiality. Statement 2: Digital signatures are a method of ensuring data integrity.

28. Statement 1: Ransomware and Supply Chain Compromises are both specific examples of sophisticated threats. Statement 2: Protecting against sophisticated threats is a goal of modern network security.

29. Statement 1: Privileged Access Management (PAM) is a type of Security Monitoring tool. Statement 2: MFA Everywhere is an essential security practice.

SOAR helps automate security response workflows. Threat Prioritization is a process within Security Assessment & Planning.

What does the acronym CIA stand for in the context of Core Security Principles?

The systematic approach to identifying and prioritizing potential threats includes methodologies like STRIDE and DREAD. What process are they associated with?

What does the acronym ZTNA stand for?

What does SASE represent in the context of network and security services?

DevSecOps describes the integration of security practices into the DevOps pipeline. What does the "Ops" in DevSecOps refer to?

What does CSPM stand for, which uses automated tools for detecting and remediating cloud misconfigurations?

APTs are defined as stealthy, continuous computer hacking processes. What does APT stand for?

What does MFA require for access, making it a critical control?

PAM is used for controlling and monitoring privileged account access. What does PAM stand for?

In encryption and data protection, what does HSM stand for, referring to physical devices that manage digital keys securely?

SIEM provides real-time analysis of security alerts. What does SIEM stand for?

XDR is a cross-layer detection and response platform. What does XDR stand for?

What process does SOAR automate, using it to accelerate security response workflows?Software Operations and Analysis Reporting

EDR tools continuously monitor and respond to endpoint threats. What does EDR stand for?

CASBs act as security policy enforcement points between cloud users and providers. What does CASB stand for?

What does SBOM stand for, which is a formal record containing details and relationships of software components?

What is the definition of BEC?