Risk Management Concepts, Agreement Types, Penetration Testing

A financial institution is required to have an external audit annually. What drives this requirement?

Which type of assessment is required annually for PCI DSS compliance?

An employee logs in from two countries within one hour. What is this an example of?

Under GDPR, what right allows individuals to request data be removed from public access?

A server takes 5 hours to recover and resume normal operations. What does this impact?

Which compliance failure could result in revocation of a business license?

Which document outlines what systems are in-scope during a pentest?

Which value helps predict how often a service is expected to fail over time?

Which agreement sets expectations for uptime and technical response?

A company simulates phishing emails and tracks employee clicks. What is the main benefit of this approach?

What makes an MOA different from an MOU?

A company includes a clause to allow review of a vendor’s security controls. What is this called?

Why should an organization track phishing click rates over time?

Who in an organization is typically accountable for protecting customer relationship data?

An executive asks if the company is protected from a new attack. What assessment type fits?

A company wants to prevent its consultant from leaking trade secrets. What should be signed?

Security updates are delayed due to a conflict with critical software. What risk approach is being used?

What is the primary goal of compliance monitoring within an organization?

Which risk metric reflects the immediate impact of an event?

Which training topic is most critical for users handling financial transactions?

A company misreports HIPAA compliance data. Who is ultimately responsible?

A user finds a USB labeled “Payroll” in the parking lot. What should they do?

A company stores user emails, medical info, and IP addresses. What are these users classified as under GDPR?

Which agreement type is informal, often outlining shared goals without legal enforcement?

Which metric defines how much data loss is acceptable after recovery?

A pentester is given no prior system details and is asked to simulate an external attack. What type of test is this?

In a risk register, what is the purpose of assigning a risk owner?

Which user behavior is most likely to be unintentional but risky?

What’s the primary reason for using an independent third party to assess cybersecurity?

What agreement defines specific tasks, deadlines, and deliverables for a contractor?

What is the difference between due diligence and due care?

Which term refers to an independent opinion regarding the accuracy of a company’s security controls?

A team uses a red/yellow/green chart to rate risks during a meeting. What method is this?

After signing a contract, what is the next step in managing a vendor relationship?

A company buys cybersecurity insurance to offset potential breach costs. What strategy is this?

A company installs new biometric scanners. What type of risk assessment is appropriate?