SecurityX CAS 005 Day 1 Revision

What mitigates misconfigurations & vulnerabilities for third-party hardware device that are purchased for an enterprise?

What is the main purpose of the NIST Cybersecurity Framework?

What type of document offers recommendations rather than mandatory rules?

Which model tracks attacker behavior across stages like Reconnaissance to Exfiltration?

What is the capital city of Germany?

What is a key factor in vendor risk assessment?

Which regulation specifically addresses online data collection from children under 13 in the US?

Where would step-by-step instructions for performing specific security tasks by useful?

What is the fastest creature on earth?

Which IT framework is primarily focused on IT service management?

What is a core concept of antitampering mechanisms?

Which risk analysis method uses numerical values and statistical models?

What is a key goal of encryption in data protection?

What describes the risk level an organization is willing to accept?

Which backup method is stored offline to prevent ransomware infection?

What is the purpose of asset management in cybersecurity?

Which of the following is considered a certification rather than an audit or assessment?

Why is data governance important in development environments?

Which GRC tool function aligns controls with regulations?

How does hashing contribute to data integrity?

Which privacy regulation provides rights to EU citizens regarding their personal data?

What is a primary focus of security awareness training?

Which third-party risk involves unauthorized subcontractors handling data?

Which of the following best describes a 'standard' in cybersecurity documentation?

Which scenario type is used in impact analysis to test resilience?

What is the goal of continuous monitoring in GRC?

Which type of attack is most commonly simulated in phishing training?

Which governance framework aligns IT goals with business objectives?

What does a CMDB typically store?

What outlines step-by-step instructions for performing specific security tasks?

Which environment is used to test new code without affecting live services?

What is a way to describe an attacker with motivations tied to political agendas?

Which factor reflects an attacker’s ability to develop and use exploits?

Which document provides high-level direction and reflects management’s intent in a security program?