Certified in Cybersecurity Free Sample Questions

A global financial institution is implementing a new security framework. The Chief Information Security Officer (CISO) emphasizes that while technical defenses are crucial, the organization must ensure that all employees understand their responsibilities and the consequences of non-compliance. Which governance document should be primarily established to provide this high-level authority and direction?

During a risk assessment meeting, the security team identifies a legacy server that contains non-critical data. The cost to upgrade the server's security controls exceeds the value of the data it processes. The management team decides to continue operating the server without additional controls. Which risk treatment strategy has management adopted?

A security consultant is explaining the concept of defense-in-depth to a client. The client recently installed a biometric scanner (Physical Control) and a firewall (Technical Control). To complete the triad of security control categories, which of the following should be implemented?

An ISC2 member discovers that their employer is unknowingly releasing software that contains a critical safety flaw which could endanger human lives. The employer refuses to delay the release due to financial pressure. According to the ISC2 Code of Ethics, which canon must the member prioritize above all others?

A user logs into a banking application using a password and a one-time code sent to their mobile phone. Which two authentication factors are being utilized in this scenario? (Select TWO)

A healthcare provider sends a digitally signed email to a patient containing medical records. The patient uses the provider's public key to verify the signature. This process primarily ensures which security concept?

True or False: In the context of risk management, 'Risk Appetite' refers to the specific amount of loss an organization can objectively endure without failing, whereas 'Risk Tolerance' is the broader strategic level of risk they are willing to take.

Which of the following scenarios best illustrates the 'Integrity' component of the CIA Triad?

A multinational corporation must comply with the General Data Protection Regulation (GDPR). They are appointing a specific role responsible for determining the purposes and means of processing personal data. What is this role called?

An organization is conducting a quantitative risk assessment. They determine that a specific server fails once every 4 years. The replacement cost of the server is $10,000. What is the Annualized Loss Expectancy (ALE)?