1 Security Fundamentals and Exam Strategy Online Quiz Questions

Under Zero Trust, being inside an organization’s network is by itself sufficient reason to grant access.

A system records file-access attempts so that security staff can identify activity for review. What is the primary function of this control?

A server runs an outdated service with a known, unpatched flaw. What is the security term for the weakness itself?

A company runs recurring staff workshops on responding to phishing attempts. By control category, how should these workshops be classified?

A business decides to discontinue an activity because the associated risk is not worth taking. Which risk response is it using?

A company wants to mitigate a risk to an important service. Select all actions that do so by reducing the likelihood or impact of loss.

Use $\text{SLE} = \text{asset value} \times \text{exposure factor}$. If an asset is valued at 80,000 dollars and an incident would cause a loss of $25\%$ of its value, what is the SLE? Enter the amount in dollars as a number, without a currency symbol.

Purchasing insurance can transfer some financial consequences of a risk, but responsibility for managing that risk may still remain with the organization.

Select all statements that correctly describe how security controls are classified by category and function.

A candidate wants to check whether their study plan covers the intended Security+ exam. Which resource should they use as the authoritative scope checklist?

Use $\text{ALE} = \text{SLE} \times \text{ARO}$. If the SLE is 18,000 dollars and the ARO is $0.2$ times per year, what is the ALE in dollars per year? Enter the amount as a number, without a currency symbol.

During practice, you choose a technically plausible control, but it does not address a scenario’s constraint. Describe how you should approach a similar scenario before choosing, and how you should review this missed question afterward.

A team implements safeguards but documents that some possibility of loss remains. Is that remaining risk residual risk?

An organization trains employees to follow its incident-handling process. Which security-control category best describes this training?

A user has signed in successfully and is then granted read-only access to a file share. Which AAA function determines that access level?

A company discovers that an attacker altered records without permission. Which security goal was directly compromised?

A system records each attempt to access a sensitive file so that investigators can identify suspicious activity. What is the control’s primary function?

What security term describes a weakness that could be exploited?