6 Mitigation and Defensive Response Online Quiz Questions

An organization disables a network service that its systems do not need, reducing the ways an attacker could gain access. What purpose does this control primarily serve?

True or false: Centralizing security logs by itself ensures that the logs cannot be altered by an unauthorized person.

A company discovers that software on an internet-facing server is unpatched. Which action most directly reduces the underlying weakness?

A security analyst uses a malicious file hash as a signal to help detect or investigate an incident. What is the general term for this kind of signal?

A security team has more weaknesses to fix than it can address immediately. Select all factors that should inform its risk-based prioritization.

True or false: During an incident, abruptly shutting down a safety-critical operational technology system is always the safest containment action.

A company wants to reduce the likelihood and potential impact of ransomware before an incident occurs. Select all the preventive measures.

A team must choose one system for urgent remediation. Which risk should it address first?

What log-management practice helps an organization use security events across systems to support detection and incident response?

Employees are being targeted by phishing, and a stolen password could provide access to email and administrator tools. Propose a coordinated set of preventive, detective, and responsive controls for this risk.

An analyst sees one suspicious account alert, followed by an unusual process and a suspicious domain connected to the same system. What is the best way to interpret these indicators?

A network is segmented so that an intruder cannot freely move between departments, and monitoring flags unexpected connections between segments. Can this control support both prevention and detection?

Responders confirm an alert, assess its likely scope and impact, and notify the appropriate team before limiting access or spread. What response phase are they performing?

An employee's password may have been stolen through phishing. Which listed control most directly reduces the chance that the password alone will grant access?

Endpoint alerts suggest ransomware is spreading across several devices. Which action is the best immediate response?

A team applies a control to reduce a vulnerability but recognizes that some possibility of harm remains. What is the risk that remains called?

A vulnerable internet-facing service cannot be patched until a planned maintenance window. Which interim action best reduces exposure in the meantime?

A suspected compromise may involve a safety-critical operational technology system. Which response best accounts for the risk that containment itself could disrupt safe operations?