8 Security in Practice Online Quiz Questions

True or false: The qualitative model $\text{risk} \approx \text{likelihood} \times \text{impact}$ is intended to provide a precise numerical prediction of harm.

A business cannot eliminate a particular financial risk, but it can arrange insurance to share some potential losses. Which risk response does this illustrate?

What term describes the risk that remains after safeguards have been applied?

True or false: Accepting a risk should be an informed decision by someone with appropriate authority, rather than an assumption that an unexamined risk is harmless.

According to the material, each account should receive only the access needed for what?

A team has completed a system review. When should it revisit that review?

Select all functions in the NIST Cybersecurity Framework 2.0.

During a practical system review, which actions directly check safeguards or evidence that protections work? Select all that apply.

An online store discovers that an administrator account uses password-only login. Which single action directly addresses the risk that a stolen password could let an attacker access that account?

An online store is comparing two risks: account takeover, given valuable customer accounts, reused passwords, and an internet-accessible login page; and a temporary outage of a nonessential internal report. Which conclusion best applies risk-based prioritization?

A company finds that an internet-facing service handling sensitive customer records is running outdated software. Describe how a practical security review should assess and manage this risk, including the potential harm, the threat and weakness, prioritization, a response, verification, and follow-up.

A team reviewing an online service inventories its applications, cloud services, vendor connections, backups, and sensitive-data locations. Which system-review step is the team performing?

Before reviewing a payment platform, a team identifies the system owner, its users, its important services, and the decisions the review should inform. Which review step does this describe?

A small business wants its security to remain effective even if one safeguard fails. Which plan best applies defense in depth?

A review finds that a business's administrative application has missed security updates and uses an unnecessarily exposed configuration. Which defense-in-depth layer most directly addresses these issues?

True or false: Using several safeguards guarantees that a system cannot be harmed, so the organization no longer needs to consider whether risks remain.

During a system review, a team traces how a phishing message could lead to account compromise and harm. What two-word term names this route from a possible event toward harm?

A company decides not to launch a feature because it does not want to undertake the risky activity at all. Which single-word risk response describes this decision?