#1
What does OPSEC stand for?
Operational Security
ExplanationIt refers to the process of protecting sensitive information from adversaries.
#2
What is the purpose of a security awareness training program?
To educate employees about security risks and best practices
ExplanationTraining programs enhance employees' understanding of security risks, fostering a culture of vigilance.
#3
Which of the following is a best practice for securing sensitive information?
Regularly updating passwords
ExplanationFrequent password updates reduce the likelihood of unauthorized access, bolstering security.
#4
Which of the following is an example of a physical security measure?
Biometric access control
ExplanationBiometric access control systems restrict physical access, enhancing security by verifying individuals' identities.
#5
What is the purpose of conducting regular security audits?
To identify potential security vulnerabilities
ExplanationSecurity audits help detect weaknesses and gaps in security protocols, enabling proactive measures.
#6
Which of the following is an example of a security incident?
Loss of a company-owned device
ExplanationA lost company device constitutes a security incident as it could lead to unauthorized access to sensitive data.
#7
What does the term 'phishing' refer to in the context of cybersecurity?
A method of social engineering used to deceive individuals into providing sensitive information
ExplanationPhishing exploits human trust to obtain sensitive data by masquerading as legitimate entities via electronic communication.
#8
Which of the following is an example of a physical security control?
Security camera
ExplanationSecurity cameras monitor physical spaces, deterring unauthorized access and providing evidence in case of incidents.
#9
What does the term 'BYOD' stand for in the context of information security?
Bring Your Own Device
ExplanationBYOD policies allow employees to use personal devices for work, posing security challenges that need to be addressed.
#10
Which of the following is NOT a component of OPSEC?
Authorization
ExplanationAuthorization is not directly related to OPSEC; it pertains to granting access rights.
#11
What is the primary goal of OPSEC?
To prevent adversaries from obtaining sensitive information
ExplanationOPSEC aims to safeguard critical information by thwarting adversaries' attempts to acquire it.
#12
Which of the following is an example of an OPSEC measure?
Encrypting sensitive data during transmission
ExplanationEncrypting data during transmission adds a layer of protection, ensuring confidentiality.
#13
What is the role of a risk assessment in OPSEC?
To identify vulnerabilities and threats
ExplanationRisk assessments pinpoint weaknesses and potential dangers, aiding in the formulation of protective measures.
#14
What is the purpose of conducting an OPSEC review?
To evaluate the effectiveness of existing OPSEC measures
ExplanationAn OPSEC review assesses the efficiency of current strategies, identifying areas for improvement.
#15
Which of the following is an example of a social engineering attack?
Phishing emails
ExplanationPhishing emails deceive recipients into divulging sensitive information, exploiting human vulnerabilities.
#16
What is the concept of 'compartmentalization' in OPSEC?
Dividing sensitive information into separate compartments with restricted access
ExplanationCompartmentalization restricts access to specific information, limiting exposure and minimizing risks.
#17
Which of the following is NOT a potential risk to operational security?
Regular system backups
ExplanationRegular system backups actually enhance operational security by safeguarding data against loss.
#18
What is the primary goal of an OPSEC program?
To identify and mitigate risks to sensitive information
ExplanationOPSEC programs aim to recognize vulnerabilities and apply measures to reduce risks to sensitive data.
#19
What is the principle of least privilege in the context of information security?
Granting users only the minimum level of access necessary to perform their job functions
ExplanationThe principle minimizes exposure by limiting user access rights to essential functions, reducing potential risks.
#20
What is the purpose of implementing multi-factor authentication?
To enhance security by requiring multiple forms of verification
ExplanationMulti-factor authentication adds layers of security by requiring multiple credentials for access.
#21
Which of the following is NOT a common method of protecting data at rest?
Firewalls
ExplanationFirewalls primarily protect against unauthorized network access; data at rest protection involves encryption, access controls, etc.
#22
What is the purpose of penetration testing?
To identify vulnerabilities in a system or network
ExplanationPenetration tests simulate cyberattacks to uncover system weaknesses and assess security measures.
#23
What is the purpose of security incident response planning?
To address security incidents effectively and minimize their impact
ExplanationResponse plans outline procedures to detect, contain, and recover from security breaches, reducing their impact.
#24
What is the primary goal of data loss prevention (DLP) technology?
To identify and prevent unauthorized access to sensitive data
ExplanationDLP systems monitor and control data transfers to prevent unauthorized access or exfiltration, safeguarding sensitive information.
#25
In the context of information protection, what does 'need-to-know' principle imply?
Only individuals with proper clearance should have access to specific information
ExplanationIt limits access to sensitive information to individuals with requisite clearance, reducing risks.