This quiz covers the key concepts from Module 3. It consists of 10 multiple-choice questions. Please answer to the best of your ability. The answer key is provided at the end.
1. Which of the following is a core principle of Zero Trust Architecture? a) Trust but verify b) Trust all internal users c) Never trust, always verify d) Perimeter security is sufficient
2. In the AWS shared responsibility model, which of the following is the customer responsible for? a) Security of the cloud infrastructure b) Configuration of security groups and NACLs c) Physical security of data centers d) Management of the hypervisor
3. What is the primary purpose of a third-party risk assessment? a) To select the cheapest vendor b) To evaluate the security posture of a vendor before entering into a business relationship c) To transfer all security risks to the vendor d) To replace internal security teams with vendors
4. What is the main difference between a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP)? a) BCP focuses on keeping business functions running, while DRP focuses on recovering IT systems b) DRP focuses on keeping business functions running, while BCP focuses on recovering IT systems c) There is no difference d) BCP is for natural disasters, DRP is for cyber attacks
5. Which of the following is a key benefit of micro-segmentation in a network? a) It simplifies network management b) It reduces the attack surface and limits the lateral movement of attackers c) It eliminates the need for firewalls d) It increases network performance
6. What is the primary purpose of a Security Information and Event Management (SIEM) system? a) To block all malicious traffic b) To automatically patch all vulnerabilities c) To aggregate, correlate, and analyze log data to detect security incidents d) To encrypt all data on the network
7. Which of the following is a key component of a secure software development lifecycle (SSDLC)? a) Threat modeling b) Bypassing security testing to speed up development c) Using default credentials in production d) Avoiding code reviews
8. What is the primary goal of a tabletop exercise for incident response? a) To test the technical skills of the incident response team b) To walk through a simulated incident scenario to identify gaps in the incident response plan c) To recover all systems after a real incident d) To blame individuals for security failures
9. Which of the following is a key consideration when developing a cloud security strategy? a) The shared responsibility model b) The physical location of the cloud provider's data centers c) The brand name of the cloud provider d) The number of employees at the cloud provider
10. What is the primary purpose of a vendor evaluation scorecard? a) To select the vendor with the best marketing materials b) To provide a subjective assessment of vendors c) To provide an objective and consistent method for comparing and selecting vendors d) To guarantee that the selected vendor will never have a security breach
- c) Never trust, always verify
- b) Configuration of security groups and NACLs
- b) To evaluate the security posture of a vendor before entering into a business relationship
- a) BCP focuses on keeping business functions running, while DRP focuses on recovering IT systems
- b) It reduces the attack surface and limits the lateral movement of attackers
- c) To aggregate, correlate, and analyze log data to detect security incidents
- a) Threat modeling
- b) To walk through a simulated incident scenario to identify gaps in the incident response plan
- a) The shared responsibility model
- c) To provide an objective and consistent method for comparing and selecting vendors