IAS Gclass Act 1-4

Which is an example of QC?

Running test cases

QA is considered

Process-oriented

Which SDLC phase focuses on defining security requirements?

Requirements Analysis

Ignoring security until the end is

Reactive approach

Which is a qualitative risk assessment?

Low, Medium, High classification

Which is an example of a vulnerability?

Outdated software

Which step involves identifying valuable resources?

Asset identification

Which is an example of QA?

Code review guidelines

In security context, QC ensures

Vulnerabilities are detected

Choosing secure architecture happens in

Design

Risk is commonly defined as

Threat x Vulnerability x Impact

Quality Assurance focuses on

Preventing defects

A penetration test reveals vulnerabilities. This is

QC

What is the primary goal of integrating security into SDLC?

Ensure security is built into every phase

Continuous risk assessment means

Regularly updating risk evaluations

Shift Left Security means

Moving security practices earlier in development

Integrating QA, QC, and risk assessment ensures

Strong information assurance

What does impact refer to in risk analysis?

Damage caused if risk occurs

A system lacks input validation. This issue occurs in

Development

Which is considered an asset?

Customer data

Why is early risk assessment important?

It reduces future security issues

QC is considered

Product-focused

Which approach integrates development, security, and operations?

DevSecOps

Which principle ensures users only have access to what they need?

Least Privilege

Which is the best mitigation for plain text passwords?

Encrypt passwords

What is risk mitigation?

Reducing risk through controls

Monitoring system logs is part of

Maintenance

Quality Control focuses on

Product inspection

Which best describes Information Assurance in SDLC?

Protecting information by maintaining confidentiality, integrity, and availability

Which occurs BEFORE defects happen?

QA

In security context, QA ensures

Secure processes are followed

Which factor determines likelihood?

Probability of threat occurrence

No firewall was configured during release. This is a problem in

Deployment

Which occurs AFTER development?

QC

Which is a proactive security strategy?

Designing secure systems from the start

What is the main focus of secure coding practices?

Preventing vulnerabilities

Identifying hackers as possible attackers is

Threat identification

Encrypting sensitive data is an example of

Control

Which activity is part of the maintenance phase?

Monitoring and patching systems

Developers follow secure coding standards. This is an example of

QA

A company has strong firewalls but experiences frequent server theft. What is lacking?

Physical security controls

A server overheats despite strict access control. Which area is weak?

Environmental security

Employees repeatedly fall for phishing attacks despite training. What is the most likely issue?

Ineffective awareness reinforcement

A company implements only environmental controls. What risk remains highest?

Unauthorized access

Which combination provides the most balanced security approach?

Integrated physical, environmental, and human controls

A breach occurred due to tailgating. Which control failed?

Physical access control

A company invests heavily in education but lacks training. What is the likely gap?

Practical skills

A system failure occurs during a power outage. Which control is missing?

UPS or generator

Which situation shows imbalance in A.T.E implementation?

No ongoing learning updates

If employees know policies but fail to apply them, what is lacking?

Training

A company installs biometric scanners to secure server rooms. This addresses

Physical access risks

A data center adds a UPS system. This helps mitigate

Power interruption

Employees receive phishing awareness emails. This is an example of

Awareness

IT staff undergo firewall configuration training. This represents

Training

A company installs fire suppression systems. This addresses

Environmental hazards

Security guards monitor entry points. This primarily supports

Physical security

Air conditioning in a server room prevents

Equipment overheating

A phishing simulation exercise is best classified as

Training

A cybersecurity degree program contributes to

Education

A company conducts monthly security updates. This is

Continuous learning

Installing CCTV cameras helps in

Access monitoring

A water leak detection system protects against

Environmental damage

Access control cards are used to

Authenticate entry

Which best defines physical security controls?

Measures that prevent unauthorized physical access

What is the main goal of environmental controls?

Maintain safe operating conditions

Awareness programs are designed to

Promote security-conscious behavior

Which learning type is structured and curriculum-based?

Formal learning

Role-based learning focuses on

Job-specific training

Simulation-based learning involves

Real-world scenarios

Installing generators ensures

Power continuity

Why is anomaly-based detection often considered more difficult to implement than signature-based detection?

It requires baselines and analysis of normal behavior patterns

A security team needs to detect possible DDoS attacks targeting the company network. Which monitoring tool would best address this need?

NIDS because it analyzes suspicious traffic patterns across the network

A company wants an early warning system capable of studying real attacker behavior. Which monitoring approach is most appropriate?

Deploying a Honeypot to gather threat intelligence

Why is a layered monitoring strategy generally more effective than relying on a single monitoring tool?

A single tool cannot provide visibility across all security areas

A company relies only on NIDS for monitoring. Which security gap is most likely to remain unresolved?

Failure to detect host-level attacks and insider activities

Which detection method identifies attacks by comparing activities against known attack patterns?

Signature-Based Detection

A system administrator needs to monitor unauthorized changes to important server files. Which tool should be deployed?

HIDS because it monitors file system changes on hosts

A monitoring system frequently generates alerts for harmless user activities. Which monitoring challenge does this situation represent?

False Positives

A company wants to detect suspicious traffic patterns and port scanning attempts at its gateway. Which solution is most appropriate?

NIDS because it monitors packet flows and network behavior

Which monitoring tool specifically focuses on observing traffic across an entire network?

Network Intrusion Detection System (NIDS)

What is the primary purpose of Information Assurance Monitoring?

To continuously observe and analyze system and network activities for threats

An organization plans to deploy a high-interaction honeypot. Which concern should security analysts evaluate most carefully?

The honeypot could be exploited as a launchpad for attacks

An organization wants visibility into user activity and privilege escalation attempts on employee computers. Which tool is most suitable?

HIDS because it analyzes host-level activities

Which tool is mainly used to attract attackers and analyze their techniques and behavior?

Honeypot

A company's security operations center is able to review suspicious activities at any time of the day. Which benefit is illustrated?

Continuous Monitoring

An organization combines NIDS, HIDS, honeypots, malware detection tools, and vulnerability scanners. Which strategy are they applying?

Defense-in-Depth Layered Monitoring

Certain network activities are not being fully inspected by the monitoring system. Which limitation does this represent?

Encrypted Traffic Blind Spots

Which feature is considered a major strength of HIDS?

Providing deep visibility into host-level activities

A cybersecurity team wants to collect intelligence about attacker behavior without exposing real company assets. Which tool is best?

Honeypot because it acts as a decoy system for attackers

A company wants to identify missing patches and software misconfigurations before an attack occurs. Which tool should they use?

Vulnerability Scanner because it identifies security weaknesses proactively

Which statement best describes cyber espionage?

A covert digital operation intended to obtain confidential information

Which factor has significantly increased the attractiveness of organizations to cyber espionage attackers?

The expansion of digital storage for sensitive information

Which cyber espionage technique primarily relies on influencing human behavior?

Social engineering

Which layer of the internet is intentionally hidden and commonly associated with anonymous activities?

Dark Web

Which technology enables systems to recognize patterns and make automated decisions?

Artificial Intelligence

An employee unknowingly submits login credentials through a deceptive email. Which preventive strategy would most effectively reduce similar incidents?

Conducting phishing awareness training for employees

A company wants to strengthen account protection even if user passwords become exposed. Which solution would best address this concern?

Multi-factor authentication

A smart home security camera still uses its default manufacturer password months after installation. Which security issue is most likely to result?

Unauthorized remote access to the device

A cybersecurity team needs a system capable of identifying suspicious activity across massive amounts of network traffic in real time. Which approach would be most effective?

AI-based threat detection systems

A corporation wants to minimize the possibility of attackers exploiting known software weaknesses. Which action should be prioritized?

Performing regular software and firmware updates