Information Security MCQs with Answers
Practice important Information Security MCQs with answers and explanations.
Multiple Choice Questions
Q491: How are vulnerabilities identified?
- A: Through threat analysis
- B: By examining information assets for weaknesses
- C: By assessing market trends
- D: Through policy reviews
View Answer
B
Q492: What should be done if threats present high danger to the organization?
- A: Ignore them
- B: Invest in minimal controls
- C: Calculate recovery and prevention costs
- D: Focus on low-risk threats
View Answer
C
Q493: What is the main goal of asset prioritization?
- A: To ensure all assets are equally protected
- B: To rank assets based on their importance and value
- C: To avoid categorizing assets
- D: To assign random values to assets
View Answer
B
Q494: What is the purpose of risk assessment?
- A: To identify vulnerabilities
- B: To evaluate relative risk for each vulnerability
- C: To categorize assets
- D: To create security policies
View Answer
B
Q495: How is likelihood typically rated in risk assessment?
- A: Between 0 and 100
- B: Between 0.1 and 1.0
- C: From 1 to 10
- D: From A to Z
View Answer
B
Q496: Which example corresponds to a high likelihood rating of 1.0?
- A: Receiving a virus email within the next year
- B: Being struck by a meteorite indoors
- C: Experiencing a hardware failure
- D: Running a software update
View Answer
A
Q497: What factor is used in the risk determination formula?
- A: Likelihood of vulnerability occurrence
- B: Number of assets
- C: Current control measures
- D: External threat sources
View Answer
A
Q498: What is residual risk?
- A: The risk remaining after applying controls
- B: The initial risk before any controls
- C: The risk associated with outdated controls
- D: The risk from uncontrolled threats
View Answer
A
Q499: Which general category of controls includes security policies?
- A: Policies
- B: Programs
- C: Technologies
- D: Procedures
View Answer
A
Q500: What does a general security policy outline?
- A: Security technology specifics
- B: Procedures for data classification
- C: Overall approach to information security
- D: Technical configurations
View Answer
C