I85PREP
⌘ K
ACRM study materials
ACRM study resources

ACRM practice questions

One question at a time. Build your ACRM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cyber risk landscape and threat environment

Which term describes an individual or group that intentionally exploits vulnerabilities to cause harm?

  1. Risk
  2. Threat actor Correct answer.
  3. Control
  4. Vulnerability

Explanation

A threat actor is any individual or group with the intent and capability to exploit a vulnerability. A vulnerability is a weakness, risk is potential loss, and a control is a safeguard.

Question 2Cyber risk landscape and threat environment

What is ransomware?

  1. A distributed denial-of-service attack using botnets
  2. Malware that encrypts data and demands payment Correct answer.
  3. A technique for stealing credentials via fake websites
  4. A method for intercepting network traffic

Explanation

Ransomware encrypts victim data and demands payment, usually in cryptocurrency, for the decryption key. The other options describe phishing, DDoS, and network eavesdropping.

Question 3Cyber risk landscape and threat environment

Which social engineering attack uses fraudulent emails to trick recipients into revealing credentials?

  1. Vishing
  2. Smishing
  3. Phishing Correct answer.
  4. Tailgating

Explanation

Phishing uses fraudulent email or messages to trick recipients into revealing credentials or clicking malicious links. Vishing uses voice calls, smishing uses SMS, and tailgating is a physical intrusion technique.

Question 4Cyber risk landscape and threat environment

What is a distributed denial-of-service (DDoS) attack designed to do?

  1. Inject malicious code into a web application
  2. Steal data from a database without authorization
  3. Encrypt files and demand payment
  4. Flood a service with traffic to deny access Correct answer.

Explanation

A DDoS attack floods a target with traffic from many compromised devices so legitimate users cannot access the service. Ransomware encrypts files, data theft exfiltrates information, and code injection targets applications.

Question 5Cyber risk landscape and threat environment

Which type of threat originates from within an organization, such as a disgruntled employee?

  1. Zero-day exploit
  2. Insider threat Correct answer.
  3. Advanced persistent threat
  4. Supply chain attack

Explanation

An insider threat originates from someone with authorized access, such as a disgruntled employee or negligent contractor. APTs are usually external, zero-days are unknown vulnerabilities, and supply chain attacks compromise vendors.

Question 6Cyber risk landscape and threat environment

A zero-day vulnerability is best described as:

  1. A weakness in physical security controls
  2. A flaw unknown to the vendor with no patch available Correct answer.
  3. A known exploit sold on the dark web after patch release
  4. A vulnerability that has been patched for more than a year

Explanation

A zero-day vulnerability is unknown to the vendor or has no patch when attackers exploit it. Patched flaws, physical weaknesses, and post-patch exploits do not meet that definition.

Question 7Cyber risk landscape and threat environment

What is a supply chain attack?

  1. An attack that uses only insider employees
  2. An attack that exploits trust in a third-party vendor Correct answer.
  3. An attack that targets a company's marketing campaign
  4. An attack that floods a network with SYN packets

Explanation

A supply chain attack compromises a trusted vendor or partner to reach the primary target. Marketing attacks, insider-only attacks, and SYN floods are different categories.

Question 8Cyber risk landscape and threat environment

Which of the following is a common initial access vector used by attackers?

  1. Using strong multi-factor authentication
  2. Conducting regular vulnerability scans
  3. Social engineering via email Correct answer.
  4. Applying security patches promptly

Explanation

Social engineering via email is a common initial access vector because it targets human trust. Patching, MFA, and vulnerability scanning are defensive controls, not attack vectors.

Question 9Cyber risk landscape and threat environment

A security team wants to map adversary behaviors to a structured knowledge base of tactics and techniques. Which framework should they use?

  1. NIST CSF
  2. ISO 27001
  3. CVSS
  4. MITRE ATT&CK Correct answer.

Explanation

MITRE ATT&CK is a curated knowledge base of adversary tactics and techniques observed in real intrusions. NIST CSF is a risk management framework, ISO 27001 is a standard, and CVSS scores vulnerability severity.

Question 10Cyber risk landscape and threat environment

An organization receives a report describing high-level geopolitical motivations and likely target sectors. What type of threat intelligence is this?

  1. Strategic Correct answer.
  2. Tactical
  3. Operational
  4. Technical

Explanation

Strategic threat intelligence addresses high-level geopolitical motivations, trends, and likely target sectors. Tactical and technical intelligence cover TTPs and indicators, while operational intelligence focuses on specific campaigns.

Question 11Cyber risk landscape and threat environment

A risk assessment calculates risk as likelihood multiplied by impact. If a threat has high likelihood but low impact, how is the risk best characterized?

  1. Moderate risk because high likelihood offsets low impact Correct answer.
  2. Low risk because impact is low
  3. High risk because likelihood alone determines risk
  4. No risk because impact is not severe

Explanation

Risk is a function of both likelihood and impact; a high-likelihood, low-impact event is usually moderate rather than low or high. Neither likelihood nor impact alone determines the final risk level.

Question 12Cyber risk landscape and threat environment

Which characteristic best distinguishes an advanced persistent threat (APT) from a typical cybercriminal?

  1. Uses only open-source tools
  2. Maintains stealthy long-term access to the target Correct answer.
  3. Focuses on immediate financial gain
  4. Relies exclusively on phishing

Explanation

An APT is distinguished by stealth, persistence, and long-term access, often for espionage or strategic advantage. Immediate financial gain, open-source-only tooling, and exclusive phishing are not defining traits.

Question 13Cyber risk landscape and threat environment

In the Cyber Kill Chain, which stage involves exploiting a vulnerability to execute code on a victim system?

  1. Exploitation Correct answer.
  2. Reconnaissance
  3. Weaponization
  4. Command and Control

Explanation

In the Cyber Kill Chain, exploitation is the stage where an attacker leverages a vulnerability to execute code. Reconnaissance gathers information, weaponization creates the payload, and command and control maintains remote access.

Question 14Cyber risk landscape and threat environment

How does a vulnerability differ from an exploit?

  1. A vulnerability is malware; an exploit is a control
  2. A vulnerability is an actor; an exploit is a target
  3. A vulnerability is an attack; an exploit is a risk
  4. A vulnerability is a weakness; an exploit is code that uses it Correct answer.

Explanation

A vulnerability is a weakness in a system, while an exploit is the method or code that takes advantage of that weakness. Malware, controls, attacks, risks, actors, and targets are distinct concepts.

Question 15Cyber risk landscape and threat environment

A botnet is primarily used by attackers to:

  1. Launch DDoS and spam campaigns Correct answer.
  2. Encrypt backups for ransom
  3. Provide legitimate cloud services
  4. Improve network performance

Explanation

A botnet is a network of compromised devices controlled remotely by an attacker. It is typically used for DDoS, spam, credential stuffing, and other coordinated malicious activity, not legitimate cloud services.

Question 16Cyber risk landscape and threat environment

Which statement correctly distinguishes credential stuffing from brute force?

  1. Credential stuffing reuses breached credentials; brute force guesses passwords Correct answer.
  2. Credential stuffing targets only administrators; brute force targets only guests
  3. Credential stuffing tries many passwords for one account; brute force uses known pairs
  4. Credential stuffing is a physical attack; brute force is social engineering

Explanation

Credential stuffing reuses breached username-password pairs across many services, relying on password reuse. Brute force systematically guesses passwords for a specific account and is not a physical or social engineering attack.

Question 17Cyber risk landscape and threat environment

In a double extortion ransomware attack, what does the attacker do beyond encrypting data?

  1. Steals data and threatens to leak it Correct answer.
  2. Uses only denial-of-service traffic
  3. Notifies law enforcement before encryption
  4. Provides free decryption keys to all victims

Explanation

Double extortion ransomware combines encryption with data theft and the threat to publish sensitive information. This pressures victims to pay even if they can restore from backups.

Question 18Cyber risk landscape and threat environment

A team uses STRIDE to categorize threats during design. Which STRIDE category covers an attacker impersonating another user?

  1. Spoofing Correct answer.
  2. Information disclosure
  3. Repudiation
  4. Tampering

Explanation

In STRIDE, spoofing covers impersonation of a user, system, or service. Tampering modifies data, repudiation denies actions, and information disclosure exposes protected data.

Question 19Cyber risk landscape and threat environment

What is the key difference between an indicator of compromise (IoC) and an indicator of attack (IoA)?

  1. IoC focuses on attacker behavior intent; IoA focuses on artifacts left after an attack
  2. IoC is an artifact of past compromise; IoA is attack behavior Correct answer.
  3. IoC and IoA are identical concepts
  4. IoC is only used for phishing; IoA is only used for DDoS

Explanation

An IoC is a forensic artifact such as a hash or IP address that suggests a compromise already occurred. An IoA focuses on attacker intent and behavior, which can reveal an ongoing attack.

Question 20Cyber risk landscape and threat environment

An analyst monitors dark web forums for leaked credentials and early warnings of attacks. This activity is best described as:

  1. Vulnerability scanning
  2. Penetration testing
  3. Threat intelligence collection Correct answer.
  4. Incident response

Explanation

Monitoring dark web forums for leaked credentials and attack warnings is threat intelligence collection. Penetration testing simulates attacks, incident response handles active incidents, and vulnerability scanning finds weaknesses.

Question 21Cyber risk landscape and threat environment

An APT has maintained undetected access to a network for six months, moving laterally and exfiltrating data slowly. Which defensive strategy most directly addresses this dwell time?

  1. Deploying signature-based antivirus only
  2. Blocking all outbound DNS traffic
  3. Continuous threat hunting and behavioral analytics Correct answer.
  4. Increasing password complexity for all users

Explanation

Long dwell times allow attackers to move laterally and exfiltrate data slowly, evading signature-based detection. Continuous threat hunting and behavioral analytics can detect subtle anomalies and ongoing malicious activity.

Question 22Cyber risk landscape and threat environment

Which motivation most typically distinguishes nation-state threat actors from cybercriminal groups?

  1. Cybercriminals focus on long-term strategic disruption
  2. Cybercriminals avoid financial gain
  3. Nation-states primarily seek immediate ransom payments
  4. Nation-states pursue espionage and geopolitical advantage Correct answer.

Explanation

Nation-state actors often pursue espionage, intellectual property theft, and geopolitical advantage rather than immediate ransom. Cybercriminals are typically financially motivated.

Question 23Cyber risk landscape and threat environment

An organization has a low risk appetite for data breaches but a high risk appetite for availability disruptions. How should this shape its threat landscape prioritization?

  1. Treat all threats equally regardless of risk appetite
  2. Ignore data breach threats because risk appetite is low
  3. Prioritize data exfiltration defenses over DDoS mitigation Correct answer.
  4. Focus exclusively on DDoS because availability is tolerated

Explanation

Risk appetite defines how much risk an organization is willing to accept, which should guide control prioritization. A low tolerance for data breaches means prioritizing confidentiality controls over DDoS mitigation.

Question 24Cyber risk landscape and threat environment

A company discovers that one of its software vendors was breached and the attacker used the vendor's update mechanism to distribute malware. This is best classified as:

  1. A zero-day exploit in the company's own code
  2. A direct insider threat
  3. A physical security breach
  4. A third-party supply chain compromise Correct answer.

Explanation

Abusing a vendor's update mechanism to distribute malware is a third-party supply chain compromise. It is not a direct insider, a zero-day in the company's own code, or a physical breach.

Question 25Cyber risk landscape and threat environment

Which standards are commonly used to exchange cyber threat intelligence in a structured, machine-readable format?

  1. STIX and TAXII Correct answer.
  2. SQL and NoSQL
  3. SMTP and IMAP
  4. HTML and CSS

Explanation

STIX structures threat intelligence into machine-readable objects, and TAXII defines how to exchange that intelligence. HTML, SQL, and email protocols are not threat intelligence exchange standards.

Question 26Cyber risk landscape and threat environment

A group defaces public websites and leaks internal documents to protest a government policy. Which threat actor motivation does this best illustrate?

  1. Personal revenge against a former employer
  2. Ideological or political activism Correct answer.
  3. Espionage on behalf of a state
  4. Financial gain through extortion

Explanation

Hacktivists are primarily driven by ideological, political, or social causes and use cyber operations to publicize grievances. Financial extortion, state espionage, and personal revenge characterize other actor motivations.

Question 27Cyber risk landscape and threat environment

A vulnerability has a CVSS base score of 9.8. What does this score primarily convey?

  1. The vulnerability affects only confidentiality, not integrity or availability.
  2. The vulnerability has critical severity and should be prioritized for remediation. Correct answer.
  3. The vulnerability has been actively exploited in the wild.
  4. The vulnerability is exploitable only by an authenticated local user.

Explanation

The CVSS base score reflects the intrinsic severity of a vulnerability based on exploitability and impact metrics. A score of 9.8 falls in the critical range and signals high remediation priority.

Question 28Cyber risk landscape and threat environment

Which malware characteristic distinguishes a worm from a virus?

  1. It hides within the master boot record of a disk.
  2. It encrypts files and demands payment for the decryption key.
  3. It spreads across networks without a host file or user action. Correct answer.
  4. It requires a user to open an infected attachment to spread.

Explanation

A worm is standalone malware that self-propagates across networks without needing a host file or user action. A virus typically requires a host file and some user action to spread.

Question 29Cyber risk landscape and threat environment

A botnet floods an online retailer with SYN packets, making the storefront unavailable to customers. Which security objective is primarily affected?

  1. Integrity
  2. Non-repudiation
  3. Confidentiality
  4. Availability Correct answer.

Explanation

A distributed denial-of-service attack exhausts resources so legitimate users cannot access the service, directly affecting availability. Confidentiality and integrity are not the primary targets of a volumetric flood.

Question 30Cyber risk landscape and threat environment

In a ransomware-as-a-service operation, an affiliate receives a ready-made encryptor and a portal for managing victims. What is the affiliate's typical role?

  1. Intruding into victim networks and deploying the payload. Correct answer.
  2. Auditing the ransomware code for security weaknesses.
  3. Developing the core ransomware code and maintaining the leak site.
  4. Providing cyber insurance coverage to victim organizations.

Explanation

Ransomware-as-a-service separates malware developers from affiliates who conduct intrusions. The affiliate typically gains access, deploys the payload, and handles victim interaction, while the developer maintains the code and infrastructure.

Question 31Cyber risk landscape and threat environment

An attacker sends a carefully crafted email that appears to come from the CEO to the CFO, requesting an urgent wire transfer. Which term best describes this attack?

  1. Whaling Correct answer.
  2. Smishing
  3. Pharming
  4. Vishing

Explanation

Whaling is a spear-phishing attack aimed at high-value executives such as a CFO or CEO. The email impersonates a senior leader to pressure the target into a fraudulent action.

Question 32Cyber risk landscape and threat environment

An employee emails a customer database to a personal account to work from home and the data is later exposed. Which category of insider threat does this represent?

  1. External attacker using stolen credentials.
  2. Unintentional insider negligence. Correct answer.
  3. Nation-state espionage agent.
  4. Malicious insider acting for financial gain.

Explanation

An unintentional insider threat occurs when an employee causes harm through carelessness or convenience without malicious intent. The employee here appears to be working from home rather than seeking to steal or sell data.

Question 33Cyber risk landscape and threat environment

Attackers compromise a website frequently visited by employees of a defense contractor and inject malware. Which attack technique is this?

  1. Brute force attack
  2. Man-in-the-middle attack
  3. SQL injection attack
  4. Watering hole attack Correct answer.

Explanation

A watering hole attack infects a website that a targeted group is known to trust and visit. The goal is to compromise members of that group through their browsing activity.

Question 34Cyber risk landscape and threat environment

A finance department receives an email that appears to be from a known supplier, asking to change the bank account for an upcoming invoice. Which threat does this describe?

  1. Business email compromise Correct answer.
  2. Ransomware encryption
  3. Distributed denial-of-service
  4. Structured query injection

Explanation

Business email compromise impersonates a trusted party to trick an employee into redirecting a payment or disclosing sensitive information. It often relies on social engineering rather than malware.

Question 35Cyber risk landscape and threat environment

A security team forms a hypothesis that attackers are using a legitimate remote-management tool for persistence and searches endpoint telemetry for evidence. What activity is this?

  1. Vulnerability scanning
  2. Penetration testing
  3. Incident response
  4. Threat hunting Correct answer.

Explanation

Threat hunting is a proactive, hypothesis-driven search for undetected adversary activity in telemetry and logs. It differs from reactive incident response and from point-in-time vulnerability assessment.

Question 36Cyber risk landscape and threat environment

An organization buys a cyber insurance policy to cover potential breach costs. Which risk treatment strategy does this represent?

  1. Risk transfer Correct answer.
  2. Risk acceptance
  3. Risk avoidance
  4. Risk mitigation

Explanation

Risk transfer shifts the financial consequences of a risk to a third party, such as an insurer. The organization still faces the event, but the policy covers defined costs.

Question 37Cyber risk landscape and threat environment

A threat intelligence analyst receives a report marked TLP:RED. How should the analyst handle the information?

  1. Restrict it to the named recipients only. Correct answer.
  2. Share it only with members of the same sharing community.
  3. Publish it after removing the organization's name and details.
  4. Share it freely with the public and on social media.

Explanation

TLP:RED is the most restrictive traffic-light marking and limits disclosure to the named recipients. The information should not be shared further without explicit permission.

Question 38Cyber risk landscape and threat environment

An attacker uses PowerShell, certutil, and wmic already installed on victim hosts to download payloads and move laterally, avoiding custom malware. Which concept does this illustrate?

  1. Zero-day exploitation
  2. Supply chain compromise
  3. Credential stuffing
  4. Living off the land Correct answer.

Explanation

Living off the land refers to abusing legitimate system tools that are already present on hosts to blend in and evade detection. The attacker avoids custom malware by using trusted utilities for malicious actions.

Question 39Cyber risk landscape and threat environment

A criminal actor sells verified VPN credentials for a corporate network to a ransomware affiliate. What role does the seller play?

  1. Cyber insurance underwriter
  2. Data exfiltration specialist
  3. Ransomware developer
  4. Initial access broker Correct answer.

Explanation

An initial access broker sells entry points into victim networks to other criminals. The ransomware affiliate then uses that access to deploy payloads and conduct extortion.

Question 40Cyber risk landscape and threat environment

The Diamond Model of intrusion analysis arranges adversary, capability, infrastructure, and victim into a diamond. What is the primary purpose of this model?

  1. To calculate a CVSS severity score for a vulnerability.
  2. To define encryption standards for data at rest.
  3. To measure employee security awareness.
  4. To structure analysis of intrusion relationships. Correct answer.

Explanation

The Diamond Model organizes intrusion events around four core features so analysts can examine relationships and pivot between them. It supports structured analysis rather than vulnerability scoring or awareness measurement.

Question 41Cyber risk identification, assessment, and quantification

Which risk register field defines the conditions under which a risk is considered acceptable?

  1. risk response
  2. risk category
  3. risk tolerance Correct answer.
  4. risk owner

Explanation

Risk tolerance defines the amount or type of risk the organization is willing to accept. It sets the conditions under which a risk is judged acceptable, not who owns or how it is treated. Risk owners, responses, and categories are separate register fields.

Question 42Cyber risk identification, assessment, and quantification

What is the primary purpose of an asset inventory in a cyber risk assessment?

  1. to schedule security awareness training sessions
  2. to identify assets exposed to risk Correct answer.
  3. to document network firewall rules in detail
  4. to track software license compliance records

Explanation

Asset inventory gives the assessment a complete view of what could be affected, including value and criticality. Without it, scenarios may omit important systems or data. Licensing, firewall rules, and training are operational records, not the primary risk purpose.

Question 43Cyber risk identification, assessment, and quantification

A risk assessment that uses labels such as high, medium, and low is best described as:

  1. qualitative Correct answer.
  2. quantitative
  3. probabilistic
  4. deterministic

Explanation

Qualitative assessments use ordinal labels such as high, medium, or low. Quantitative assessments express risk in numeric units such as dollars or frequencies. Deterministic and probabilistic describe modeling approaches, not the label-based scale.

Question 44Cyber risk identification, assessment, and quantification

In a simple risk calculation, risk is commonly expressed as the product of:

  1. likelihood and impact Correct answer.
  2. threat and control
  3. vulnerability and patch level
  4. asset value and insurance

Explanation

A common risk expression is likelihood multiplied by impact. This captures both how often an event may occur and how much harm it could cause. Threat, control, asset value, and insurance are inputs or responses rather than the basic product.

Question 45Cyber risk identification, assessment, and quantification

When an organization purchases cyber insurance to shift financial consequences of a risk, which risk treatment option is used?

  1. avoid
  2. transfer Correct answer.
  3. accept
  4. mitigate

Explanation

Risk transfer shifts the financial consequence of a risk to another party, such as an insurer. Avoidance removes the activity, mitigation reduces likelihood or impact, and acceptance retains the risk. Insurance does not eliminate the underlying risk.

Question 46Cyber risk identification, assessment, and quantification

What term describes the risk that remains after controls have been applied?

  1. secondary risk
  2. inherent risk
  3. residual risk Correct answer.
  4. absolute risk

Explanation

Residual risk is what remains after existing controls and treatments. Inherent risk is the risk before controls are considered. Secondary and absolute risk are not the standard terms for post-control exposure.

Question 47Cyber risk identification, assessment, and quantification

Which term defines the target time to restore a business process after disruption?

  1. recovery time objective
  2. maximum tolerable downtime Correct answer.
  3. service level agreement
  4. recovery point objective

Explanation

The recovery time objective is the target duration for restoring a process after disruption. The recovery point objective concerns tolerable data loss, not downtime. Maximum tolerable downtime is the outer limit, and an SLA is a contractual service commitment.

Question 48Cyber risk identification, assessment, and quantification

STRIDE is a threat modeling framework that categorizes threats into which set?

  1. Identify, protect, detect, respond, recover, govern, and assure
  2. Plan, do, check, act, review, improve, and standardize
  3. Spoofing, tampering, repudiation, disclosure, DoS, elevation Correct answer.
  4. Confidentiality, integrity, availability, authenticity, nonrepudiation, freshness, atomicity

Explanation

STRIDE stands for Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. The other lists describe control functions or improvement cycles. STRIDE is used to structure threat identification during design.

Question 49Cyber risk identification, assessment, and quantification

In FAIR, which pair represents the two primary components of risk?

  1. asset replacement value and vulnerability count
  2. loss event frequency and loss magnitude Correct answer.
  3. threat agent capability and control strength
  4. annualized rate of occurrence and insurance coverage

Explanation

FAIR decomposes risk into loss event frequency and loss magnitude. Frequency captures how often a loss event occurs, while magnitude captures how much loss results. Control strength, asset value, and insurance are factors or responses rather than the two top-level components.

Question 50Cyber risk identification, assessment, and quantification

An asset has a single loss expectancy of $200,000 and an annualized rate of occurrence of 0.25. What is the annualized loss expectancy?

  1. $200,000
  2. $50,000 Correct answer.
  3. $800,000
  4. $25,000

Explanation

Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence. Here, $200,000 × 0.25 = $50,000. The other values result from multiplying or dividing incorrectly.