I85PREP
⌘ K
EXIN Cyber Security Foundation study materials
EXIN Cyber Security Foundation study resources

EXIN Cyber Security Foundation practice questions

One question at a time. Build your EXIN Cyber Security Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cyber Security Fundamentals

Which statement best describes the relationship between an asset, a threat, and a vulnerability in cyber security risk analysis?

  1. A threat exploits an asset to create a vulnerability
  2. A vulnerability exploits an asset to cause harm to a threat
  3. An asset exploits a vulnerability to cause harm to a threat
  4. A threat exploits a vulnerability to cause harm to an asset Correct answer.

Explanation

Risk analysis separates three elements: the asset is what has value and needs protection, a vulnerability is a weakness in that asset or its controls, and a threat is an actor or event that can exploit the weakness and cause harm. The direction of exploitation always runs from threat, through vulnerability, to asset.

Question 2Cyber Security Fundamentals

In the CIA triad, which property is directly compromised when an attacker silently modifies the balance shown in a bank's customer database?

  1. Confidentiality
  2. Integrity Correct answer.
  3. Availability
  4. Non-repudiation

Explanation

Integrity concerns the accuracy and completeness of data and the assurance that it has not been altered without authorization. Unauthorized modification of a stored balance attacks integrity, even if the data remains readable and the service stays online.

Question 3Cyber Security Fundamentals

Which activity is an example of a technical preventive control?

  1. Restoring data from backup after a ransomware incident
  2. Running a phishing awareness campaign for new staff
  3. Reviewing audit logs each morning for failed logins
  4. Enforcing a firewall rule that blocks inbound traffic on an unused port Correct answer.

Explanation

Preventive controls stop an event before it happens, and technical controls are implemented in systems rather than through people or procedures. A firewall rule that blocks unwanted traffic acts automatically before any connection is established.

Question 4Cyber Security Fundamentals

What is the primary purpose of hashing a password before storing it?

  1. To make the original password unrecoverable from the stored value Correct answer.
  2. To compress the password so it takes less storage space
  3. To encrypt the password so it can be decrypted for verification
  4. To synchronize the password across multiple servers

Explanation

A cryptographic hash is a one-way function, so the stored digest cannot practically be turned back into the password. Verification is done by hashing the supplied password again and comparing digests, which limits damage if the database leaks.

Question 5Cyber Security Fundamentals

Which factor makes a one-time password sent by SMS a weaker authentication method than a hardware token?

  1. The code cannot be combined with a password
  2. The code never expires
  3. The code is always longer than a token code
  4. The code can be intercepted or the SIM can be hijacked Correct answer.

Explanation

SMS codes travel over the mobile network and can be stolen through SIM swapping, SS7 abuse, or malware that reads messages. A hardware token generates the code locally, so there is no network channel to intercept in the same way.

Question 6Cyber Security Fundamentals

Which statement correctly distinguishes a virus from a worm?

  1. A virus encrypts files, while a worm only deletes them
  2. A virus needs a host file or user action to spread, while a worm self-propagates across networks Correct answer.
  3. A virus spreads only over email, while a worm spreads only over USB drives
  4. A virus targets servers, while a worm targets workstations

Explanation

The defining difference is propagation. A virus attaches to a host program or document and needs that code or a user to run before it spreads, whereas a worm is standalone and replicates itself across network links without user intervention.

Question 7Cyber Security Fundamentals

What is the main security objective of network segmentation?

  1. To allow all internal hosts to share a single broadcast domain
  2. To increase the available bandwidth between internal subnets
  3. To replace the need for user authentication on internal systems
  4. To limit how far an attacker can move after compromising one part of the network Correct answer.

Explanation

Segmentation divides a network into zones with controlled traffic between them, so a compromised host cannot freely reach unrelated systems. This containment of lateral movement is the core defensive benefit.

Question 8Cyber Security Fundamentals

Which statement best captures the principle of least privilege?

  1. Users receive full administrative rights so they can respond quickly to incidents
  2. Users and processes receive only the access rights needed for their current task Correct answer.
  3. Access rights are granted permanently once a user is hired
  4. All users share a single privileged account to simplify administration

Explanation

Least privilege limits rights to the minimum required for a defined task and for only as long as needed. This reduces both the chance of accidental damage and the impact of a compromised account.

Question 9Cyber Security Fundamentals

An employee receives an email that appears to come from the finance director and urgently asks for a payment to a new supplier. Which attack type does this best illustrate?

  1. SQL injection
  2. Business email compromise Correct answer.
  3. Watering hole attack
  4. Denial of service

Explanation

Business email compromise uses impersonation or a hijacked mailbox to trick staff into transferring money or data. The hallmark is authority plus urgency around a payment or credential request.

Question 10Cyber Security Fundamentals

Which property of a digital signature allows a recipient to prove to a third party that a message was signed by the holder of a specific private key?

  1. Confidentiality
  2. Non-repudiation Correct answer.
  3. Availability
  4. Anonymity

Explanation

A digital signature is created with the signer's private key and verified with the matching public key, binding the message to that key holder. Because only the holder should control the private key, the signer cannot credibly deny having signed.

Question 11Cyber Security Fundamentals

Why does an organization apply patching to a system that is not directly reachable from the internet?

  1. Patches are required to keep the warranty valid
  2. Unpatched systems consume more electrical power
  3. Internal systems cannot be logged, so patches replace logging
  4. Internal systems can still be reached by attackers who have gained an initial foothold Correct answer.

Explanation

Once an attacker compromises one host, unpatched internal systems become easy stepping stones for lateral movement and privilege escalation. Defense in depth therefore requires patching regardless of internet exposure.

Question 12Cyber Security Fundamentals

What does a risk treatment decision to transfer risk typically involve?

  1. Removing the asset that creates the risk
  2. Purchasing cyber insurance or outsourcing the activity under contract Correct answer.
  3. Applying additional technical controls to reduce likelihood
  4. Accepting the risk without any further action

Explanation

Transfer shifts the financial or operational consequences to another party, most commonly through insurance or contractual arrangements. The risk itself still exists; only who bears the impact changes.

Question 13Cyber Security Fundamentals

Which characteristic most clearly indicates that a security incident should be escalated rather than handled as a routine event?

  1. The event involves a single workstation with no unusual activity
  2. The event affects personal data or a critical service and exceeds defined thresholds Correct answer.
  3. The event was reported by an automated tool rather than a person
  4. The event was detected outside normal business hours

Explanation

Escalation criteria are tied to impact and severity, such as regulated data, critical services, or thresholds defined in the incident response plan. Time of day, detection source, or a single quiet host are not severity indicators on their own.

Question 14Cyber Security Fundamentals

Which control best mitigates the risk of a stolen laptop exposing stored customer records?

  1. An antivirus scan scheduled every night
  2. A screen saver that activates after ten minutes
  3. A printed asset label on the device lid
  4. Full-disk encryption combined with a strong pre-boot authentication factor Correct answer.

Explanation

Encryption at rest makes the data unreadable without the key, and pre-boot authentication ensures the key is protected by a secret the thief does not have. This directly addresses the loss-of-device scenario.

Question 15Cyber Security Fundamentals

What is the security function of a DMZ in a typical network architecture?

  1. To host internet-facing services while limiting direct access to the internal network Correct answer.
  2. To carry all internal user traffic between departments
  3. To store backups of the internal network in encrypted form
  4. To provide the main authentication service for employees

Explanation

A DMZ is a buffer zone between the untrusted internet and the trusted internal network, hosting public services under stricter rules. If a public server is compromised, the segmentation limits access to internal systems.

Question 16Cyber Security Fundamentals

Which practice most effectively defends against credential stuffing attacks on a login portal?

  1. Rate limiting plus detection of logins from many accounts on one client Correct answer.
  2. Displaying detailed error messages for failed logins
  3. Requiring longer passwords without any other change
  4. Allowing unlimited retries to avoid locking out legitimate users

Explanation

Credential stuffing replays leaked username and password pairs at scale, so throttling and detecting distributed or high-volume attempts breaks the attack economics. These controls also reduce automated guessing generally.

Question 17Cyber Security Fundamentals

Which statement correctly describes the role of a hash in verifying file integrity during download?

  1. The published hash is decrypted with a public key to reveal the file
  2. The published hash is appended to the file to make it self-verifying
  3. The published hash is used as the encryption key for the file
  4. The published hash is recomputed locally and compared with the downloaded file's hash Correct answer.

Explanation

The provider publishes a digest of the file, and the recipient hashes the downloaded copy and compares the two values. A match indicates the file was not altered in transit, assuming the published value was obtained over a trusted channel.

Question 18Cyber Security Fundamentals

Which element of an access control decision is provided by the resource owner who formally approves a user's access request?

  1. Authentication
  2. Accounting
  3. Authorization Correct answer.
  4. Identification

Explanation

Authorization is the granting of specific rights to an identity after approval by the responsible owner. Authentication only proves the identity; authorization determines what that identity may do.

Question 19Cyber Security Fundamentals

A company stores encryption keys in the same unencrypted folder as the encrypted backups. Which principle does this most directly violate?

  1. Need-to-know for the backup schedule
  2. Mandatory vacation for administrators
  3. Least functionality of the backup server
  4. Separation of duties between data protection and key custody Correct answer.

Explanation

Keeping keys with the data they protect means anyone who obtains the backup also obtains the means to decrypt it. Key custody must be separated from the protected data so that a single compromise does not defeat the control.

Question 20Cyber Security Fundamentals

Which statement best explains why security awareness training alone cannot prevent phishing success?

  1. Attackers adapt lures continuously, so technical controls must also block or contain the messages Correct answer.
  2. Phishing only targets new employees
  3. Training is only effective for technical staff
  4. Users cannot learn to recognize any suspicious email

Explanation

Human judgment is fallible and attackers refine their lures, so training reduces but does not eliminate the chance of a click. Layered technical controls such as filtering, link isolation, and MFA containment are needed alongside awareness.

Question 21Cyber Security Fundamentals

In a public key infrastructure, what is the role of a certificate authority?

  1. It revokes the private keys of subscribers when they leave
  2. It encrypts all traffic between subscribers
  3. It signs certificates that bind a public key to a verified identity Correct answer.
  4. It stores the private keys of all subscribers for recovery

Explanation

The certificate authority validates the subscriber's identity and issues a signed certificate that binds that identity to a public key. Relying parties trust the CA's signature, so they can trust the binding without contacting the subscriber directly.

Question 22Cyber Security Fundamentals

An organization detects unusual outbound traffic from a server to an unknown external address every night at the same time. Which interpretation is most consistent with incident response analysis?

  1. A user error that requires no log review
  2. A hardware failure that should be reported to the vendor
  3. Normal backup replication that can be ignored without checking
  4. Possible command-and-control beaconing that warrants investigation as a potential compromise Correct answer.

Explanation

Regular, periodic outbound connections to an unknown destination match the pattern of malware beaconing to command-and-control infrastructure. The correct next step is to investigate, correlate logs, and contain if the activity is confirmed malicious.

Question 23Cyber Security Fundamentals

Why does a defense-in-depth design accept that some individual controls will fail?

  1. Independent overlapping controls mean a single failure does not remove all protection Correct answer.
  2. Every control is guaranteed to be bypassed eventually, so none matter
  3. Only the outermost control is ever effective in practice
  4. Failures are prevented by documenting controls in a policy

Explanation

Defense in depth assumes no single control is perfect and layers preventive, detective, and corrective measures across people, process, and technology. If one layer fails, another independent layer still reduces likelihood or impact.

Question 24Cyber Security Fundamentals

A penetration test report rates a finding as high risk although the affected system holds no sensitive data and is isolated from other networks. Which action best reflects sound risk-based judgement?

  1. Escalate to regulators before any internal validation
  2. Apply the report rating unchanged because the tester's severity is always final
  3. Reject the finding entirely because the system is isolated
  4. Reassess the finding in its business context and document the adjusted rating and rationale Correct answer.

Explanation

Technical severity and business risk are not identical: likelihood and impact must be evaluated in the actual environment. A validated reassessment with documented rationale keeps the register accurate and defensible.

Question 25Cyber Security Fundamentals

Which combination best reduces the impact of a successful ransomware attack on file servers?

  1. A stronger password policy plus annual awareness training only
  2. Antivirus on workstations plus a longer backup retention period
  3. Full-disk encryption on servers plus a firewall at the perimeter
  4. Immutable offline backups plus tested restore procedures and network segmentation Correct answer.

Explanation

Impact reduction requires that recovery be possible and that the attack be contained: immutable offline backups survive encryption attempts, tested restores prove recovery works, and segmentation limits spread. Together they shorten outage and data loss.

Question 26Cyber Security Fundamentals

Which term describes the assurance that data has not been altered, whether in storage or in transit, by an unauthorized party?

  1. Confidentiality
  2. Integrity Correct answer.
  3. Non-repudiation
  4. Availability

Explanation

Integrity is the property that data remains accurate and complete and has not been changed by anyone not authorized to do so. It is one of the core pillars of information security alongside confidentiality and availability.

Question 27Cyber Security Fundamentals

In information security, what does the term 'vulnerability' specifically refer to?

  1. The likelihood that a threat occurs in a year
  2. A weakness that could be exploited to harm an asset Correct answer.
  3. The total financial loss from a realized threat
  4. Any event that has already caused data loss

Explanation

A vulnerability is a weakness in a system, process, or control that a threat could exploit. It is distinct from the threat itself and from the impact that would follow exploitation.

Question 28Cyber Security Fundamentals

Which activity belongs to the 'identification' step of an access control process rather than to authentication or authorization?

  1. A user presenting a unique account name to the system Correct answer.
  2. A user proving knowledge of a secret password
  3. A system checking whether a user may open a payroll file
  4. A system logging the time a user opened a file

Explanation

Identification is the act of claiming an identity, typically by supplying a unique account name or identifier. Authentication then verifies that claim, and authorization decides what the verified identity may do.

Question 29Cyber Security Fundamentals

Which statement describes symmetric encryption?

  1. Each message uses a key derived only from the sender's identity
  2. A public key encrypts and a private key decrypts the data
  3. A hash of the plaintext is used as the decryption key
  4. The same secret key is used to encrypt and to decrypt the data Correct answer.

Explanation

Symmetric encryption uses one shared secret key for both encryption and decryption, so the key must be distributed securely to every party that needs it. Its main strength is speed, which makes it suitable for bulk data.

Question 30Cyber Security Fundamentals

What is the primary purpose of a firewall placed at the boundary between an internal network and the internet?

  1. To filter traffic according to rules that permit or deny connections Correct answer.
  2. To detect malicious software already running on endpoints
  3. To encrypt all files stored on internal servers
  4. To authenticate users who log on to their workstations

Explanation

A firewall enforces a rule set that decides which network connections may pass, based on attributes such as addresses, ports, and protocol state. It controls traffic flow rather than encrypting storage or authenticating end users.

Question 31Cyber Security Fundamentals

Which document, approved by management, states the organization's overall intentions and direction for information security?

  1. The acceptable use procedure
  2. The information security policy Correct answer.
  3. The disaster recovery plan
  4. The asset register

Explanation

An information security policy is a management-approved statement of principles and direction that other standards and procedures must follow. Plans, registers, and procedures implement or support that direction rather than set it.

Question 32Cyber Security Fundamentals

Which type of malware spreads by itself across networks by exploiting vulnerable services, without needing a user to open a file?

  1. Trojan horse
  2. Worm Correct answer.
  3. Logic bomb
  4. Adware

Explanation

A worm is self-replicating and propagates across networks by exploiting weaknesses in reachable services, so it does not depend on user interaction. This autonomous spreading is its defining characteristic.

Question 33Cyber Security Fundamentals

What distinguishes a business continuity plan from a disaster recovery plan?

  1. Continuity addresses only physical security, while recovery addresses only logical security
  2. Continuity applies only to IT staff, while recovery applies to all employees
  3. Continuity covers keeping critical business functions running, while recovery focuses on restoring IT systems and data Correct answer.
  4. Continuity is written after an incident, while recovery is written before one

Explanation

Business continuity planning aims to keep essential business processes operating during and after disruption, often through manual workarounds. Disaster recovery is the narrower IT-focused effort to restore systems, data, and infrastructure.

Question 34Cyber Security Fundamentals

An attacker floods a web server with a very high volume of requests from many compromised hosts until legitimate users cannot connect. Which type of attack is this?

  1. Cross-site scripting
  2. SQL injection
  3. Session fixation
  4. Distributed denial of service Correct answer.

Explanation

A distributed denial of service attack uses many coordinated hosts to exhaust a target's capacity so that genuine users are denied service. The goal is availability loss rather than data theft or code execution.

Question 35Cyber Security Fundamentals

Which control type is a security guard patrolling a data center?

  1. Preventive and physical Correct answer.
  2. Detective and logical
  3. Corrective and technical
  4. Compensating and administrative

Explanation

A guard is a physical control because it operates in the physical environment, and it is preventive because its presence deters and stops unauthorized access. Some effect is also detective, but the primary classification is preventive and physical.

Question 36Cyber Security Fundamentals

An organization wants to reduce the chance that a single leaked password grants broad access across many systems. Which measure addresses this most directly?

  1. Increasing the password minimum length to twelve characters
  2. Storing password hashes with a fast general-purpose algorithm
  3. Sending password expiry reminders by email every month
  4. Requiring multi-factor authentication for access to critical systems Correct answer.

Explanation

Multi-factor authentication means a leaked password alone is insufficient, because a second factor is also required. This directly limits the value of a stolen credential across the systems it protects.

Question 37Cyber Security Fundamentals

Which statement best describes the role of an asset owner in information security?

  1. Auditing compliance with security policy across the whole organization
  2. Operating the backup infrastructure for all servers in the data center
  3. Approving the annual security budget for the entire company
  4. Deciding the classification and required protection level of a specific information asset Correct answer.

Explanation

An asset owner is accountable for a particular asset and decides how sensitive it is and what protection it needs. Operational, audit, and budgeting duties belong to other roles such as administrators, auditors, and executive management.

Question 38Cyber Security Fundamentals

Why should an organization classify information assets?

  1. So that the asset register can be published to all external partners
  2. So that protection measures and handling rules can be matched to the asset's sensitivity and value Correct answer.
  3. So that every asset can be given the same level of protection regardless of content
  4. So that encryption becomes unnecessary for internal documents

Explanation

Classification groups assets by sensitivity and value so that proportionate controls and handling rules can be applied. Without classification, organizations tend to over-protect low-value data and under-protect critical data.

Question 39Cyber Security Fundamentals

An employee finds a USB stick in the parking area and plugs it into a company laptop. Which risk does this behavior most directly introduce?

  1. Malware being introduced to the corporate network from removable media Correct answer.
  2. Loss of network availability due to a routing loop
  3. Privilege escalation through a misconfigured directory service
  4. Disclosure of data through an unencrypted backup tape

Explanation

Unknown removable media can carry malware that executes when connected, which is a classic route for introducing malicious code into an isolated environment. The behavior bypasses perimeter controls by carrying the threat inside physically.

Question 40Cyber Security Fundamentals

Which activity is part of the 'response' phase rather than the 'preparation' phase of incident management?

  1. Training the incident response team on its roles
  2. Defining the incident severity scale and escalation contacts
  3. Purchasing and configuring a forensic workstation
  4. Containing affected systems and preserving evidence for later analysis Correct answer.

Explanation

Containment and evidence preservation happen while an incident is live, which places them in the response phase. Preparation covers the arrangements made before any incident, such as definitions, training, and tooling.

Question 41Cyber Security Fundamentals

What is the main security benefit of enforcing a clean-desk and clear-screen practice?

  1. It removes the need for screen-lock timeouts on laptops
  2. It guarantees that malware cannot spread between workstations
  3. It replaces the requirement for access badges in restricted areas
  4. It reduces exposure of sensitive information to people who pass by or gain physical access Correct answer.

Explanation

Clean desk and clear screen reduce the chance that documents, notes, or on-screen data are seen or taken by unauthorized people. They address information exposure in the physical workspace rather than technical threats.

Question 42Cyber Security Fundamentals

A developer embeds the database password directly in application source code stored in a shared repository. Which change most directly addresses the underlying weakness?

  1. Adding a comment that the password must not be shared
  2. Renaming the repository to something less obvious
  3. Moving secrets into a dedicated secrets management service with restricted access Correct answer.
  4. Compressing the source files before committing them

Explanation

Hard-coded secrets are exposed to anyone who can read the code or its history, so they must be removed and stored in a controlled secrets store. Access to that store can then be limited, audited, and rotated independently of the code.

Question 43Cyber Security Fundamentals

Which statement explains why logging and monitoring support accountability?

  1. They encrypt all log data so that it cannot be read
  2. They replace the need for access control decisions
  3. They create a recorded trail that links actions to identified users and systems Correct answer.
  4. They prevent users from making mistakes in the first place

Explanation

Logs record who did what and when, which allows actions to be attributed to an identity after the fact. This traceability is what makes accountability enforceable, even though logging does not itself stop the action.

Question 44Cyber Security Fundamentals

An organization must send a large batch of files to a partner over the internet and wants both confidentiality and integrity protection. Which approach fits best?

  1. Rely on the file transfer protocol's default settings without additional protection
  2. Send the files unencrypted and rely on the partner's firewall
  3. Rename the files with random strings and send them by email
  4. Encrypt the files with a shared symmetric key and accompany them with a keyed integrity check Correct answer.

Explanation

Symmetric encryption provides confidentiality efficiently for bulk data, and a keyed integrity check such as a message authentication code detects tampering. Together they address both required properties.

Question 45Cyber Security Fundamentals

Why is separating the duties of requesting, approving, and performing a privileged change important?

  1. It allows the approver to skip reviewing the change details
  2. It reduces the number of changes that need to be documented
  3. It prevents one person from completing a sensitive action without independent oversight Correct answer.
  4. It removes the need to log privileged activity

Explanation

Separation of duties means no single person controls all stages of a sensitive transaction, so an error or abuse requires collusion. This introduces a check that a lone individual cannot bypass.

Question 46Cyber Security Fundamentals

A server room's temperature monitoring alarm fails silently, and a cooling failure goes unnoticed for hours. Which control objective was most directly unmet?

  1. Ensuring data is encrypted at rest on the servers
  2. Verifying the identity of administrators before logon
  3. Detecting environmental conditions that threaten equipment availability Correct answer.
  4. Preventing unauthorized entry into the server room

Explanation

Temperature monitoring is an environmental detective control intended to warn of conditions that can damage equipment. Its silent failure meant the organization lost the ability to detect a cooling problem in time.

Question 47Cyber Security Fundamentals

An organization is choosing between accepting and mitigating a risk. Which consideration is most relevant to that decision?

  1. Whether the affected system runs on the newest hardware available
  2. Whether the cost of the mitigation is proportionate to the potential loss and the organization's risk appetite Correct answer.
  3. Whether the mitigation can be implemented entirely by the IT department without management involvement
  4. Whether the risk has ever materialized before in the organization's history

Explanation

Risk treatment compares the cost and effectiveness of a control with the potential loss, judged against the organization's risk appetite. If mitigation costs more than the exposure it removes, acceptance may be the rational choice.

Question 48Cyber Security Fundamentals

A web application reflects user input back into the page without encoding it, allowing an attacker to run script in other users' browsers. Which mitigation addresses the root cause?

  1. Requiring longer passwords for application users
  2. Context-aware output encoding of all user-supplied data before it is rendered Correct answer.
  3. Blocking all outbound traffic from the web server
  4. Increasing the length of the session timeout

Explanation

The flaw is that untrusted input reaches the browser as executable content, so context-aware output encoding prevents the input from being interpreted as code. Other measures may reduce impact but do not remove the injection path.

Question 49Cyber Security Fundamentals

An organization discovers that a former contractor's account still has active access months after the contract ended. Which process failure does this most clearly indicate?

  1. The backup schedule did not run as planned
  2. The password policy did not require sufficient complexity
  3. The vulnerability scanning scope excluded external hosts
  4. The joiner-mover-leaver process did not trigger timely revocation of access Correct answer.

Explanation

Access lifecycle management should revoke entitlements when a person leaves or a contract ends. A dormant account with live access shows that the leaver step of the identity lifecycle was not executed.

Question 50Cyber Security Fundamentals

A team proposes relying on a single very strong control, such as one hardened gateway, to protect a critical service. Why does this conflict with sound security architecture?

  1. Strong controls are always more expensive than layered weaker controls
  2. A single control is a single point of failure, so its compromise or outage leaves nothing else protecting the service Correct answer.
  3. Layered controls are only useful for low-value systems
  4. A single control cannot be audited effectively

Explanation

Concentrating protection in one element means that if it fails, is misconfigured, or is bypassed, no further barrier remains. Layered architecture assumes individual controls can fail and ensures others still reduce exposure.