I85PREP
⌘ K
EXIN Information Security Essentials study materials
EXIN Information Security Essentials study resources

EXIN Information Security Essentials practice questions

One question at a time. Build your EXIN Information Security Essentials understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information and Information Security Concepts

In information security, what does the term 'availability' of information refer to?

  1. The property that information is stored in more than one physical location
  2. The property that information is accurate and complete for its intended purpose
  3. The property that information can be read only by its original creator
  4. The property that information is accessible and usable on demand by authorized users Correct answer.

Explanation

Availability is one of the three core pillars of information security and means that authorized parties can reach and use information and systems whenever they need them. It is about timely and reliable access, not about accuracy, secrecy, or the number of storage locations.

Question 2Information and Information Security Concepts

A payroll clerk can view salary data for the whole company although the role only requires access to their own department. Which security principle is primarily violated?

  1. Separation of duties
  2. Non-repudiation
  3. Business continuity
  4. Least privilege Correct answer.

Explanation

Least privilege means users receive only the access rights they need to perform their tasks. Viewing company-wide salary data exceeds what the payroll role requires. Separation of duties concerns splitting conflicting tasks, not the scope of one user's access.

Question 3Information and Information Security Concepts

Which statement best describes the relationship between data and information?

  1. Data consists of raw facts that become information once they are processed and given meaning Correct answer.
  2. Information only exists inside databases, while data exists everywhere
  3. Information is raw facts and data is interpreted meaning
  4. Data and information are synonyms in security terminology

Explanation

Data are unprocessed facts or symbols, while information is data that has been organized, processed, and interpreted so that it has meaning and value. This distinction underpins why information, not raw data alone, is the asset that security protects.

Question 4Information and Information Security Concepts

A company's customer records are altered by an attacker so that delivery addresses are changed. Which core information security property is directly affected?

  1. Authenticity of the network
  2. Integrity Correct answer.
  3. Availability
  4. Confidentiality

Explanation

Integrity is the property that information remains accurate, complete, and unaltered except through authorized changes. Unauthorized modification of stored addresses is a direct integrity breach. Availability and confidentiality concern access and disclosure rather than correctness.

Question 5Information and Information Security Concepts

What is the primary purpose of classifying information?

  1. To determine the level of protection required based on sensitivity and value Correct answer.
  2. To reduce the amount of storage needed for documents
  3. To replace the need for access control measures
  4. To make all information available to every employee

Explanation

Classification assigns information to categories such as public, internal, or confidential so that proportionate protective measures can be applied. It is a governance activity that drives handling rules and access decisions rather than a storage or availability technique.

Question 6Information and Information Security Concepts

Which of the following is an example of a threat rather than a vulnerability?

  1. A weak password policy
  2. A criminal group that targets financial institutions Correct answer.
  3. An unlocked server room door
  4. A missing software patch on a web server

Explanation

A threat is any potential cause of an unwanted incident, such as a malicious actor or natural event. Vulnerabilities are weaknesses in assets or controls, such as missing patches, weak policies, or unlocked doors, that a threat could exploit.

Question 7Information and Information Security Concepts

An employee receives an email that appears to come from the IT department and asks them to confirm their password via a link. Which type of social engineering attack is this?

  1. Tailgating
  2. Dumpster diving
  3. Shoulder surfing
  4. Phishing Correct answer.

Explanation

Phishing uses fraudulent messages that impersonate a trusted party to trick recipients into revealing credentials or clicking malicious links. Shoulder surfing, tailgating, and dumpster diving are physical observation or access techniques rather than deceptive electronic messages.

Question 8Information and Information Security Concepts

What does the term 'asset' mean in the context of information security?

  1. Only the financial resources of an organization
  2. Any device that is connected to the internet
  3. A software tool used to detect intrusions
  4. Anything that has value to the organization and therefore needs protection Correct answer.

Explanation

In information security an asset is anything of value to the organization, which includes information, hardware, software, people, and services. Protection efforts are directed at assets because harm to them harms the organization.

Question 9Information and Information Security Concepts

Which measure best supports the confidentiality of information stored on a laptop that may be lost or stolen?

  1. Daily backups of the hard disk
  2. Antivirus software updated every week
  3. A printed copy of the data kept in the office
  4. Full-disk encryption combined with a strong authentication method Correct answer.

Explanation

Encryption renders data unreadable without the key, and strong authentication prevents easy access to the decrypted content, so both directly protect confidentiality if the device is lost. Backups, printed copies, and antivirus address availability or malware rather than disclosure of data on a stolen device.

Question 10Information and Information Security Concepts

A hospital must ensure patient records remain readable for many years even if the original software is retired. Which property is most directly addressed by planning for format migration and media refresh?

  1. Least privilege
  2. Non-repudiation of entries
  3. Defense in depth
  4. Availability over time Correct answer.

Explanation

Long-term readability depends on keeping information accessible as formats, media, and systems change, which is a dimension of availability. Format migration and media refresh keep records usable rather than ensuring secrecy, proof of origin, or access restriction.

Question 11Information and Information Security Concepts

Which pairing of an information security objective with a supporting control is correct?

  1. Availability supported by deleting all backup copies
  2. Confidentiality supported by publishing data on an open website
  3. Integrity supported by cryptographic hashing of records Correct answer.
  4. Integrity supported by granting every employee write access

Explanation

Hashing produces a value that changes if the content changes, so it can be used to detect unauthorized modification and thus support integrity. The other pairings either undermine the stated objective or expose data unnecessarily.

Question 12Information and Information Security Concepts

What distinguishes a risk from a vulnerability?

  1. Risk applies only to physical assets, while vulnerabilities apply only to software
  2. Risk is a weakness in a system, while a vulnerability is the chance of loss
  3. Risk and vulnerability are interchangeable terms in security management
  4. Risk combines the likelihood and impact of a threat exploiting a vulnerability, while a vulnerability is a weakness that could be exploited Correct answer.

Explanation

A vulnerability is a weakness, whereas risk expresses the potential for loss by combining the likelihood that a threat exploits that weakness with the resulting impact. Keeping the concepts separate allows weaknesses to be fixed and risks to be prioritized and treated.

Question 13Information and Information Security Concepts

An organization discovers that a former employee still has an active account with access to the file server. Which type of control failure does this most directly represent?

  1. A failure of physical environmental control
  2. A failure in access management during the joiner-mover-leaver process Correct answer.
  3. A failure of network segmentation
  4. A failure of cryptographic key length

Explanation

Accounts must be adjusted or revoked when people change roles or leave, which is part of the joiner-mover-leaver process within identity and access management. A lingering account is an authorization problem, not an environmental, cryptographic, or segmentation issue.

Question 14Information and Information Security Concepts

Which statement about the relationship between security and usability is most accurate?

  1. Increasing security always improves usability
  2. Security controls should always be maximized regardless of their effect on users
  3. Controls should be proportionate so that protection is achieved without unnecessary friction that encourages workarounds Correct answer.
  4. Usability and security are completely independent concerns

Explanation

Effective security balances protection with the way people actually work; excessive friction leads users to bypass controls, which reduces real security. Proportionate controls therefore serve both goals, and the two concerns are related rather than independent or automatically aligned.

Question 15Information and Information Security Concepts

What is the main difference between an incident and an event in information security?

  1. Events occur only in networks, while incidents occur only in applications
  2. An event is always malicious, while an incident is always accidental
  3. An event is any observable occurrence in a system, while an incident is an event or series of events that actually or potentially harms the organization Correct answer.
  4. An incident is a planned maintenance window, while an event is an unplanned outage

Explanation

An event is simply something observable that happens in systems or networks, and most events are benign. An incident is a subset of events that has caused or could cause harm, which is why it triggers the incident response process.

Question 16Information and Information Security Concepts

A manager approves a payment request after receiving a phone call from someone claiming to be the CEO. Which control would best have prevented a fraudulent approval?

  1. Requiring independent verification of the request through a known channel before approval Correct answer.
  2. Installing a firewall in front of the payment server
  3. Increasing the length of user passwords
  4. Encrypting the payment system's database

Explanation

This is a business email or voice impersonation attempt, and the effective defense is a callback or other verification through a channel the organization already trusts. Encryption, password length, and firewalls protect technical assets but do not stop a person from approving a fraudulent instruction.

Question 17Information and Information Security Concepts

Which statement correctly describes the purpose of an information security policy?

  1. It records every security incident that has occurred
  2. It replaces the need for awareness training
  3. It lists the exact firewall rules that engineers must configure
  4. It provides management direction and rules for protecting information across the organization Correct answer.

Explanation

A policy states management's intent, principles, and mandatory rules for information security and provides the basis for more detailed standards and procedures. Firewall rules and incident logs are operational artifacts, and a policy complements rather than replaces training.

Question 18Information and Information Security Concepts

An attacker gains access by pretending to be a technician and asking an employee at the reception desk to hold the door open. Which two attack techniques does this combine?

  1. Eavesdropping and hashing
  2. Brute force and SQL injection
  3. Phishing and ransomware
  4. Tailgating and pretexting Correct answer.

Explanation

Tailgating is physically following an authorized person into a restricted area, and pretexting is inventing a plausible role or story to manipulate someone. Together they describe this physical social engineering scenario, whereas the other options are technical or electronic attacks.

Question 19Information and Information Security Concepts

Which of the following best illustrates the concept of defense in depth?

  1. Combining access control, encryption, monitoring, and staff training so that a failure of one control does not leave the organization unprotected Correct answer.
  2. Relying on a single very strong firewall for all protection
  3. Applying the same password to all administrative accounts
  4. Removing controls that overlap to reduce cost

Explanation

Defense in depth layers independent controls so that if one fails, others still reduce risk. A single control, even a strong one, is a single point of failure, and deliberately removing overlapping controls or reusing passwords weakens protection.

Question 20Information and Information Security Concepts

An organization rates a risk as high because the potential financial loss is large and the threat is expected to occur frequently. Which two factors is the organization combining?

  1. Likelihood and impact Correct answer.
  2. Confidentiality and integrity
  3. Asset value and encryption strength
  4. Vulnerability and patch level

Explanation

Risk assessment combines the likelihood that a threat event occurs with the impact or consequence if it does. A frequent threat with large potential loss therefore yields a high risk, and the other pairs do not constitute the standard risk formula.

Question 21Information and Information Security Concepts

A company stores backups on the same server as the production data. Which security weakness does this configuration create most directly?

  1. It reduces the availability of data after a server failure Correct answer.
  2. It improves the integrity of the backups
  3. It increases the confidentiality of the data
  4. It removes the need for access control on backups

Explanation

If production data and backups reside on the same server, a single failure, ransomware infection, or deletion event can destroy both copies, undermining availability and recovery. Co-location does not improve confidentiality or integrity and certainly does not remove the need for access control.

Question 22Information and Information Security Concepts

Which statement best explains why information can be considered an asset that requires protection even though it has no physical form?

  1. Information cannot be stolen because it is intangible
  2. Information has no value unless it is printed on paper
  3. Information can be copied, shared, and sold, and its loss or disclosure can cause financial and reputational harm Correct answer.
  4. Information security only concerns physical documents

Explanation

Information has value because it supports decisions, operations, and competitive position, and because its disclosure, alteration, or loss can cause real harm. Intangibility does not prevent theft or misuse, and digital information is a primary target of attacks.

Question 23Information and Information Security Concepts

A security team wants to compare the relative importance of two systems so that protection effort can be prioritized. Which approach is most appropriate?

  1. Assign a value based on the business impact if the system's information were disclosed, altered, or unavailable Correct answer.
  2. Measure the physical size of each server
  3. Count the number of files stored on each system
  4. Compare the purchase price of the hardware alone

Explanation

Prioritization should reflect the business impact of losing confidentiality, integrity, or availability, because that captures the value of the information and the consequences of failure. File counts, physical size, and hardware price are poor proxies for business criticality.

Question 24Information and Information Security Concepts

An organization applies the same high level of protection to all its information regardless of sensitivity. Which consequence is most likely?

  1. Availability automatically increases for all systems
  2. Classification becomes unnecessary and can be abolished
  3. Overall security improves because nothing is under-protected
  4. Protection costs rise unnecessarily while resources are diverted from the most critical assets Correct answer.

Explanation

Uniform maximum protection wastes resources and spreads effort thinly, so the most critical assets may not receive the attention they need. Proportionate, risk-based protection is more effective, and uniform treatment does not make classification pointless or improve availability by itself.

Question 25Information and Information Security Concepts

A company's risk assessment shows that a specific threat has low likelihood but would cause catastrophic impact. Which treatment decision is most defensible?

  1. Transfer or mitigate the risk through controls such as insurance, redundancy, and contingency planning proportionate to the potential impact Correct answer.
  2. Eliminate all documentation of the risk to avoid liability
  3. Ignore the risk because the likelihood is low
  4. Accept the risk without any further analysis because impact alone does not matter

Explanation

Risk combines likelihood and impact, so a low-likelihood event with catastrophic consequences can still justify treatment such as mitigation, transfer through insurance, or contingency planning. Dismissing the risk on likelihood alone, or hiding it, ignores the impact dimension and good governance.

Question 26Information and Information Security Concepts

In EXIN's information security terminology, which pair correctly distinguishes a threat from a vulnerability?

  1. A threat is the measured value of potential loss, while a vulnerability is the probability that the loss occurs.
  2. A threat is a potential cause of an unwanted incident, while a vulnerability is a weakness that such a cause could exploit. Correct answer.
  3. A threat is a control that has failed, while a vulnerability is a control that has not yet been tested.
  4. A threat is a weakness in a system, while a vulnerability is the person or group motivated to attack it.

Explanation

A threat is any potential cause of an unwanted incident that could harm information or systems, such as a criminal, malware, or a natural event. A vulnerability is an inherent weakness in an asset or control that a threat could exploit, for example missing patches or weak procedures. The two concepts are separate: a threat exists in the environment, while a vulnerability exists inside the organization's protection.

Question 27Information and Information Security Concepts

An organization classifies its information so that staff know how it must be handled. Which statement best describes the primary purpose of information classification?

  1. To record which employee created each document for audit purposes
  2. To encrypt every document automatically before it is stored on any medium
  3. To indicate the value and sensitivity of information so that proportionate protection can be applied Correct answer.
  4. To reduce the total volume of information that the organization keeps on its servers

Explanation

Classification assigns information to levels (for example public, internal, confidential, secret) based on its value and sensitivity and on the harm that disclosure or loss would cause. Its purpose is to let the organization apply protection measures that are proportionate to that value, rather than treating all information the same. Encryption and retention rules may follow from a classification decision, but they are not the purpose of classifying.

Question 28Information and Information Security Concepts

A payroll administrator can view salary data but is not permitted to change it, while a payroll officer can change it but cannot approve the monthly run. Which principle does this arrangement illustrate?

  1. Defense in depth based on redundant controls
  2. Non-repudiation supported by digital signatures
  3. Separation of duties combined with least privilege Correct answer.
  4. Availability ensured through redundancy of systems

Explanation

Least privilege gives each role only the access needed for its task (read-only versus change), and separation of duties ensures that no single person can both perform and approve a sensitive transaction. Together they limit the damage one account can cause and make fraud harder to conceal. The arrangement does not add redundant layers, signatures, or system redundancy.

Question 29Information and Information Security Concepts

A team is asked to express a risk in a way that supports a decision about whether to accept it. Which formulation is most consistent with information security risk management?

  1. The backup server is located in the same room as the main server.
  2. The firewall rule set contains 214 rules, of which 12 are unused
  3. The password policy requires a minimum length of twelve characters
  4. The likelihood of a ransomware attack multiplied by the resulting business impact Correct answer.

Explanation

Risk is commonly expressed as the combination of the likelihood of a threat exploiting a vulnerability and the resulting impact or loss. Stating a risk this way allows it to be compared with a risk appetite or tolerance and supports a decision to mitigate, transfer, avoid, or accept it. The other options are observations about controls or configurations, not risk statements.

Question 30Information and Information Security Concepts

An organization's information security management system is described as following a continual improvement cycle. Which description best captures how the plan-do-check-act cycle applies to information security?

  1. Security spending is reduced each year until incidents rise, after which the budget is restored.
  2. Risks are assessed and controls planned, implemented, monitored against objectives, and adjusted based on the results. Correct answer.
  3. Security controls are designed once during the initial project and then frozen until the next external audit.
  4. Every control is replaced annually regardless of whether it still addresses a current risk.

Explanation

The continual improvement cycle links risk assessment and planning to implementation, then to monitoring and review, and finally to corrective action that feeds the next planning round. This keeps controls aligned with changing threats, business processes, and legal requirements. It is a feedback loop, not a one-time design, a budget cycle, or a fixed replacement schedule.

Question 31Information Security Threats and Risks

Which term describes a weakness in software, configuration, or process that a threat could exploit?

  1. Risk appetite
  2. Threat agent
  3. Vulnerability Correct answer.
  4. Control objective

Explanation

A vulnerability is an internal weakness or flaw that creates the opportunity for loss. A threat agent is the actor or event that could exploit that weakness, while risk appetite and control objectives are governance concepts rather than weaknesses.

Question 32Information Security Threats and Risks

In risk terminology, what is the best description of a threat?

  1. The measured likelihood that a safeguard fails during an audit
  2. The total cost of controls implemented to reduce exposure
  3. A documented policy that restricts user behaviour
  4. Any potential cause of an unwanted incident that could harm assets Correct answer.

Explanation

A threat is any potential cause of an unwanted incident, such as an attacker, malware, fire, or human error, that could damage assets. It is distinct from the vulnerability it exploits and from the controls used to reduce exposure.

Question 33Information Security Threats and Risks

What does a phishing attack primarily rely on?

  1. Flooding a network link with traffic until it saturates
  2. Exploiting a buffer overflow in a web server
  3. Intercepting radio signals from wireless peripherals
  4. Deceiving a person into revealing credentials or executing an action Correct answer.

Explanation

Phishing is a social engineering technique that manipulates people through deceptive messages so they disclose information or perform an action. The other options describe technical attacks that do not depend on human deception.

Question 34Information Security Threats and Risks

Which type of malware typically encrypts files and demands payment for the decryption key?

  1. Rootkit
  2. Ransomware Correct answer.
  3. Logic bomb
  4. Adware

Explanation

Ransomware denies access to data, commonly by encryption, and demands payment to restore it. Rootkits hide attacker presence, adware displays unwanted advertising, and logic bombs trigger on a condition.

Question 35Information Security Threats and Risks

What is the main purpose of a DMZ in a network architecture?

  1. To authenticate employees before they enter the building
  2. To isolate internet-facing services from the internal network Correct answer.
  3. To distribute electrical load across server racks
  4. To store encrypted backups of the primary database

Explanation

A demilitarized zone places externally reachable systems in a segmented area so that a compromise there does not give direct access to the internal network. It is a segmentation control, not a backup, physical access, or power measure.

Question 36Information Security Threats and Risks

Which practice most directly reduces the risk from lost or stolen laptops?

  1. Increasing the screen brightness
  2. Using a shared administrator password
  3. Full-disk encryption with strong key management Correct answer.
  4. Disabling automatic operating system updates

Explanation

Full-disk encryption renders stored data unreadable without the key, so a stolen device does not automatically expose confidential information. The other practices either have no security effect or weaken protection.

Question 37Information Security Threats and Risks

What distinguishes a virus from a worm?

  1. A virus encrypts data, while a worm only deletes logs
  2. A worm is always harmless, while a virus always destroys data
  3. A virus only affects mobile phones, while a worm only affects servers
  4. A worm spreads across networks on its own, while a virus needs a host file or user action Correct answer.

Explanation

The defining difference is self-propagation: worms spread autonomously across networks, whereas viruses attach to host files or rely on user action to propagate. Both can cause damage and neither is defined by device type.

Question 38Information Security Threats and Risks

Which statement best describes the relationship between likelihood and impact in risk assessment?

  1. Risk level is measured only by the cost of the affected hardware
  2. Risk level is fixed once a control is purchased
  3. Risk level combines the probability of an event with the severity of its consequences Correct answer.
  4. Risk level depends only on the number of identified vulnerabilities

Explanation

Risk is assessed by combining how probable an unwanted event is with how severe its consequences would be for the organization. Vulnerability counts, control purchases, or hardware cost alone do not express risk level.

Question 39Information Security Threats and Risks

An employee receives a call from someone claiming to be from the IT helpdesk who asks for the employee's password to fix a mailbox problem. Which attack is this?

  1. Tailgating
  2. Shoulder surfing
  3. Watering hole
  4. Vishing Correct answer.

Explanation

Vishing is voice-based social engineering in which an attacker impersonates a trusted party by telephone to extract information. Shoulder surfing is visual observation, tailgating is physical entry following, and a watering hole compromises a website frequented by targets.

Question 40Information Security Threats and Risks

A developer accidentally commits an API key to a public code repository. Which risk is most directly created?

  1. Unauthorized use of the credential to access systems and data Correct answer.
  2. Corruption of the repository's version history
  3. Physical theft of the developer's workstation
  4. Loss of network bandwidth through broadcast storms

Explanation

An exposed credential allows anyone who finds it to authenticate as the key holder and reach whatever the key authorizes. Physical theft, bandwidth storms, and version history corruption are unrelated to credential disclosure.

Question 41Information Security Threats and Risks

Why does patching a known vulnerability reduce risk more effectively than relying on user awareness alone?

  1. It replaces the need for logging and monitoring
  2. It removes the technical weakness that exploitation depends on Correct answer.
  3. It eliminates the need for access control policies
  4. It guarantees that no attacker will target the organization

Explanation

A patch closes the specific flaw an exploit relies on, so the attack path no longer exists regardless of user behaviour. No control guarantees immunity, and patching does not replace monitoring or access policies.

Question 42Information Security Threats and Risks

A finance employee transfers a large sum after receiving an email that appears to come from the CEO asking for an urgent confidential payment. Which threat is most likely?

  1. SQL injection
  2. Business email compromise Correct answer.
  3. Denial of service
  4. Cross-site scripting

Explanation

Business email compromise impersonates an executive or trusted partner to pressure an employee into an unauthorized payment or data disclosure. The other options are technical attacks against availability or web application input handling.

Question 43Information Security Threats and Risks

What is the primary security concern with using unsupported end-of-life software?

  1. The license will convert to an open source license
  2. The software will automatically delete user files
  3. Vulnerabilities discovered later will not receive vendor fixes Correct answer.
  4. The software will stop connecting to the internet

Explanation

Once a vendor stops supporting a product, newly discovered vulnerabilities remain unpatched, leaving a permanent exposure. End-of-life status does not itself delete files, change licensing, or disable connectivity.

Question 44Information Security Threats and Risks

Which control best mitigates the risk of a brute-force attack against a web login form?

  1. Displaying detailed error messages for each failed attempt
  2. Allowing unlimited session length
  3. Storing passwords with reversible encryption
  4. Account lockout or rate limiting after repeated failures Correct answer.

Explanation

Lockout thresholds and rate limiting slow or block repeated guessing attempts, making brute force impractical. Detailed errors, reversible encryption, and long sessions all increase exposure rather than reduce it.

Question 45Information Security Threats and Risks

An attacker floods a web server with so many requests that legitimate customers cannot connect. Which security objective is primarily affected?

  1. Authentication
  2. Availability Correct answer.
  3. Integrity
  4. Non-repudiation

Explanation

A denial-of-service attack consumes resources so that legitimate users cannot reach the service, which is a direct attack on availability. Integrity, authentication, and non-repudiation concern data correctness, identity proof, and accountability.

Question 46Information Security Threats and Risks

Why is encryption of data at rest considered a defence-in-depth measure rather than a complete solution?

  1. It prevents all malware from executing on the server
  2. It guarantees compliance with every regulation
  3. It removes the need to classify information
  4. It protects stored data if media is lost, but does not stop misuse by an authorized user Correct answer.

Explanation

Encryption at rest protects confidentiality when media is lost or stolen, but an authorized user with the key can still misuse data. It does not stop malware execution, replace classification, or by itself guarantee regulatory compliance.

Question 47Information Security Threats and Risks

An organization allows staff to install any app on company laptops. Which risk does this policy most directly increase?

  1. Reduction of disk encryption strength
  2. Increase in the number of backup tapes
  3. Introduction of malware and unvetted software vulnerabilities Correct answer.
  4. Loss of physical network cabling

Explanation

Unrestricted installation lets users introduce malicious or unpatched software that bypasses controlled deployment and testing. It does not affect cabling, weaken encryption algorithms, or change backup media counts.

Question 48Information Security Threats and Risks

Which scenario best illustrates the principle of least privilege reducing insider risk?

  1. All staff share one account for the finance application
  2. Former employees retain access for one year after leaving
  3. Every employee receives local administrator rights for convenience
  4. A payroll clerk can view salary data but cannot modify system configuration Correct answer.

Explanation

Least privilege grants only the access needed for a role, so an insider cannot reach unrelated systems or settings. Shared accounts, broad admin rights, and retained ex-employee access all expand the potential for misuse.

Question 49Information Security Threats and Risks

A supplier's software update mechanism is compromised and distributes malicious code to customers. Which threat category does this best represent?

  1. Phishing campaign
  2. Supply chain attack Correct answer.
  3. Insider fraud
  4. Physical intrusion

Explanation

A supply chain attack compromises a trusted third party or its distribution channel so that malicious content reaches downstream customers. Phishing, insider fraud, and physical intrusion operate through different vectors.

Question 50Information Security Threats and Risks

Which measure best protects data on a decommissioned hard drive that will be sold?

  1. Cryptographic erasure or verified physical destruction of the media Correct answer.
  2. Deleting the files and emptying the recycle bin
  3. Moving the drive to a storage cupboard
  4. Renaming the drive volume

Explanation

Cryptographic erasure destroys the keys protecting the data, and physical destruction removes the media entirely, both of which prevent recovery. Simple deletion, renaming, or storage leaves recoverable data on the device.