Assessing Corporate Cybersecurityintermediate
Select all valid primary objectives of an organizational cybersecurity tabletop exercise.
Answer
Identifying procedural gaps and clarifying incident response roles
Explanation
### Why this is right
- **A** is correct: The exercise aims to assess adherence to Payment Card Industry Data Security Standard (PCI DSS) version 4.0 and identify gaps.
- **B** is correct: Practising decisions during simulated breach scenarios is an explicit objective.
- **D** is correct: The exercise aims to increase risk awareness and collaboration among participants.
- **E** is correct: Developing practical strategies for small and medium-sized businesses is a stated goal.
### The concept
A tabletop exercise lets participants discuss realistic events and rehearse how they would respond. It can reveal uncertainty about roles, communication, or procedures and help produce improvement actions. It is a preparation activity, not a substitute for every audit or a guarantee that an organization meets all requirements.
### The other options
- **C. Replace all external audits with a single discussion exercise.**: The exercise includes a mock audit as a learning activity, but it does not claim to replace external audits.
### Terms
- **Payment Card Industry Data Security Standard (PCI DSS)**: A payment-card security standard named in the exercise as the basis for the compliance assessment.
- **Small and medium-sized business (SMB)**: A business described by its comparatively small or medium organizational scale.
### Remember
A tabletop exercise practises decisions and identifies gaps; it does not certify compliance.
Related Questions
- Outsourcing payment processing to a third-party vendor completely transfers all regulatory compliance and data protection responsibilities away from the hiring organization.(intermediate)
- In an incident management exercise divided into discovery, investigation, response, and recovery, the phase focused on analyzing logs, alerts, and evidence to examine unauthorized activity is called _____.(basic)
- The recovery and compliance review phase can include a mock audit, ongoing monitoring, staff training, and improvements informed by the incident.(basic)
- A staff member accesses the billing system from an unprotected personal laptop, and suspicious activity alerts appear. Which response area is most directly implicated by this new information?(intermediate)
- During a tabletop incident response exercise involving potential payment card data compromise, which activity is the primary focus of the Discovery phase?(advanced)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free