A Security Analyst Has Been Asked to Create a List

question 16

Multiple Choice

A security analyst has been asked to create a list of external IT security concerns, which are applicable to the organization. The intent is to show the different types of external actors, their attack vectors, and the types of vulnerabilities that would cause business impact. The Chief Information Security Officer (CISO) will then present this list to the board to request funding for controls in areas that have insufficient coverage. Which of the following exercise types should the analyst perform?

• A) Summarize the most recently disclosed vulnerabilities.
• B) Research industry best practices and the latest RFCs.
• C) Undertake an external vulnerability scan and penetration test.
• D) Conduct a threat modeling exercise.

---

Definitions:

Criminal Behaviour

Actions that violate laws and are subject to official sanction, reflecting a deviation from social norms and expectations.

Etiology

The examination of the roots and causes behind various diseases or disorders.

Diagnosis

The process of determining by examination the nature and circumstances of a diseased condition.

Prognosis

A prediction of the likely course and outcome of a disease or condition over time.