Free PCES-30-01 sample questions

Correct answer: Accountability

Accountability extends the CIA triad by ensuring that actions within a system can be traced back to a specific user or entity. By permanently recording every action linked to a doctor's unique ID, the hospital ensures that users are held responsible for their actions.

Correct answers: The threat is classified as a phishing/social engineering attack.; An appropriate defense measure is implementing multi-factor authentication (MFA) for financial approvals alongside security awareness training.

The scenario describes a Business Email Compromise (BEC), which is a form of phishing and social engineering where attackers manipulate employees into performing actions.

Layered defenses (defense in depth) for social engineering include combining technical controls like MFA for sensitive transactions with administrative controls like employee training.

Correct answer: Incorrect decision-making based on false data, leading to operational disruptions

Data manipulation directly attacks the integrity of the data. In a logistics context, altering GPS coordinates leads to incorrect routing decisions, causing severe operational disruptions, wasted fuel, and delayed deliveries.

Correct answer: False

False. Major data protection regulations like GDPR impose strict timelines for reporting breaches (e.g., within 72 hours of becoming aware of the breach). Waiting 6 months would violate reporting obligations and invite severe regulatory fines.

Correct answer: Abandonment of shopping carts and reduced future purchases due to loss of customer trust

System unavailability causes direct financial losses (lost sales during the outage) as well as indirect impacts, such as abandoned shopping carts, long-term brand damage, and customers moving to competitors for future purchases.

Correct answer: Non-Disclosure Agreement (NDA)

A Non-Disclosure Agreement (NDA) is a legal contract that outlines confidential material, knowledge, or information (like trade secrets and proprietary algorithms) that the parties wish to share with one another but wish to restrict access to or by third parties.