(B) Incorrect — this is the specific flaw in the original statement being tested.

(C) Incorrect — availability concerns uptime and access, not encryption.

(D) Incorrect — encryption absolutely applies to data at rest (BitLocker, AES-256 on SSDs).

(A) Incorrect — Confidentiality alone is not what ransomware primarily attacks.

(C) Incorrect — Integrity is also violated because files are modified (encrypted) without authorization.

(D) Incorrect — Confidentiality is not confirmed violated without evidence of data exfiltration.

(A) Incorrect — this is the exact misconception the question tests.

(B) Incorrect — series vs. parallel placement is irrelevant if both use identical rule sets.

(C) Incorrect — defense-in-depth applies across all seven layers.

(A) Incorrect — DLP (III) would also independently help.

(B) Incorrect — a duplicate firewall adds no independent protection; DLP does.

(D) Incorrect — II does not provide independent protection as explained.

(B) Partially tempting, but the sign’s primary function is to deter, not detect. The actual log system is the detective control.

(C) Incorrect — labeling something “restricted” does not make it physically restrictive.

(D) Incorrect — corrective controls restore systems after an incident.

(A) Incorrect — III is also accurate.

(B) Incorrect — I and III are also accurate.

(D) Incorrect — II is also accurate.

(B) Incorrect — cost-benefit analysis requires complete total cost of impact, not just the ALE figure.

(C) Incorrect — quantitative is appropriate here; the method isn’t the problem, the incomplete inputs are.

(D) Incorrect — ALE applies to any risk with estimable frequency and impact, not just physical assets.

(A) $800,000 — this is the SLE (the loss from a single event), not the ALE.

(B) $400,000 — this has no formula basis; a common random distractor.

(C) $2,000,000 — this is the total asset value, the starting point, not the answer.

(A) Incorrect — insurance does not reduce breach likelihood; controls like MFA and patching do.

(C) Incorrect — accept means acknowledging risk AND taking no compensating action at all.

(D) Incorrect — avoid means eliminating the activity that creates the risk (e.g., not storing that data). Insurance cannot avoid a risk.

(B) Incorrect — counting inputs is the exact misconception being tested. Category diversity is what defines MFA.

(C) Incorrect — security questions are actually among the weakest second factors, not the strongest.

(D) Incorrect — MFA provides independent protection that password complexity alone cannot.

(A) Incorrect — granting full access and revoking specific items is the inverse of least privilege; it starts too permissive.

(C) Incorrect — this describes a workflow, not an access control model; MAC uses sensitivity labels set by administrators, not manager approval requests.

(D) Incorrect — encryption is a confidentiality control, not an access control model, and doesn’t solve the authorization problem.

(A) Incorrect — the employee had authorized access; encryption prevents unauthorized reading, not authorized writing.

(B) Incorrect — availability means uptime/access, not accuracy. The data was accessible; it was wrong.

(D) Tempting but wrong — correctly identifies Integrity but names encryption as the control. Encryption at rest does nothing to prevent or detect modification by an authorized user with valid credentials.

(A) Incorrect — email sandboxing (II) would also independently stop the attack.

(C) Incorrect — a duplicate firewall (III) provides no independent protection.

(D) Incorrect — III is redundancy, not defense-in-depth.

(A) Incorrect — classifies the guard (1) as preventive, but a guard that is visible from a distance deters rather than blocks.

(C) Incorrect — CCTV recording (3) is detective, not preventive; cameras do not block intrusions.

(D) Incorrect — a surveillance sign (4) deters, not prevents; signs cannot block physical entry.

(B) Tempting — an unpatched server does contribute to risk, but it is the vulnerability component, not risk itself. Risk requires combining threat × vulnerability × impact.

(C) Incorrect — the server is an asset, but the unpatched state of the server is the vulnerability.

(D) Incorrect — the analyst is correct. Misusing the term “threat” for “vulnerability” leads to misprioritized responses.

(A) Incorrect — authentication verifies identity at login, not per-query action logging.

(B) Incorrect — authorization controls what resources are accessible, not what actions were taken on them.

(D) Partially correct logic (non-repudiation is a benefit) but misidentifies the component as authentication.

(A) Incorrect — host antivirus is not a physical security control; it is a host-layer control.

(B) Incorrect — Detective and Preventive describe how a control works, not which defense-in-depth layer it belongs to.

(D) Incorrect — the seven layers of defense-in-depth are fixed categories; multiple controls can belong to the same layer.

(A) Incorrect — reverses the classifications entirely.

(C) Incorrect — describing the same risk does not make them both quantitative; the method of measurement differs.

(D) Correctly identifies the types but wrong conclusion — quantitative is more useful for budget allocation decisions.

(B) Incorrect — Integrity was not violated (no modifications confirmed). Authorization failure implies an authenticated user had wrong permissions; here, there was no authentication at all.

(C) Incorrect — a misconfiguration that removes authentication is an access control failure.

(D) Incorrect — Availability was not violated (data was accessible, not unavailable). The firewall absence is secondary; the primary failure is missing authentication.

(A) Incorrect — redundant identical firewalls are NOT defense-in-depth; they are redundancy within a single layer.

(C) Incorrect — a single “AllAccess” role is the direct opposite of least privilege; it grants maximum permissions to everyone.

(D) Incorrect — qualitative HIGH is a starting point, not a complete risk management decision; no mitigation strategy or budget justification follows.