Cybersecurity Consulting Flashcards

Question 1

What is the difference between a threat, a vulnerability, and a risk?

Accepted Answer

A threat is any person, event, or condition that could cause harm to an asset. A vulnerability is a weakness that a threat could exploit. Risk is the likelihood that a threat will exploit a vulnerability, multiplied by the impact if it does. Controls aim to reduce one or more of these.

Question 2

What is the CIA triad in information security?

Accepted Answer

The CIA triad is a model of three core security goals: confidentiality, integrity, and availability. Confidentiality means only authorized people can access information. Integrity means data stays accurate and is not changed improperly. Availability means systems and data are accessible to authorized users when needed. Most controls protect at least one.

Question 3

Why is defense in depth considered a foundational security principle?

Accepted Answer

Defense in depth means layering several independent controls so that no single failure exposes everything. If an attacker bypasses a firewall, endpoint protection, access rules, or monitoring may still stop or detect them. Layers should cover people, processes, and technology. Consultants use it to avoid depending on any single safeguard.

Question 4

What is the principle of least privilege, and why does it matter?

Accepted Answer

Least privilege means each user, program, or account receives only the access needed to perform its assigned task. Limiting access reduces the damage that a compromised account or a mistake can cause. It also makes unusual activity easier to spot, since normal behavior is narrower. Reviewing permissions is a common recommendation.

Question 5

What is the difference between a vulnerability scan and a penetration test?

Accepted Answer

A vulnerability scan is an automated check that identifies known weaknesses in systems and reports issues. A penetration test is an authorized, goal-driven effort where testers try to exploit weaknesses to show what an attacker could reach. Scans show what might be wrong, while penetration tests show how problems combine into real impact.

Question 6

What does a risk register record, and who typically maintains it?

Accepted Answer

A risk register is a living document that lists identified risks with details such as description, owner, likelihood, impact, current controls, and planned treatment. The organization owns the register, while a risk or security function usually coordinates updates. Consultants often build or review it during engagements.

Question 7

What is the purpose of asset inventory in security risk management?

Accepted Answer

An asset inventory is a complete list of the systems, data, devices, applications, and accounts an organization depends on. It matters because organizations cannot protect what they do not know exists. Inventories reveal shadow systems, unmanaged devices, and data stored in unexpected places. Consultants often begin engagements by validating this list.

Question 8

What is the difference between a policy, a standard, and a procedure?

Accepted Answer

A policy is a high-level statement of management intent that describes what the organization requires. A standard sets specific, mandatory requirements that support the policy, such as approved encryption methods. A procedure is a step-by-step set of instructions that staff follow to meet a standard. This layering helps trace recommendations to documented goals.

Question 9

What is a security framework, and how do consultants use one?

Accepted Answer

A security framework is a structured set of practices, categories, and outcomes that organizations use to organize their security programs. Consultants use frameworks as a common language to compare a client's current state with a target state. Frameworks support decisions but do not replace local judgment about business needs.

Question 10

What is a gap analysis in a framework-based engagement?

Accepted Answer

A gap analysis compares an organization's current controls and practices against the requirements or target state defined by a chosen framework. The output shows where practices are missing, partially implemented, or working well. Consultants rank gaps by risk and business value. This produces a practical improvement plan rather than a checklist of failures.

Question 11

What is the role of a risk appetite statement?

Accepted Answer

A risk appetite statement describes how much risk an organization is willing to accept while pursuing its objectives. It guides which risks need treatment and which can be accepted. Consultants use it to judge whether a finding is urgent, tolerable, or outside acceptable limits. Without it, priorities tend to follow the loudest voice.

Question 12

What does the term compliance mean, and how does it differ from security?

Accepted Answer

Compliance means meeting specific requirements set by laws, regulations, contracts, or internal policies. Security is the broader goal of protecting information and systems from harm. An organization can be compliant yet still insecure, because checklists rarely capture every threat. Consultants help clients use compliance as a floor, then build security practices above it.

Question 13

What is a control objective, and why is it written before a control?

Accepted Answer

A control objective states the outcome a safeguard must achieve, such as restricting administrative access to authorized staff. Writing the objective first keeps teams focused on the risk being addressed rather than on a specific tool. It also lets auditors and assessors test whether the outcome is met, regardless of how it is achieved.

Question 14

What is the purpose of a security governance committee?

Accepted Answer

A security governance committee brings together leaders from technology, legal, operations, and business units to guide security decisions. Its purpose is to set priorities, approve risk decisions, and make sure security spending matches business goals. Clear membership and regular meetings help prevent security from being treated as only an IT concern.

Question 15

What is the difference between an internal audit and an external audit?

Accepted Answer

An internal audit is performed by staff within the organization, often reporting to an audit committee or executive leadership. An external audit is performed by an independent outside firm, which provides assurance to outside parties such as regulators or investors. Both examine whether controls operate as designed. Independence is the key distinction.

Question 16

Why do security consultants need to understand regulatory obligations?

Accepted Answer

Regulatory obligations define which data must be protected, how it must be handled, and when incidents must be reported. A consultant who overlooks them may recommend controls that fail audits or leave the client exposed. Consultants should confirm legal details with qualified counsel rather than guessing.

Question 17

What is a security assessment, and what usually does it produce?

Accepted Answer

A security assessment is a structured review of systems, processes, and controls to determine how well they protect information. It usually produces a report with findings, evidence, risk ratings, and recommended actions. Assessments can be scoped narrowly, such as one application, or broadly, such as an entire enterprise.

Question 18

What are the main differences between black box, gray box, and white box testing?

Accepted Answer

Black box testing gives testers no internal details, so they approach the target as an outsider would. Gray box testing provides partial information, such as user credentials or network diagrams. White box testing gives full access to source code, architecture, and configuration. Each level trades realism against depth.

Question 19

How does social engineering testing differ from technical testing?

Accepted Answer

Social engineering testing evaluates how people respond to manipulation, such as phishing emails, pretext phone calls, or tailgating into secure areas. Technical testing focuses on software, networks, and configurations. Both matter because attackers often combine them. Consultants must obtain written approval and set clear limits before testing people.

Question 20

Why should a security test begin with a written rules of engagement?

Accepted Answer

A rules of engagement document defines what testers may do, which systems are in scope, when testing occurs, and who to contact during problems. It protects both parties by turning informal expectations into written agreements. Consultants should review it with the client before any testing starts.

Question 21

What is a threat model, and when is it useful?

Accepted Answer

A threat model is a structured way to identify what is being protected, who might attack it, how attacks could occur, and which defenses are needed. It is useful during system design or major changes, when risks are cheaper to address. Consultants use threat models to focus testing on the most plausible attack paths.

Question 22

What is a configuration review, and what does it check?

Accepted Answer

A configuration review examines how systems, devices, and applications are set up compared with approved baselines. It checks items such as default passwords, unnecessary services, weak encryption settings, and overly permissive file shares. Reviews often use automated tools paired with manual verification. Findings usually show where settings drift from documented standards over time.

Question 23

Why is evidence collection important during a security assessment?

Accepted Answer

Evidence collection provides proof for every finding, such as screenshots, log extracts, configuration files, or interview notes. Without evidence, a claim cannot be verified, and the client may dispute or ignore it. Good evidence is specific, dated, and traceable to its source. Careful handling also protects sensitive data that testers may encounter.

Question 24

What is a retest, and why do consultants perform one?

Accepted Answer

A retest is a follow-up check that confirms whether previously reported findings have been fixed. Consultants perform retests to verify that remediation actually addressed the root cause, not just the symptom. Retests also close the loop with the client and provide documented evidence of improvement. Without them, unverified fixes may give leaders false confidence.

Question 25

What is a statement of work, and what should it include?

Accepted Answer

A statement of work is a contract document that describes the services to be delivered, the deliverables, the timeline, and the fees. It should also define scope boundaries, assumptions, client responsibilities, and how changes will be handled. A clear statement of work prevents disputes by setting shared expectations before work starts.

Question 26

How should a consultant handle scope creep during an engagement?

Accepted Answer

Scope creep happens when requests expand beyond the agreed work without adjusting time or cost. A consultant should recognize new requests early, document them, and explain their impact on schedule and budget. The client can then approve a formal change order or defer the request. Handling changes openly protects both the relationship and quality.

Question 27

What should a consultant include in a clear executive summary?

Accepted Answer

An executive summary should state the most important risks, their business impact, and the decisions leaders need to make. It should avoid technical detail, using plain language and brief sentences. A reader who reads only this page should understand what matters and what to do next.

Question 28

How do consultants explain technical findings to nontechnical executives?

Accepted Answer

Consultants translate each technical finding into a business consequence, such as lost customer data, service downtime, or regulatory exposure. They use analogies carefully, avoid jargon, and state the likelihood and impact in plain terms. Visuals like simple risk matrices can help leaders compare issues quickly. Consultants also confirm understanding by asking for a summary.

Question 29

What is stakeholder mapping, and why is it useful in consulting?

Accepted Answer

Stakeholder mapping identifies everyone affected by a security project, along with their influence, interests, and concerns. It helps consultants decide who to interview, who must approve decisions, and who needs regular updates. Mapping also reveals hidden opposition or unexpected allies. Starting it early prevents surprises late in an engagement.

Question 30

How should consultants handle disagreement with a client's leadership about a finding?

Accepted Answer

Consultants should first listen to the client's reasoning and confirm they understand the context. If the evidence still supports the finding, they should restate it calmly, with the supporting data. Risk acceptance is ultimately the client's decision. Consultants should document the disagreement and the accepted risk without changing the finding.

Question 31

Why should consultants communicate progress regularly during a project?

Accepted Answer

Regular progress updates keep clients informed, reduce surprises, and show that work is on track. Short, predictable updates build trust even when problems arise. Updates should highlight completed tasks, upcoming risks, decisions needed, and any schedule changes. Silence often leads clients to assume the worst, which can damage the relationship.

Question 32

What makes a client relationship trustworthy in security consulting?

Accepted Answer

Trust grows when consultants are honest about findings, limits, and uncertainty. Clients value advisors who admit what they do not know and who avoid inflating risks to sell additional services. Keeping confidential information protected is essential. Consistent follow-through on promises matters as much as technical skill.

Question 33

What are the main phases of incident response?

Accepted Answer

Incident response commonly follows phases of preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Preparation builds the plans, tools, and roles needed before anything happens. Detection and analysis confirm what occurred and how serious it is. The remaining phases stop the threat, restore systems, and improve future responses.

Question 34

What is the purpose of an incident response plan?

Accepted Answer

An incident response plan is a guide that tells people what to do, who to notify, and how decisions are made during a security incident. It defines roles, communication paths, escalation thresholds, and contact lists. A plan reduces confusion when stress is high and time is short. Consultants often test plans through tabletop exercises.

Question 35

What is containment, and why does timing matter?

Accepted Answer

Containment limits the spread and impact of an incident while investigation continues. Containment may isolate a device or disable an account. Timing matters because delay allows attackers more time to move laterally, steal data, or destroy evidence. Decisions should balance speed against preserving information for analysis.

Question 36

Why is preserving evidence important after a security incident?

Accepted Answer

Evidence helps investigators learn how an attacker got in, what was accessed, and how far the intrusion spread. Careful preservation keeps logs, memory captures, and disk images intact and traceable. Mishandled evidence can lead to incomplete findings or make legal action difficult. Chain of custody records who handled evidence and when.

Question 37

What is root cause analysis, and why is it important for remediation?

Accepted Answer

Root cause analysis asks why an incident happened and keeps asking until the underlying condition is identified. Fixing only the visible symptom, such as deleting one malicious file, may leave the real weakness in place. Identifying root causes helps remediation address process gaps, configuration errors, or missing controls.

Question 38

How should remediation items be prioritized after an assessment?

Accepted Answer

Remediation items are usually prioritized by combining the severity of the risk, the likelihood of exploitation, and the value of the affected asset. Quick wins that cut significant exposure at low cost often rise to the top. Consultants should explain the reasoning so clients can adjust priorities.

Question 39

What should a post-incident review cover in a security program?

Accepted Answer

A post-incident review examines what happened, how the response performed, and what should change to prevent recurrence. It covers timelines, decisions, communication, root causes, and gaps in tools or training. The review should be blameless so people share accurate details. Its outcomes should become tracked actions with owners and due dates.

Question 40

Why do consultants recommend tabletop exercises for response teams?

Accepted Answer

A tabletop exercise walks a team through a realistic scenario in a discussion setting, without touching live systems. It reveals unclear roles, missing contacts, outdated procedures, and decisions no one has rehearsed. Because it is low risk, teams can practice difficult choices repeatedly. Results should feed directly into plan updates and training.

Cybersecurity Consulting Flashcards

1Core risk and security concepts

2Frameworks and governance essentials

3Assessment and testing methods

4Client engagement and communication

5Incident response and remediation planning

Learning Resources