The main purpose of a 'baseline' in security documentation is: **b. Sets minimum acceptable security levels** A baseline establishes the minimum standards and requirements for security measures within an organization, helping to ensure compliance and consistency in security practices.

The control framework known for the publication SP 800-53 is **c. NIST** (National Institute of Standards and Technology).

The correct answer is **b. Data Custodian**. The Data Custodian is typically responsible for implementing access controls according to the specifications set by the Data Owner.

In STRIDE threat modeling, 'S' stands for **Spoofing**.

c. Risk Management ISO 31000 is a standard that provides guidelines on risk management principles and processes. It is designed to help organizations manage risks effectively and is applicable to any organization regardless of size, industry, or sector.

c. Detective Detective controls are designed to identify and detect security breaches or incidents after they have occurred.

c. Operational

In quantitative risk analysis, 'SLE' stands for **b. Single Loss Expectancy**.

c. Ransomware

The correct answer is **c. Stealth Virus**. Stealth viruses are designed to camouflage themselves by intercepting and modifying system requests, thereby hiding their presence from antivirus software and users.

c. Fraud and misuse Separation of duties is primarily designed to prevent fraud and misuse by ensuring that no single individual has control over all aspects of a financial transaction or critical system process. By dividing responsibilities among multiple individuals, organizations can reduce the risk of errors and intentional wrongdoing.

The correct answer is **a. Security awareness training**. Deterrent controls are designed to discourage security violations before they occur. Security awareness training helps inform users about security policies and risks, thus acting as a deterrent to malicious or negligent behavior. The other options serve different purposes: - **b. Antivirus software** is a preventive control aimed at detecting and stopping malware. - **c. Backups** are

The purpose of a 'guideline' in a security documentation framework is primarily to: c. Suggest best practices Guidelines provide recommendations and best practices that can help organizations implement security measures effectively, though they are not mandatory like policies or controls.

c. Data Owner The Data Owner is typically responsible for classifying organizational data, as they have the authority and knowledge about the data's sensitivity, value, and compliance requirements.

The term that describes a technique that uses a vulnerability to perform an attack is **a. Exploit**.

c. The likelihood and impact of a threat exploiting a vulnerability In information security, 'risk' is typically defined as the combination of the likelihood of a threat exploiting a vulnerability and the impact that such an exploitation would have on an asset or organization.

The option that best defines 'Threat' in cybersecurity is: **c. An event that could cause harm to an asset** A threat in cybersecurity refers to any potential danger that can exploit a vulnerability to breach security and cause harm to an asset.

The component of the CIA triad that ensures data is accurate and unaltered is: b. Integrity