Exam 1 Review: Weeks 1–5 Practice

Theory: How to Approach These

Exam 1 covers Weeks 1–5 (the CIA Triad through Security Controls). This page gives you practice in the style of Part 2 (short answers) and Part 3 (an extended case). Part 1 multiple-choice practice is in the course quiz.

Exam format

Part	Format	Marks	Suggested time
Part 1	40 standalone multiple-choice questions, 5 options each, no calculation	40 × 1 = 40	30 min
Part 2	14 short-answer questions: some numerical calculations, some mini-cases, some conceptual explanations	14 × 2.5 = 35	40 min
Part 3	ONE extended case with several connected sub-questions, applying concepts from across Weeks 1–5	25	20 min

Total: 100 points, 120 minutes, closed book (no textbooks, notes or electronic devices).
The suggested times add to 90 minutes, leaving about 30 minutes to review your answers.
In Part 3, read the entire case once before answering any sub-question: later questions often depend on facts mentioned only once.

Short-answer technique (2.5 marks each). Give the term or number first, then one or two sentences of reasoning tied to the scenario. For calculations, write the formula, substitute the numbers, and state the result with units (฿ or “per year”). A correct answer without working risks losing marks.

What to know, week by week

Week 1: Security & the CIA Triad (see 1.1–1.3)

Definitions: security (freedom from danger, fear or anxiety), information security (protecting information from unauthorized access, use, disclosure, modification or destruction, in physical or digital form), cybersecurity (people, processes, tools and regulations protecting cyber-properties from all threats).
Confidentiality (only authorized people can see it), Integrity (accurate, complete, unaltered except by authorized action), Availability (accessible to authorized users when needed). Identify which leg(s) a scenario violates; it can be more than one.
The triad in tension: more of one often costs another. Security is also balanced against functionality, ease of use and cost.
Security management (policy, governance, risk decisions, compliance: “what should we protect, and why?”) vs. security engineering (building defenses: “how do we build it securely?”).

Week 2: Threats, Vulnerabilities & Attack Vectors (see 2.1–2.3)

The chain: Target (the asset aimed at), Vulnerability (the weakness), Threat (any potential danger able to cause harm), Threat actor (the concrete entity behind it), Attack vector (the path/method used to deliver the exploit), Exploit (the code or technique, and the act, of taking advantage of the vulnerability), Attack (the whole event end to end).
Asset categories: Information/Data, Technology/Systems, Physical, People, Reputation/Intangible. Criticality = Value to the business × Sensitivity of the information.
Vulnerability categories: Human/Process, Technical, Physical.
Threat actors and motivations: insider (grievance, gain, negligence), cybercriminal / organized crime (money), nation-state (espionage), hacktivist (ideology), script kiddie (opportunity).
Common attack vectors: phishing/social engineering, malware, unpatched systems, weak/stolen credentials, physical access, third-party/supply chain.
Defender’s response: monitor & analyze, penetration test (authorized simulated attack), the security analyst deciding what to fix first, which is risk assessment.

Week 3: Risk Assessment & Treatment (see 3.1–3.3)

Risk = potential for loss when a threat exploits a vulnerability affecting an asset. Risk score = Likelihood × Impact (each 1–5).
Bands: Low 1–4, Medium 5–9, High 10–16, Critical above 16.
Qualitative (fast, judgment-based, risk matrix) vs. quantitative (monetary, data-heavy, for budget cases).
SLE = AV × EF, ALE = SLE × ARO (ARO 0.5 = once every 2 years).
Treatments: Avoid, Mitigate, Transfer, Accept; chosen by cost vs. risk, feasibility, risk appetite and legal requirements. Rule of thumb: Critical/High → avoid or mitigate; Medium → mitigate or transfer; Low → accept and monitor.
Risk register columns: Asset, Risk, Likelihood, Impact, Risk Level, Treatment, Owner. Frameworks: NIST SP 800-30, ISO/IEC 27005.

Week 4: Policy & Governance (see 4.1–4.3)

Hierarchy: Policy (why/what, broad intent, mandatory) → Standard (specific mandatory requirement) → Procedure (step-by-step how) → Guideline (recommended, not mandatory).
Governance roles: Board/Executive approves policy; CISO owns policy content and monitors compliance; IT Manager owns standards and procedures; all staff comply.
Lifecycle: Draft → Review → Approve → Publish & Train → Periodic Review (often looping back to Draft).
Common policies: Acceptable Use, Access Control, Incident Response, Data Classification.
Six parts: Purpose, Scope, Policy Statement, Roles & Responsibilities, Compliance & Enforcement, Review Date. Five language principles: Mandatory, Specific & Measurable, Enforceable, Clear to non-technical staff, Practical.

Week 5: Controls & Secure Design (see 5.1–5.2)

A control is the concrete safeguard that enforces a policy (policy = what, control = how).
Function: Preventive, Detective, Corrective, Deterrent. Nature: Administrative, Technical, Physical.
Principles: Defense in Depth, Least Privilege, Fail-Safe Defaults, Separation of Duties.
Policy → Control → Standard: intent, real safeguard, exact measurable spec.

Part 2 Style: Short-Answer Practice

Exercise SA1

For each incident, identify which leg of the CIA Triad was mainly violated.

(a) Someone who guessed a lecturer’s password changes a student’s final grade in the registration system.
(b) A laptop holding an unencrypted spreadsheet of customer addresses is stolen from a car.
(c) A flood of traffic (DDoS) keeps the university’s registration website offline on the first day of registration.

Show solution ↓

Solution

Ask of each incident: was information seen by the wrong people (C), changed without authorization (I), or unreachable when needed (A)?

(a) The grade is no longer accurate; it was altered by an unauthorized action → Integrity.
(b) Customer data can now be read by whoever has the laptop → Confidentiality.
(c) Students cannot reach the system when they need it → Availability.

Exercise SA2

A hospital locks down patient records so tightly that doctors cannot access them during an emergency. Which leg of the CIA Triad has failed, and what does this example show about security management?

Show solution ↓

Solution

The records are protected from disclosure (confidentiality is strong), but the people who are authorized cannot reach them when needed. That is a failure of Availability.

It shows that the triad legs are in tension: strengthening one (confidentiality, through very strict access controls) can weaken another (availability). A security manager’s job is to balance them for the organization’s needs, for example by allowing logged, pre-approved emergency “break-glass” access that is reviewed afterwards.

Answer: Availability failed; more security is not automatically better, and the manager must balance C, I and A.

Exercise SA3

Mini-case: A criminal group wants to sell students’ personal data. They scan the internet and discover that a university’s library website runs an outdated content-management system with a known, unpatched flaw. They run a publicly available exploit script against that flaw and download the student database connected to the site.

Map the case to: Target, Vulnerability, Threat actor, Attack vector, Exploit, Attack.

Show solution ↓

Solution

Term	In this case
Target	The student database (the valuable asset the group is after)
Vulnerability	The outdated, unpatched content-management system
Threat actor	The criminal group (cybercriminals, motivated by financial gain)
Attack vector	An unpatched, outdated system exposed to the internet (found by scanning)
Exploit	Running the public exploit script against the known flaw
Attack	The whole chain: scanning, exploiting the flaw and downloading the database

Keep vulnerability (the weakness that exists even if nobody attacks) separate from exploit (the act or code that uses it).

Exercise SA4

Classify each vulnerability as Human/Process, Technical, or Physical.

(a) Staff reuse short, simple passwords.
(b) The server room door is often propped open during deliveries.
(c) A database server still uses the vendor’s default admin password.
(d) There is no procedure for staff to report suspicious emails.

Show solution ↓

Solution

(a) Human/Process: a behaviour of people (weak passwords).
(b) Physical: lack of physical access control to hardware.
(c) Technical: an insecure default setting in the system.
(d) Human/Process: a missing procedure.

Watch (c): it is a technical vulnerability even though a person forgot to change it, because the weakness lives in the system’s configuration.

Exercise SA5

Name the threat actor category and its most likely motivation.

(a) An employee who was just dismissed deletes project files on his last day.
(b) A group defaces a ministry website to protest a new law.
(c) A state-backed team quietly steals chip designs from a technology firm.
(d) A teenager runs a downloaded attack tool against random websites “to see what happens.”

Show solution ↓

Solution

(a) Insider: motivated by grievance; insiders target the data and systems they already access.
(b) Hacktivist: ideological / political statement; targets public-facing systems and reputation.
(c) Nation-state actor: espionage / geopolitical advantage; targets intellectual property and critical infrastructure.
(d) Script kiddie / opportunist: curiosity or opportunity, using others’ tools with little skill.

Exercise SA6

Using Risk = Likelihood × Impact and the bands Low 1–4, Medium 5–9, High 10–16, Critical above 16, compute the score and level of each risk.

Risk	Likelihood	Impact
R1	4	3
R2	2	2
R3	5	4
R4	3	3
R5	1	5

Show solution ↓

Solution

Multiply, then read the band.

Risk	L × I	Score	Level
R1	4 × 3	12	High (10–16)
R2	2 × 2	4	Low (1–4)
R3	5 × 4	20	Critical (above 16)
R4	3 × 3	9	Medium (5–9)
R5	1 × 5	5	Medium (5–9)

Note R5: a severe impact with rare likelihood still comes out only Medium. That is why some severe risks (e.g. patient safety) are treated anyway because of legal or regulatory requirements.

Exercise SA7

Calculate SLE and ALE for these two MediCare Plus assets and state which deserves security investment first.

Asset	Asset Value	EF	ARO
Billing system	฿3,000,000	50%	0.4
Networked medical devices	฿5,000,000	60%	0.3

Show solution ↓

Solution

Formulas: SLE = AV × EF, ALE = SLE × ARO.

Billing system

SLE = 3,000,000 × 0.50 = ฿1,500,000
ALE = 1,500,000 × 0.4 = ฿600,000 per year

Networked medical devices

SLE = 5,000,000 × 0.60 = ฿3,000,000
ALE = 3,000,000 × 0.3 = ฿900,000 per year

Priority: the medical devices have the higher expected yearly loss (฿900,000 vs ฿600,000), so on ALE alone they come first.

Exercise SA8

A file server has an asset value of ฿1,500,000 and an exposure factor of 40%. Its ALE is ฿150,000.

(a) Find the SLE and the ARO, and say in words how often the incident is expected.
(b) A vendor offers a control costing ฿200,000 per year that would remove this risk. Is it justified on cost alone?

Show solution ↓

Solution

(a) SLE = AV × EF = 1,500,000 × 0.40 = ฿600,000.

Rearrange ALE = SLE × ARO to get ARO = ALE ÷ SLE = 150,000 ÷ 600,000 = 0.25.

An ARO of 0.25 means once every 4 years (1 ÷ 0.25 = 4).

Check: 600,000 × 0.25 = 150,000 ✓

(b) The control costs ฿200,000 per year but only prevents an expected ฿150,000 per year of loss. Spending more than the risk costs is not justified on cost alone; accepting (and monitoring) or a cheaper mitigation would be more sensible, unless a legal or regulatory requirement forces treatment.

Exercise SA9

Choose the most suitable risk treatment strategy (Avoid, Mitigate, Transfer, Accept) for each case and justify briefly.

(a) An old file server that nobody uses any more still stores archived patient files and cannot be patched.
(b) The EHR server is missing a critical security patch.
(c) An online shop is worried about the cost of a data breach and lets a payment gateway handle all card data.
(d) The guest Wi-Fi is occasionally slow; the fix would cost more than the inconvenience it causes.

Show solution ↓

Solution

(a) Avoid: the activity brings no value, so move the needed archives to a secure system and decommission the server, eliminating the risk entirely.
(b) Mitigate: the system is essential, so reduce the likelihood by applying the patch.
(c) Transfer: shifting card handling to a specialist provider moves that risk (and much of its liability) to a third party; cyber insurance would be another transfer.
(d) Accept: the cost of treatment exceeds the risk; acknowledge it and monitor.

Exercise SA10

Classify each statement as a Policy, Standard, Procedure, or Guideline, and state which one is not mandatory.

(a) “Staff are encouraged to use a privacy screen when working in public places.”
(b) “MediCare Plus Hospital shall protect the confidentiality, integrity, and availability of all patient health information.”
(c) “Step 1: Open Settings > Security. Step 2: Enable disk encryption. Step 3: Save the recovery key to the IT vault.”
(d) “All workstations must be encrypted using AES-256 and locked after 5 minutes of inactivity.”

Show solution ↓

Solution

(a) Guideline: recommended practice (“encouraged”); offers judgment, not a requirement.
(b) Policy: broad statement of management intent (what and why), no details.
(c) Procedure: step-by-step instructions on how to meet a standard.
(d) Standard: a specific, measurable, mandatory requirement supporting the policy.

Only the guideline (a) is not mandatory.

Exercise SA11

Rewrite this policy statement so that it follows the principles of strong policy language, and explain what you fixed:

“Lost or stolen devices should be reported as soon as possible.”

Show solution ↓

Solution

Problems:

“should” is not mandatory.
“as soon as possible” is not specific or measurable, so nobody can check compliance.
It does not say who must report, which devices, or to whom, so it is not enforceable.

Rewrite:

“All staff must report any lost or stolen hospital-issued device, or any personal device approved for hospital email, to the IT Service Desk within 1 hour of discovering the loss.”

Now it is mandatory (“must”), measurable (“within 1 hour”), enforceable (the Service Desk records the time of each report, so delays can be audited), and clear to non-technical staff.

Exercise SA12

A clinic’s remote-work policy contains a Purpose, a Scope, Policy Statements, a Roles section (“The IT department is responsible for supporting this policy”) and a Compliance section. Which of the six parts of a good policy is missing, why does it matter, and who should approve a top-level policy?

Show solution ↓

Solution

Missing part: the Review Date. Checking against the six parts (Purpose, Scope, Policy Statement, Roles & Responsibilities, Compliance & Enforcement, Review Date), only the review date is absent.

Why it matters: a policy is never “done.” Without a review date it skips the Periodic Review stage of the policy lifecycle and goes stale as risks, laws and technology change.

Approval: a top-level policy is approved by the Board / Executive (top management), who are accountable to regulators and the public. The CISO drafts and owns the content; the IT Manager owns the standards and procedures beneath it.

(The Roles section also exists but is weak: “responsible for supporting” does not say who owns, enforces or is accountable.)

Exercise SA13

Classify each control by Function and Nature.

(a) A login banner: “This system is monitored. Misuse will be reported.”
(b) A mandatory quarterly review of who has access to the EHR.
(c) An incident response plan.
(d) A locked server room.

Show solution ↓

Solution

Control	Function	Nature
(a) Login banner	Deterrent: discourages misuse; does not block it	Technical: displayed by the system
(b) Quarterly access review	Detective: discovers inappropriate access	Administrative: a people/process control
(c) Incident response plan	Corrective: guides restoring normal operation after an incident	Administrative: a documented process
(d) Locked server room	Preventive: stops entry before it happens	Physical: enforced in the real world

Exercise SA14

Name the secure design principle illustrated by each practice.

(a) The IT Manager cannot approve her own access requests; a department head must approve them.
(b) A firewall, MFA, log monitoring and offline backups all protect the same database.
(c) If the access-control server cannot be reached, the VPN refuses all new connections instead of letting everyone in.
(d) The Billing Staff role can view invoices only.

Show solution ↓

Solution

(a) Separation of Duties: requesting/provisioning and approving are split between two people.
(b) Defense in Depth: several layers, so one failure does not expose the asset.
(c) Fail-Safe Defaults: when the decision cannot be made, the default is deny.
(d) Least Privilege: only the access the job strictly needs.

Part 3 Style: Extended Case

Read the whole case first, then answer C1–C6. The questions build on each other, from the CIA Triad (Week 1) through to controls (Week 5).

Case: Lanna Craft Online

Lanna Craft Online is a small Thai online retailer selling handmade goods. It has 35 staff and one in-house web developer; its website runs on a single rented server. Card payments are handled by an external payment gateway, so the company never stores card numbers. Its own customer database holds about 18,000 customers’ names, phone numbers, delivery addresses and order histories.

The website’s admin panel lets staff change products and prices and export customer lists. To “keep things simple,” five staff in marketing and sales share one admin account called admin. Its password has not been changed for two years, and the panel uses password only, no second factor. There is no written access-control policy; the owner’s only rule, sent by chat, is: “Everyone should be careful with the admin password and only use it when needed.”

Timeline of the incident:

3 November: a marketing assistant receives an email that appears to come from the hosting company, asking her to “re-verify your admin login” via a link. She enters the shared admin username and password on the fake page.
11 November (the big “11.11” sale), 02:00: someone logs into the admin panel from overseas using the stolen credentials, exports the full customer list, and changes the price of 40 popular items to ฿1.
08:30: hundreds of ฿1 orders arrive. A customer posts a screenshot on social media; staff then notice the prices.
09:00–13:00: the owner takes the whole website offline for 4 hours while the developer finds and corrects every changed price, on the busiest sales day of the year.
Because only the shared admin account exists, the logs cannot show which person used it, and nobody can say whether earlier exports were legitimate.

Exercise C1

(Week 1) Identify every leg of the CIA Triad violated in this incident, pointing to the specific event for each. Which violation is likely to have the longest-lasting impact on the business, and why?

Show solution ↓

Solution

Leg	Event in the case	Why
Confidentiality	Export of 18,000 customers’ personal data by an unauthorized person	Information disclosed to someone not authorized to see it
Integrity	Prices of 40 items changed to ฿1	Data altered without authorized action, no longer accurate
Availability	Website offline for 4 hours on the sale day	Authorized users (customers, staff) could not use the system when needed

Longest-lasting impact: Confidentiality. The price changes were fixed in hours and the outage lasted 4 hours, but stolen personal data cannot be “restored”: it can be sold and misused indefinitely. The company also faces legal duties under Thailand’s PDPA and long-term reputation damage as customers lose trust. (Note also that Availability was lost partly because of the response, which shows how integrity damage can force an availability trade-off.)

Exercise C2

(Week 2) Map the attack using the chain terms Target, Vulnerability, Threat actor, Attack vector, Exploit, Attack. Then name two vulnerabilities in the case and classify each as Human/Process, Technical, or Physical.

Show solution ↓

Solution

Chain mapping

Term	In this case
Target	The customer database (via the admin panel) and the product price data
Vulnerability	A shared admin account protected by password only, plus staff not trained to recognize phishing
Threat actor	An external cybercriminal, most likely motivated by financial gain (selling customer data, disrupting a competitor’s sale)
Attack vector	A phishing email leading to stolen credentials
Exploit	Logging in to the admin panel with the stolen password (no second factor stops it) and using the export and price-edit functions
Attack	The whole chain from the phishing email on 3 November to the export and price changes on 11 November

Two vulnerabilities (any two of these):

Shared, never-changed admin account with no MFA: Technical (weak authentication configuration) with a Human/Process element (the decision to share).
Staff unable to recognize phishing / no training: Human/Process.
No written access-control policy, only a vague chat message: Human/Process.
Single server and no rapid way to roll back price changes: Technical.

Exercise C3

(Week 3, qualitative) The owner scores three risks as follows. Compute each risk level and recommend a treatment strategy, with a one-sentence justification.

#	Risk	Likelihood	Impact
R1	Stolen admin credentials used to steal customer data	4	4
R2	Single server overloaded during a big sale	3	3
R3	A staff laptop (no customer data stored) stolen from a café	2	2

Show solution ↓

Solution

#	Score (L × I)	Level	Treatment	Justification
R1	4 × 4 = 16	High (10–16)	Mitigate	It has already happened once, involves personal data the company must protect under the PDPA, and cheap controls (individual accounts, MFA) cut the likelihood sharply.
R2	3 × 3 = 9	Medium (5–9)	Mitigate or Transfer	Move to hosting with automatic scaling under a service-level agreement (transfer part of the risk to the provider) or add capacity before big sales (mitigate).
R3	2 × 2 = 4	Low (1–4)	Accept (and monitor)	No customer data is on the laptop, so the loss is small and easily absorbed; full-disk encryption is a cheap optional extra.

All three follow the rule of thumb (High → avoid/mitigate, Medium → mitigate/transfer, Low → accept), and R1’s legal dimension means it must be treated regardless of cost.

Exercise C4

(Week 3, quantitative) The customer database is valued at ฿2,400,000. A data-theft incident like this one is estimated to cost 50% of that value (notification, compensation, lost sales). Without changes, such an incident is expected once every 2 years.

A proposed package (individual accounts, MFA on the admin panel, and phishing training) costs ฿90,000 per year and is expected to reduce the frequency to once every 10 years.

(a) Compute the SLE and the ALE before the package.
(b) Compute the ALE after the package.
(c) Is the package financially justified? Show the comparison.

Show solution ↓

Solution

(a) Before

SLE = AV × EF = 2,400,000 × 0.50 = ฿1,200,000
Once every 2 years → ARO = 1 ÷ 2 = 0.5
ALE = SLE × ARO = 1,200,000 × 0.5 = ฿600,000 per year

(b) After

The loss per incident is unchanged: SLE = ฿1,200,000.
Once every 10 years → ARO = 1 ÷ 10 = 0.1
ALE = 1,200,000 × 0.1 = ฿120,000 per year

(c) Comparison

Reduction in expected annual loss = 600,000 − 120,000 = ฿480,000 per year.
Cost of the package = ฿90,000 per year.
Since 480,000 > 90,000, the package saves far more than it costs; the net benefit is 480,000 − 90,000 = ฿390,000 per year.

Yes, the package is financially justified. This is exactly the kind of figure a CFO or owner wants before approving a security budget.

Exercise C5

(Week 4) (a) Critique the owner’s rule “Everyone should be careful with the admin password and only use it when needed” against the principles of strong policy language. (b) Write a replacement policy statement for an Access Control Policy. (c) Classify these supporting statements by hierarchy level:

“All admin-panel accounts must use MFA and must be individually assigned.”
“Steps to enroll your phone in the authenticator app: 1) … 2) … 3) …”
“Consider using a password manager for your work accounts.”

(d) Who should approve the policy at a company of this size?

Show solution ↓

Solution

(a) Critique

Not mandatory: “should” instead of “must.”
Not specific or measurable: “be careful” and “when needed” cannot be checked.
Not enforceable: with one shared account, nobody can check who used it or why.
Not practical as security: it accepts the dangerous practice (sharing) instead of forbidding it.
Not a real policy: it has no purpose, scope, roles, enforcement or review date, and lives in a chat message.

(b) Replacement policy statement

“All access to the website admin panel must be through individually assigned accounts, each limited to the functions the person’s job requires. Shared or generic accounts are prohibited. Access must be removed within 24 hours of any role or employment change.”

(c) Hierarchy levels

Standard: specific, mandatory, measurable.
Procedure: step-by-step how-to.
Guideline: recommended, not mandatory.

(d) Approval: the owner / top management (the equivalent of the Board or Executive) should approve the policy, because they are accountable for the business and its legal duties; the web developer would own the supporting standards and procedures.

Exercise C6

(Week 5) Propose four controls for Lanna Craft Online that together cover at least three different functions. For each, give its Function, Nature, and the design principle that justifies it. Finally, explain how your set reflects Defense in Depth.

Show solution ↓

Solution

#	Control	Function	Nature	Principle and why
1	Individual admin accounts with MFA; the shared `admin` account is disabled	Preventive	Technical	Least Privilege (each account gets only its role’s functions) and accountability; a phished password alone no longer opens the panel.
2	Price changes over 50% or bulk changes require approval by a second person in the admin panel	Preventive	Technical (enforced by the panel)	Separation of Duties: one compromised or careless account cannot change prices alone.
3	Customer-list export disabled by default, enabled only for the owner’s account	Preventive	Technical	Fail-Safe Defaults: unless explicitly granted, nobody can export, so a new or stolen account cannot.
4	Alert to the owner on any admin login from outside Thailand or any customer export, with logs naming the individual account	Detective	Technical	Defense in Depth: if prevention fails, the attack is noticed within minutes, not after a social media post.
5 (optional)	Phishing-awareness training for all staff	Preventive	Administrative	Reduces the human vulnerability that started the attack.
6 (optional)	Documented rollback plan to restore prices from a saved catalogue snapshot	Corrective	Technical + Administrative	Turns a 4-hour outage into minutes.

Defense in Depth: the controls form independent layers of different functions and natures. Training makes phishing less likely; if a password is still stolen, MFA blocks the login; if an account is somehow misused, separation of duties and default-deny export limit what it can do; if something still gets through, the alert detects it and the rollback plan corrects it. No single failure would expose the customer data again.