Free L6M7 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

Multi-factor authentication would be the most useful to protect a mobile phone. Multi-factor

authentication uses three things: something you know (password), something you have (a secret

code or token), and something you are (biometric scan). This is more secure than biometrics alone.

CCTV does not prevent someone from accessing Bob’s phone. A firewall is better suited for an IT

system or intranet. P.187

Domain: 3.2

The Data Processing cycle is acquisition - processing - reporting- storing. Do learn this off by heart.

The term processing means anything from using data, to altering it, to moving it or publishing it. Data

controller is a person or organisation that determines how the data is processed, but it's rarely used

as a verb (you don't say I'm 'controlling' the data'). P. 121

Domain: 2.3

This is a Business Impact Assessment because it talks about consequences. A Risk Assessment would

look at the likelihood and severity of a security breach and would probably be done next. A Recovery

Objectives Report would then be created after that if needed.

This is air-gapping. Air-gapping is when you disconnect from an outside network such as the internet.

P.171

Domain: 3.1

All staff should get Cyber Security Training. This relates to the last sentence in the case study, which

talks about ensuring people store data correctly and know about cyber attacks.

Analytics predicts future trends using data. BI (Business Intelligence) focuses on past and present

data but does not predict. Big Data is just large datasets, and Black Box refers to decision-making

without transparency.

Integrity refers to the trustworthiness and accuracy of data. If data has been altered, its integrity has

been compromised. The Information Security Triangle consists of Confidentiality, Integrity, and

Availability (CIA). Accuracy is not part of this model. (P.143)

Data can be used to predict demand and influence customer purchasing behavior (e.g.,

recommending related products). Selling data is illegal, and data itself does not directly reduce

overhead costs or increase profitability—its application does. (P.97)

This is an example of a phishing email. Phishing is when a cybercriminal tries to do something

malicious like steal data or put a virus on your computer by deceiving the user. In this case, they’re

pretending to be a supplier and want David to open an email attachment, which is probably not an

invoice. See p.148

Domain: 3.1

A black swan refers to false pattern recognition—when a pattern appears in data but does not

actually exist.

Cloud storage is the answer. All the new people will be working in different places, so there needs to

be a central place for them to access documents. Physical storage options such as USBs, laptops, and

network-attached storage devices wouldn’t work.

Domain: Scenario

This is the component approach - it looks at each individual component (each part of the IT system)

in turn to check its okay. When a component is not directly controlled by the organisation (e.g.

something to do with a supplier) this is called a dependency. Component approach is a bottom-up

approach and is the opposite of the top-down approach which is called the 'system driven approach'.

P.179

Domain: 3.2