Cybersecurity Practices and Incident Response

Third-Party Information Gathering

• A company hired a third party to gather information about their servers and data.
• The third party cannot directly access the internal network.
• The best description of this approach is passive reconnaissance.

Email Server Message Disposition

• A company's email server received an email from a third party.
• The origin server didn't match authorized devices.
• Disposition of the message is determined using SPF, NAC, DMARC, or DKIM.

Threat Actor Financial Motive

• The threat actor most likely to attack systems for financial gain is organized crime.

Security Vulnerability Description

• A server was compromised due to a known operating system vulnerability.
• This finding is BEST described as a known operating system vulnerability exploit.

Emergency Medical Dispatch Priority

• System availability is the highest priority for an ambulance service network.

Database Access Alert Description

• A text alert was triggered when access rights were changed on a database containing private customer information.
• The alert describes a security concern about database access rights.

Data in Use, Obfuscated Data, Trade Secrets, and Regulated Data

• Data in use is data that is currently being used by a system.
• Obfuscated data is data that has been made difficult to understand.
• Trade secrets are confidential information that gives a company a competitive edge.
• Regulated data is data that is subject to government regulations.

Data Breach Policies and Requirements

• Data access records from all devices must be saved and archived.
• Data access outside of normal working hours must be reported immediately.
• Data access must occur only within the country.
• Access logs, and audit reports must be created from a single database.
• Security team will need to use GPS location, data account authentication server, and access logs and audit reports from a single database to meet these requirements.

Firewall Log Information

• A firewall log shows that a Trojan attempt was blocked from a specific IP address. The victim's IP address is 136.127.92.171.

Third-Party Website Certification Issue

• A user received a message "Your connection is not private. NET::ERR_CERT_INVALID" from a third-party website.
• This message indicates a trustworthiness issue and is MOST likely because of a deauthentication attack.

Website Login Credentials

• The best way to provide website logins using existing third-party credentials is to store these credentials within the site's internal database.

Firewall Hardware Uptime

• Details about how often firewall hardware is expected to fail are called Mean Time Between Failures (MTBF).

Attacker's Phone Call Description

• An attacker pretended to be a company director to gain access, this is social engineering.

Formal Partnership Agreement Description

• A formal agreement between two companies to qualify their partnership is called an acceptable use policy.

Email Signature Justification

• Companies use digital signatures to ensure email integrity, authenticity, and confidentiality.

Embedded OS System Error Description

• An embedded operating system constantly rebooting due to a file system error is called "memory injection," potentially stemming from malicious code corruption on the machine.

Password Policy Issues and Corrections

• Current password policies lack restrictions on attempts and lack password change requirements.
• Password policy corrections are frequent password changes, and password limitations on attempts or errors.

Server Update Delays Response

• The best immediate response to servers not updated in a year and needing two weeks to deploy updates is to move the servers to a protected segment.

Business Management Steps Description

• Steps for responding to an Internet connection failure in the business process are called Continuity of Operations/Cold site recovery (and table top exercises are ways to practice for this contingency).

Data Center Employee Credential Examination

• The best way to examine credentials for data center building entry is to use authentication process, such as multi factor authentication (MFA).

Employee Information Encryption Strategy Description

• Storing some employee information in encrypted form, while other details remain unencrypted, is called "full-disk encryption" for stored data, but not all.

Database Corruption Minimization Strategy

• The best method to minimize database corruption if power is lost to a server is to do replication. This will duplicate the database to another server.

Corporate Mobile Device Security Policy Establishment

• To create a corporate mobile device security policy, policies should be created, or implemented to: Automatically lock devices after a predefined time period, Track the location of the device, and prevent user's information from being mixed with company information or data.

Monthly Vulnerability Scan Results Description

• A monthly vulnerability scan showing no vulnerabilities, while a known vulnerability was announced last week, means there is a false negative.

Security Event Automation Use Cases

• IT help desk automation of security events includes escalation, guard rails, continuous integration, and resource provisioning.

Wireless Network Authentication Configuration

• To authenticate users with their corporate credentials when using a company wireless network, 802.1x should be used.

VPN Service Posture Assessment

• A VPN service performing a posture assessment during login is a form of security testing and is a critical assessment.

Access Control Model Description

• Access control model used to assign individual rights and permissions to a file on a network drive is called a discretionary access control model.

Text Message Attack Description

• A user received a text message with a link for logging into a work schedule. The best description of this attack would be "smishing."

Company Policy Formalization Description

• The company process for formalizing the design and deployment processes for their applications is called "development lifecycle."

Incident Response Process Description

• Copying a suspected malware executable to a sandbox for analysis is part of the incident response process..

Bank Website Visitor Decrease with Possible Attack Description

• A decrease in bank website visitors, coupled with traffic being routed to a different IP address, suggests a deauthentication attack.

Password Policy Security Control

• The security policies lack the use of salt in password hashing. Salting is needed when implementing a password policy.

Server Vulnerability Issue Description

• A vulnerability that was patched previously surfacing again means it is an "end-of-life" vulnerability.

Disaster Recovery Process Description

• A simulated disaster to discuss logistics and processes of resolving the disaster is a disaster recovery exercise.

Security Access Control Method Description

• Blocking access to websites hosting malicious software in an organization can be accomplished with "DNS filtering".

Malware Infection Incident Response Steps

• When a system has a malware infection, the best response is to create "lessons learned".

This quiz covers critical aspects of cybersecurity, including immediate responses to incidents, handling order processing during network failures, and strategies for employee data protection. Assess your knowledge on the role of third-party information gathering and mechanisms for email handling based on server authorization.